VMware VKS

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/zw008-vmware-vks

About

Use cases: containers-kubernetes, cloud-management

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

15 read · 7 write · 2 delete

Secrets

None asked for

Install scripts

None found

Runs as

Python package

Tools (24)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• check_vks_compatibilityread-only

  [READ] Check whether this vCenter supports VKS (requires vSphere 8.x+). Returns compatible (bool), vcenter_version, wcp_enabled_clusters and wcp_clusters ({cluster, status}). Start here: those cluster MoRefs are the cluster_id for get_supervisor_status and create_namespace. Only reports vCenter-level support — a listed cluster may still be CONFIGURING. Args: target: vCenter in config.yaml; omit for the default.

• create_namespace

  [WRITE] Create a vSphere Namespace on a Supervisor Cluster. Without confirm=True this only previews: it returns blast_radius (the spec that would be applied, and whether the name is already taken) and creates nothing. Show it to the user and get their decision. Do not set confirm=True on your own because the user asked earlier — they have not seen the preview yet. confirm=True returns {action: "created", namespace, status, cluster, blast_radius}; it is refused when the name is taken (use update_namespace) or the existing names could not be read. Confirm with get_namespace afterwards. Args: …

• create_tkc_cluster

  [WRITE] Create a TanzuKubernetesCluster in a vSphere Namespace. Without confirm=True this only previews: it returns blast_radius (node counts, VM class, the YAML manifest, and whether the name is taken) and creates nothing. Show it to the user and get their decision. Do not set confirm=True on your own because the user asked earlier — they have not seen the preview yet. confirm=True returns {action: "created", name, namespace, status: "creating", yaml, blast_radius} and provisions in the background — poll get_tkc_cluster until phase is running. Refused when the name is taken or the namespace'…

• delete_namespacecan change or delete data

  [WRITE] Delete a vSphere Namespace and everything inside it (irreversible). Without confirm=True this only previews: it returns blast_radius (the namespace, and the TKC clusters, VMs and PVCs inside it, with counts and names) and deletes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user said "delete" earlier: they have not seen what it destroys yet. confirm=True returns {action: "deleted", namespace, status, blast_radius}. Refused while TKC clusters exist inside (run delete_tkc_cluster on each), and whenever the clusters, VMs…

• delete_tkc_clustercan change or delete data

  [WRITE] Delete a TKC cluster and all of its nodes (irreversible). Without confirm=True this only previews: it returns blast_radius (control plane and worker node counts per pool, and the running Deployments, StatefulSets and DaemonSets) and deletes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user said "delete" earlier: they have not seen what it destroys yet. confirm=True returns {action: "deleted", name, namespace, status: "deleting", blast_radius}. Refused while workloads run (drain them, or pass force=True, which skips th…

• get_access_inforead-only

  [READ] Which account this server uses, and whether it holds each tool's vSphere privileges. Use this when a tool fails with a permission error, or before a write, to check what the configured account may do. Asks vCenter about the current session (needs only System.View, so any account can ask about itself). Returns target, account, the privilege states, and for one tool its requires/verdict/meaning; without tool, every tool grouped by verdict. Gotchas: privileges are checked on the root folder only, and a verdict of not_granted_at_root is NOT "no access" — it may be granted on a specific clu…

• get_harbor_inforead-only

  [READ] Get status of the embedded Harbor container registry on the Supervisor. Returns {registries: [{id, cluster (Supervisor MoRef), version, url, status, storage_used_mb}]}; status and storage come from a detail call and are null if it fails. If Harbor is not enabled it returns {error, hint} rather than raising. Use it to check registry health or find the push URL — it does not list repositories or images. Run check_vks_compatibility first if the Supervisor may be down. Args: target: vCenter in config.yaml; omit for the default.

• get_namespaceread-only

  [READ] Get detailed configuration for a single vSphere Namespace. Returns one raw vCenter namespace object, not the list envelope: config_status, description, storage_specs, quotas. Use list_namespaces first for the name; follow with list_namespace_storage_usage for PVC usage or list_tkc_clusters for the clusters inside. Point-in-time only — a CONFIGURING namespace may not have quotas applied. Args: name: Namespace name, e.g. 'dev' (discover via list_namespaces). target: vCenter in config.yaml; omit for the default.

• get_supervisor_statusread-only

  [READ] Get the health of one Supervisor Cluster (vSphere with Tanzu control plane). Returns cluster_id, config_status (RUNNING = healthy, else CONFIGURING / ERROR / REMOVING), kubernetes_status (READY / WARNING / ERROR), api_server_cluster_endpoint, kubernetes_version (null plus kubernetes_version_hint if unavailable), and network_provider. Run check_vks_compatibility first for cluster IDs; use this to confirm a Supervisor is healthy before create_namespace or create_tkc_cluster. Args: cluster_id: Compute cluster MoRef, e.g. 'domain-c1' (wcp_clusters field of check_vks_compatibil…

• get_tkc_available_versionsread-only

  [READ] List Kubernetes versions (TanzuKubernetesReleases) available on the Supervisor. Returns {versions: [{name, version, e.g. 'v1.28.4+vmware.1'}]}, newest first. If the TanzuKubernetesRelease API is unavailable it returns an empty versions list with error and hint rather than raising. Call this before create_tkc_cluster or upgrade_tkc_cluster to pick a valid k8s_version. Args: namespace: vSphere Namespace used to reach the Supervisor K8s API. target: vCenter in config.yaml; omit for the default.

• get_tkc_clusterread-only

  [READ] Get detailed status for a single TKC cluster. Returns one object, not the list envelope: name, namespace, phase, k8s_version, control_plane_replicas, worker_replicas, conditions, infrastructure_ready, control_plane_ready. Run list_tkc_clusters first — a TKC name is only unique within one namespace. Poll this after create_tkc_cluster, scale_tkc_cluster or upgrade_tkc_cluster to watch an async change land. Args: name: Cluster name (via list_tkc_clusters). namespace: Namespace holding it. target: vCenter in config.yaml; omit for the default.

• issue_supervisor_kubeconfig

  [WRITE] Credential access: issue a kubeconfig for the Supervisor K8s API. Call only when the user explicitly asks for this kubeconfig; never as a side step. Returns {namespace, kubeconfig} as a YAML string, or {namespace, written_to} when output_path is given. The kubeconfig embeds a Supervisor bearer token (JWT from /wcp/login) that acts as the configured vCenter account until the JWT expires (typically hours; not tied to this process) — always pass output_path so the token never enters agent context, and report only the path. The file is created owner-only (0600). Use issue_tkc_kubeconfig i…

• issue_tkc_kubeconfig

  [WRITE] Credential access: issue a kubeconfig for one TKC cluster. Call only when the user explicitly asks for this kubeconfig; never as a side step. Returns {cluster, kubeconfig}, or {cluster, written_to} when output_path is given. The kubeconfig embeds a Supervisor bearer token (JWT from /wcp/login) that acts as the configured vCenter account until the JWT expires (typically hours; not tied to this process) — always pass output_path so the token never enters agent context, and report only the path. Nothing in the managed cluster changes, but output_path creates parent directories and trunca…

• list_namespace_storage_usageread-only

  [READ] List PersistentVolumeClaims and storage usage inside one vSphere Namespace. Via the Supervisor K8s API. Returns the family list envelope: {namespace, items: [{name, namespace, status (Bound / Pending / Lost), capacity ('10Gi'), storage_class}], returned, limit, total, truncated, hint}. Every PVC comes back in one call, so truncated is always False. Run list_namespaces first for the namespace; use list_supervisor_storage_policies instead for policy-level rather than PVC-level information. 'pvcs' and 'pvc_count' are deprecated pre-1.8.0 aliases of 'items' and 'returned', removed in 2.0 —…

• list_namespacesread-only

  [READ] List all vSphere Namespaces on the target vCenter with their status. Returns the list envelope: items of {namespace, config_status (RUNNING = healthy, CONFIGURING, REMOVING, ERROR), description} plus returned/total/truncated — one call returns them all, so truncated is always false. Start here, then call get_namespace for detail, list_tkc_clusters for what runs inside, or update_namespace / delete_namespace to change one. Args: target: vCenter in config.yaml; omit for the default.

Signals

Stars

5

Forks

1

Open issues

2

Weekly downloads

519

Last commit

Oct 24, 2026 (4 days ago)

Last release

Oct 19, 2026 (10 days ago)

Last package publish

Oct 19, 2026 (10 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.zw008/vmware-vks

Version

1.8.8

Auth

No auth

Packages

pypi vmware-vks

License

MIT

Repository

github.com/zw008/VMware-VKS

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql