{ "markdown": "\n# VMware NSX\n\n> **Author**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com\n> This is a community-driven project by a VMware engineer, not an official VMware product.\n> For official VMware developer tools see [developer.broadcom.com](https://developer.broadcom.com).\n\n[English](README.md) | [中文](README-CN.md)\n\nVMware NSX networking management: segments, gateways, NAT, routing, IPAM — 33 MCP tools, domain-focused.\n\n> NSX Policy API skill for NSX-T 3.0+ and NSX 4.x.\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)\n\n## Companion Skills\n\n| Skill | Scope | Tools | Install |\n|-------|-------|:-----:|---------|\n| **[vmware-aiops](https://github.com/vmware-skills/VMware-AIops)** ⭐ entry point | VM lifecycle, deployment, guest ops, clusters | 49 | `uv tool install vmware-aiops` |\n| **[vmware-monitor](https://github.com/vmware-skills/VMware-Monitor)** | Read-only monitoring, alarms, events, VM info | 27 | `uv tool install vmware-monitor` |\n| **[vmware-storage](https://github.com/vmware-skills/VMware-Storage)** | Datastores, iSCSI, vSAN | 11 | `uv tool install vmware-storage` |\n| **[vmware-vks](https://github.com/vmware-skills/VMware-VKS)** | Tanzu Namespaces, TKC cluster lifecycle | 20 | `uv tool install vmware-vks` |\n| **[vmware-nsx-security](https://github.com/vmware-skills/VMware-NSX-Security)** | DFW microsegmentation, security groups, Traceflow | 21 | `uv tool install vmware-nsx-security` |\n| **[vmware-aria](https://github.com/vmware-skills/VMware-Aria)** | Aria Ops metrics, alerts, capacity planning | 28 | `uv tool install vmware-aria` |\n| **[vmware-avi](https://github.com/vmware-skills/VMware-AVI)** | AVI/NSX ALB load balancing, AKO | 28 | `uv tool install vmware-avi` |\n| **[vmware-harden](https://github.com/vmware-skills/VMware-Harden)** | Compliance baselines, drift detection | 6 | `uv tool install vmware-harden` |\n\n## Quick Install\n\n```bash\n# Via PyPI\nuv tool install vmware-nsx-mgmt\n\n# Or pip\npip install vmware-nsx-mgmt\n```\n\n### Offline / Air-Gapped Install (from source)\n\nThis project uses the modern PEP 517 build system (hatchling), so there is **no\n`setup.py`** by design — that is expected, not a missing file. If you cloned the\nsource and hit `ERROR: File \"setup.py\" or \"setup.cfg\" not found ... editable mode\ncurrently requires a setuptools-based build`, your `pip` is older than 21.3 and\ncannot do an *editable* (`-e`) install with a non-setuptools backend. Editable\nmode is a developer convenience, not needed to run the tool — do one of:\n\n```bash\n# From the source tree — a normal (non-editable) install builds a wheel:\npip install . # NOT pip install -e .\n\n# ...or upgrade pip first, and editable works too:\npip install --upgrade pip && pip install -e .\n```\n\nFor a **truly air-gapped host**, build the wheels on a connected machine and copy\nthem over — the target then needs no network:\n\n```bash\n# On a connected machine, collect this package + its dependencies as wheels:\npip wheel . -w dist # → dist/*.whl (or: uv build, for just this package)\n\n# Copy dist/ to the air-gapped host, then install offline:\npip install --no-index --find-links dist vmware-nsx-mgmt\n```\n\n## Configuration\n\n```bash\nmkdir -p ~/.vmware-nsx\ncp config.example.yaml ~/.vmware-nsx/config.yaml\n# Edit with your NSX Manager credentials\n\necho \"VMWARE_NSX_NSX_PROD_PASSWORD=your_password\" > ~/.vmware-nsx/.env\nchmod 600 ~/.vmware-nsx/.env\n\n# Verify\nvmware-nsx doctor\n```\n\n## What This Skill Does\n\n| Category | Tools | Count | Read / Write |\n|----------|-------|:-----:|:------------:|\n| **Segments** | list, get, create, update, delete | 5 | 2R / 3W |\n| **Tier-0 Gateways** | list, get, BGP neighbors, configure BGP | 4 | 3R / 1W |\n| **Tier-1 Gateways** | list, get, create, update, delete | 5 | 2R / 3W |\n| **NAT** | list, create, delete | 3 | 1R / 2W |\n| **Static Routes** | list, create, delete | 3 | 1R / 2W |\n| **IP Pools** | list, usage, create, delete | 4 | 2R / 2W |\n| **Fabric Inventory** | transport zones, transport nodes, edge clusters | 3 | 3R / 0W |\n| **Health & Troubleshooting** | alarms, transport node status, edge cluster status, manager status, port status, VM-to-segment | 6 | 6R / 0W |\n\n**Total**: 33 tools (20 read-only + 13 write)\n\n## Common Workflows\n\n### Create an App Network (Segment + T1 Gateway + NAT)\n\n1. Create gateway: `vmware-nsx gateway create-t1 app-t1 --edge-cluster edge-cluster-01 --tier0 tier0-gw`\n2. Create segment: `vmware-nsx segment create app-web-seg --gateway app-t1 --subnet 10.10.1.1/24 --transport-zone tz-overlay`\n3. Add SNAT: `vmware-nsx nat create app-t1 --action SNAT --source 10.10.1.0/24 --translated 172.16.0.10`\n4. Verify: `vmware-nsx segment list` and `vmware-nsx nat list app-t1`\n\nUse `--dry-run` to preview any write command first.\n\n### Check Network Health\n\n1. Manager status: `vmware-nsx health manager-status`\n2. Transport nodes: `vmware-nsx health transport-nodes`\n3. Edge clusters: `vmware-nsx health edge-clusters`\n4. Alarms: `vmware-nsx health alarms --severity HIGH` (exact-match filter; query each severity separately)\n\n### Troubleshoot VM Connectivity\n\n1. Find VM's segment: `vmware-nsx troubleshoot vm-segment `\n2. Check port realized state: `vmware-nsx troubleshoot port-status ` (all ports on the segment: attachment, realized bindings, transport nodes)\n3. Check routes: `vmware-nsx gateway routes-t1 app-t1`\n4. Check BGP: `vmware-nsx gateway bgp-neighbors tier0-gw`\n\n## MCP Tools (33 — 20 read, 13 write)\n\n| Category | Tools | Type |\n|----------|-------|------|\n| Segments | `list_segments`, `get_segment`, `create_segment`, `update_segment`, `delete_segment` | Read/Write |\n| Tier-0 GW | `list_tier0_gateways`, `get_tier0_gateway`, `get_bgp_neighbors`, `configure_tier0_bgp` | Read/Write |\n| Tier-1 GW | `list_tier1_gateways`, `get_tier1_gateway`, `create_tier1_gateway`, `update_tier1_gateway`, `delete_tier1_gateway` | Read/Write |\n| NAT | `list_nat_rules`, `create_nat_rule`, `delete_nat_rule` | Read/Write |\n| Static Routes | `list_static_routes`, `create_static_route`, `delete_static_route` | Read/Write |\n| IP Pools | `list_ip_pools`, `get_ip_pool_usage`, `create_ip_pool`, `delete_ip_pool` | Read/Write |\n| Fabric | `list_transport_zones`, `list_transport_nodes`, `list_edge_clusters` | Read |\n| Health | `list_nsx_alarms` (per-severity, exact match), `get_transport_node_status`, `get_edge_cluster_status`, `get_nsx_manager_status` | Read |\n| Troubleshoot | `get_logical_port_status` (realized state of all ports on a segment), `get_segment_port_for_vm` (lookup by VM display name) | Read |\n\nFull per-tool endpoints and methods: `skills/vmware-nsx/references/capabilities.md`.\n\n## CLI\n\n```bash\n# Segments\nvmware-nsx segment list\nvmware-nsx segment get app-web-seg\nvmware-nsx segment create app-web-seg --gateway app-t1 --subnet 10.10.1.1/24 --transport-zone tz-overlay\nvmware-nsx segment delete app-web-seg\n\n# Gateways\nvmware-nsx gateway list-t0\nvmware-nsx gateway list-t1\nvmware-nsx gateway create-t1 app-t1 --edge-cluster edge-cluster-01 --tier0 tier0-gw\nvmware-nsx gateway bgp-neighbors tier0-gw\nvmware-nsx gateway routes-t1 app-t1\n\n# NAT\nvmware-nsx nat list app-t1\nvmware-nsx nat create app-t1 --action SNAT --source 10.10.1.0/24 --translated 172.16.0.10\nvmware-nsx nat delete app-t1 rule-01\n\n# Static Routes\nvmware-nsx route list app-t1\nvmware-nsx route create app-t1 --network 192.168.100.0/24 --next-hop 10.10.1.254\n\n# IP Pools\nvmware-nsx ippool list\nvmware-nsx ippool create tep-pool\nvmware-nsx ippool add-subnet tep-pool --start 192.168.100.10 --end 192.168.100.50 --cidr 192.168.100.0/24\n\n# Health & Troubleshooting\nvmware-nsx health alarms --severity HIGH # exact match: LOW | MEDIUM | HIGH | CRITICAL\nvmware-nsx health transport-nodes\nvmware-nsx health manager-status\nvmware-nsx troubleshoot vm-segment my-vm-01 # VM display name\nvmware-nsx troubleshoot port-status app-web-seg # segment ID\n\n# Diagnostics\nvmware-nsx doctor\n```\n\n## MCP Server\n\n**After `uv tool install vmware-nsx-mgmt`, start the MCP server with one command** (v1.5.15+):\n\n```bash\n# Recommended — single command, no network re-resolve\nvmware-nsx mcp\n\n# Or via Docker\ndocker compose up -d\n```\n\n### Agent Configuration\n\nAdd to your AI agent's MCP config:\n\n```json\n{\n \"mcpServers\": {\n \"vmware-nsx\": {\n \"command\": \"vmware-nsx\",\n \"args\": [\"mcp\"],\n \"env\": {\n \"VMWARE_NSX_CONFIG\": \"~/.vmware-nsx/config.yaml\"\n }\n }\n }\n}\n```\n\n
\nAlternative: uvx (no install) or legacy entry point\n\n```bash\n# Run without installing (requires PyPI access each launch)\nuvx --from vmware-nsx-mgmt vmware-nsx mcp\n\n# Legacy entry point (still works, kept for backward compatibility)\nvmware-nsx-mcp\n```\n\n> **Behind a corporate TLS proxy?** uvx may fail with `invalid peer certificate: UnknownIssuer`.\n> Use the recommended `vmware-nsx mcp` form above (no network needed), or set `UV_NATIVE_TLS=true`.\n\n
\n\nMore agent config templates (Claude Code, Cursor, Goose, Continue, etc.) in [examples/mcp-configs/](examples/mcp-configs/).\n\n## Version Compatibility\n\n| NSX Version | Support | Notes |\n|-------------|---------|-------|\n| NSX 9.1 | Full | Policy API supported. Note: VDS 7.0+ required (N-VDS removed in NSX 9). |\n| NSX 9.0 | Full | Policy API supported. Note: bare-metal agent / physical-server L2 overlay removed. |\n| NSX 4.x | Full | Latest Policy API, all features |\n| NSX-T 3.2 | Full | All features work |\n| NSX-T 3.1 | Full | Minor route table format differences |\n| NSX-T 3.0 | Compatible | IP pool subnet API introduced here |\n| NSX-T 2.5 | Limited | Policy API incomplete; some tools may fail |\n| NSX-V (6.x) | Not supported | Different API (SOAP-based) |\n\n### VCF Compatibility\n\n| VCF Version | Bundled NSX | Support |\n|-------------|-------------|---------|\n| VCF 9.1 | NSX 9.1 | Full |\n| VCF 9.0 | NSX 9.0 | Full |\n| VCF 5.x | NSX 4.x | Full |\n| VCF 4.3-4.5 | NSX-T 3.1-3.2 | Full |\n\n#### Official Broadcom References\n\n- **SDKs**: — VMware NSX for Python SDK (official; future migration target), VCF Python SDK\n- **REST APIs**: — NSX-T Data Center REST API (this skill uses the Policy API subset)\n- **CLI Tools**: — VCF PowerCLI 9.1 (includes NSX cmdlets)\n\n## Safety\n\n| Feature | Description |\n|---------|-------------|\n| Read-heavy | 20/33 tools are read-only |\n| Double confirmation | CLI write commands require two prompts |\n| Dry-run mode | All write commands support `--dry-run` preview |\n| Dependency checks | Delete operations validate no connected resources |\n| Input validation | CIDR, IP, VLAN IDs, gateway existence validated |\n| Audit logging | All operations logged to `~/.vmware-nsx/audit.log` |\n| No firewall ops | Cannot create/modify DFW rules or security groups |\n| Credential safety | Passwords only from environment variables |\n| Prompt injection defense | NSX object names sanitized before output |\n\n## Troubleshooting\n\n| Problem | Cause & Fix |\n|---------|-------------|\n| \"Segment not found\" | Policy API uses segment `id`, not `display_name`. Run `segment list` to get the exact ID. |\n| NAT creation fails \"gateway not found\" | NAT requires a Tier-1 (or Tier-0) gateway. Verify with `gateway list-t1`. Gateway must have an edge cluster. |\n| BGP neighbor stuck in Connect/Active | Peer unreachable, ASN mismatch, TCP 179 blocked, or MD5 password mismatch. |\n| Transport node \"degraded\" | TEP unreachable (check MTU >= 1600), NTP sync issues, or host switch config mismatch. |\n| \"Password not found\" | Variable naming: `VMWARE_NSX__PASSWORD` (hyphens to underscores). Check `~/.vmware-nsx/.env`. |\n| Connection timeout | Use `vmware-nsx doctor --skip-auth` to bypass auth checks on high-latency networks. |\n\n## License\n\n[MIT](LICENSE)\n", "bytes": 11879, "sha": "c0b8384e6bccbf0b3c3281aa532d0bad0ebc6aaeb84cdfe5b48e183d54deee9d", "repo_slug": "zw008/vmware-nsx", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_zw008_vmware_nsx_876ffb04/readme" }