{
  "markdown": "<!-- mcp-name: io.github.vmware-skills/vmware-nsx-security -->\n# VMware NSX Security\n\n> **Author**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com\n> This is a community-driven project by a VMware engineer, not an official VMware product.\n> For official VMware developer tools see [developer.broadcom.com](https://developer.broadcom.com).\n\nVMware NSX DFW microsegmentation and security MCP skill — 22 tools for distributed firewall policies/rules, security groups, VM tags, the DFW exclusion list, Traceflow packet tracing, and IDPS.\n\n> **Companion skills**: [vmware-nsx](https://github.com/vmware-skills/VMware-NSX) (networking), [vmware-aiops](https://github.com/vmware-skills/VMware-AIops) (VM lifecycle), [vmware-monitor](https://github.com/vmware-skills/VMware-Monitor) (monitoring)\n\n## Quick Start\n\n```bash\nuv tool install vmware-nsx-security\n\nmkdir -p ~/.vmware-nsx-security\ncp config.example.yaml ~/.vmware-nsx-security/config.yaml\n# Edit config.yaml with your NSX Manager host\n\necho \"VMWARE_NSX_SECURITY_NSX_PROD_PASSWORD=your_password\" > ~/.vmware-nsx-security/.env\nchmod 600 ~/.vmware-nsx-security/.env\n\nvmware-nsx-security doctor\n```\n\n### Offline / Air-Gapped Install (from source)\n\nThis project uses the modern PEP 517 build system (hatchling), so there is **no\n`setup.py`** by design — that is expected, not a missing file. If you cloned the\nsource and hit `ERROR: File \"setup.py\" or \"setup.cfg\" not found ... editable mode\ncurrently requires a setuptools-based build`, your `pip` is older than 21.3 and\ncannot do an *editable* (`-e`) install with a non-setuptools backend. Editable\nmode is a developer convenience, not needed to run the tool — do one of:\n\n```bash\n# From the source tree — a normal (non-editable) install builds a wheel:\npip install .              # NOT  pip install -e .\n\n# ...or upgrade pip first, and editable works too:\npip install --upgrade pip && pip install -e .\n```\n\nFor a **truly air-gapped host**, build the wheels on a connected machine and copy\nthem over — the target then needs no network:\n\n```bash\n# On a connected machine, collect this package + its dependencies as wheels:\npip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)\n\n# Copy dist/ to the air-gapped host, then install offline:\npip install --no-index --find-links dist vmware-nsx-security\n```\n\n## What It Does\n\n| Category | Tools |\n|----------|-------|\n| DFW Policy | list, get, create, update, delete, list rules |\n| DFW Rules | create, update, delete, stats |\n| Security Groups | list, get, create, delete |\n| VM Tags | list tags, apply tag, remove tag |\n| Traceflow | run trace, get result |\n| IDPS | list profiles, signature status + settings |\n| DFW Exclusions | list excluded members |\n\n**Total: 22 MCP tools** (11 read-only + 11 write)\n\n### DFW exclusion list\n\nA VM on the NSX distributed-firewall exclusion list has no DFW in its datapath: the rules that\nname it exist and none of them applies. On a VCF estate the management VMs (vCenter, VCF\nOperations, NSX managers) are commonly on it — one real NSX 9.1 fabric had 10 of 12 VMs excluded.\n`list_dfw_exclusions` shows the list, and `list_vm_tags` / `get_group` / `list_dfw_policies` say\nwhen a member is excluded, so \"protected by DFW policy\" is never reported for a VM the DFW does\nnot see. `dfw_excluded: null` means the list could not be read — which is not `false`.\n\n## MCP Server Setup\n\n**After `uv tool install vmware-nsx-security`, start the MCP server with one command** (v1.5.15+):\n\n```bash\n# Recommended — single command, no network re-resolve\nvmware-nsx-security mcp\n\n# With a custom config path\nVMWARE_NSX_SECURITY_CONFIG=/path/to/config.yaml vmware-nsx-security mcp\n```\n\nAdd to `~/.claude.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"vmware-nsx-security\": {\n      \"command\": \"vmware-nsx-security\",\n      \"args\": [\"mcp\"],\n      \"env\": {\n        \"VMWARE_NSX_SECURITY_CONFIG\": \"~/.vmware-nsx-security/config.yaml\"\n      }\n    }\n  }\n}\n```\n\n<details>\n<summary>Alternative: uvx (no install) or legacy entry point</summary>\n\n```bash\n# Run without installing (requires PyPI access each launch)\nuvx --from vmware-nsx-security vmware-nsx-security mcp\n\n# Legacy entry point (still works, kept for backward compatibility)\nvmware-nsx-security-mcp\n```\n\n> **Behind a corporate TLS proxy?** uvx may fail with `invalid peer certificate: UnknownIssuer`.\n> Use the recommended `vmware-nsx-security mcp` form above (no network needed), or set `UV_NATIVE_TLS=true`.\n\n</details>\n\n## Common Workflows\n\n### Microsegment an Application\n\n```bash\n# 1. Create groups by tag — via the create_group MCP tool\n#    (tag_scope=tier, tag_value=web → matched as Condition value \"tier|web\";\n#     multiple criteria types — tag/IP/segment — are ORed)\n\n# 2. Create DFW policy\nvmware-nsx-security policy create web-app-policy --name \"Web to App\" --category Application\n```\n\n### Tag a VM\n\n```bash\n# Find VM and its external ID\nvmware-nsx-security tag list my-vm-01\n\n# Apply tag using the external ID\nvmware-nsx-security tag apply <external-id> --scope tier --value web\n```\n\n### Trace a Packet\n\n```bash\nvmware-nsx-security traceflow run <src-lport-id> \\\n  --src-ip 10.0.1.5 --dst-ip 10.0.2.10 --proto TCP --dst-port 443\n```\n\nOutput reports `operation_state` (`IN_PROGRESS`/`FINISHED`/`FAILED`),\nhop-by-hop `observations` discriminated by `resource_type` (Dropped*\nentries carry `reason` + `acl_rule_id`), and a `dfw_hits` summary.\n\n## Safety\n\n- **Dependency checks**: Cannot delete a policy with active rules, or a group referenced by DFW rules/scopes; group deletion aborts if the reference scan fails\n- **Audit logging**: All write ops logged to `~/.vmware-nsx-security/audit.log`\n- **Input validation**: IDs validated; all API text sanitized against prompt injection\n- **Dry-run mode**: All CLI write commands support `--dry-run`\n- **Credential safety**: Passwords only from env vars, never in config files\n\n### Companion Skills\n\n| Skill | Scope | Tools | Install |\n|-------|-------|:-----:|---------|\n| **[vmware-aiops](https://github.com/vmware-skills/VMware-AIops)** ⭐ entry point | VM lifecycle, deployment, guest ops, clusters | 49 | `uv tool install vmware-aiops` |\n| **[vmware-monitor](https://github.com/vmware-skills/VMware-Monitor)** | Read-only monitoring, alarms, events, VM info | 27 | `uv tool install vmware-monitor` |\n| **[vmware-nsx](https://github.com/vmware-skills/VMware-NSX)** | NSX networking: segments, gateways, NAT, IPAM | 33 | `uv tool install vmware-nsx-mgmt` |\n| **[vmware-storage](https://github.com/vmware-skills/VMware-Storage)** | Datastores, iSCSI, vSAN | 11 | `uv tool install vmware-storage` |\n| **[vmware-vks](https://github.com/vmware-skills/VMware-VKS)** | Tanzu Namespaces, TKC cluster lifecycle | 20 | `uv tool install vmware-vks` |\n| **[vmware-aria](https://github.com/vmware-skills/VMware-Aria)** | Aria Ops metrics, alerts, capacity planning | 28 | `uv tool install vmware-aria` |\n\n\n## Version Compatibility\n\n| NSX Version | Support | Notes |\n|-------------|---------|-------|\n| NSX 9.1 / VCF 9.1 | ✅ Full | DFW + Security Group + Traceflow + IDS/IPS via Policy API. VDS 7.0+ required (N-VDS removed in NSX 9). |\n| NSX 9.0 / VCF 9.0 | ✅ Full | Same as 9.1. Bare-metal NSX agent removed. |\n| NSX 4.x / VCF 5.x | ✅ Full | All features supported. |\n| NSX-T 3.2 / VCF 4.5 | ✅ Full | Policy API stable. |\n\n#### Official Broadcom References\n\n- **SDKs**: <https://developer.broadcom.com/sdks> — VMware NSX for Python SDK (future migration target)\n- **REST APIs**: <https://developer.broadcom.com/xapis> — NSX-T Data Center REST API\n- **CLI Tools**: <https://developer.broadcom.com/tools> — VCF PowerCLI 9.1\n\n## License\n\nMIT\n",
  "bytes": 7633,
  "sha": "eab6ef02ec4c3235a22dbd4ec2bf95f2381dcb9f2ce5cc464fbf70ea733ebdae",
  "repo_slug": "zw008/vmware-nsx-security",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_zw008_vmware_nsx_security_16269f8d/readme"
}