{
  "markdown": "<!-- mcp-name: io.github.vmware-skills/vmware-vdi -->\n\n# VMware VDI (Horizon)\n\n**AI-powered intelligent operations for VMware / Omnissa Horizon VDI** — manage desktop pools, RDS farms,\npublished apps, **user sessions**, desktop machines, entitlements, instant-clone images, and Horizon\nevents/health/statistics through the **Horizon 8 Connection Server REST API**. Ships as both an **MCP\nserver** (for AI agents) and a **CLI** (for help-desk and scripting). Part of the\n[VMware skill family](#companion-skills).\n\n> **Disclaimer**: Community-maintained open-source project, **not affiliated with, endorsed by, or\n> sponsored by VMware, Inc., Broadcom Inc., or Omnissa, LLC.** \"VMware\", \"Horizon\", and \"Omnissa\" are\n> trademarks of their respective owners. Source is publicly auditable under the MIT license.\n\n> **Status: v1.0.0 (beta).** REST endpoints are verified against the official Horizon Server API;\n> GET-response field projections are defensive and pending validation against a live Connection Server\n> (a field-name mismatch yields empty results, not a crash — see the [beta note](#beta-note)).\n\n## Why vmware-vdi\n\nEvery other VMware family skill stops at the vСenter VM. **A Horizon desktop pool sits *on* those VMs** —\nso `vmware-aiops` can reset the backing VM, but it cannot see a *user session*, log a user off, disable a\n*pool*, or push a golden image. `vmware-vdi` fills exactly that day-2 VDI gap — \"who is stuck on a broken\ndesktop\", \"log this user off so their profile unlocks\", \"why is this pool not provisioning\", \"push the\npatched image to Finance tonight\" — with the family's **governed-ops harness**: every write is audited,\npreviews its blast radius, and is authorized by the Horizon account's own RBAC role.\n\n## Capabilities — 27 MCP tools (16 read / 11 write)\n\n| Category | Tools |\n|----------|-------|\n| **Monitoring** | health summary · session list/get · machine list/get · event list |\n| **Statistics** | session concurrency stats · per-pool utilization |\n| **Management** | pool list/get · farm list · app-pool list · entitlement list · image list · AD search · pool enable/disable · entitlement add/remove |\n| **Ops actions** | session logoff / disconnect / message · machine reset / maintenance / remove |\n| **Tasks** | task status · **image push** · task cancel |\n\nReads are strictly non-destructive. Writes **preview their blast radius**, double-confirm at the CLI, and\nare audit-logged to `~/.vmware/audit.db`. `pool_push_image` recreates *every desktop in a pool* — the\nhighest single-call blast radius in the family — and its preview states affected-desktop and\nin-session counts before any confirm, together with `occupancy`: `determined` when those counts\ncan be believed, `unknown` when sessions exist that cannot be attributed to any pool or farm. An\n`unknown` occupancy refuses the confirm rather than reporting an unverified zero; overriding it\nneeds `--acknowledge-unknown-occupancy` and is recorded in the audit row.\n\n## Quick start\n\n```bash\nuv tool install vmware-vdi\nvmware-vdi init      # friendly wizard: connect to a Connection Server + discover your pools\nvmware-vdi doctor    # verify config / credentials / connectivity\nvmware-vdi health    # one-glance VDI health\n```\n\n`vmware-vdi init` prompts for the Connection Server host, admin username, AD domain, and password; writes\n`~/.vmware-vdi/config.yaml` + a `0600` `.env` (password obfuscated); tests the login; and on success\n**discovers your pools, machines, and sessions** with the next commands to try.\n\n## Example workflows\n\n**Help-desk — a user's desktop is stuck**\n```bash\nvmware-vdi session list --user alice\nvmware-vdi machine list --state AGENT_UNREACHABLE\nvmware-vdi session logoff --user alice --dry-run   # preview which sessions\nvmware-vdi session logoff --user alice             # double-confirm, then logs off + audits\n```\n\n**Patch night — push a new golden image**\n```bash\nvmware-vdi image list\nvmware-vdi pool push-image --id pool-fin --dry-run  # BLAST RADIUS: N desktops, M logged-in users\nvmware-vdi pool push-image --id pool-fin            # double-confirm; returns a task\nvmware-vdi task status --pool pool-fin              # track progress\n```\n\n## MCP server\n\n```json\n{\n  \"mcpServers\": {\n    \"vmware-vdi\": {\n      \"command\": \"vmware-vdi\",\n      \"args\": [\"mcp\"],\n      \"env\": { \"VMWARE_VDI_CONFIG\": \"~/.vmware-vdi/config.yaml\" }\n    }\n  }\n}\n```\nUsing the installed `vmware-vdi mcp` console script (not `uvx`) avoids a PyPI re-resolve on every launch —\nimportant behind enterprise TLS proxies.\n\n## Supported versions\n\n- **VMware Horizon 8.x** (primary) — Connection Server REST API `/rest/v1`.\n- **Latest Omnissa Horizon** (2406 / 2412+) — same `/rest/v1` lineage.\n\n## Security\n\n- **Authorization = Horizon RBAC.** The skill does not gate read vs write; point a target at a **read-only\n  Horizon admin role** and every write is refused at the Connection Server, un-bypassably.\n- **Credentials** live only in `~/.vmware-vdi/.env` (`0600`, obfuscated `b64:` at rest); config files hold\n  host/username/domain only. Inject `VMWARE_VDI_<TARGET>_PASSWORD` from a secret manager for real secrecy.\n- **TLS** verification on by default. All Connection-Server text is `sanitize()`d against prompt injection.\n- **No outbound calls** except to the configured Connection Server — no webhooks, no telemetry.\n\nSee [`SECURITY.md`](SECURITY.md) and `skills/vmware-vdi/references/setup-guide.md`.\n\n## Beta note\n\nREST **endpoints** are verified against the official Horizon Server API operation index. GET-response\n**field names** (and a few write bodies) are defensive (`.get()` with fallbacks) and **pending validation\nagainst a live Connection Server**. On a field-name mismatch a list reads empty rather than crashing.\nFirst real-Horizon use should run `vmware-vdi init` and confirm the session/machine/pool projections;\nplease [file an issue](https://github.com/vmware-skills/VMware-VDI/issues) with raw `*_get` output if a projection\nlooks empty. Quality: 32 regression tests, ruff clean, bandit 0, tool endpoints pinned to a verified spec.\n\n## Companion skills\n\nPart of the VMware skill family — install the modules you need:\n\n- **[vmware-aiops](https://github.com/vmware-skills/VMware-AIops)** — the vCenter VMs backing the desktops (power, snapshot, clone, migrate)\n- **[vmware-monitor](https://github.com/vmware-skills/VMware-Monitor)** — read-only vSphere monitoring\n- **[vmware-nsx-security](https://github.com/vmware-skills/VMware-NSX-Security)** — desktop network microsegmentation\n- **[vmware-aria](https://github.com/vmware-skills/VMware-Aria)** · **[vmware-nsx](https://github.com/vmware-skills/VMware-NSX)** · **[vmware-storage](https://github.com/vmware-skills/VMware-Storage)** · **[vmware-vks](https://github.com/vmware-skills/VMware-VKS)** · **[vmware-avi](https://github.com/vmware-skills/VMware-AVI)** · **[vmware-harden](https://github.com/vmware-skills/VMware-Harden)**\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n",
  "bytes": 6948,
  "sha": "988c5d79a3e8ff785125b6f0ecea151337af749c2569dbc5ad7c38ec2bee541a",
  "repo_slug": "zw008/vmware-vdi",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_zw008_vmware_vdi_09ae0ee0/readme"
}