VMware NSX Security

What zw008/VMware-NSX-Security MCP server does

The zw008/VMware-NSX-Security MCP server gives an MCP-compatible agent access to VMware NSX security administration. Its scope covers distributed firewall (DFW) policies and rules, security groups, VM tags, the DFW exclusion list, Traceflow packet tracing, and intrusion detection and prevention system (IDPS) information.

The repository documents 22 tools, divided between read-only and write operations. Policy operations include listing, retrieving, creating, updating, deleting, and listing rules. Rule operations include creation, modification, deletion, and statistics. Security-group tools cover discovery, retrieval, creation, and deletion. Other tools list or change VM tags, run Traceflow, retrieve Traceflow results, inspect IDPS profiles and signature settings, and list excluded DFW members.

How it works

The server uses an NSX Manager host defined in a YAML configuration file and communicates with the NSX Policy API. It is launched locally through the vmware-nsx-security mcp command, allowing an MCP client to start it over standard input and output. The README provides a Claude Desktop configuration using the vmware-nsx-security executable and an optional configuration-path environment variable.

The zw008/VMware-NSX-Security MCP server reports whether VMs are on the DFW exclusion list when returning relevant security information. An unavailable exclusion-list lookup is represented as unknown (null), rather than as confirmation that the VM is not excluded. Traceflow results can include operation state, hop observations, drop reasons, rule IDs, and a DFW-hit summary.

Setup and configuration

Install the package with uv tool install vmware-nsx-security, create ~/.vmware-nsx-security/config.yaml from the example configuration, and set the NSX Manager host. The documented setup stores a profile password in an environment file at ~/.vmware-nsx-security/.env; passwords are not placed in the configuration file. Run vmware-nsx-security doctor to check the setup, then start the MCP process with vmware-nsx-security mcp.

For a custom configuration location, set VMWARE_NSX_SECURITY_CONFIG before starting the server. The project also documents uvx --from vmware-nsx-security vmware-nsx-security mcp, but that mode may resolve from PyPI on each launch. Source installations can use a normal wheel install, and the README describes building wheels for air-gapped hosts.

Tools and capabilities

The zw008/VMware-NSX-Security MCP server supports workflows such as creating tag-based security groups, defining DFW policies, applying tags to VMs, and tracing traffic between source and destination addresses. Group criteria can use tags, IP addresses, or segments, with multiple criteria types combined as documented by the project.

Write safety is built into the documented operations. Policy deletion is blocked when active rules remain. Group deletion checks for references from DFW rules and scopes, and aborts if that reference scan cannot complete. CLI write commands support dry-run mode, and write operations are recorded in ~/.vmware-nsx-security/audit.log.

Limitations and notes

This is a community-driven project authored by a VMware engineer, not an official VMware product. The README lists full feature support for NSX 9.1 and 9.0, NSX 4.x, and NSX-T 3.2, with stated VCF compatibility from VCF 9.1 through VCF 4.5. NSX 9.x requires VDS 7.0 or later according to the compatibility notes.

The server requires access to an NSX Manager and suitable credentials. It is intended for security administration rather than the networking, VM lifecycle, or monitoring scopes covered by the repository's companion skills. The README lists MIT as the project license.