Skip to main content
Glama
vmware-skills

io.github.zw008/vmware-log-insight

VMware Log Insight

Disclaimer: Community-maintained open-source project, not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc. "VMware", "vSphere", and "Aria" are trademarks of Broadcom. Source is publicly auditable under the MIT license.

Read-only log search and aggregation for VMware Aria Operations for Logs (formerly vRealize Log Insight) — the appliance that collects syslog from ESXi hosts, vCenter, and VMs. The centralized-log data source for the VMware skill family. Strictly non-destructive: it queries, it never writes.

Companion Skills

Need

Skill

Tools

Raw centralized logs + spikes

vmware-log-insight (this)

7

vCenter events & alarms

vmware-monitor

27

Metrics, anomalies, capacity

vmware-aria

28

Incident correlation / root cause

vmware-debug — feed it log_search output

2

VM lifecycle / operations

vmware-aiops

49

Related MCP server: quickwit-mcp

Install

uv tool install vmware-log-insight
mkdir -p ~/.vmware-log-insight
cp config.example.yaml ~/.vmware-log-insight/config.yaml   # edit host/username/provider
echo 'VMWARE_LOG_INSIGHT_PROD_PASSWORD=...' > ~/.vmware-log-insight/.env
chmod 600 ~/.vmware-log-insight/.env
vmware-log-insight doctor

Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is no setup.py by design — that is expected, not a missing file. If you cloned the source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and cannot do an editable (-e) install with a non-setuptools backend. Editable mode is a developer convenience, not needed to run the tool — do one of:

# From the source tree — a normal (non-editable) install builds a wheel:
pip install .              # NOT  pip install -e .

# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .

For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:

# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)

# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-log-insight

MCP Tools (7 — all read-only)

Tool

What

log_search

Search events by time window + text + filters

log_aggregate

Count/aggregate over time bins, with z-score spike detection

log_fields

List extracted fields usable in filters

log_version

Appliance version/build

alert_list / alert_get / alert_history

Query defined alerts and their trigger history

Workflows

  • Find errors fastvmware-log-insight search -q error -l 1h.

  • Where did logs burst?vmware-log-insight aggregate -q error -l 6h --bin-ms 300000, read spikes[], then search the spike window.

  • Root cause — pass log_search results (plus vCenter events from vmware-monitor and metrics from vmware-aria) to vmware-debug incident_timeline.

Troubleshooting

  • 401 on /sessions → check username/password/provider and the VMWARE_LOG_INSIGHT_<TARGET>_PASSWORD env var.

  • 503 everywhere → appliance starting up; doctor reports it as a status, not a crash.

  • Empty results → widen --last; default API port is 9543 (set port if different).

Security

Read-only by construction. Credentials in ~/.vmware-log-insight/.env (chmod 600); plaintext passwords auto-obfuscated to grep-safe b64: (obfuscation, not encryption — inject from a secret manager for real secrecy). TLS on by default. See SECURITY.md.

License

MIT.

Available Tools

7 tools
alert_getA
Read-onlyIdempotent

[READ] Get the stored definition of one alert. Use this after alert_list.

Returns the same sanitized {id, name, enabled, info} projection as an alert_list row plus 'raw_keys' — the sorted key names the appliance actually sent — so you can see what else the definition carries without this skill guessing at its shape. For when the alert fired, use alert_history. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
alert_idYesThe alert id exactly as returned in an alert_list row's 'id' field (not the alert's name). An empty string is refused with a message telling you to run alert_list; a well-formed but unknown id comes back as a 404 from the appliance.

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond annotations by disclosing the exact return projection shape, including 'raw_keys' and the intentional non-guessing behavior. It redundantly states 'Read-only' when annotations already include readOnlyHint=true, but it adds useful behavioral context about the response contents.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with a [READ] tag and a clear purpose. The return-shape explanation is slightly elaborate but earns its place because there is no output schema; only the repeated 'Read-only' at the end is redundant with the annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read tool with no output schema, the description fully explains what the agent will receive, how to get the alert id, and which sibling covers the alternative case. Input schema and annotations complete the rest.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaningful parameter guidance beyond the schema, especially for alert_id: it must match an alert_list row's 'id', is not the alert's name, empty strings are refused, and unknown ids return a 404.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Get the stored definition of one alert.' It also distinguishes itself from siblings by saying 'Use this after alert_list' and routing alert firing questions to alert_history, so an agent can pick the right tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs when to use the tool ('after alert_list') and when not to use it ('For when the alert fired, use alert_history'). The alert_id parameter description also clarifies that the id must come from an alert_list row, not the alert's name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

alert_historyA
Read-onlyIdempotent

[READ] List recent trigger-history records for an alert.

Use this for when an alert fired, not how it's defined. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {timestamp_ms, info}. total is the real history-record count, so truncated answers whether older records were left behind — raise limit when true. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum history records returned, most recent first as the appliance orders them (default 50). There is no offset — the appliance hands back the whole history in one call and this slices it, so when truncated is true the only way to reach older records is a larger limit.
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
alert_idYesThe alert id exactly as returned in an alert_list row's 'id' field (not the alert's name). An empty string is refused with a message telling you to run alert_list first.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the exact return envelope, item shape, and the semantics of 'total' and 'truncated' — including the actionable 'raise limit when true' behavior. This goes well beyond the annotations' readOnlyHint and gives the agent operational understanding of the tool's output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: a [READ] tag, a clear purpose sentence, a usage note, and a return-format explainer. Every sentence contributes value, and nothing is wasted or redundant with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description fully documents the return envelope and item fields, plus the truncation/limit behavior. Combined with a 100%-covered input schema, an agent has everything needed to call this tool correctly and interpret its results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description reinforces the limit/truncated relationship, but the input schema already explains it in detail; the description adds no new parameter-level meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair: 'List recent trigger-history records for an alert.' It also disambiguates from sibling tools by clarifying this concerns when an alert fired ('trigger-history') rather than how it's defined, which clearly separates it from alert_list and alert_get.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The statement 'Use this for when an alert fired, not how it's defined' is an explicit when/when-not guardrail. It tells the agent to choose this tool for firing events, not definition/configuration, and directs the agent away from definition-focused siblings without needing to inspect schemas.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

alert_listA
Read-onlyIdempotent

[READ] List defined Log Insight alerts.

Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {id, name, enabled, info}. Start here, then pass an id to alert_get or alert_history. total is the real count matching name_filter, so truncated answers whether more exist; raise limit or narrow name_filter when true. Read-only — this skill never creates/edits/deletes alerts.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum items in the page (default 50). It slices the matches after filtering; 'total' still reports every match, so a small limit never hides how many alerts exist.
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
name_filterNoCase-insensitive substring matched against the alert's name only (not its id or description). Omit to list every defined alert. The appliance returns the whole collection either way and the filter runs locally, so filtering costs nothing extra.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and non-destructive behavior, and the description reinforces these with 'Read-only — this skill never creates/edits/deletes alerts.' It adds meaningful behavioral context about the pagination envelope, total/truncated semantics, and where to go next, which annotations do not cover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: a clear read header, a concise return-shape summary, routing guidance, pagination semantics, and a safety note. Every sentence earns its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with rich annotations and fully documented parameters, the description covers the return envelope, pagination behavior, sibling routing, and read-only guarantee. Nothing needed to select or invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by explaining how limit and name_filter interact with total and truncated, e.g., 'raise limit or narrow name_filter when true,' which is not fully captured by the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: '[READ] List defined Log Insight alerts.' It also distinguishes itself from siblings by explicitly saying 'Start here, then pass an id to alert_get or alert_history,' making the tool's role in the family clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit guidance: use this as the entry point, then route to alert_get or alert_history with an id. It also instructs when to raise limit or narrow name_filter based on the truncated flag, which is actionable usage guidance beyond the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_aggregateA
Read-onlyIdempotent

[READ] Aggregate matching events into a time series and detect spikes.

WHEN: to find when/whether log volume burst without pulling raw events. Follow up with log_search on the spike window.

RETURNS: {aggregation, bin_width_ms, constraints, bins:[{timestamp_ms, value}], spikes:[{timestamp_ms, value, zscore}]}. A bin is flagged as a spike when it sits at least 2 standard deviations above the mean; a series of fewer than 3 bins, or a flat one, reports no spikes rather than calling everything a spike — so an empty 'spikes' list is not evidence of calm when the window is short. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
lastNoRelative window ending now — "30m", "2h", "7d" (units s/m/h/d) or a bare number of seconds. Cannot be combined with begin_ms/end_ms. Omit all three and the window defaults to the last hour.
textNoFree-text substring matched with CONTAINS, exactly as in log_search. Omit to aggregate every event in the window.
end_msNoAbsolute window end as epoch milliseconds. Usable on its own; cannot be combined with last.
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
begin_msNoAbsolute window start as epoch milliseconds. Usable on its own; cannot be combined with last.
aggregationNoThe function applied within each bin — exactly one of COUNT, UCOUNT, AVG, MIN, MAX, SUM, STDDEV, VARIANCE, SAMPLE (lower case is accepted and upper-cased). Anything else raises a ValueError listing the nine. Default COUNT, which answers "how many events per bin" and is what spike detection is normally run on.COUNT
bin_width_msNoWidth of each time bin in milliseconds, must be positive (default 60000 = one minute). It sets the resolution of both the series and the spike test: bins much wider than the burst average it away, bins much narrower make every quiet minute look like noise.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint, idempotentHint), the description discloses the spike detection threshold (≥2 standard deviations above the mean), the edge case behavior for short or flat series, and explicitly warns that an empty spikes list is not evidence of calm in short windows. It also declares 'Read-only,' consistent with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly organized into READ, WHEN, and RETURNS sections, with no filler. It front-loads the core purpose, gives a usage signal, and tucks the return shape and edge-case caveat into the RETURNS block — every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, usage context, return shape, and behavioral nuances (spike detection caveats). With 7 parameters fully documented in the schema and no output schema, the description supplies the missing output contract and enough context for an agent to invoke the tool correctly and interpret results, including the important empty-spikes caveat.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already has 100% parameter description coverage, with detailed explanations for last, text, begin_ms/end_ms, target, aggregation, and bin_width_ms. The tool description does not repeat parameter details, which is appropriate; the baseline of 3 applies because the description adds no parameter-level semantics beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Aggregate matching events into a time series and detect spikes.' This clearly distinguishes the tool from siblings like log_search (raw events) and log_fields (schema inspection), and the '[READ]' prefix immediately signals it is a non-mutating operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The WHEN section explicitly states the intended scenario: 'to find when/whether log volume burst without pulling raw events,' and directs the agent to 'Follow up with log_search on the spike window.' This names the alternative tool and provides actionable routing guidance rather than leaving the decision implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_fieldsA
Read-onlyIdempotent

[READ] List the extracted fields available to use in query filters.

Use this to discover valid field names before filtering log_search / log_aggregate. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {name}. No limit — every matching field is returned, so truncated is always false: this is the complete field list, not a page. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
name_filterNoCase-insensitive substring matched against the field name. Omit to return every field this appliance extracts. Field extraction is deployment-specific, so a name absent here does not exist for this target no matter what it is called elsewhere.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only/idempotent/destructive hints. The description adds valuable behavioral details beyond annotations: the exact envelope shape, that every matching field is returned, and that truncated is always false — meaning the result is a complete list, not a page. This is helpful for an agent deciding whether to paginate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with '[READ]' and the primary action, then flows logically through purpose, return format, and pagination behavior. Almost every sentence earns its place, though the trailing 'Read-only' is redundant given the '[READ]' prefix and annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explains the return envelope, field item shape, and pagination behavior, so an agent knows exactly what to expect. Combined with the fully documented schema and strong annotations, nothing needed to invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both optional parameters well. The description adds the important 'no limit / complete list' nuance but does not need to repeat parameter meaning; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('List'), the resource ('extracted fields'), and the purpose ('available to use in query filters'). Explicitly names the downstream consumers (log_search / log_aggregate), making the tool's role clear and distinguishable from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context: 'Use this to discover valid field names before filtering log_search / log_aggregate.' It does not explicitly describe when not to use it or mention alternatives, but no sibling tool performs field discovery, so the guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_versionA
Read-onlyIdempotent

[READ] Return the Log Insight appliance version/build (diagnostics and query-syntax compatibility). Returns {version, release_name, build}. Use this first when a query behaves unexpectedly, to confirm the appliance version before trusting log_search. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names. This is also the cheapest way to prove a given target's credentials work at all.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, and non-destructive behavior. The description adds useful context beyond that: the diagnostic purpose, exact return fields, and the fact that it is the cheapest way to validate target credentials.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with the verb and resource, and every sentence serves a distinct role. Slight redundancy exists because '[READ]' and 'Read-only' both repeat the readOnlyHint annotation, so it is not maximally lean.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter, no-output-schema tool, this is complete: the return structure is spelled out, the target parameter is fully documented in the schema, and annotations cover the safety profile.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the target parameter is thoroughly documented including default behavior and the error case. The description adds no parameter-level meaning, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('Return') and resource ('Log Insight appliance version/build'), and lists the exact output fields. It also differentiates the tool from its siblings by positioning it as a diagnostic precondition for log_search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when-to-use rule: 'Use this first when a query behaves unexpectedly' and explains why, namely to confirm the appliance version before trusting log_search. This directly guides selection among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 7 tool updatesv1.8.14
    • Changedalert_get3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / alert_id / description
        Added value: +"The alert id exactly as returned in an alert_list row's 'id' field (not the alert's name). An empty string is refused with a message telling you to run alert_list; a well-formed but unknown id comes back as a 404 from the appliance."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
    • Changedalert_history4 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / alert_id / description
        Added value: +"The alert id exactly as returned in an alert_list row's 'id' field (not the alert's name). An empty string is refused with a message telling you to run alert_list first."
      • addedInput schema / properties / limit / description
        Added value: +"Maximum history records returned, most recent first as the appliance orders them (default 50). There is no offset — the appliance hands back the whole history in one call and this slices it, so when truncated is true the only way to reach older records is a larger limit."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
    • Changedalert_list4 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / limit / description
        Added value: +"Maximum items in the page (default 50). It slices the matches after filtering; 'total' still reports every match, so a small limit never hides how many alerts exist."
      • addedInput schema / properties / name_filter / description
        Added value: +"Case-insensitive substring matched against the alert's name only (not its id or description). Omit to list every defined alert. The appliance returns the whole collection either way and the filter runs locally, so filtering costs nothing extra."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
    • Changedlog_aggregate8 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / aggregation / description
        Added value: +"The function applied within each bin — exactly one of COUNT, UCOUNT, AVG, MIN, MAX, SUM, STDDEV, VARIANCE, SAMPLE (lower case is accepted and upper-cased). Anything else raises a ValueError listing the nine. Default COUNT, which answers \"how many events per bin\" and is what spike detection is normally run on."
      • addedInput schema / properties / begin_ms / description
        Added value: +"Absolute window start as epoch milliseconds. Usable on its own; cannot be combined with last."
      • addedInput schema / properties / bin_width_ms / description
        Added value: +"Width of each time bin in milliseconds, must be positive (default 60000 = one minute). It sets the resolution of both the series and the spike test: bins much wider than the burst average it away, bins much narrower make every quiet minute look like noise."
      • addedInput schema / properties / end_ms / description
        Added value: +"Absolute window end as epoch milliseconds. Usable on its own; cannot be combined with last."
      • addedInput schema / properties / last / description
        Added value: +"Relative window ending now — \"30m\", \"2h\", \"7d\" (units s/m/h/d) or a bare number of seconds. Cannot be combined with begin_ms/end_ms. Omit all three and the window defaults to the last hour."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
      • addedInput schema / properties / text / description
        Added value: +"Free-text substring matched with CONTAINS, exactly as in log_search. Omit to aggregate every event in the window."
    • Changedlog_fields3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / name_filter / description
        Added value: +"Case-insensitive substring matched against the field name. Omit to return every field this appliance extracts. Field extraction is deployment-specific, so a name absent here does not exist for this target no matter what it is called elsewhere."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
    • Changedlog_search7 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / begin_ms / description
        Added value: +"Absolute window start as epoch milliseconds (not seconds). May be given without end_ms, which then means \"from this instant onwards\". Cannot be combined with last."
      • addedInput schema / properties / end_ms / description
        Added value: +"Absolute window end as epoch milliseconds (not seconds). May be given without begin_ms, which then means \"everything up to this instant\". Cannot be combined with last."
      • addedInput schema / properties / last / description
        Added value: +"Relative window ending now, as a quantity plus a unit suffix — s, m, h or d (\"30m\", \"2h\", \"7d\") — or a bare number of seconds. Anything else raises a ValueError naming the accepted forms. Cannot be combined with begin_ms/end_ms; passing both is refused. Omit all three and the query defaults to the last hour, so it is never unbounded."
      • addedInput schema / properties / limit / description
        Added value: +"Maximum events returned, 1..20000, default 50. Out-of-range values are silently clamped into that range rather than refused. Narrow the window or the text rather than raising this — raw events are the largest thing this skill can put in context."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
      • addedInput schema / properties / text / description
        Added value: +"Free-text substring matched against the event message with the CONTAINS operator — not a regex and not a full query expression. Omit to match every event in the window. To filter on an extracted field instead, discover names with log_fields; this tool exposes no field-filter parameter."
    • Changedlog_version2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names. This is also the cheapest way to prove a given target's credentials work at all."
  2. 7 tool updatesv1.8.9
    • First observedalert_get
    • First observedalert_history
    • First observedalert_list
    • First observedlog_aggregate
    • First observedlog_fields
    • First observedlog_search
    • First observedlog_version

TDQS

A4.5/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: alert list/get/history handle alert definitions and trigger records, while log_search/log_aggregate/log_fields/log_version handle log exploration and diagnostics. There is no realistic overlap between alert_get and alert_history or between log_search and log_aggregate.

Naming Consistency5/5

All tool names use lowercase snake_case and follow a consistent noun_verb pattern, with alert_ prefixed for alert operations and log_ prefixed for log operations. This creates a predictable and scannable naming scheme.

Tool Count5/5

Seven tools is a well-scoped size for a focused read-only Log Insight API. Each tool earns its place and there is no redundancy or padding.

Completeness4/5

The toolset covers the main read workflows: version checking, field discovery, event search, aggregation, and alert definition/history inspection. The only gap is that the alert surface is intentionally read-only, so creating, updating, or deleting alerts requires external tooling.

Maintenance

ActivityActive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    MCP server for querying and analyzing logs from VMware Aria Operations for Logs, enabling log search, incident detection, and vROps correlation.
    6
    4
    MIT
  • A
    license
    Not graded
    quality
    F
    maintenance
    A read-only MCP server that exposes Quickwit log search and aggregations to LLM clients, enabling natural language log investigation.
    Apache 2.0
  • A
    license
    Not graded
    quality
    D
    maintenance
    Read-only MCP server for exploring and searching OpenSearch clusters, enabling log analysis, index exploration, and query execution.
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    A read-only MCP server that enables AI assistants to search, aggregate, and explore OpenSearch log data through 12 tools for connectivity, index discovery, search, and aggregations.
    17
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/vmware-skills/VMware-Log-Insight'

If you have feedback or need assistance with the MCP directory API, please join our Discord server