vmware-pilot
This server provides multi-step workflow orchestration for VMware infrastructure, combining skills like VM lifecycle, monitoring, networking, and storage into automated sequences with approval gates, rollback, and audit trails.
Workflow Design & Creation
design_workflow— Describe a goal in natural language and get a draft workflow with proposed stepsupdate_draft— Edit a draft workflow's name, description, or steps based on feedbackconfirm_draft— Finalize a draft workflow (DRAFT → PENDING), optionally saving as a reusable templatecreate_workflow— Create a custom workflow from an explicit step list when no template fitslist_workflows— View all built-in and custom YAML workflow templatesget_skill_catalog— Browse all available VMware skills and tools to use as workflow building blocks
Planning & Execution
plan_workflow— Generate an execution plan from a built-in template (e.g.,clone_and_test,incident_response,compliance_scan)run_workflow— Execute a planned workflow; pauses at approval gates for human reviewapprove— Resume a workflow paused at an approval gate (recorded in audit log)rollback— Abort a workflow and reverse completed steps in reverse ordercancel_workflow— Permanently cancel a workflow (e.g., after a rejected approval)
Monitoring & Review
review_workflow— Sanity-check a workflow before execution: detects conflicts, missing params, ungated destructive steps, and risk profileget_workflow_status— Query full workflow state, step-by-step diff report, and complete audit log
Provides multi-step workflow orchestration for VMware MCP skills, developed by an engineer at Broadcom (formerly VMware), enabling state machines, approval gates, and audit trails across the VMware ecosystem.
Provides multi-step workflow orchestration for VMware MCP skills, including VM lifecycle, cluster management, monitoring, storage, networking, security, Tanzu Kubernetes, NSX, Aria, and AVI load balancing, with state machine, approval gates, and audit trail.
VMware Pilot
Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.
English | 中文
Multi-step workflow orchestration for VMware MCP skills — state machine, approval gates, audit trail.
Companion skills handle everything else:
Skill
Scope
Install
VM lifecycle, deployment, guest ops, cluster
uv tool install vmware-aiopsRead-only: inventory, health, alarms, events
uv tool install vmware-monitorDatastores, iSCSI, vSAN management
uv tool install vmware-storageTanzu Namespaces, TKC cluster lifecycle
uv tool install vmware-vksNSX networking: segments, gateways, NAT
uv tool install vmware-nsx-mgmtDFW firewall rules, security groups
uv tool install vmware-nsx-securityAria Ops: metrics, alerts, capacity
uv tool install vmware-ariaAVI load balancing, pool management, AKO K8s ops
uv tool install vmware-avi
Install
uv tool install vmware-pilot
vmware-pilot mcp # start the MCP server (stdio)Offline / Air-Gapped Install (from source)
This project uses the modern PEP 517 build system (hatchling), so there is no
setup.py by design — that is expected, not a missing file. If you cloned the
source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and
cannot do an editable (-e) install with a non-setuptools backend. Editable
mode is a developer convenience, not needed to run the tool — do one of:
# From the source tree — a normal (non-editable) install builds a wheel:
pip install . # NOT pip install -e .
# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:
# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist # → dist/*.whl (or: uv build, for just this package)
# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-pilotRelated MCP server: vmware-harden
MCP Tools (13 — 4 read, 9 write)
Tool | Description |
| List all available skills and tools for workflow design |
| List built-in and custom templates |
| Sanity-check a planned workflow before execution |
| Natural language goal → draft workflow |
| Edit draft workflow steps |
| Finalize draft → ready to execute |
| Generate execution plan from template, returns workflow_id |
| Create custom workflow from step list |
| Execute workflow, pauses at approval gates |
| Query state + diff report + audit log |
| Human approval, continue execution |
| Abort and rollback at any stage |
| Cancel a workflow — move it to the terminal CANCELLED state |
MCP Configuration
{
"mcpServers": {
"vmware-pilot": {
"command": "vmware-pilot",
"args": ["mcp"]
}
}
}Fallback:
{"command": "uvx", "args": ["--from", "vmware-pilot", "vmware-pilot-mcp"]}still works, butuvxre-resolves against PyPI on every start and fails behind a TLS-inspecting corporate proxy (invalid peer certificate: UnknownIssuer). The installed entry point above touches the network zero times; setUV_NATIVE_TLS=trueif you must useuvx.
License
MIT
Available Tools
13 toolsapproveA
[WRITE] Approve a workflow that is waiting for human confirmation.
Use this only after showing the user the pending step and getting explicit human consent; use cancel_workflow instead when the approval is rejected. Only works when workflow state is 'awaiting_approval'. After approval, execution continues to the next steps.
Args: workflow_id: The workflow ID to approve. approver: Name of the person approving (for audit trail).
Note: this server has no dispatcher — after approval, remaining steps are recorded as 'not_executed' and the result carries outcome='dispatch_required' with a 'pending_dispatch' list for the calling agent to perform (see run_workflow).
Returns: Updated workflow state after resuming.
| Name | Required | Description | Default |
|---|---|---|---|
| approver | No | ||
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes beyond annotations by disclosing that approval does not automatically execute next steps on this server; instead, it marks them as 'not_executed' and returns outcome='dispatch_required' with a 'pending_dispatch' list. This is critical behavioral context not implied by readOnlyHint=false or destructiveHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear purpose, usage guidance, args, note, and returns section. Every sentence adds value, especially the dispatcher note which is essential for correct agent behavior. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool mutates workflow state and has no output schema; the description covers prerequisites, side effects, return value, and the special dispatch requirement. It references run_workflow for further context, making it complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema lacks parameter descriptions, but the description compensates fully by explaining workflow_id as 'The workflow ID to approve' and approver as 'Name of the person approving (for audit trail)', adding meaningful semantics beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Approve a workflow that is waiting for human confirmation.' It uses a specific verb and resource, and distinguishes itself from siblings by explicitly mentioning cancel_workflow for rejections and the awaiting_approval state requirement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage instructions: 'Use this only after showing the user the pending step and getting explicit human consent' and directs to cancel_workflow when approval is rejected. Also specifies the precondition that the workflow must be in 'awaiting_approval' state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cancel_workflowA
[WRITE] Cancel a workflow — move it to the terminal CANCELLED state.
Use this when an approval is REJECTED, a review flags the plan as unsafe, or an operator decides the workflow must never run. A cancelled workflow is dead: run_workflow and approve refuse to execute it. Without this, an approval-rejected PENDING workflow could still be picked up and run.
Cancel only stops FUTURE steps. It does NOT undo already-completed steps — use rollback() to reverse those. Cancel is valid only from a non-terminal state; cancelling an already completed/failed/cancelled workflow returns a teaching error. The cancellation is written to the workflow audit log.
Args: workflow_id: The workflow ID to cancel. reason: Optional human-readable reason (e.g. "approval rejected by on-call"), recorded in the audit log.
Returns: Updated workflow state (state='cancelled', outcome='cancelled'), or an error if the workflow is already terminal.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | ||
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses side effects: moves to terminal CANCELLED state, stops future steps, does not undo completed, writes to audit log, returns error if already terminal. Annotations are readOnlyHint=false and destructiveHint=false, which are consistent; description adds far more detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is thorough but not overly verbose; includes clear sections (Args, Returns). Some repetition could be trimmed, but it's well-organized and front-loaded with the most critical information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, description provides return format (updated workflow state or error). Also includes necessary context about the tool's effect on workflow lifecycle, making it fully self-contained for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It fully describes both parameters: workflow_id (the ID to cancel) and reason (optional human-readable reason with example and that it's recorded in audit log). This is excellent guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description starts with '[WRITE] Cancel a workflow — move it to the terminal CANCELLED state.' Clearly states the verb and resource. Distinguishes from siblings like rollback, run_workflow, and approve by explaining when to use it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: approval rejected, review flags unsafe, operator decision. Also states when not to use and alternatives: 'Cancel only stops FUTURE steps. It does NOT undo already-completed steps — use rollback() to reverse those.' Also indicates valid only from non-terminal state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
confirm_draftA
[WRITE] Confirm a draft workflow — changes state from DRAFT to PENDING.
Use this once the user has approved the draft's steps; call update_draft instead if anything still needs changing. After confirmation, the workflow can be executed via run_workflow(). Optionally saves as a YAML template for future reuse.
Args: workflow_id: The draft workflow ID to confirm. save_as_template: If True, save to ~/.vmware/workflows/ for reuse.
Returns: Confirmed workflow summary. Call run_workflow() to execute.
| Name | Required | Description | Default |
|---|---|---|---|
| workflow_id | Yes | ||
| save_as_template | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that this is a write operation ([WRITE]) that changes state, consistent with readOnlyHint=false. It also reveals a side effect: optionally saving a YAML template to ~/.vmware/workflows/, which goes beyond the annotations. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and efficient, with clear structure (overview, usage, args, returns). Some redundancy (repeating run_workflow call) but overall every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, usage, parameters, and return value, and there is no output schema to rely on. It could mention the precondition that the workflow must be in DRAFT state, but the rest is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0%, the description compensates by explaining each parameter: workflow_id is 'The draft workflow ID to confirm' and save_as_template is 'If True, save to ~/.vmware/workflows/'. This adds functionality beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: confirming a draft workflow and transitioning it from DRAFT to PENDING. It distinguishes from sibling tools like update_draft and run_workflow by specifying the exact state change and subsequent execution.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('once the user has approved') and when to use update_draft instead ('if anything still needs changing'). Also provides sequencing guidance by mentioning that run_workflow() should be called after confirmation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_workflowA
[WRITE] Create a custom workflow dynamically from a step list.
Use this when you already know the steps and no built-in template matches; prefer plan_workflow when one does, and design_workflow when the user gave a goal rather than steps. Call get_skill_catalog first for the skill and tool names a step may target.
Each step dict must have: action, skill, tool, params. Optional: rollback_tool, rollback_params. action="require_approval" inserts a human approval gate — run_workflow refuses ungated destructive steps.
Args: name: Workflow name (used as workflow_type). description: Human-readable description. steps: List of step dicts, each with action/skill/tool/params. save_as_template: If True, save as YAML to ~/.vmware/workflows/ for reuse.
Returns: dict with workflow_id and plan summary. Next call review_workflow to check the plan, then run_workflow to execute; rollback undoes it.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| steps | Yes | ||
| description | Yes | ||
| save_as_template | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses key behavioral traits beyond annotations: the [WRITE] prefix, dynamic creation from steps, the requirement for approval for destructive steps, and the side effect of saving a YAML file when save_as_template is true. Annotations are consistent (readOnlyHint=false), so no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the primary purpose. It uses clear sections for usage, step requirements, args, and returns, with each sentence earning its place. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for a complex tool with no output schema and low schema coverage. It covers prerequisites (get_skill_catalog), step structure, approval gates, side effects, and the full follow-up flow (review_workflow, run_workflow, rollback). No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description fully documents each parameter: name (used as workflow_type), description, steps (with required sub-fields action/skill/tool/params and optional rollback fields), and save_as_template (with file path). This adds critical meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description immediately states a specific verb+resource: 'Create a custom workflow dynamically from a step list.' It clearly distinguishes this from siblings by naming plan_workflow and design_workflow as alternatives with different applicability criteria.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit usage guidance is provided: use when you already know the steps and no built-in template matches; prefer plan_workflow when a template matches; prefer design_workflow when the user gave a goal. It also instructs calling get_skill_catalog first for skill and tool names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
design_workflowA
[WRITE] Start designing a workflow from a natural language description.
Call this when the user describes a complex operation and you need to design a multi-step workflow. Returns a DRAFT workflow with proposed steps for the user to review and edit before execution.
Design flow: design_workflow → update_draft (add steps, then iterate on user feedback) → confirm_draft (state becomes PENDING) → run_workflow.
Use get_skill_catalog() first to see which tools the steps may target.
Args: goal: Natural language description of what the user wants to accomplish. constraints: Optional constraints (e.g. "must have approval before any destructive step", "use NSX for networking", "target is vcenter-prod").
Returns: dict with workflow_id (state=DRAFT), proposed steps placeholder, and instructions for the AI to fill in steps via update_draft.
| Name | Required | Description | Default |
|---|---|---|---|
| goal | Yes | ||
| constraints | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond annotations by clarifying that the tool creates a DRAFT workflow with 'proposed steps placeholder,' meaning the output is incomplete and requires further updates via update_draft. It also states the workflow state is DRAFT. This adds valuable behavioral context that the annotations (readOnlyHint=false, openWorldHint=true) do not convey. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear opening, usage context, flow, prerequisites, args, and returns. Each section adds necessary information; nothing seems redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains return values (workflow_id, state=DRAFT, placeholder, instructions) despite no output schema. It also outlines the full design flow and prerequisites, making it complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides no parameter descriptions (0% coverage), but the description fills the gap with clear definitions for both 'goal' and 'constraints,' including examples for constraints. This fully compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Start designing a workflow from a natural language description.' It specifies the resource (workflow) and the action (design), and distinguishes it from siblings by positioning it as the initial entry point in the design flow (design_workflow → update_draft → confirm_draft → run_workflow).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use: 'Call this when the user describes a complex operation and you need to design a multi-step workflow.' It also instructs to use get_skill_catalog() first. However, it does not explicitly mention when not to use it or alternative tools like create_workflow, so a 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_skill_catalogARead-onlyIdempotent
[READ] Get the complete catalog of available skills and tools for workflow design.
Use this to understand what building blocks are available when designing a custom workflow, then feed the skill and tool names into create_workflow or update_draft steps. Note this is a static curated catalog, not a live query of each skill's registry, so it may lag a skill's actual tool list; pilot cannot call these tools itself — the calling agent does.
Returns: dict mapping skill name → {description, tools: {tool_name: {risk, desc}}}.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even though annotations already provide readOnlyHint and idempotentHint, the description adds unique behavioral context: the catalog is static and may lag the actual registry, and that the calling agent (not the pilot) must invoke the listed tools. It also discloses the return structure, giving the agent a clear expectation of the output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a bold READ tag, early statement of purpose, then usage guidance and a note on limitations, followed by a compact return format. Every sentence adds necessary value, and the most critical information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description fully documents the return type ('dict mapping skill name → {description, tools: {tool_name: {risk, desc}}}'). It also explains the tool's role in the workflow design process, making it complete for an agent to select and use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema trivially covers 100%. The description does not need to explain parameters. Baseline for zero params is 4, and no additional parameter semantics are required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with '[READ] Get the complete catalog of available skills and tools for workflow design,' which names a specific verb, resource, and context. This clearly distinguishes it from sibling tools like create_workflow and run_workflow that perform actions rather than provide an inventory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use the tool ('when designing a custom workflow') and how to use the result ('feed the skill and tool names into create_workflow or update_draft steps'). It also clarifies limitations (static catalog may lag, pilot cannot call tools) which prevents misuse, going beyond generic guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_workflow_statusARead-onlyIdempotent
[READ] Get current workflow state, diff report, and audit log.
Use this to poll a workflow after run_workflow and to find out why one stopped: outcome='dispatch_required' means you must perform the pending steps yourself, 'awaiting_approval' means call approve. Returns a point-in-time snapshot and does not advance the workflow.
Args: workflow_id: The workflow ID to query.
Returns: Full workflow state including steps, audit log, and diff report.
| Name | Required | Description | Default |
|---|---|---|---|
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/destructiveHint=false, but the description adds valuable behavioral context beyond that: it 'Returns a point-in-time snapshot and does not advance the workflow,' and it explains the semantic meaning of specific outcome values. This goes above and beyond the structured hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately long but well-structured with a [READ] tag, usage context, outcome explanations, args, and returns. Every sentence earns its place, and the critical information is front-loaded. It is concise relative to the amount of behavioral nuance it conveys.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description fully explains the return value: 'Full workflow state including steps, audit log, and diff report.' It also covers side effects (no advancement), outcome semantics, and references to related tools (run_workflow, approve), making it complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has zero parameter descriptions, so the description must compensate. It says 'workflow_id: The workflow ID to query,' which is clear but essentially restates the schema title. For a single simple ID parameter, this is adequate but adds no extra depth like formats or examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with '[READ] Get current workflow state, diff report, and audit log,' which is a specific verb+resource that clearly states what the tool does. It also distinguishes itself from siblings by framing this as the polling/status tool after run_workflow, not a workflow creation or mutation tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this to poll a workflow after run_workflow and to find out why one stopped,' giving direct when-to-use guidance. It also provides conditional alternatives: 'awaiting_approval' means call approve, and 'dispatch_required' means perform pending steps yourself, clarifying when not to rely solely on this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflowsARead-onlyIdempotent
[READ] List all available workflow templates (built-in + custom).
Use this first to see whether a template already covers the goal, then pass its name to plan_workflow; if none fit, use create_workflow instead. Built-in templates are always available. Custom templates are loaded from ~/.vmware/workflows/*.yaml — drop a YAML file there to add your own workflows.
Returns: dict with builtin and custom workflow lists, each with name, description, steps count, plus active_workflows — the IDs of in-flight runs to pass to get_workflow_status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description complements this by adding context about the source of custom templates (~/.vmware/workflows/*.yaml) and the exact return structure, including active_workflows for passing to get_workflow_status. No contradictions with annotations. The behavior is transparent for a read-only listing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a bracketed '[READ]' and a one-line purpose statement. It then provides just enough context: usage flow, custom template path, and return structure. Every sentence earns its place; there is no filler or repetition. The three short paragraphs are well-structured and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description fully explains the returned dict's keys (builtin, custom, active_workflows) and how to use the active_workflows IDs. It also includes enough sibling context (plan_workflow, create_workflow, get_workflow_status) to make the tool's place in the workflow clear. For a zero-parameter, read-only listing tool, this is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline for this dimension is 4 per the rubric. The description adds no parameter semantics because none exist, but it compensates by thoroughly detailing the return value, which is the only meaningful information an agent needs for invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear, specific verb+resource: 'List all available workflow templates (built-in + custom).' It distinguishes itself from siblings by explicitly positioning this as the first step and directing to plan_workflow or create_workflow based on the result, making its purpose unambiguous relative to other workflow tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage guidance is explicit: 'Use this first to see whether a template already covers the goal, then pass its name to plan_workflow; if none fit, use create_workflow instead.' It also explains the custom template file path, which informs when custom templates might appear, giving the agent clear decision-making context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
plan_workflowA
[WRITE] Create an execution plan for a multi-step workflow.
Use this when the goal matches one of the built-in types below; use create_workflow instead when none of them fit.
Available workflow types:
clone_and_test: Clone VM → apply changes → monitor → approve → commit
incident_response: Diagnose alert → collect info → approve → remediate
plan_and_approve: Wrap aiops batch operations with approval gate
compliance_scan: Read-only health/capacity/anomaly check (no approval)
Args: workflow_type: One of the available workflow types. params: Workflow-specific parameters. clone_and_test: target_vm (str), change_spec (dict), monitor_minutes (int), target (str). incident_response: alert_entity (str), alert_name (str), target (str). plan_and_approve: operations (list[dict]), target (str), description (str). compliance_scan: target (str), check_alarms (bool), check_capacity (bool).
Returns: dict with workflow_id, steps summary, and plan details.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes | ||
| workflow_type | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate a non-read-only, non-idempotent operation. The description adds context beyond that by marking the tool as '[WRITE]' and explaining approval gates for some workflow types while noting compliance_scan is read-only with no approval. It does not fully describe side effects or state changes, but the added context is valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: it opens with the main action, then usage guidance, then a clear list of workflow types, then parameter details, and finally return value. Every section earns its place, and while lengthy, it is organized with lists and headers that make it easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description correctly explains the return value (dict with workflow_id, steps summary, and plan details). It covers all workflow-specific parameter schemas and explicitly mentions the approval gates. This makes the tool complete even for a complex multi-mode operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no descriptions for parameters (0% coverage), so the description carries the full burden. It thoroughly explains workflow_type and then details per-type params for each of the four workflow types with types and field names. This goes well beyond the schema and makes the parameters self-explanatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb+resource: 'Create an execution plan for a multi-step workflow.' It also lists four specific workflow types and explicitly contrasts with the sibling tool create_workflow, making the tool's purpose distinct and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent when to use this tool ('Use this when the goal matches one of the built-in types below') and when to use an alternative ('use create_workflow instead when none of them fit'). It also gives a brief scenario for each workflow type, providing strong usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
review_workflowARead-onlyIdempotent
[READ] Sanity-check a planned workflow before execution.
Performs structural validation only — does NOT call into other skills. Catches the common authoring errors before they hit production:
Delete-then-use: a step deletes resource X, a later step references X
Missing required params: a step has empty params or placeholder values
Cross-skill order issues: surfacing the cross-skill dispatch sequence
Risk profile: count of destructive vs. read-only steps
Approval coverage: are all destructive ops gated behind a require_approval?
Args:
workflow_id: The workflow ID returned by plan_workflow.
Returns:
Dict with keys:
- verdict: "approved" if no structural issues, otherwise "needs_revision"
- findings: list of {severity, kind, message, step_index}
- summary: counts (steps, gather/destructive/approval), groups, est_duration_min
| Name | Required | Description | Default |
|---|---|---|---|
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds 'Performs structural validation only — does NOT call into other skills,' clarifying the read-only nature and constraints. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is front-loaded with purpose and key constraint, uses bullet points for error checks, and has well-structured Args/Returns sections. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool, the description fully specifies inputs, outputs (verdict, findings, summary), and behavioral constraints. Annotations cover safety hints. No gaps given the tool's validation-only role.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description documents 'workflow_id: The workflow ID returned by plan_workflow,' adding provenance constraints beyond the schema's bare type/required annotation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Sanity-check a planned workflow before execution' and specifies it performs structural validation only, distinguishing it from sibling tools like run_workflow or plan_workflow. It lists specific error types caught, making the purpose precise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('before execution') and what it does NOT do (does not call into other skills). It lists common errors it catches, guiding usage context. Lacks explicit exclusions or alternative tool mentions, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rollbackADestructive
[WRITE] Abort a workflow and rollback completed steps in reverse order.
Use this to undo steps that already ran; use cancel_workflow instead to stop a workflow that has not started yet or whose approval was rejected. Works in any state except 'completed'. Irreversible steps are skipped. The workflow state is set to 'failed' after rollback.
Args: workflow_id: The workflow ID to rollback.
Returns: Rollback results for each step. Check get_workflow_status afterwards to see which steps were actually reversed and which were skipped.
| Name | Required | Description | Default |
|---|---|---|---|
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructive and write behavior; the description adds concrete behavioral details: irreversible steps are skipped, workflow state becomes 'failed', and it works in any state except 'completed'. It also notes the return value and advises checking get_workflow_status afterward, transparently setting expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately concise, starting with a clear verb phrase and including alternative guidance. The Args/Returns sections add useful context, though the Args section is somewhat redundant with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
All essential aspects are covered: purpose, alternatives, state constraints, behavior on irreversible steps, and post-rollback verification. Given the tool's simplicity and the annotation coverage, this is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema declares workflow_id as a required string, and the description merely restates 'The workflow ID to rollback.' With 0% schema coverage, the description does not provide additional semantic info such as format, source, or constraints beyond the obvious, but it at least lists the parameter clearly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'abort' and 'rollback' with the resource 'workflow', clearly stating it undoes completed steps. It explicitly distinguishes itself from cancel_workflow by specifying when to use each, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use this tool versus cancel_workflow: use rollback for already-run steps, and cancel_workflow for not-yet-started or rejected workflows. It also specifies the allowed states ('any state except completed') and the resulting state ('failed'), providing clear usage conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_workflowA
[WRITE] Advance a planned workflow. Pauses at approval gates.
IMPORTANT — this MCP server has no dispatcher and cannot call other skills' MCP tools itself. Steps are recorded as 'not_executed' and the run finishes with outcome='dispatch_required' (NOT 'completed'), returning each pending step's skill/tool/params. YOU (the calling agent) must then perform those skill/tool calls in order. A workflow only reaches 'completed' when every step genuinely executed via a real dispatcher (embedders supplying one to WorkflowExecutor).
Safety: the workflow is structurally reviewed before each run. Runs are REFUSED if review finds ungated destructive steps or destructive steps inside a parallel group, unless force=True (forced runs are written to the workflow audit log).
When an approval gate is reached, the workflow pauses with state 'awaiting_approval'. Call approve() to continue.
Args: workflow_id: The workflow ID from plan_workflow. force: Bypass blocking review findings (ungated_destructive, destructive_in_parallel_group). Use only with explicit human consent; the bypass is audited.
Returns: Current workflow state with 'outcome' (completed | awaiting_approval | dispatch_required | failed) and, when dispatch is required, a 'pending_dispatch' list of steps for the agent to perform.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | ||
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnlyHint=false, destructiveHint=false), the description discloses critical behaviors: no dispatcher, outcome states, safety review refusal, audit logging of forced runs, and return format. This adds value over structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized into clear sections (overview, important note, safety, args, returns). Each sentence is informative and non-redundant, achieving conciseness without sacrificing completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (workflow execution, approval gates, dispatcher limitation, safety checks), the description covers all necessary aspects, including return values and state outcomes, despite no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description fully explains both parameters: 'workflow_id' (from plan_workflow) and 'force' (bypasses review with explicit human consent, audited). This compensates for lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with '[WRITE] Advance a planned workflow. Pauses at approval gates.' It specifies the action ('advance') and resource ('planned workflow'), clearly distinguishing from sibling tools like 'approve' or 'cancel_workflow'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides detailed usage context: the server has no dispatcher, steps are recorded as 'not_executed', and the calling agent must perform the pending steps. It explains when to use 'force' and conditions for refusal, differentiating from 'approve' for gates.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_draftA
[WRITE] Update a DRAFT workflow's name, description, or steps.
Call this after design_workflow() to fill in the actual steps, or to modify steps based on user feedback. Use it only while the workflow is still DRAFT — after confirm_draft the steps are frozen and you must create_workflow a new one instead.
Each step dict: {action, skill, tool, params, rollback_tool?, rollback_params?} Use action="require_approval" for approval gates.
Args: workflow_id: The draft workflow ID. name: Workflow name (optional, updates workflow_type). description: Human-readable description. steps: Complete list of steps (replaces all existing steps).
Returns: Updated workflow summary for user review.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| steps | No | ||
| description | No | ||
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses important behaviors beyond annotations: that steps are replaced as a whole ('replaces all existing steps'), that it's only valid pre-confirmation, and the [WRITE] flag. This adds context to the annotations' readOnlyHint=false and destructiveHint=false, clarifying the actual mutation scope without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with usage guidance, step format, Args, and Returns. Every sentence adds value—no fluff, yet it covers all necessary details without excessive length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description covers the return value ('Updated workflow summary for user review'') and explains the workflow lifecycle context. Combined with sibling references and precise parameters, it is fully complete for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only names/types with no descriptions (0% coverage). The description compensates fully by explaining each parameter's purpose, optionality, and the step dict structure, including approved actions. This is essential for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Update a DRAFT workflow's name, description, or steps' with a specific verb and resource. It differentiates from siblings by emphasizing the DRAFT state and pointing to create_workflow for after confirmation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says when to use it ('after design_workflow() to fill in the actual steps, or to modify steps based on user feedback') and when not to ('only while the workflow is still DRAFT — after confirm_draft... create_workflow a new one instead'), with an alternative named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
v1.5.38- Added
cancel_workflow - Changed
run_workflow1 field changed- added
Input schema / properties / forceAdded value: +{ + "default": false, + "title": "Force", + "type": "boolean" +}
12 tool updates
v1.5.22- First observed
approve - First observed
confirm_draft - First observed
create_workflow - First observed
design_workflow - First observed
get_skill_catalog - First observed
get_workflow_status - First observed
list_workflows - First observed
plan_workflow - First observed
review_workflow - First observed
rollback - First observed
run_workflow - First observed
update_draft
TDQS
The three workflow creation tools (create_workflow, design_workflow, plan_workflow) could be confused, but their descriptions explicitly distinguish when to use each: known steps, natural language goal, or built-in template. The remaining tools map clearly to distinct lifecycle stages (update, confirm, run, approve, cancel, rollback, review, status, list, catalog).
All tool names follow a consistent lowercase snake_case verb_object pattern: create_workflow, update_draft, confirm_draft, plan_workflow, run_workflow, cancel_workflow, review_workflow, get_workflow_status, list_workflows, get_skill_catalog. Even single-word tools like rollback and approve fit the verb-first convention without breaking the pattern.
With 13 tools, the set covers the complete workflow lifecycle—design, creation, planning, review, execution, approval, cancellation, rollback, status, and skill discovery. Each tool is purpose-built and the count is well within the ideal 3-15 range for a domain-focused server.
The set covers authoring, review, execution, approval, cancellation, rollback, and monitoring, but there is a significant gap: after run_workflow returns dispatch_required, no tool exists to mark dispatched steps as executed or feed results back, so workflows cannot reach 'completed' without an external dispatcher. Additionally, there is no delete/archive tool for workflow templates, though that is a minor omission.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Human-in-the-loop review and approval for AI agents. Audit trail, approval policies, native MCP.
MCP Hub: AI service discovery, per-user OAuth, and multi-service workflow orchestration
Orchestration & technical-consulting MCP for end-to-end Salesforce, ServiceNow & HubSpot back-end.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables orchestration of MCP tool calls through declarative YAML-defined directed graphs with data transformation, conditional routing, and observable execution flows.2421MIT
- AlicenseAqualityAmaintenanceVMware vSphere compliance and hardening — read-only baseline scanning plus drift detection across CIS, DISA STIG, vSphere SCG, China DJCP 2.0, and PCI-DSS frameworks. Includes LLM-powered remediation suggestions; apply-side gated through the vmware-pilot approval workflow.83MIT
- AlicenseNot gradedqualityCmaintenanceEnables management of VMware ESXi hosts and virtual machines through standardized MCP interfaces, supporting host operations, VM lifecycle, resource monitoring, and security management.17MIT
- FlicenseNot gradedqualityDmaintenanceOrchestrates multiple MCP tool calls into sequential workflows with conditional logic, data transformation via JSONPath, and workflow templates.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/vmware-skills/VMware-Pilot'
If you have feedback or need assistance with the MCP directory API, please join our Discord server