EsxiSAFE
A VMware ESXi/vCenter management server based on MCP (Model Control Protocol), providing simple REST API interfaces for virtual machine management.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A VMware ESXi/vCenter management server based on MCP (Model Control Protocol), providing simple REST API interfaces for virtual machine management.
Features
- Support for ESXi and vCenter Server connections
- Real-time communication based on SSE (Server-Sent Events)
- RESTful API interface with JSON-RPC support
- API key authentication
- Complete virtual machine lifecycle management
- Real-time performance monitoring
- SSL/TLS secure connection support
- Flexible configuration options (YAML/JSON/Environment Variables)
Core Functions
- Virtual Machine Management
- Create VM
- Clone VM
- Delete VM
- Power On/Off operations
- List all VMs
- Performance Monitoring
- CPU usage
- Memory usage
- Storage usage
- Network traffic statistics
Requirements
- Python 3.7+
- pyVmomi
- PyYAML
- uvicorn
- mcp-core (Machine Control Protocol core library)
Quick Start
- Install dependencies:
pip install pyvmomi pyyaml uvicorn mcp-core
- Create configuration file
config.yaml:
vcenter_host: "your-vcenter-ip" vcenter_user: "[email protected]" vcenter_password: "your-password" datacenter: "your-datacenter" # Optional cluster: "your-cluster" # Optional datastore: "your-datastore" # Optional network: "VM Network" # Optional insecure: true # Skip SSL certificate verification api_key: "your-api-key" # API access key log_file: "./logs/vmware_mcp.log" # Log file path log_level: "INFO" # Log level
- Run the server:
python server.py -c config.yaml
API Interface
Authentication
All privileged operations require authentication first:
POST /sse/messages Authorization: Bearer your-api-key
Main Tool Interfaces
- Create VM
{
"name": "vm-name",
"cpu": 2,
"memory": 4096,
"datastore": "datastore-name",
"network": "network-name"
}- Clone
67a22eeaaa06OBSERVED · 2026-10-07Exposed tools (7)
4 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
authenticate | write | Authenticate using API key to enable privileged operations |
cloneVM | read | Clone a virtual machine from a template or existing VM |
createVM | write | Create a new virtual machine |
deleteVM | destructive | Delete a virtual machine |
listVMs | read | List all virtual machines |
powerOff | read | Power off a virtual machine |
powerOn | read | Power on a virtual machine |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
deleteVM
pyvmomi, pyyaml, uvicorn, mcp, pytest
Gates applied: no_behavioural_pass.
67a22eeaaa06full audit observations/trust-audit/mcp-server/bright8192__esxi.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 67a22eeaaa06 | SAFE | B | 89 | first audit |
Questions
What is the Esxi MCP server?
A VMware ESXi/vCenter management server based on MCP (Model Control Protocol), providing simple REST API interfaces for virtual machine management.
What tools does Esxi expose?
7 in total: 4 read-only, 2 that write, and 1 that can delete or overwrite (deleteVM). Every one is listed on this page with its risk.
Is Esxi safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Esxi need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (67a22eeaaa06), read on 2026-10-07. The repository is watched and re-audited when it changes.