Atlas / MCP servers / buenapp / vcenter-mcp

vcenter-mcpBLOCK

Name: vcenter-mcp
Author: buenapp

mcp/buenapp/vcenter-mcp

MCP server by buenapp · mcp · mcp server · mcp servers · Audited 2026-10-12

⚑ Report / re-scan Source ↗

VMware vCenter MCP server on the Enchilada Framework

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

49 33r · 13w · 3d

Transport

streamable-http

License

BSD-2-Clause

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

An MCP (Model Context Protocol) server that exposes VMware vCenter to AI agents over stdio. Built on the Enchilada Framework 3.0 — PHP 8.4, no Composer.

Features

Multi-instance configuration (config/instances.json)
Inventory browsing: datacenters, clusters, hosts, datastores, networks,

folders, resource pools, datastore file listing

VM lifecycle: list, inspect, create (with automatic host/datastore

placement, host exclusion, and optional hardware version), delete, CPU/memory resize

Device management: CD-ROM ISO attach/detach, disks, NICs, boot order,

video card (VRAM auto-detect, displays, 3D support)

Power control and guest OS information
Console interaction over two transports: WebMKS (AcquireTicket ->

wss -> RFB on the ESXi host) or vim25 SOAP — screenshots (PNG), keystrokes (X11 keysyms or USB HID), blocking VM questions; method=auto tries WebMKS and falls back to SOAP

Relaxed TLS by default (vCenter certs are VMCA-issued/self-signed);

opt-in DANE-first validation (TLSA records, CA fallback, optional SHA-256 certificate pin) via tls.verify

Credentials inline or via ~/.netrc

Requirements

PHP 8.4+ CLI with curl and openssl extensions
A vCenter 7+/8 instance reachable over HTTPS

Install

Download the self-contained vcenter-mcp.phar from the latest release (no Composer, no dependencies):

mkdir -p ~/.local/bin
curl -L -o ~/.local/bin/vcenter-mcp.phar \
https://github.com/buenapp/vcenter-mcp/releases/latest/download/vcenter-mcp.phar
chmod +x ~/.local/bin/vcenter-mcp.phar

To run from source instead:

git clone https://pacyworld.dev/buenapp/vcenter-mcp.git
cd vcenter-mcp
php bin/vcenter-mcp --config=config/instances.json

Quick start

~/.config/vcenter-mcp/instances.json:

{
"default": "main",
"instances": {
"main": {
"url": "https://

Read from source at commit a2078a31ddc0OBSERVED · 2026-10-12

Exposed tools (49)

33 read · 13 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_disk`	write	Add a new SCSI disk to a VM, on an existing controller by default. If controller_type names a type the VM lacks, that controller is created too, which requires the VM powered off.
`add_nic`	write	Add a NIC to a VM.
`answer_vm_question`	read	Answer the VM\
`attach_iso`	read	Attach an ISO to a VM CD-ROM (connected immediately when powered on).
`attach_pci`	read	Attach a host PCI device to a VM via Dynamic DirectPath I/O. Requires the VM powered off (no hot-add); locks all guest memory (memoryReservationLockedToMax) as DirectPath requires. Refuses a device already attached to another VM.
`browse_datastore`	read	List files on a datastore (e.g. find ISOs: path
`create_vm`	write	Create a VM. Omitted host/datastore are auto-picked (a non-excluded host, its datastore with most free space); excluded hosts are refused. With iso, boots CDROM then DISK.
`delete_vm`	destructive	Delete a VM. Refuses a powered-on VM unless force=true (powers off first).
`deploy_ova`	write	Deploy a VM from an OVA (
`deploy_vm`	write	Provision a VM to the estate FreeBSD service-VM spec: LSI boot volume, PVSCSI independent_persistent ZFS data volumes, vRAM auto-detect, EFI, FreeBSD install + provisioning script.
`detach_iso`	write	Detach an ISO: disconnect the CD-ROM and set its backing to CLIENT_DEVICE. After an OS install, reboot out of the installer first; detaching while it runs raises a
`detach_pci`	destructive	Remove a passthrough PCI device from a VM. Identified by device key, backing PCI id, or a unique substring of its label. Requires the VM powered off (no hot-remove).
`find_vm_ip`	read	Get guest IPs from VMware Tools; without Tools, returns NIC MACs to look up in DHCP leases.
`get_guest_info`	read	Get guest OS identity and network interfaces (requires VMware Tools).
`get_vcenter_info`	read	Get vCenter version/build/apiVersion and REST/SOAP session state.
`get_video`	read	Get a VM\
`get_vm`	read	Get a full VM summary: hardware, disks, NICs (with MACs), CD-ROMs, boot config, power state.
`get_vm_power`	read	Get a VM\
`get_vm_question`	read	Get the VM\
`guest_download`	read	Download a file from the guest via VMware Tools. Returns text (base64 if binary), or writes to local_path.
`guest_list_files`	read	List files in a guest directory via VMware Tools. Large listings page via index/new_index.
`guest_process_status`	read	List guest processes via VMware Tools; exited ones include exit_code and end_time.
`guest_run`	write	Run a program in the guest via VMware Tools and wait for exit. Give command (via /bin/sh -c) or program + arguments (no shell).
`guest_upload`	write	Upload a file into the guest via VMware Tools. Give exactly one of content, content_base64 or local_path.
`list_cdroms`	read	List a VM\
`list_clusters`	read	List clusters.
`list_controllers`	read	List a VM\
`list_datacenters`	read	List datacenters.
`list_datastores`	read	List datastores with capacity and free space.
`list_disks`	read	List a VM\
`list_folders`	read	List inventory folders.
`list_host_pci`	read	List PCI devices on an ESXi host with their passthrough state. By default only passthrough-enabled devices; pass capable_only=false for the full PCI table.
`list_hosts`	read	List ESXi hosts with connection/power state; hosts excluded from VM placement are marked excluded:true.
`list_networks`	read	List networks (standard and distributed portgroups).
`list_nics`	read	List a VM\
`list_passthrough_devices`	read	List a VM\
`list_resource_pools`	read	List resource pools.
`list_vcenter_instances`	read	List configured vCenter instances.
`list_vms`	read	List VMs, optionally filtered.
`ovf_info`	read	Inspect an OVA/OVF package and report its declared name, networks, vApp properties, disks and EULAs. Source is
`read_datastore_file`	read	Read a datastore file (e.g. a .vmx). Text is returned verbatim, binary as base64; max 8 MiB.
`set_boot`	write	Set VM boot firmware, boot device order and/or enter-setup-mode flag.
`set_disk`	write	Change an existing disk\
`set_video`	write	Change a VM\
`set_vm_hardware`	write	Change VM CPU count and/or memory size.
`vm_console_info`	read	Diagnose WebMKS console access: reports ESXi host/port, WebSocket subprotocol, TLS trust basis (DANE TLSA or ticket thumbprint) and framebuffer size.
`vm_power`	destructive	Change VM power state. on/off/reset/suspend are hard; shutdown_guest/reboot_guest need VMware Tools.
`vm_screenshot`	read	Capture the VM console as PNG. webmks needs the ESXi host reachable; soap goes through vCenter; auto (default) tries webmks then soap.
`vm_send_keys`	write	Type text and/or press keys on the console of a powered-on VM (US layout). Sent in order: text, keys, then Enter if enter=true. method auto (default) tries webmks then soap (USB HID); webmks does not fall back.

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (9 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (12)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

classes/VCenter/Instance.class.php:131

"No .netrc entry with a password for '{$host}' (instance '{$this->name}')",

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

classes/VCenter/Netrc.class.php:52

$path = (getenv('HOME') ?: ($_SERVER['HOME'] ?? '')) . '/.netrc';

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

tools/PromptTools.php:95

- Afterwards append your own SSH public key to /root/.ssh/authorized_keys.

Why it matters. touches a credential store

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

classes/VCenter/TlsPolicy.class.php:72

bool $verify = false,

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_vm, detach_pci, vm_power

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862

streamable-http

Why it matters. a network transport with no auth environment variable found

Fix. require a token

LOWInventory / provenance · inv.binary · CWE-1104

tests/fixtures/app.ova

app.ova

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

tests/NetrcTest.php:55

$this->assertNull(Netrc::lookup('x', '/nonexistent/.netrc'));

Why it matters. touches a credential store

LOWNetwork egress · net.tls_off · CWE-200, CWE-319

tests/TlsPolicyTest.php:112

$policy = new TlsPolicy(false, null, null, fn() => $this->fail('TLSA lookup must not run when verify=false'));

Why it matters. certificate verification is disabled

Fix. leave verification on

INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427

README.md:79

be `null` with `"netrc": true` to read it from `~/.netrc` (`machine

Why it matters. asks the agent to read credentials

INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427

docs/ARCHITECTURE.md:78

read `~/.netrc` (`machine <url host>`, `default` fallback). Passwords

Why it matters. asks the agent to read credentials

INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427

docs/SETUP.md:29

and `netrc` to `true` to read it from `~/.netrc` (`machine <host>`).

Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha a2078a31ddc0full audit observations/trust-audit/mcp-server/buenapp__vcenter-mcp.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-12	`a2078a31ddc0`	BLOCK	D	69	first audit

Questions

What is the vcenter-mcp MCP server?

VMware vCenter MCP server on the Enchilada Framework

What tools does vcenter-mcp expose?

49 in total: 33 read-only, 13 that write, and 3 that can delete or overwrite (delete_vm, detach_pci, vm_power). Every one is listed on this page with its risk.

Is vcenter-mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does vcenter-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does vcenter-mcp run?

It speaks streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (a2078a31ddc0), read on 2026-10-12. The repository is watched and re-audited when it changes.

Source	buenapp/vcenter-mcp
Transports	streamable-http
License	BSD-2-Clause
Activity	pushed 7d ago