VMware Aria Operations for Logs — MCP Server
MCP server for querying and analyzing logs from VMware Aria Operations for Logs (formerly vRealize Log Insight). Provides log search, mass incident detection, and optional VMware Aria Operations (vROps) correlation.
Built for use with Claude Code, Claude Desktop, LobeChat, and any MCP-compatible client.
Features
- Log Search — Query events with time range, text filters, and field constraints via Log Insight API v2
- Incident Detection — Signature-based clustering to identify mass log incidents (Stormbreaker engine)
- API Surface Probe — Detect appliance version and available API endpoints
- Dashboard Listing — Enumerate saved dashboards (legacy vRLIC API, deprecated on 8.18+)
- vROps Correlation — Cross-reference log entities with Aria Operations resources and alerts
Quick Start
Install via uvx (recommended)
uvx vmware-aria-logs
Install via pip
pip install vmware-aria-logs
Run with environment variables
export LI_BASE_URL=https://loginsight.example.com
export LI_USERNAME=admin
export LI_PASSWORD=your-password
export LI_PROVIDER=Local
vmware-aria-logs
MCP Tools
| Tool | Description |
|---|---|
query_events |
Search log events with time range, text filter, field constraints |
get_version |
Get appliance version and probe API surface |
list_dashboards |
List saved dashboards (legacy vRLIC API, deprecated on 8.18+) |
detect_incidents |
Mass incident detection via signature clustering |
find_vrops_resources |
Find entities in Aria Operations by name |
get_vrops_alerts |
Get alerts for specific vROps resources |
Configuration
Required Environment Variables
| Variable | Description | Default |
|---|---|---|
LI_BASE_URL |
Log Insight appliance URL | — |
LI_USERNAME |
API username | admin |
LI_PASSWORD |
API password | — |
LI_PROVIDER |
Auth provider (Local, ActiveDirectory) | Local |
LI_VERIFY_TLS |
Verify TLS certificates | false |
Optional (vROps Correlation)
| Variable | Description | Default |
|---|---|---|
VROPS_BASE_URL |
Aria Operations URL | — |
VROPS_USERNAME |
vROps username | admin |
VROPS_PASSWORD |
vROps password | — |
VROPS_AUTH_SOURCE |
Auth source | local |
Claude Code / MCP Client Configuration
{
"mcpServers": {
"aria-logs": {
"command": "uvx",
"args": ["vmware-aria-logs"],
"env": {
"LI_BASE_URL": "https://loginsight.example.com",
"LI_USERNAME": "admin",
"LI_PASSWORD": "your-password"
}
}
}
}
Why This Server?
VMware Aria Operations for Logs (Log Insight) is widely deployed in enterprise VMware environments, but lacks modern AI-assisted log analysis tooling. This MCP server bridges that gap:
- Zero dependencies beyond the MCP SDK — uses Python stdlib
urllibfor HTTP - Stormbreaker engine — unique signature-based clustering that finds mass incidents humans miss
- vROps correlation — cross-reference log events with infrastructure health in a single conversation
- Works on v8.x+ — tested on Aria Operations for Logs 8.18.3, gracefully degrades deprecated APIs
Also Available On
License
MIT
Metadata
Release files for vmware-aria-logs 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| vmware_aria_logs-0.1.0.tar.gz | 71.7 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| vmware_aria_logs-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 85.7 kB
Release files / vmware_aria_logs-0.1.0.tar.gz
| Download URL | vmware_aria_logs-0.1.0.tar.gz |
|---|---|
| Size | 71.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
6b2c2252766d4253b15ebb3e0148bf74829b053feca407fb9e767d563508c5ac
|
|
BLAKE2b-256 checksum How to use checksums |
144559e6c27dc9b0f6ceadaf76cb74a3896d02a8719c831f7c7452b8fb23f687
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.10.12 {"installer":{"name":"uv","version":"0.10.12","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
Release files / vmware_aria_logs-0.1.0-py3-none-any.whl
| Download URL | vmware_aria_logs-0.1.0-py3-none-any.whl |
|---|---|
| Size | 14.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
281aaf3a681086e4458f511e205ebbfd62777411e4b52f4ba08527084221cff1
|
|
BLAKE2b-256 checksum How to use checksums |
f1aa52bc0620dccfea02b12d44b39df92d5d9d322420db85c60f3e168d0a268c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.10.12 {"installer":{"name":"uv","version":"0.10.12","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
Security for vmware-aria-logs 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.