VMware Aria Operations MCP Skill

Note: In VCF 9.0 and later, VMware Aria Operations has been rebranded as VCF Operations. This skill works against both names — the /suite-api/ REST endpoints are unchanged.

Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.

AI-assisted monitoring and capacity planning for VMware Aria Operations (vRealize Operations) via the Model Context Protocol (MCP).

Upgrading to 2.0

2.0 renames 4 of its 44 MCP tools so every name starts with a verb (e.g. findings_list → list_findings, fleet_certificate_list → list_fleet_certificates, fleet_domain_list → list_fleet_domains). The full old → new table is in RELEASE_NOTES.md. Nothing else changes: same tools, parameters, safety gates and CLI commands. If an agent prompt, script or ~/.vmware/rules.yaml names a tool, update it — though deny rules written with the old names keep working with vmware-policy ≥ 1.18 (vmware-audit policy lists any rule the renames widened), and vmware-pilot ≥ 1.13 translates old names in saved workflows. If an install older than 2.0 shares that rules.yaml, give it vmware-policy ≥ 1.18.2 too: it matches each rule against both the old and the new name, so one file serves both.

Overview

vmware-aria exposes 44 MCP tools for interacting with Aria Operations through natural language AI agents (Claude Code, Cursor, Goose, etc.):

Category	Tools	Type
Resources	list, get, metrics, health badge, top consumers, metric keys, properties, relationships	Read-only (8)
Alerts	list, get, investigate (alert→resource), acknowledge, cancel, definitions, notes (list / add), recommendations	Read + 3 Write (9)
Alert Definitions	symptom definitions, create, enable/disable, delete	Read + 3 Write (4)
Capacity	overview, remaining, time-remaining, rightsizing	Read-only (4)
Reports	definitions, generate, list, get, delete	Read + 2 Write (5)
Anomaly	list anomalies, risk badge	Read-only (2)
Health	platform health, collector groups, Aria node memory/swap/heap, adapter collection state	Read-only (4)
Maintenance	start / end resource maintenance, maintenance schedules	Read + 2 Write (3)
Fleet / PromQL (VCF Ops 9.1)	fleet certificates, password accounts, VCF domains, diagnostic findings, real-time PromQL query	Read-only (5)

Total: 44 tools — 34 read-only, 10 write

Quick Start

# Install
uv tool install vmware-aria

# Configure
mkdir -p ~/.vmware-aria
cat > ~/.vmware-aria/config.yaml << 'EOF'
targets:
  prod:
    host: aria-ops.example.com
    username: admin
    port: 443
    verify_ssl: true
    auth_source: LOCAL
default_target: prod
EOF

# Set password (never in config.yaml)
echo "VMWARE_ARIA_PROD_PASSWORD=your_password" > ~/.vmware-aria/.env
chmod 600 ~/.vmware-aria/.env

# Verify setup
vmware-aria doctor

Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is no setup.py by design — that is expected, not a missing file. If you cloned the source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and cannot do an editable (-e) install with a non-setuptools backend. Editable mode is a developer convenience, not needed to run the tool — do one of:

# From the source tree — a normal (non-editable) install builds a wheel:
pip install .              # NOT  pip install -e .

# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .

For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:

# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)

# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-aria

CLI Examples

# List top CPU consumers
vmware-aria resource top --metric 'cpu|usage_average' --top 10

# Check active CRITICAL alerts
vmware-aria alert list --criticality CRITICAL

# Acknowledge an alert
vmware-aria alert acknowledge <alert-id>

# Fetch 4-hour CPU + memory metrics for a VM ("missing" says why a key has no points)
vmware-aria resource metrics <vm-id> --metrics 'cpu|usage_average,mem|usage_average' --hours 4

# Check cluster capacity
vmware-aria capacity remaining <cluster-id>
vmware-aria capacity time-remaining <cluster-id>

# Find rightsizing opportunities (vCPU / memory now → recommended, direction, actionable)
vmware-aria capacity rightsizing

# Check Aria platform health: HEALTHY / DEGRADED / DOWN / UNKNOWN, per service, plus version
vmware-aria health status
vmware-aria health collectors

# Is the Aria node short of memory? Which adapter stopped collecting?
vmware-aria health node
vmware-aria health adapters

# Look up the metric keys a VM reports before querying them
vmware-aria resource keys <vm-id> --filter 'mem|'

# Put a host in maintenance for 2 hours before planned work, then end it (asks once; --dry-run prints the API call)
vmware-aria maintenance start <host-id> --duration 120
vmware-aria maintenance end <host-id>

# Record who is handling an alert, and read what Aria recommends
vmware-aria alert note-add <alert-id> "Taking this: rebooting esx-03"
vmware-aria alert recommendations <alert-id>

MCP Setup (Claude Code)

After uv tool install vmware-aria, add to ~/.claude.json:

{
  "mcpServers": {
    "vmware-aria": {
      "command": "vmware-aria",
      "args": ["mcp"],
      "env": {
        "VMWARE_ARIA_CONFIG": "~/.vmware-aria/config.yaml"
      }
    }
  }
}

v1.5.15+ uses the single-command form vmware-aria mcp. The legacy vmware-aria-mcp console script is still kept for backward compatibility. If you must use uvx --from vmware-aria vmware-aria mcp (no install) and hit invalid peer certificate: UnknownIssuer behind a corporate TLS proxy, set UV_NATIVE_TLS=true or use the recommended vmware-aria mcp form above.

Then use natural language:

"Show me the top 10 CPU consumers right now"
"List all CRITICAL alerts and acknowledge them"
"How long until the prod cluster runs out of memory?"
"Which VMs are over-provisioned? Show rightsizing recommendations"
"Are there any anomalies on vm-web-01?"

Authentication

Aria Operations uses vRealizeOpsToken authentication:

POST /suite-api/api/auth/token/acquire
{"username": "admin", "password": "...", "authSource": "LOCAL"}
→ {"token": "abc123", "validity": 1765182896000}  # validity = expiry epoch ms

Subsequent requests: Authorization: vRealizeOpsToken abc123

Tokens have a 6-hour sliding validity (extended on each call, per the official spec); the client re-acquires automatically 60 seconds before expiry. The validity field is the expiry timestamp in epoch milliseconds, not a duration.

Architecture

User (natural language)
  ↓
AI Agent (Claude Code / Goose / Cursor)
  ↓  [reads SKILL.md]
vmware-aria MCP server (stdio transport)
  ↓  [HTTPS + vRealizeOpsToken]
Aria Operations Suite API
  ↓
VMs / Hosts / Clusters / Alerts / Capacity

Companion Skills

Skill	Scope	Tools	Install
vmware-aiops ⭐ entry point	VM lifecycle, deployment, guest ops, clusters	60	`uv tool install vmware-aiops`
vmware-monitor	Read-only monitoring, alarms, events, VM info	32	`uv tool install vmware-monitor`
vmware-nsx	NSX networking: segments, gateways, NAT, IPAM	33	`uv tool install vmware-nsx-mgmt`
vmware-nsx-security	DFW microsegmentation, security groups, Traceflow	22	`uv tool install vmware-nsx-security`
vmware-avi	AVI / NSX ALB load balancing, AKO K8s operations	28	`uv tool install vmware-avi`
vmware-storage	Datastores, iSCSI, vSAN	12	`uv tool install vmware-storage`
vmware-vks	Tanzu Namespaces, TKC cluster lifecycle	23	`uv tool install vmware-vks`
vmware-harden	Compliance baselines, drift detection	8	`uv tool install vmware-harden`

Security

Passwords loaded from env vars or .env file, never from config.yaml
Every MCP tool call and every CLI command that reaches Aria audit-logged to ~/.vmware/audit.db (via vmware-policy); CLI write operations (alert acknowledge/cancel, alert notes, alert definition management, report generate/delete, resource maintenance start/end) also append to ~/.vmware-aria/audit.log
API responses sanitized (control chars stripped, 500-char limit) to prevent prompt injection
MCP destructive writes (alert acknowledge/cancel, alert definition and report delete, maintenance start/end) take confirm (default false): without confirm=true they return a blast_radius of what would change and change nothing; confirm=true is refused on a blocker (e.g. a resource already in maintenance) or an unreadable field. confirmed is a deprecated alias
TLS verification is on by default; for a private CA set SSL_CERT_FILE to a bundle with your CA (see setup guide). verify_ssl: false is for isolated self-signed labs only

Official Broadcom References

REST APIs: https://developer.broadcom.com/xapis — VCF Operations API (formerly Aria Operations suite-api)
SDKs: https://developer.broadcom.com/sdks — VCF Python SDK
CLI Tools: https://developer.broadcom.com/tools — PowerCLI 9.1 includes "VCF Operations (formerly vRealize Operations Manager)" cmdlets

License

MIT — see LICENSE

Development Status
- 4 - Beta
License
- OSI Approved :: MIT License
Programming Language
- Python :: 3
Topic
- System :: Monitoring

Metadata

Development Status
- 4 - Beta
License
- OSI Approved :: MIT License
Programming Language
- Python :: 3
Topic
- System :: Monitoring

Release files for vmware-aria 2.0.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for vmware-aria 2.0.0
File	Size	Uploaded
vmware_aria-2.0.0.tar.gz	582.7 kB	Oct 14, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for vmware-aria 2.0.0
File	Interpreter	ABI	Platform	Reset
vmware_aria-2.0.0-py3-none-any.whl 194.6 kB Oct 14, 2026	Python 3	none	any	Details

Total release size: 777.3 kB

Release files / vmware_aria-2.0.0.tar.gz

Download URL	vmware_aria-2.0.0.tar.gz
Size	582.7 kB
Tags	Source
SHA-256 checksum How to use checksums	`1e1a8491a2b9f1928d68d8f8475e9a2ddfa2c9b29e70f50dd5bda54c4858c9ab`
BLAKE2b-256 checksum How to use checksums	`4ea05924d952160704422a59ea0a5c02f0e4e244f7009f349a6ad07d8f913472`
Upload date	Oct 14, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.12`

Release files / vmware_aria-2.0.0-py3-none-any.whl

Download URL	vmware_aria-2.0.0-py3-none-any.whl
Size	194.6 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`633d301ae4f8b2ac2722200de616599f2479942870e274a55c53747e27e7e0f6`
BLAKE2b-256 checksum How to use checksums	`acd40b8e6614477dbf98aef7aea1095be9b1afbdd3557912970d7f82a2ad201b`
Upload date	Oct 14, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.12`