VMware Policy

Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.

Unified audit logging, policy enforcement, and sanitization for the VMware MCP skill family.

  • Read-only gate for the whole family (v1.8.0) — this package implements apply_read_only_gate(); the skills only call it. One env var puts every installed VMware skill into read-only mode, structurally removing write tools from the MCP registry rather than asking the model nicely. See Read-Only Mode.

Install

pip install vmware-policy

Usage

from vmware_policy import vmware_tool

@vmware_tool(risk_level="high", sensitive_params=["password"])
def delete_segment(name: str, env: str = "") -> dict:
    ...

Read-Only Mode

This package implements the family's read-only gate; the skills only call it. A prompt instruction ("never modify anything") is advisory, and a weak model can ignore it. apply_read_only_gate() makes the guarantee structural: when the mode is on, every write tool is removed from the FastMCP registry before the server serves, so list_tools() never offers them. The model cannot call what it cannot see.

For operators

One variable puts every installed VMware skill into read-only mode:

{ "env": { "VMWARE_READ_ONLY": "true" } }

Resolution order: per-skill env (VMWARE_AIOPS_READ_ONLY, VMWARE_NSX_SECURITY_READ_ONLY, …) → family env VMWARE_READ_ONLY → the skill's own read_only: config flag → off. Off by default, so nothing changes until you switch it on; each server logs exactly which tools it withheld.

Fail-closed. A read-only mode that silently degrades to read-write is worse than none, because operators stop checking. Anything that cannot be proven aborts startup with ReadOnlyGateError:

  • the FastMCP tool registry cannot be enumerated (e.g. an incompatible mcp version);
  • a removal does not take effect — a write tool survives the sweep.

A switch value that cannot be parsed (VMWARE_READ_ONLY=ture) does not abort: it resolves to on, with a warning naming the accepted values. A typo must never leave write tools exposed.

How tools are classified

A tool is withheld unless it is provably read-only. Signals, in priority order:

  1. FORCE_WRITE membership;
  2. [WRITE] docstring prefix;
  3. readOnlyHint=False annotation;
  4. [READ] docstring prefix;
  5. readOnlyHint=True annotation;
  6. nothing conclusive → treated as a write tool.

The docstring marker outranks the MCP annotation because it has full coverage (244/244 family tools), while vmware-harden and vmware-debug register their tools through a build_server() factory that passes no annotations at all.

FORCE_WRITE overrides tools whose marker under-reports their real effect. All three current entries are the same shape — read-only against the managed infrastructure, but writing a file to a caller-supplied local path, with credentials involved:

Tool Skill Why
vm_guest_download vmware-aiops Reads from the guest OS, but writes an operator-supplied local_path and takes guest credentials.
get_supervisor_kubeconfig vmware-vks Materialises a session-token credential file at a model-supplied local path.
get_tkc_kubeconfig vmware-vks Same shape as above.

Tools that write only to a skill's own local store (vmware-harden's DuckDB twin, say) stay exposed — that store is a cache of observations, not managed infrastructure.

For skill authors

Call the gate once, after every tool module has registered and before the server runs:

from vmware_policy import apply_read_only_gate

WITHHELD_WRITE_TOOLS: list[str] = apply_read_only_gate(
    mcp, "vmware-aria", config_flag=_config_read_only()
)

apply_read_only_gate(mcp, skill, config_flag=None) -> list[str] returns the sorted names of the tools it removed (empty when the mode is off), so the caller can log what was withheld; it is idempotent. skill is the hyphenated skill name and is normalised to the per-skill env var (vmware-nsx-security → VMWARE_NSX_SECURITY_READ_ONLY). config_flag carries the skill's own read_only: setting and is consulted only when neither env var is set. To test the switch without touching a registry, use read_only_enabled(skill, config_flag=None) -> bool.

Read-only mode landed with two sibling harness pieces from the same report (VMware-AIops#31): the list envelope paginated() (envelope.py) and declared environments set_environment_resolver() (environment.py).

CLI

vmware-audit log --last 20
vmware-audit log --status denied --since 2026-03-28
vmware-audit stats --days 7

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.13.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for zw008 from gravatar.com zw008

Credits

Author: Wei Zhou

License expression

MIT
View SPDX License List

Requires

Python >=3.10

Provides Extra

dev

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

vmware_policy-1.8.1.tar.gz (132.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

vmware_policy-1.8.1-py3-none-any.whl (51.6 kB view details)

Uploaded Python 3

File details

Details for the file vmware_policy-1.8.1.tar.gz.

File metadata

  • Download URL: vmware_policy-1.8.1.tar.gz
  • Upload date:
  • Size: 132.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: uv/0.10.0 {"installer":{"name":"uv","version":"0.10.0","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"macOS","version":null,"id":null,"libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}

File hashes

Hashes for vmware_policy-1.8.1.tar.gz
Algorithm Hash digest
SHA256 bfeeda25023abc91e3a135a937875bbbe75e0008dad22a45959ee0cd557de40c
MD5 7c27db6a5c1f17919a996d694d467a73
BLAKE2b-256 bc65a55ae13f0f44553e252ccd3a6a5c2ca45441bbbd009b429f22d89d0d1cf9

See more details on using hashes here.

File details

Details for the file vmware_policy-1.8.1-py3-none-any.whl.

File metadata

  • Download URL: vmware_policy-1.8.1-py3-none-any.whl
  • Upload date:
  • Size: 51.6 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: uv/0.10.0 {"installer":{"name":"uv","version":"0.10.0","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"macOS","version":null,"id":null,"libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}

File hashes

Hashes for vmware_policy-1.8.1-py3-none-any.whl
Algorithm Hash digest
SHA256 d71f26b2a48f24f1b9944c6d936357abd9d9b15afa74d98bfb560cab40df2958
MD5 ab5f2191918a494b4ad8d9ab4b5cb354
BLAKE2b-256 bcfd078ff064de5dc6adbfa1589b929a5d144aabf72b036796cf416f4787e784

See more details on using hashes here.

Release history Release notifications | RSS feed

1.13.0

2 files

1.12.1

2 files

1.12.0

2 files

1.11.0

2 files

1.10.0

2 files

1.9.0

2 files

1.8.9

2 files

1.8.8

2 files

1.8.7

2 files

1.8.5

2 files

1.8.4

2 files

1.8.3

2 files

1.8.2

2 files

This release

1.8.1 This release

2 files

1.8.0

2 files

1.6.1

2 files

1.6.0

2 files

1.5.37

2 files

1.5.36

2 files

1.5.35

2 files

1.5.22

2 files

1.5.21

2 files

1.5.19

2 files

1.5.18

1 file

1.5.17

2 files

1.5.16

2 files

1.5.14

2 files

1.5.13

2 files

1.5.12

2 files

1.5.11

2 files

1.5.10

2 files

1.5.8

2 files

1.5.7

2 files

1.5.6

2 files

1.5.5

2 files

1.5.4

2 files

1.5.0

2 files

1.4.5

2 files

1.4.4

2 files

1.4.3

2 files

1.4.1

2 files

1.4.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page