VMware Monitor
Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.
English | 中文
Read-only VMware vCenter/ESXi monitoring — 33 tools. No destructive operations exist in this codebase, and a test enforces that.
Why a separate repository? VMware Monitor is fully independent from VMware-AIops. No power off, delete, create, reconfigure, snapshot-create/revert/delete, clone, or migrate functions exist in this codebase — not a prompt constraint, an absence.
How that is enforced, precisely.
tests/eval/regression/test_read_only_enforcement.pyparses every source file withastand requires each vSphere method the package calls to appear on a reviewed allowlist, cross-checked against pyVmomi's own type metadata: anything returning avim.Task, or gated by vCenter on a non-read privilege, fails unless a human wrote down why. Today that allowlist is fourteen methods. The check is a gate on the code as written — it cannot see a method name assembled at runtime, and nothing runs it automatically, so it holds only as far as someone runs the test suite. For a guarantee that does not depend on this repository at all, point the skill at a dedicated account holding vCenter's built-in Read-Only role (which reads need more than that role).What "read-only" does not cover. It is a claim about vCenter/ESXi: no code path changes their state. On vCenter the skill opens only its own login session and short-lived query handles it releases. It does write locally:
~/.vmware-monitor/config.yamland.env(viainit; plaintext passwords in.envare rewritten asb64:on load), audit logs (~/.vmware/audit.dbfor MCP calls,~/.vmware-monitor/audit.logfor CLI commands),--htmlsnapshots in~/vmware-health/, and — only afterdaemon start—daemon.pid,scan.log, and posts to a webhook you configured. Full table: setup guide.





