What makes vmware-nsx notable?

4.9K downloads. Trust evidence available

How should vmware-nsx be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

vmware-nsx

Use this skill when the user needs to inspect or manage VMware NSX networking through NSX Manager — segments, Tier-0/Tier-1 gateways, NAT, static routes/BGP, and IP pools. Directly handles: list and inspect segments, gateways, NAT rules, routes and IP pools; check transport node, edge cluster and manager health; find a VM's segment. Changes (create/update/delete segments, Tier-1 gateways, NAT rules, static routes, IP pools, Tier-0 BGP) only when the user explicitly asks for that change. Use this skill for "create segment", "set up gateway", "create NAT rule", "check network health", "troubleshoot connectivity" when the context is explicitly NSX, NSX-T, or NSX Manager. Do NOT use for networking outside NSX, DFW firewall rules or security groups (use vmware-nsx-security), vSphere distributed port groups or host VMkernel adapters (use vmware-aiops), VM lifecycle (use vmware-aiops), or AVI/ALB load balancing (use vmware-avi). For multi-step workflows use vmware-pilot.

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

4.9k

Updated

Oct 9, 2026

Version

1.11.0

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 4.9K downloads reported by the source. Last updated 10/9/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 9, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 9, 2026
Adoption signal: 4.9K downloadsadoption · observed Oct 9, 2026
Latest release: 1.11.0release · observed Sep 20, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s171xgnmqse0nqvgqvqnaq5f9183kyre:vmware-nsx

Install using `clawhub skill install s171xgnmqse0nqvgqvqnaq5f9183kyre:vmware-nsx` in an isolated environment before connecting it to live workloads.
No published capability contract is available yet, so validate auth and request/response behavior manually.
Review the upstream CLAWHUB listing at https://clawhub.ai/zw008/vmware-nsx before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-zw008-vmware-nsx/snapshot"

Documentation

CLAWHUB

152,596 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: vmware-nsx
description: >
  Use this skill when the user needs to inspect or manage VMware NSX networking through NSX Manager — segments, Tier-0/Tier-1 gateways, NAT, static routes/BGP, and IP pools.
  Directly handles: list and inspect segments, gateways, NAT rules, routes and IP pools; check transport node, edge cluster and manager health; find a VM's segment. Changes (create/update/delete segments, Tier-1 gateways, NAT rules, static routes, IP pools, Tier-0 BGP) only when the user explicitly asks for that change.
  Use this skill for "create segment", "set up gateway", "create NAT rule", "check network health", "troubleshoot connectivity" when the context is explicitly NSX, NSX-T, or NSX Manager.
  Do NOT use for networking outside NSX, DFW firewall rules or security groups (use vmware-nsx-security), vSphere distributed port groups or host VMkernel adapters (use vmware-aiops), VM lifecycle (use vmware-aiops), or AVI/ALB load balancing (use vmware-avi).
  For multi-step workflows use vmware-pilot.
installer:
  kind: uv
  package: vmware-nsx-mgmt
allowed-tools:
  - Bash
metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx","uvx"]},"optional":{"env":["VMWARE_NSX_CONFIG","VMWARE_NSX_<TARGET>_PASSWORD","VMWARE_NSX_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX","emoji":"🌐","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx/.env following the pattern VMWARE_NSX_<TARGET_NAME_UPPER>_PASSWORD. Username/password session auth only (client-certificate auth is not implemented). Passwords are never logged or echoed.
  Write operations: CLI write commands require double confirmation and support --dry-run. The five MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains (attached ports, Tier-1 dependents, allocated IPs) or a read failed. Other MCP write tools execute when called and are audit-logged, so the agent must call them only on the user's explicit request; ~/.vmware/rules.yaml deny rules can block them per environment.
  VMWARE_AUDIT_APPROVED_BY is an optional attestation recorded in the audit row; it is not a gate and does not carry credentials.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).
  SSL bypass: verify_ssl is on by default; trust a private CA via the SSL_CERT_FILE env var; verify_ssl false only for isolated labs with self-signed certs.
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.
---

# VMware NSX

> **Disclaimer**: This is a community-maintained open-source project and is

_meta.json

{
  "ownerId": "kn7b067awq2s97bn3d7p5qfhw5827pxc",
  "slug": "vmware-nsx",
  "version": "1.11.0",
  "publishedAt": 1789915924988
}

references/agent-guardrails.md

# Operating vmware-nsx with a local / small model

Claude-class models drive this skill without special instruction. Smaller and
locally-hosted models — Llama 3.3 70B, Qwen, Mistral, and similar, served
through Goose, Ollama, or OpenShift AI — need explicit operating rules to call
tools reliably.

This page exists because an operator wrote those rules by hand first. The
guardrails below are adapted, with thanks, from the working configuration
[@juanpf-ha](https://github.com/juanpf-ha) developed while running
vmware-monitor and vmware-aria against a production vSphere estate with Llama
3.3 70B FP8 on an on-prem H100
([VMware-AIops#31](https://github.com/vmware-skills/VMware-AIops/issues/31)). The
cross-skill rules are identical across this family; the parts below marked
vmware-nsx are specific to this skill.

vmware-nsx exposes 33 MCP tools, 13 of which change state. Network writes fail
differently from other writes: deleting a segment or reconfiguring a Tier-0's
BGP does not error, it disconnects things — often something other than the
object the model was looking at.

> **Disclaimer**: This is a community-maintained open-source project and is
> **not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom
> Inc.** "VMware" and "vSphere" are trademarks of Broadcom.

---

## First: the rules you no longer need to write

Several guardrails from the original configuration are now enforced by the
skill itself. Prompt instructions are advisory — a model can ignore them.
These are structural, so it cannot.

| Guardrail you would otherwise prompt for | Now enforced by |
|---|---|
| "Warn me if a segment still has workloads on it before deleting" | **`delete_segment` checks the ports first** and refuses, deleting nothing, while any is attached (it names them). The check runs server-side, not in the prompt. |
| "Show me what a delete would remove before it happens" | **The five delete tools preview by default.** Without `confirm=True` they return `blast_radius` and delete nothing; `confirm=True` is refused while a blocker remains or a read failed. |
| "Use explicit limits for queries that may return large amounts of data" | **The list envelope.** Every list-returning tool returns `{items, returned, limit, total, truncated, hint}`, so the model reads truncation instead of guessing at it. `truncated: true` means `items` is not the whole collection; `next_offset` (null on the last page) is what a paging loop stops on, and the `hint` says which of the two you are looking at. |
| "If a listing came back empty, say so rather than claiming the call failed" | Same envelope. Empty `items` with `truncated: false` means the query genuinely matched nothing — a stated result, not a silence the model has to interpret. |
| "Log every state change you make" | **The `@vmware_tool` decorator.** Every write is recorded to `~/.vmware/audit.db` before the model sees the result, and policy rules are evaluated ahead of execution. |
| "Block state-changing writes

references/capabilities.md

# Capabilities

Detailed capability reference for `vmware-nsx`.

## Automation Level Reference

Each operation is classified by autonomy level per the Enterprise Harness Engineering framework:

| Level | Meaning | Agent autonomy | Examples in this skill |
|:-:|---|---|---|
| **L1** | Read-only, raw data | Always auto-run | `list_segments`, `get_segment`, `list_tier0_gateways`, `list_tier1_gateways`, `list_nat_rules`, `list_ip_pools`, `list_static_routes`, alarms/health queries |
| **L2** | Read + analysis / recommendation | Always auto-run | `get_bgp_neighbors`, `get_segment_port_for_vm`, `get_ip_pool_usage`, `get_logical_port_status` — correlation and utilization summaries over raw data |
| **L3** | Single write — user must approve | Only when the user explicitly asked for that change; CLI adds double-confirm + optional `--dry-run`; the five MCP deletes preview by default and act only with `confirm=True`; segment delete refuses while ports are attached; Tier-1 delete refuses while anything still depends on the gateway; IP pool delete refuses while addresses are allocated | `create_segment`, `delete_segment`, `create_nat_rule`, `update_tier1_gateway`, `create_ip_pool`, `configure_tier0_bgp`, static route mutations |
| **L4** | Multi-step plan / apply workflow | Plan generation auto; apply gated by user approval | *(roadmap — multi-segment rollout plans, gateway HA failover sequences)* |
| **L5** | Auto-remediation from learned pattern | Pattern library only; requires `risk:low` + `reversible:true` + `repeatable:true` | *(roadmap — candidates: stale segment cleanup, transport-node refresh)* |

**Notes**:
- L1/L2 tools are always safe for agents to call without confirmation.
- L3 tools always pass through the `@vmware_tool` decorator: policy check (`~/.vmware/rules.yaml` deny rules, per environment) → execute → audit log. The CLI's double-confirm and `--dry-run` do not apply to MCP calls.
- **MCP deletes preview by default** (`delete_segment`, `delete_tier1_gateway`, `delete_nat_rule`, `delete_static_route`, `delete_ip_pool`). A call without `confirm=True` reads what the delete would remove and returns `{"action": "preview", "blast_radius": {...}}`, deleting nothing. `blast_radius` names the object and what it measured — a segment's gateway, subnets, `port_count`/`port_ids`; a Tier-1's `tier0_path`, the `default` locale-service and edge cluster it removes, and its `dependents` by kind; a NAT rule's gateway, action, match and translation; a route's gateway, network and next hops; a pool's `pool_usage`, `allocation_count` (Policy ip-allocations), `realized_allocation_count` (NSX's `pool_usage.allocated_ip_allocations`, which also counts addresses Policy does not list, e.g. TEP pools) and `allocated_ips` — plus `blockers` and `unmeasured`. `confirm=True` re-measures and is refused, deleting nothing, while a blocker remains (attached ports, any Tier-1 dependent, allocated IPs) or while any of those reads failed (`unmeasured` non-empty); the refusal is

references/cli-reference.md

# CLI Reference

Complete command reference for the `vmware-nsx` CLI. Command groups:
`inventory`, `networking`, `health`, `troubleshoot` (read-only) and
`segment`, `gateway`, `nat`, `route`, `ip-pool` (write), plus `doctor`,
`mcp`, and `mcp-config`.

## Global Options

All commands accept these options:

| Option | Description |
|--------|-------------|
| `--target`, `-t <name>` | Target name from `~/.vmware-nsx/config.yaml` (defaults to the configured default target) |
| `--config`, `-c <path>` | Override config file path |
| `--help` | Show command help |

Write commands additionally accept:

| Option | Description |
|--------|-------------|
| `--dry-run` | Print the API call that would be made without executing it |

**Error handling**: operational failures (connection refused, HTTP 4xx/5xx
from NSX Manager, missing config) print a single red `Error: ...` line with
a remediation hint and exit with code 1 — no Python traceback.

---

## Inventory Commands (read-only)

### `inventory list-segments`

List all network segments with type, subnet, admin state, and port count.

```bash
vmware-nsx inventory list-segments
vmware-nsx inventory list-segments --target nsx-prod
```

### `inventory get-segment`

Get detailed info for a specific segment.

```bash
vmware-nsx inventory get-segment app-web-seg
```

| Argument | Required | Description |
|----------|:--------:|-------------|
| `segment_id` | Yes | Segment ID (Policy API ID, not display name) |

### `inventory list-tier0s`

List all Tier-0 gateways with HA mode and transit subnets.

```bash
vmware-nsx inventory list-tier0s
```

### `inventory get-tier0`

Get detailed info for a Tier-0 gateway.

```bash
vmware-nsx inventory get-tier0 tier0-gw
```

### `inventory list-tier1s`

List all Tier-1 gateways with linked Tier-0 path and route advertisement.

```bash
vmware-nsx inventory list-tier1s
```

### `inventory get-tier1`

Get detailed info for a Tier-1 gateway.

```bash
vmware-nsx inventory get-tier1 app-t1
```

### `inventory list-transport-zones`

List all transport zones with type (OVERLAY / VLAN).

```bash
vmware-nsx inventory list-transport-zones
```

### `inventory list-transport-nodes`

List all transport nodes with node type and status.

```bash
vmware-nsx inventory list-transport-nodes
```

### `inventory list-edge-clusters`

List all edge clusters with member count and deployment type.

```bash
vmware-nsx inventory list-edge-clusters
```

---

## Networking Commands (read-only)

### `networking list-nat-rules`

List NAT rules on a Tier-1 gateway.

```bash
vmware-nsx networking list-nat-rules app-t1
```

| Argument | Required | Description |
|----------|:--------:|-------------|
| `tier1_id` | Yes | Tier-1 gateway ID |

### `networking bgp-neighbors`

Show BGP neighbors for a Tier-0 gateway, including realized session state,
remote ASN, hold/keep-alive timers, and prefix counts.

```bash
vmware-nsx networking bgp-neighbors tier0-gw
```

| Argument | Required | Description |
|----------|:--

Github ReposUpdated 6h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.