VMware NSX

VMware NSX

For a read-only check of this skill with your model and agent host, use the shared model-fit self-test in the marketplace root.

Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com

This is a community-driven project by a VMware engineer, not an official VMware product.

For official VMware developer tools see developer.broadcom.com.

English | 中文

VMware NSX networking management: segments, gateways, NAT, routing, IPAM — 33 MCP tools, domain-focused.

NSX Policy API skill for NSX-T 3.0+ and NSX 4.x.

Companion Skills

Quick Install

# Via PyPI

uv tool install vmware-nsx-mgmt

Or pip

pip install vmware-nsx-mgmt

Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is no `setup.py` by design — that is expected, not a missing file. If you cloned the source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and cannot do an *editable* (-e) install with a non-setuptools backend. Editable mode is a developer convenience, not needed to run the tool — do one of:

# From the source tree — a normal (non-editable) install builds a wheel:

pip install . # NOT pip install -e .

...or upgrade pip first, and editable works too:

pip install --upgrade pip && pip install -e .

For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:

# On a connected machine, collect this package + its dependencies as wheels:

pip wheel . -w dist # → dist/*.whl (or: uv build, for just this package)

Copy dist/ to the air-gapped host, then install offline:

pip install --no-index --find-links dist vmware-nsx-mgmt

Configuration

mkdir -p ~/.vmware-nsx

cp config.example.yaml ~/.vmware-nsx/config.yaml

Edit with your NSX Manager credentials

echo "VMWARE_NSX_NSX_PROD_PASSWORD=your_password" > ~/.vmware-nsx/.env chmod 600 ~/.vmware-nsx/.env

Verify

vmware-nsx doctor

What This Skill Does

Total: 33 tools (20 read-only + 13 write)

Common Workflows

Create an App Network (Segment + T1 Gateway + NAT)

1. Create gateway: vmware-nsx gateway create-t1 app-t1 --edge-cluster edge-cluster-01 --tier0 tier0-gw
2. Create segment: vmware-nsx segment create app-web-seg --name app-web-seg --tz --subnet 10.10.1.1/24
3. Add SNAT: vmware-nsx nat create app-t1 --action SNAT --source 10.10.1.0/24 --translated 172.16.0.10
4. Verify: vmware-nsx segment list and vmware-nsx nat list app-t1

Use --dry-run to preview any write command first.

Check Network Health

1. Manager status: vmware-nsx health manager-status
2. Transport nodes: vmware-nsx health transport-nodes
3. Edge clusters: vmware-nsx health edge-clusters
4. Alarms: vmware-nsx health alarms --severity HIGH (exact-match filter; query each severity separately)

Troubleshoot VM Connectivity

1. Find VM's segment: vmware-nsx troubleshoot vm-segment
2. Check port realized state: vmware-nsx troubleshoot port-status (all ports on the segment: attachment, realized bindings, transport nodes)
3. Check routes: vmware-nsx gateway routes-t1 app-t1
4. Check BGP: vmware-nsx gateway bgp-neighbors tier0-gw

MCP Tools (33 — 20 read, 13 write)

Full per-tool endpoints and methods: skills/vmware-nsx/references/capabilities.md.

CLI

# Segments

vmware-nsx segment list vmware-nsx segment get app-web-seg vmware-nsx segment create app-web-seg --name app-web-seg --tz --subnet 10.10.1.1/24 vmware-nsx segment delete app-web-seg

Gateways

vmware-nsx gateway list-t0 vmware-nsx gateway list-t1 vmware-nsx gateway create-t1 app-t1 --edge-cluster edge-cluster-01 --tier0 tier0-gw vmware-nsx gateway bgp-neighbors tier0-gw vmware-nsx gateway routes-t1 app-t1

NAT

vmware-nsx nat list app-t1 vmware-nsx nat create app-t1 --action SNAT --source 10.10.1.0/24 --translated 172.16.0.10 vmware-nsx nat delete-rule --tier1 app-t1 --rule-id rule-01

Static Routes

vmware-nsx route list app-t1 vmware-nsx route create app-t1 --network 192.168.100.0/24 --next-hop 10.10.1.254

IP Pools

vmware-nsx ippool list vmware-nsx ippool create tep-pool vmware-nsx ippool add-subnet tep-pool --start 192.168.100.10 --end 192.168.100.50 --cidr 192.168.100.0/24

Health & Troubleshooting

vmware-nsx health alarms --severity HIGH # exact match: LOW | MEDIUM | HIGH | CRITICAL vmware-nsx health transport-nodes vmware-nsx health manager-status vmware-nsx troubleshoot vm-segment my-vm-01 # VM display name vmware-nsx troubleshoot port-status app-web-seg # segment ID

Diagnostics

vmware-nsx doctor

MCP Server

After `uv tool install vmware-nsx-mgmt`, start the MCP server with one command (v1.5.15+):

# Recommended — single command, no network re-resolve

vmware-nsx mcp

Or via Docker

docker compose up -d

Agent Configuration

Add to your AI agent's MCP config:

{

"mcpServers": { "vmware-nsx": { "command": "vmware-nsx", "args": ["mcp"], "env": { "VMWARE_NSX_CONFIG": "~/.vmware-nsx/config.yaml" } } } }

Alternative: uvx (no install) or legacy entry point

# Run without installing (requires PyPI access each launch)

uvx --from vmware-nsx-mgmt vmware-nsx mcp

Legacy entry point (still works, kept for backward compatibility)

vmware-nsx-mcp

Behind a corporate TLS proxy? uvx may fail with invalid peer certificate: UnknownIssuer.

Use the recommended vmware-nsx mcp form above (no network needed), or set UV_NATIVE_TLS=true.

More agent config templates (Claude Code, Cursor, Goose, Continue, etc.) in examples/mcp-configs/.

Version Compatibility

VCF Compatibility

Official Broadcom References

• SDKs: https://developer.broadcom.com/sdks — VMware NSX for Python SDK (official; future migration target), VCF Python SDK
• REST APIs: https://developer.broadcom.com/xapis — NSX-T Data Center REST API (this skill uses the Policy API subset)
• CLI Tools: https://developer.broadcom.com/tools — VCF PowerCLI 9.1 (includes NSX cmdlets)

Safety