Purpose
VMware NSX is an NSX Policy API skill for NSX-T 3.0+ and NSX 4.x, used to manage VMware NSX networking through AI agents or the command line. The project was initiated by Wei Zhou, an engineer at VMware by Broadcom, and is a community-driven project, not an official VMware product. For official VMware developer tools, see developer.broadcom.com.
Main Capabilities
This skill provides a total of 33 MCP tools, of which 20 are read-only tools and 13 are write tools, organized by domain focus, covering the following network management objects:
- Segments
- Gateways, including Tier-0 and Tier-1
- NAT rules
- Routing (static routes and BGP)
- IPAM pools
The complete per-tool endpoint and method descriptions are located in skills/vmware-nsx/references/capabilities.md.
Usage
Installation and Startup
The project uses a modern PEP 517 build system (hatchling), so by design there is no setup.py; this is expected behavior, not a missing file. If, after cloning the source, you encounter "ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build", it means the pip version is lower than 21.3 and cannot perform an editable (-e) install for a non-setuptools backend. Editable mode is only a developer convenience feature and is not required to run the tools.
For fully offline/air-gapped hosts, you can first build a wheel on a networked machine and copy it over; the target host does not need network access.
Installation command: uv tool install vmware-nsx-mgmt
After installation (v1.5.15+), the MCP server can be started with a single command.
Agent Configuration
Add the corresponding configuration to the AI agent's MCP configuration. For more agent configuration templates (Claude Code, Cursor, Goose, Continue, etc.), see examples/mcp-configs/.
If you are behind a corporate TLS proxy, uvx may report "invalid peer certificate: UnknownIssuer". It is recommended to use the vmware-nsx mcp form recommended above (no network required), or set UV_NATIVE_TLS=true.
Common Workflows
Create an application network (segment + T1 gateway + NAT)
- Create a gateway: vmware-nsx gateway create-t1 app-t1 --edge-cluster edge-cluster-01 --tier0 tier0-gw
- Create a segment: vmware-nsx segment create app-web-seg --name app-web-seg --tz <tz-overlay-path> --subnet 10.10.1.1/24
- Add SNAT: vmware-nsx nat create app-t1 --action SNAT --source 10.10.1.0/24 --translated 172.16.0.10
- Verify: vmware-nsx segment list and vmware-nsx nat list app-t1
Before any write command, you can preview with --dry-run.
Check network health
- Manager status: vmware-nsx health manager-status
- Transport nodes: vmware-nsx health transport-nodes
- Edge clusters: vmware-nsx health edge-clusters
- Alarms: vmware-nsx health alarms --severity HIGH (exact-match filtering; query each severity level separately)
Troubleshoot virtual machine connectivity
- Find the segment where a virtual machine resides: vmware-nsx troubleshoot vm-segment <vm-display-name>
- Check port realization status: vmware-nsx troubleshoot port-status <segment-id> (all ports on this segment: attachment, realized bindings, transport nodes)
- Check routes: vmware-nsx gateway routes-t1 app-t1
- Check BGP: vmware-nsx gateway bgp-neighbors tier0-gw
Applicable Scenarios
- Automate management of NSX segments, gateways, NAT, routing, and IPAM via AI agents or the CLI
- Quickly check the health status of NSX Managers, transport nodes, edge clusters, and alarms
- Troubleshoot VM connectivity issues, locating segments, port realization status, routes, and BGP neighbors
- Deploy and use in air-gapped/offline environments
Limitations and Notes
- The project is community-driven and is not an official VMware product.
- Targets NSX-T 3.0+ and NSX 4.x, using a subset of the Policy API.
- Editable installation requires pip 21.3 or later.
- In enterprise TLS proxy environments, uvx may fail due to certificate issues; switch to a form that requires no network or set UV_NATIVE_TLS=true.
- Alarm severity filtering is an exact match, so queries must be made separately by severity.
- For more information on version compatibility, VCF compatibility, SDKs, REST APIs, and CLI tools, the materials only provide official links (sdks, xapis, tools under developer.broadcom.com) and do not provide specific compatibility matrix details.
- Security policy-related content is not covered in the materials.
