VMware NSX Security

May 19, 2026 · View on GitHub

Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.

VMware NSX DFW microsegmentation and security MCP skill — 20 tools for distributed firewall policies/rules, security groups, VM tags, Traceflow packet tracing, and IDPS.

Companion skills: vmware-nsx (networking), vmware-aiops (VM lifecycle), vmware-monitor (monitoring)

Quick Start

uv tool install vmware-nsx-security

mkdir -p ~/.vmware-nsx-security
cp config.example.yaml ~/.vmware-nsx-security/config.yaml
# Edit config.yaml with your NSX Manager host

echo "VMWARE_NSX_SECURITY_NSX_PROD_PASSWORD=your_password" > ~/.vmware-nsx-security/.env
chmod 600 ~/.vmware-nsx-security/.env

vmware-nsx-security doctor

What It Does

CategoryTools
DFW Policylist, get, create, update, delete, list rules
DFW Rulescreate, update, delete, stats
Security Groupslist, get, create, delete
VM Tagslist tags, apply tag
Traceflowrun trace, get result
IDPSlist profiles, engine status

Total: 20 MCP tools (10 read-only + 10 write)

MCP Server Setup

After uv tool install vmware-nsx-security, start the MCP server with one command (v1.5.15+):

# Recommended — single command, no network re-resolve
vmware-nsx-security mcp

# With a custom config path
VMWARE_NSX_SECURITY_CONFIG=/path/to/config.yaml vmware-nsx-security mcp

Add to ~/.claude.json:

{
  "mcpServers": {
    "vmware-nsx-security": {
      "command": "vmware-nsx-security",
      "args": ["mcp"],
      "env": {
        "VMWARE_NSX_SECURITY_CONFIG": "~/.vmware-nsx-security/config.yaml"
      }
    }
  }
}
Alternative: uvx (no install) or legacy entry point 
# Run without installing (requires PyPI access each launch)
uvx --from vmware-nsx-security vmware-nsx-security mcp

# Legacy entry point (still works, kept for backward compatibility)
vmware-nsx-security-mcp

Behind a corporate TLS proxy? uvx may fail with invalid peer certificate: UnknownIssuer. Use the recommended vmware-nsx-security mcp form above (no network needed), or set UV_NATIVE_TLS=true.

Common Workflows

Microsegment an Application

# 1. Create groups by tag
vmware-nsx-security group create web-vms --name "Web VMs" --tag-scope tier --tag-value web
vmware-nsx-security group create app-vms --name "App VMs" --tag-scope tier --tag-value app

# 2. Create DFW policy
vmware-nsx-security policy create web-app-policy --name "Web to App" --category Application

Tag a VM

# Find VM and its external ID
vmware-nsx-security tag list my-vm-01

# Apply tag using the external ID
vmware-nsx-security tag apply <external-id> --scope tier --value web

Trace a Packet

vmware-nsx-security traceflow run <src-lport-id> \
  --src-ip 10.0.1.5 --dst-ip 10.0.2.10 --proto TCP --dst-port 443

Safety

  • Dependency checks: Cannot delete a policy with active rules, or a group referenced by DFW rules
  • Audit logging: All write ops logged to ~/.vmware-nsx-security/audit.log
  • Input validation: IDs validated; all API text sanitized against prompt injection
  • Dry-run mode: All CLI write commands support --dry-run
  • Credential safety: Passwords only from env vars, never in config files

Companion Skills

SkillScopeToolsInstall
vmware-aiops ⭐ entry pointVM lifecycle, deployment, guest ops, clusters31uv tool install vmware-aiops
vmware-monitorRead-only monitoring, alarms, events, VM info8uv tool install vmware-monitor
vmware-nsxNSX networking: segments, gateways, NAT, IPAM31uv tool install vmware-nsx-mgmt
vmware-storageDatastores, iSCSI, vSAN11uv tool install vmware-storage
vmware-vksTanzu Namespaces, TKC cluster lifecycle20uv tool install vmware-vks
vmware-ariaAria Ops metrics, alerts, capacity planning18uv tool install vmware-aria

Version Compatibility

NSX VersionSupportNotes
NSX 9.1 / VCF 9.1✅ FullDFW + Security Group + Traceflow + IDS/IPS via Policy API. VDS 7.0+ required (N-VDS removed in NSX 9).
NSX 9.0 / VCF 9.0✅ FullSame as 9.1. Bare-metal NSX agent removed.
NSX 4.x / VCF 5.x✅ FullAll features supported.
NSX-T 3.2 / VCF 4.5✅ FullPolicy API stable.

Official Broadcom References

License

MIT