This is a community-maintained open-source project and is not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc. "VMware", "NSX", and "AVI" are trademarks of Broadcom Inc.

Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com

If you discover a security vulnerability, please report it privately:

• Email: wei-wz.zhou@broadcom.com
• GitHub: Open a private security advisory

Do not open a public GitHub issue for security vulnerabilities.

• AVI Controller passwords are stored exclusively in ~/.vmware-avi/.env (never in config.yaml, never in code)
• .env file permissions are verified at startup (chmod 600 required)
• No credentials are logged, echoed, or included in audit entries
• Each controller uses a separate environment variable following the pattern: <CONTROLLER_NAME_UPPER>_PASSWORD
• AKO operations require a valid kubeconfig — the file is read-only and never modified by this skill

This skill operates in two modes with separate authentication:

1. AVI Controller mode — authenticates via avisdk to AVI/NSX ALB controllers using username/password from .env
2. AKO Kubernetes mode — authenticates via kubectl using the user's existing kubeconfig; no additional credentials required

All write operations pass through multiple safety layers:

1. @vmware_tool decorator — mandatory on every MCP tool; provides pre-checks, audit logging, data sanitization, and timeout control
2. Double confirmation — CLI destructive commands (vs disable, pool disable, ako restart, ako config upgrade, ako sync force) require two separate "Are you sure?" prompts
3. --dry-run default — the CLI ako config upgrade defaults to --dry-run mode; the caller must explicitly opt out to execute
4. MCP blast-radius gate — the matching MCP tools (vs_toggle, pool_member_disable, ako_restart, ako_sync_force, ako_config_upgrade) take confirm (default false). A call without confirm=true returns the measured blast_radius and changes nothing; confirm=true is refused when a blocker is found (the pool's only enabled member, a terminating AKO pod, a failing helm upgrade --dry-run, a release mid-operation) or anything the measurement depends on could not be read. The AKO pod delete is pinned to the measured pod's uid
5. Audit logging — every operation (read and write) is logged to ~/.vmware/audit.db (SQLite WAL) with timestamp, user, target, operation, parameters, and result
6. Policy engine — ~/.vmware/rules.yaml can deny operations by pattern, enforce maintenance windows, and set risk-level thresholds

• TLS certificate verification is enabled by default for both AVI Controller and Kubernetes API connections
• disableSslCertValidation: true exists solely for AVI Controllers using self-signed certificates in isolated lab/home environments
• In production, always use CA-signed certificates with full TLS verification

• vmware-policy is the only transitive dependency auto-installed; it provides the @vmware_tool decorator and audit logging
• All other dependencies are standard Python packages (avisdk, Click, Rich, python-dotenv, kubernetes)
• No post-install scripts or background services are started during installation
• PyPI package name: vmware-avi

• All AVI-sourced content (virtual service names, pool member addresses, AKO status messages) is processed through _sanitize()
• Sanitization truncates to 500 characters and strips C0/C1 control characters
• Output is wrapped in boundary markers when consumed by LLM agents

helm get values, helm diff upgrade --reuse-values and helm upgrade all render the AKO release's own values — including avicredentials.password and the avi-secret Secret it templates. In MCP mode what an ops function prints is the tool result, so every one of those outputs is redacted before it is displayed, not only before it is stored: declaring a tool sensitive_result keeps the credential out of ~/.vmware/audit.db and does nothing about the copy in the agent's context.

Redaction is structural where the output is a YAML document (redact_yaml, parsed and re-emitted) and line-oriented where it is not — a helm diff will not parse, and withholding it entirely would cost the operator the diff they came to read. Command stderr is redacted on the same terms: a tool that fails rendering a template prints the values it was handed.

This project is scanned with Bandit before every release, targeting 0 Medium+ issues:

uvx bandit -r vmware_avi/