This is a community-maintained open-source project and is not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc. "VMware" and "vSphere" are trademarks of Broadcom. Source code is publicly auditable at github.com/vmware-skills/VMware-Debug under the MIT license.
Report security issues via a GitHub private security advisory on the repository, or by email to the maintainer. Please do not open public issues for security bugs.
vmware-debug has no network access and no credentials. It does not connect to
vCenter, NSX, Aria, or any appliance. Its tools work over event data the
orchestrating agent has already fetched with the other skills' read tools. Seven
of its fourteen MCP tools write — only to the local investigation ledger under
$OPS_HOME (default ~/.vmware/cases). Evidence, gaps, hypotheses and grade
history are only ever added to; timeline.md is regenerated from the evidence
and case.json holds the current grade and state. That holds with several writers
too: every write to a case takes that case's lock file (.ledger.lock, created
exclusively), so two processes working one case in a shared $OPS_HOME are
serialised rather than losing each other's entries, and every file is written to
a temporary name and moved into place, so a reader never sees half of one (on a
filesystem without hard links, a new evidence file is created in place instead:
still never overwritten, but readable half-written). A lock left by a crashed
process is reported with its holder and never removed automatically; delete it
once nothing is writing the case. Released versions up to and including 1.11.3
do not take the lock, so upgrade every machine that shares a cases folder. There
is no destructive surface against any VMware system and no secret to leak.
debug only diagnoses and recommends. Any fix is routed to vmware-aiops (single op, with its own confirmation) or vmware-pilot (multi-step, approval-gated, audited). The safety gates live in those skills, not here.
debug imports none of the other skill packages at runtime. Events arrive as plain dicts (the unified event envelope), so there is no transitive dependency surface.
debug operates on text the agent supplies. Its outputs are structured data (timelines, hypotheses, routing strings); it does not execute or shell out to anything based on event content.
uvx bandit -r vmware_debug/Release bar: 0 Medium-or-higher severity findings.
The latest released version receives fixes. Versions are kept aligned across the VMware skill family.