VMware Inspection

Use this skill for inventory and configuration inspection only. Keep credentials in runtime input or an approved secret store; never write passwords, tokens, or connection records into the skill, source tree, reports, or command history.

Workflow

Confirm the target vCenter address, account, requested inspection categories, output format, and whether self-signed TLS is expected.
Explain that the account must have the standard vCenter Read-only role (or equivalent read privileges) propagated from the vCenter root to the inventory objects that must be inspected.
Check that the runtime has pyVmomi/pyVim, openpyxl, and cryptography. These are runtime dependencies of the bundled collector and are not bundled into the skill.
Run scripts/inspect_vcenter.py for a portable read-only collection. Use --password-stdin or an interactive prompt; never put the password in a command argument, source file, report, JSON output, or shell history. Add --output <path>.xlsx when a report is requested.
Load references/inspection-contract.md when interpreting fields, permission boundaries, or known data-quality limitations.
Report counts, collection errors, incomplete categories, and environmental prerequisites separately. Do not call a run successful merely because the connection succeeded.

Typical invocation:

python scripts/inspect_vcenter.py --host <VC_ADDRESS> --user <VC_USER> --password-stdin --insecure --categories all --output <REPORT>.xlsx

Use --insecure only when the vCenter uses a self-signed or otherwise untrusted certificate. Keep the password in the process stdin or an approved secret store.

Supported Categories

hosts: ESXi identity, status, hardware, current quick statistics, VMkernel addresses, certificate expiry observed over HTTPS, SSH service running state, and time configuration.
vms: VM placement, power state, guest information, Tools state, CPU/memory configuration, disks, datastores, port groups, NSX heuristic, and committed space.
Credential-like lines in VM annotations are redacted before JSON and XLSX output.
storage: datastore capacity, accessibility, type, filesystem, SSD hint, status, device identity, and URL.
local-disks: ESXi SCSI LUNs classified as local using transport and device-name heuristics, with VMFS usage when mapped and VSAN ownership, vSAN disk-group ID, cache/capacity role, and group member count when matched to config.vsanHostConfig.storageInfo.diskMapping. The derived vsan-disk-groups result is included whenever local disks are collected.
iscsi: host IQN, configured dynamic targets, and configured static targets. Multiple target addresses are preserved as separate wrapped lines in XLSX.
portgroups: distributed port groups, VLAN interpretation, datacenter, switch, and NSX heuristic.
nics: ESXi physical NICs, MAC address, actual/configured speed, and switch association. The collector always writes the inspection result as UTF-8 JSON to stdout. With --output, it also writes a standalone XLSX workbook with these fixed sheets:

ESXi主机巡检
虚拟机巡检
存储巡检
本地硬盘巡检
VSAN磁盘组
iSCSI巡检
端口组巡检
ESXi网卡巡检

The workbook contract is fixed: preserve Unicode strings directly; center and wrap populated cells; apply thin borders to the table; freeze the first row at A2; enable an auto-filter; use a blue/white header; use a white, non-banded body with no alternating blue/white rows; and keep column widths/row heights readable. Convert capacities strictly when the value is greater than 1024 GB, displaying TB; keep multiple IPs, target addresses, VM disks, port groups, and vSAN capacity-disk members as wrapped lines in one cell.

Apply red cell highlighting for host CPU or memory usage greater than 80%, VM CPU or memory hot-add value 否, and datastore free rate below 20%. The ESXi host sheet must include SSH是否启用 and 时间配置. For NTP, format the time value as NTP followed by each configured server on its own line; only actual configured NTP servers qualify as NTP. For PTP, only actual PTP port configuration qualifies as PTP; format it as PTP followed by the configured PTP port address/device when exposed, or 未提供服务器地址 when no such endpoint is available. If no synchronization service configuration is exposed, use 未设置时间; use 手动 only when the API explicitly reports synchronization disabled/manual. The local-disk sheet must show vSAN磁盘组, 磁盘角色, and 组内磁盘数; the VSAN磁盘组 sheet must show one row per traditional disk group with host, group ID, cache disk, capacity-disk count, wrapped capacity-disk list, and total capacity. Do not merge data cells, because filtering and sorting must continue to work.

Do not write SQLite snapshots.

Read-only Guardrails

Do not use this skill to perform VM power operations, reconfiguration, migration, cloning, disk/NIC changes, iSCSI mounting or rescanning, ESXi service changes, NTP changes, password changes, certificate renewal, or VMware service restarts. Those operations belong to separate administrative workflows and require write privileges.

The ESXi certificate check is a direct TLS connection to each host's management address on TCP/443; it is not authorized by the vCenter account. VCSA/VECS certificate inspection and vCert operations require separate VCSA OS/root and, for some operations, SSO credentials; they are outside this skill.

For vSAN, derive group membership only from the object relationship in config.vsanHostConfig.storageInfo.diskMapping: ssd is the cache disk and nonSsd[] are capacity disks. Do not infer membership from disk names or media type. An empty diskMapping is not a traditional OSA disk group and may represent vSAN ESA; report that boundary instead of inventing DG01/DG02 membership.

Failure Handling

Treat an empty category as an observable result, not proof that no objects exist. Distinguish no visible objects, inaccessible objects, connection errors, direct ESXi network failures, missing VMware Tools data, and parser errors. Preserve per-category errors in the result summary.

For a validation run, record the vCenter address, timestamp, category counts, and error types, but redact usernames/passwords and avoid collecting unnecessary inventory names in the final response.

Treat direct ESXi certificate failures separately from vCenter API failures. The certificate check additionally requires TCP/443 access from the collector machine to every ESXi management address.

Resources

Read references/inspection-contract.md for field mappings, scope, and limitations.
Run scripts/inspect_vcenter.py for a deterministic read-only check and optional XLSX export.