# VMware NSX

Lets an agent read and change NSX segments, Tier-0 and Tier-1 gateways, NAT rules, routes and IP pools without opening NSX Manager in a browser.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 5
- Author: vmware-skills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/vmware-skills/VMware-NSX
- Updated: 2026-10-18
- HTML: https://affpapa.org/en/nevibecode/mcp/vmware-nsx

## What it does

The server talks to the NSX Policy API and targets NSX-T 3.0+ along with NSX 4.x. It ships 33 tools: segments, gateways and their BGP neighbors, NAT, static routes, IP pools, fabric inventory, alarms, and two lookups for tracing a VM to its segment and checking port state. Thirteen of the tools write; the other twenty only read.

You need NSX Manager credentials before anything runs. Put the config at `~/.vmware-nsx/config.yaml` and the password in `~/.vmware-nsx/.env` as `VMWARE_NSX_NSX_PROD_PASSWORD`. Then `vmware-nsx doctor` tells you whether the connection works. Every write command takes `--dry-run`, and skipping it is how a wrong subnet prefix or overlay zone path ends up on a live segment.

A VMware engineer maintains this, and the repo says plainly that it is not an official vendor product. Microsegmentation with DFW, security groups and Traceflow live in `vmware-nsx-security`; load balancing through AVI is in `vmware-avi`. The author points to `vmware-aiops` as the entry package for the wider family.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `VMWARE_NSX_CONFIG` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env VMWARE_NSX_CONFIG=<VMWARE_NSX_CONFIG> --transport stdio vmware-nsx -- uvx vmware-nsx-mgmt
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vmware-nsx-mgmt <command>

### Codex

**Platform CLI**
```bash
codex mcp add vmware-nsx --env VMWARE_NSX_CONFIG=<VMWARE_NSX_CONFIG> -- uvx vmware-nsx-mgmt
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vmware-nsx-mgmt <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "vmware-nsx": {
            "command": "uvx",
            "args": [
                "vmware-nsx-mgmt"
            ],
            "env": {
                "VMWARE_NSX_CONFIG": "<VMWARE_NSX_CONFIG>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vmware-nsx-mgmt <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "vmware-nsx": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "vmware-nsx-mgmt"
            ],
            "env": {
                "VMWARE_NSX_CONFIG": "<VMWARE_NSX_CONFIG>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vmware-nsx-mgmt <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e VMWARE_NSX_CONFIG=<VMWARE_NSX_CONFIG> vmware-nsx uvx vmware-nsx-mgmt
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vmware-nsx-mgmt <command>

## When to use it
- stand up a segment and Tier-1 gateway for a new app
- add an SNAT rule for a subnet and confirm it
- find which segment a VM sits on by its display name
- check port realization and transport node state on a segment
- pull high-severity alarms from NSX Manager

## Example prompts
- Create a segment called `app-web-seg` in the overlay zone and show me the result
- Check BGP neighbors on `tier0-gw` and the state of the edge clusters
- Which segment does VM `web-01` use, and are its ports realized?

## Similar
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33989
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81163
- [Oh My Posh Validator](https://affpapa.org/en/nevibecode/mcp/oh-my-posh-validator.md) — MCP server · ★ 23654
- [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18779
- [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17191
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md