Nutanix AIops MCP server

<!-- mcp-name: io.github.AIops-tools/nutanix-aiops -->

Nutanix AIops

Disclaimer: Community-maintained open-source project. Not affiliated with, endorsed by, or sponsored by Nutanix. Product and trademark names belong to their owners. MIT licensed.

Governed AI-ops for Nutanix Prism Central (v4 REST API) — clusters, hosts, VMs (AHV + ESXi), storage, network, catalog, data protection / DR, alerts, LCM upgrades, and capacity — with a built-in governance harness: unified audit log, token/runaway budget guard, undo-token recording, and descriptive risk-tier labels. Connects to Prism Central on HTTPS :9440 with HTTP Basic auth (username + encrypted password). Self-contained: no dependencies beyond httpx and the MCP SDK.

Why this over a read-only Nutanix MCP

or delete without the entity's current ETag — the classic footgun. This tool fetches and sends If-Match for you.

• Automatic ETag / If-Match on every mutation. The v4 API rejects an update

{"": [...], "returned", "limit", "truncated"} envelope so a capped read announces itself instead of looking like the whole estate.

• Automatic pagination — list tools walk every v4 page for you, and return a

null, never as "". v4 omits a lot of fields; the two facts stay distinct.

• Absent is not empty — a field Prism Central did not return comes back as

guests under the same Prism Central (built for hypervisor-migration estates).

• Mixed-hypervisor VM listing — vmlist returns both AHV and ESXi**

labels / undo-token / prompt-injection sanitize, with dry-run + double-confirm on destructive writes.

• Governance harness — audit / token+call budget / descriptive risk-tier

What this tool does, and does not, decide

It delivers Nutanix Prism Central operations — reads and writes — accurately and efficiently, and records every one of them. It does not decide whether a write is allowed to happen. That is the agent's judgement, or the permission of the account you connect it with: connect with a Prism Central account holding only a read-only (Viewer) role, and the writes fail at the server — the place that actually owns the permission.

So there is no read-only switch, no policy file, no approval gate to configure. The one thing the tool guarantees is that nothing is silent: every call, over MCP and over the CLI alike, lands an audit row in ~/.nutanix-aiops/audit.db, and destructive writes still capture their before-state and record an inverse where one exists.

Each tool declares a risk_level, carried into the audit row as a descriptive

tier (none/confirm/review) — so a reviewer can see at a glance that a row was a

high-risk delete. It is a label, not a gate.

Running a smaller / local model? See agent-guardrails.md — it lists the guardrails this tool now enforces for you (so you don't spend prompt budget restating them) and gives a ready-made system prompt for what's left.

Capability matrix (51 MCP tools)

Shortened. The full README is on GitHub.