VMware VDI (Horizon) MCP server

<!-- mcp-name: io.github.vmware-skills/vmware-vdi -->

VMware VDI (Horizon)

AI-powered intelligent operations for VMware / Omnissa Horizon VDI — manage desktop pools, RDS farms, published apps, user sessions, desktop machines, entitlements, instant-clone images, and Horizon events/health/statistics through the Horizon 8 Connection Server REST API. Ships as both an MCP server (for AI agents) and a CLI (for help-desk and scripting). Part of the VMware skill family.

Disclaimer: Community-maintained open-source project, **not affiliated with, endorsed by, or

sponsored by VMware, Inc., Broadcom Inc., or Omnissa, LLC.** "VMware", "Horizon", and "Omnissa" are

trademarks of their respective owners. Source is publicly auditable under the MIT license.

Status: v1.0.0 (beta). REST endpoints are verified against the official Horizon Server API;

GET-response field projections are defensive and pending validation against a live Connection Server

(a field-name mismatch yields empty results, not a crash — see the beta note).

Why vmware-vdi

Every other VMware family skill stops at the vСenter VM. A Horizon desktop pool sits on those VMs — so vmware-aiops can reset the backing VM, but it cannot see a user session, log a user off, disable a pool, or push a golden image. vmware-vdi fills exactly that day-2 VDI gap — "who is stuck on a broken desktop", "log this user off so their profile unlocks", "why is this pool not provisioning", "push the patched image to Finance tonight" — with the family's governed-ops harness: every write is audited, previews its blast radius, and is authorized by the Horizon account's own RBAC role.

Capabilities — 27 MCP tools (16 read / 11 write)

Reads are strictly non-destructive. Writes preview their blast radius, double-confirm at the CLI, and are audit-logged to ~/.vmware/audit.db. poolpushimage recreates every desktop in a pool — the highest single-call blast radius in the family — and its preview states affected-desktop and in-session counts before any confirm, together with occupancy: determined when those counts can be believed, unknown when sessions exist that cannot be attributed to any pool or farm. An unknown occupancy refuses the confirm rather than reporting an unverified zero; overriding it needs --acknowledge-unknown-occupancy and is recorded in the audit row. A machine that names no desktop pool also makes the desktop count a lower bound ("at least N"); that refuses the confirm with no override.

On MCP, every gated write takes confirm (default false). A call without it returns blast_radius — the object's identity, counts, identifiers up to 20, blockers and unmeasured — and changes nothing; the acting response carries the same dict. An agent should show it to the user and pass confirm=true only after they agree. When something the blast radius depends on could not be read — a machine's state, a session's user, a task's type or state, a pool's enabled flag, a pool's current entitlements — confirm=true is refused with a message naming what to check.

Quick start

uv tool install vmware-vdi
vmware-vdi init      # friendly wizard: connect to a Connection Server + discover your pools
vmware-vdi doctor    # verify config / credentials / connectivity
vmware-vdi health    # one-glance VDI health

Shortened. The full README is on GitHub.