VCF LCM Pre-check Analyzer

An MCP server that interfaces with VCF SDDC Manager to retrieve and analyze LCM upgrade pre-check results, providing instant remediation steps for failures.

Security Scan

The skill's code, declared env vars, and runtime instructions are consistent with its stated purpose of querying VMware Cloud Foundation SDDC Manager pre-check results; nothing suggests unrelated access or hidden exfiltration.

Purpose & Capability

The skill declares and uses SDDCMANAGER_HOST and SDDCMANAGER_API_TOKEN, calls the SDDC Manager /v1/upgrades/prechecks endpoint, and exposes a single MCP tool analyze_lcm_precheck — all align with the stated purpose.

Instruction Scope

SKILL.md instructs running a local MCP server and only that server reads the two declared env vars. The code disables TLS verification (verify=False and suppresses insecure warnings) to allow self-signed certs; this is plausible for VCF environments but increases MITM risk and should be acknowledged/mitigated.

Install Mechanism

Install is pip install -r requirements.txt for 'mcp' and 'requests' from PyPI — a standard, expected approach. There are no downloads from untrusted URLs or extracted archives.

Credentials

Only two env vars are required and both are directly relevant to connecting to SDDC Manager. No unrelated credentials, config paths, or unexpected secrets are requested.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It runs as a local MCP server and can be invoked by the agent (normal for MCP skills); it does not modify other skills or agent-wide config.

Assessment

This skill appears coherent and limited to querying your SDDC Manager, but take these precautions before installing: (1) Run the MCP server on a trusted host with network access to your SDDC Manager. (2) Provide a token with least privilege necessary (avoid using a full administrator token) and rotate it regularly. (3) Be aware the code disables SSL verification for self-signed certs — if possible, use valid TLS or restrict network exposure to prevent MITM. (4) Review the short server.py yourself (it is included) to confirm it matches your security policies. (5) If you allow autonomous agent invocation, treat the skill like any other connector with access to your SDDC API and monitor its usage.

VCF LCM Pre-check Analyzer (MCP)

This skill utilizes the Model Context Protocol (MCP) to provide the AI agent with a native analyze_lcm_precheck tool, connecting directly to the VMware Cloud Foundation SDDC Manager API.

Setup Instructions for OpenClaw

To use this skill, the OpenClaw agent must run the attached Python MCP server locally.

1. Install dependencies: pip install -r requirements.txt
2. Configure your OpenClaw settings to launch this MCP server by adding the following to your agent's MCP configuration block:

{
  "mcpServers": {
    "vcf-lcm-analyzer": {
      "command": "python",
      "args": ["server.py"],
      "env": {
        "SDDCMANAGER_HOST": "your-sddc-manager-fqdn",
        "SDDCMANAGER_API_TOKEN": "your-api-token"
      }
    }
  }
}