zw008/VMware-Harden

> **Disclaimer**: Community-maintained open-source project. **Not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc.** "VMware", "vSphere", "ESXi", and "NSX" are trademarks of Broadcom. Source code is publicly auditable at github.com/vmware-skills/VMware-Harden under the MIT license.
English | 中文
AI-native VMware compliance and baseline enforcement. Sibling to the vmware-* skill family.
- **Read-only against vSphere**: all 8 MCP tools carry the [READ] marker and none mutate managed VMware infrastructure; scan_target writes only to the local twin DB (a cache of its own observations). See Read-only by design.
GA family member (since v1.5.18)
Production-ready compliance platform with **9 built-in baselines** (CIS ESXi 8.0 + 9.0, vSphere SCG v8 + v9, **vSphere 9 STIG-aligned**, **等保 2.0 三级**, PCI-DSS 4.0, **EU NIS2**, **BSI IT-Grundschutz**) carrying **99 rules**, multi-vCenter Twin, drift detection, **LLM Remediation Advisor**, **MCP server** with 8 audited tools, web dashboard, and vmware-harden doctor environment diagnostics.
Quickstart
Reading a result: violations alone are not a verdict
A rule can only judge configuration that was actually gathered, and that fails
in two independent ways. A rule whose attribute **no collector produces** is not
executed at all. A rule that *does* run can still learn nothing about one
particular host, because there the value came back absent or as the N/A
sentinel — an unreachable host, an account without the privilege, a setting the
ESXi build does not have. Neither is reported as passing:
--format json returns {"violations": [...], "coverage": {...}}, and the MCP
tools return the same coverage block, so an agent reading violations: 0
cannot conclude "compliant" on its own. Before v1.9.0 the uncollected-attribute
rules matched zero rows and were silently counted as passes; before v1.10.0 the
per-node case was, too. See RELEASE_NOTES.md.
The two lists call for different work: the first is waiting on a collector, the
second on that node's reachability and the scanning account's privileges.
Offline / Air-Gapped Install (from source)
This project uses the modern PEP 517 build system (hatchling), so there is **no
setup.py** by design — that is expected, not a missing file. If you cloned the
source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode
currently requires a setuptools-based build, your pip is older than 21.3 and
cannot do an *editable* (-e) install with a non-setuptools backend. Editable
mode is a developer convenience, not needed to run the tool — do one of:
For a **truly air-gapped host**, build the wheels on a connected machine and copy
them over — the target then needs no network:
Read-Only by Design
vmware-harden is read-only against vSphere and NSX — all 8 MCP tools carry the [READ]
marker, and none mutate managed VMware infrastructure. scan_target writes only to the
local twin DB (~/.vmware-harden/twin.duckdb), a cache of its own observations rather than
managed infrastructure. Remediation is never applied by this skill; it is deferred to
vmware-pilot, which provides approval gating and audit trails for write operations.
Built-in baselines
| Baseline | Rules | Applies to | Source |
|----------|-------|-----------|--------|
| cis-vmware-esxi-8.0-subset | 20 | host | CIS Benchmark v1.0 |
| vsphere-scg-v8-subset | 15 | host, vm | VMware vcf-security-and-compliance-guidelines |
| dengbao-2.0-level3-vmware | 20 | host, vm, datastore, dfw_rule | GB/T 22239-2019 三级 |
| pci-dss-4.0-vmware | 10 | host, dfw_rule | PCI-DSS v4.0 |
| eu-nis2-vmware | 12 | host, dfw_rule | EU NIS2 Directive (Articles 21/23, Annex I) |
| bsi-itgs-basisabsicherung-vmware | 10 | host | BSI IT-Grundschutz (OPS.1.1.4 + SYS.1.1) |
| cis-vmware-esxi-9.0-subset | 20 | host | Inherits cis-vmware-esxi-8.0-subset via extends: |