VMware VDI (Horizon)
PYPI · VMWARE-VDI
VMware/Omnissa Horizon VDI ops: pools, sessions, machines, images — 27 MCP tools.
Available components
Last scanned (6 hours ago)
Scores higher than 56% of PyPI servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 3 of 39 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 18 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability71
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3987 tokens (~147/item across 27 items; 27 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability check failed: the tool surface changed between 1.3.0 and 2.4.1: 27 tool removals, 0 breaking changes, 27 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 28 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 30 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 20 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 19 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 18 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 2.4.0 → 2.4.1 functional
- 17 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 16 Oct 26 0
- Package version: 2.3.0 → 2.4.0 functional
- 15 Oct 26 +30
- Stability: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Injection markers: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Package version: 2.0.0 → 2.3.0 functional
- Package version: 2.0.0 → 2.2.0 functional
- Package version: 1.3.0 → 2.1.0 functional
- Package version: 1.3.0 → 2.0.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/vmware-vdi@2.4.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 39 packages
| Packages resolved | 39 |
|---|---|
| Stale | 3 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_entitlement ~198
[WRITE] Grant desktop-pool access to AD user/group SID(s). Get SIDs from search_ad_users. A bare call returns blast_radius (pool identity, which principals are already entitled and which are new) and grants nothing; confirm=True grants. Refused when the pool's current entitlements cannot be read. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| ad_user_or_group_ids | array | yes | AD SIDs to entitle (from search_ad_users). |
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True grants. |
| pool_id | string | yes | The desktop-pool id (from list_desktop_pools). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
cancel_vdi_task ~191
[WRITE] Cancel a running pool task (e.g. an in-progress image push). A bare call reads the task and returns blast_radius (task type, state, progress) and cancels nothing; confirm=True cancels. A task whose type or state cannot be read is refused. Work already applied is not rolled back. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True cancels. |
| pool_id | string | yes | The desktop-pool id. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
| task_id | string | yes | The task id (from get_vdi_task_status). |
No output schema declared.
No examples provided.
disconnect_vdi_session ~181
[WRITE] Disconnect Horizon session(s) — state preserved, the user can reconnect. Less disruptive than logoff. Identify by session_ids OR user. A bare call returns blast_radius (session ids, count, affected users) and changes nothing; confirm=True disconnects. A session whose user cannot be read is refused. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True disconnects. |
| session_ids | – | – | Session ids to disconnect. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
| user | – | – | Disconnect all sessions of this AD user (substring match). |
No output schema declared.
No examples provided.
get_desktop_pool ~156
[READ] One desktop pool by id (teaching 404 on a wrong id). Same projection as one list_desktop_pools row — id, name, type, enabled, provisioning_enabled, assignment — fetched with a single GET instead of listing every pool. Use it to re-check one pool after a write, or when you already hold an id.
| Name | Type | Req | Description |
|---|---|---|---|
| pool_id | string | yes | Horizon desktop-pool id (the opaque 'id' of a list_desktop_pools row, not the pool's display name). A wrong id returns a 404 whose hint tells you to re-run list_desktop_pools for exact ids. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
get_desktop_pool_utilization ~75
[READ] Per-pool capacity: total / available / in-use / error machines and utilization %. The "am I running out of desktops?" view, sorted by utilization. Drill in with list_vdi_machines --pool.
| Name | Type | Req | Description |
|---|---|---|---|
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
get_vdi_health_summary ~94
[READ] One-glance Horizon VDI health: session totals by state, problem machines, pool availability. The first thing to call for "how is VDI right now?". Aggregates sessions, machines, and pools into a compact status. Drill into problems with list_vdi_machines --state or list_vdi_sessions.
| Name | Type | Req | Description |
|---|---|---|---|
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
get_vdi_machine ~166
[READ] One Horizon desktop machine by id (teaching 404 on a wrong id). Same projection as one list_vdi_machines row — id, name, pool_id, state, assigned user, agent_version, base_image — fetched with a single GET instead of scanning the estate. Use it to re-check one machine after a write, or when you already hold an id.
| Name | Type | Req | Description |
|---|---|---|---|
| machine_id | string | yes | Horizon machine id (the opaque 'id' of a list_vdi_machines row, not the desktop's display name and not the vCenter VM name). A wrong id returns a 404 whose hint tells you to re-run list_vdi_machines… |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
get_vdi_session ~87
[READ] Full detail for one Horizon session by id. A wrong id returns a teaching error ("run list_vdi_sessions for current ids"), not a traceback. Use list_vdi_sessions to discover ids.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | The session id (from list_vdi_sessions). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
get_vdi_session_stats ~62
[READ] Session statistics: concurrency by state / protocol, current concurrent, busiest pools. The reporting counterpart to list_vdi_sessions — aggregate numbers, not per-session rows.
| Name | Type | Req | Description |
|---|---|---|---|
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
get_vdi_task_status ~124
[READ] Status of a pool's long task (image push / provisioning), or all tasks for the pool. Horizon tasks are pool-scoped. Give task_id (from push_desktop_pool_image or a prior get_vdi_task_status) for one task; omit it to list all tasks for the pool.
| Name | Type | Req | Description |
|---|---|---|---|
| pool_id | string | yes | The desktop-pool id. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
| task_id | – | – | A specific task id; omit to list all tasks for the pool. |
No output schema declared.
No examples provided.
list_app_pools ~70
[READ] List published application pools: id, name, farm, enabled, executable path. Paginated.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 50). |
| offset | integer | – | Page offset. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
list_desktop_pools ~96
[READ] List Horizon desktop pools: id, name, type (AUTOMATED/MANUAL/RDS), enabled, assignment. The verify pair for set_desktop_pool_enabled and push_desktop_pool_image. Paginated envelope.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 50). |
| offset | integer | – | Page offset. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
list_entitlements ~109
[READ] List the AD users/groups entitled to a desktop pool (who can access it). Paginated. A wrong pool id returns a teaching 404. Use list_desktop_pools for pool ids.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 50). |
| offset | integer | – | Page offset. |
| pool_id | string | yes | The desktop-pool id (from list_desktop_pools). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
list_farms ~72
[READ] List Horizon RDS farms: id, name, type, enabled, RDS server count. Paginated.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 50). |
| offset | integer | – | Page offset. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
list_vdi_events ~112
[READ] List Horizon audit events (newest first), optionally filtered by severity. Paginated. Each item: time, severity, type, module, user, machine, message. Use for "what went wrong recently".
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 50). |
| offset | integer | – | Page offset. |
| severity | – | – | Filter by severity (e.g. ERROR, WARNING, AUDIT_FAIL). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
list_vdi_images ~65
[READ] List instant-clone base VMs and snapshots (the golden-image catalog for push_desktop_pool_image).
| Name | Type | Req | Description |
|---|---|---|---|
| base_vm_id | – | – | Optionally scope snapshots to one base VM. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
list_vdi_machines ~153
[READ] List Horizon desktop machines, filtered by pool id / state. Paginated. Each item: id, name, pool_id, state (AVAILABLE/CONNECTED/AGENT_UNREACHABLE/PROVISIONING/ ERROR/MAINTENANCE/…), assigned user, agent_version, base_image. Verify pair for the machine write tools.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 50). |
| offset | integer | – | Page offset. |
| pool | – | – | Filter to one desktop-pool id. |
| state | – | – | Filter by machine state (e.g. AGENT_UNREACHABLE, ERROR). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
list_vdi_sessions ~192
[READ] List Horizon VDI sessions, filtered by user / pool id / state. Paginated. Returns a {items, returned, limit, total, truncated, hint} envelope; each item has id, user, type (DESKTOP/APPLICATION), state (CONNECTED/DISCONNECTED/PENDING), protocol (BLAST/PCOIP/RDP), pool_id, machine_id, start_time. This is the verify pair for logoff/disconnect — get a session id or confirm a user's sessions here first.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 50). |
| offset | integer | – | Page offset. |
| pool | – | – | Exact desktop-pool / farm id. |
| state | – | – | CONNECTED, DISCONNECTED, or PENDING. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
| user | – | – | Substring-match the AD user name. |
No output schema declared.
No examples provided.
logoff_vdi_session ~201
[WRITE] Force-logoff Horizon session(s) — kicks the user, triggers profile write-back. Identify targets by explicit session_ids OR by user (all of that user's sessions). A bare call returns blast_radius — session ids, count and affected users — and logs off nothing; confirm=True logs off. A session whose user cannot be read is refused. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True logs off. |
| session_ids | – | – | Session ids to log off (from list_vdi_sessions). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
| user | – | – | Log off all sessions of this AD user (substring match); refuses if none match. |
No output schema declared.
No examples provided.
push_desktop_pool_image ~316
[WRITE] Apply the pending image to an instant-clone pool — RECREATES EVERY DESKTOP in it. Highest blast radius in the family: the preview states affected-desktop and in-session counts before you confirm, plus blast_radius.occupancy — "determined" when those counts can be believed, "unknown" when sessions exist that cannot be attributed to any pool or farm. confirm=True schedules the apply. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| acknowledge_unknown_occupancy | boolean | – | Only consulted when the preview reports blast_radius.occupancy == "unknown", where in_session_count is a lower bound rather than a count and confirm=True is refused. Setting it True pushes on an unve… |
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True schedules the push. |
| logoff_policy | string | – | WAIT_FOR_LOGOFF (default) or FORCE_LOGOFF. |
| pool_id | string | yes | The pool id (from list_desktop_pools). |
| stop_on_error | boolean | – | Halt the rolling push on the first machine error (default True). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
remove_entitlement ~200
[WRITE] Revoke desktop-pool access from AD user/group SID(s). Get SIDs from list_entitlements. A bare call returns blast_radius (pool identity, which principals lose access and which were not entitled) and revokes nothing; confirm=True revokes. Refused when the pool's current entitlements cannot be read. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| ad_user_or_group_ids | array | yes | AD SIDs to remove (from list_entitlements). |
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True revokes. |
| pool_id | string | yes | The desktop-pool id (from list_desktop_pools). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
remove_vdi_machine ~166
[WRITE] Remove machine(s) from their pool — for instant clones this DELETES the backing VM. A bare call returns blast_radius (machine ids, names, states, assigned users) and removes nothing; confirm=True removes. A machine whose state cannot be read is refused. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True removes. |
| machine_ids | array | yes | Machine ids to remove (from list_vdi_machines). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
reset_vdi_machine ~179
[WRITE] Hard-reset desktop machine(s) — the user loses unsaved state. A bare call returns blast_radius (machine ids, names, states, assigned users) and resets nothing; confirm=True resets. A machine whose state cannot be read is refused. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. For a graceful in-guest reboot use vmware-aiops (the vCenter VM). Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True resets. |
| machine_ids | array | yes | Machine ids to reset (from list_vdi_machines). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
search_ad_users ~77
[READ] Resolve AD users/groups by name to their SIDs — needed to entitle a pool (add_entitlement).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max principals to return (default 25). |
| name | string | yes | Name substring to search for. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
send_vdi_session_message ~134
[WRITE] Send a message to Horizon session(s) — e.g. "save your work, maintenance in 10 min". Low blast radius (informational only, no session disruption), so no confirm gate. Identify by session_ids OR user. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | The text to display to the user(s). |
| message_type | string | – | INFO, WARNING, or ERROR. |
| session_ids | – | – | Session ids to message. |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
| user | – | – | Message all sessions of this AD user (substring match). |
No output schema declared.
No examples provided.
set_desktop_pool_enabled ~188
[WRITE] Enable or disable a desktop pool — disabling stops NEW sessions (existing keep running). Idempotent (matching state returns a noop). A bare call returns blast_radius (pool identity, current and new enabled state) and changes nothing; confirm=True applies. A pool whose current enabled state cannot be read is refused. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True applies it. |
| enabled | boolean | yes | True enables; False disables. |
| pool_id | string | yes | The pool id (from list_desktop_pools). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
set_vdi_machine_maintenance ~184
[WRITE] Enter (enabled=True) or exit (False) maintenance mode for machine(s). Maintenance drains the machine (no new sessions). A bare call returns blast_radius (machine ids, states, assigned users) and changes nothing; confirm=True applies. A machine whose state cannot be read is refused. Show blast_radius to the user and wait for their decision. Do not set confirm=True on your own because the user asked for this earlier: they have not seen the blast radius yet. Audited.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | False (default) returns the blast radius and changes nothing. True applies it. |
| enabled | boolean | yes | True enters maintenance; False exits. |
| machine_ids | array | yes | Machine ids (from list_vdi_machines). |
| target | – | – | Horizon target from config.yaml; omit to use the default. |
No output schema declared.
No examples provided.
How do I install the VMware VDI (Horizon) MCP server?
VMware VDI (Horizon) runs locally as a PyPI package, launched with uvx vmware-vdi. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · vmware-vdi
claude mcp add vmware-skills-vmware-vdi -- uvx vmware-vdi
What is the VMware VDI (Horizon) MCP server?
VMware VDI (Horizon) is an MCP server listed in the public MCP registry as io.github.vmware-skills/vmware-vdi. VMware/Omnissa Horizon VDI ops: pools, sessions, machines, images, 27 MCP tools. This page covers its PyPI package (vmware-vdi).
Is the VMware VDI (Horizon) MCP server safe to use?
VMware VDI (Horizon) scores 55 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the VMware VDI (Horizon) MCP server expose?
VMware VDI (Horizon) exposes 27 tools: list_app_pools, list_vdi_images, search_ad_users, list_entitlements, add_entitlement, and 22 more. Their descriptions and schemas cost roughly 3,848 tokens of context every time the server is loaded.
Is the VMware VDI (Horizon) MCP server still maintained?
VMware VDI (Horizon) is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the VMware VDI (Horizon) MCP server under?
VMware VDI (Horizon) declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.