vmware-pilot 2.0.0__tar.gz → 2.1.0__tar.gz

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-pilot",
   "displayName": "VMware Pilot",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Multi-step workflow orchestration for VMware MCP skills with approval gates and rollback.",
   "author": {
     "name": "Wei Zhou",

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-pilot==2.0.0",
+        "vmware-pilot==2.1.0",
         "vmware-pilot-mcp"
       ]
     }

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-pilot
-Version: 2.0.0
+Version: 2.1.0
 Summary: VMware workflow orchestration — multi-step state machine with approval gates
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Pilot
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Pilot
@@ -12,7 +12,7 @@ Requires-Python: >=3.10
 Requires-Dist: mcp[cli]<2.0,>=1.0
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: typer<1.0,>=0.12
-Requires-Dist: vmware-policy<2.0,>=1.19.0
+Requires-Dist: vmware-policy<2.0,>=1.20.0
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.vmware-skills/vmware-pilot -->

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/RELEASE_NOTES.md

@@ -1,3 +1,20 @@
+## v2.1.0 — offer only read tools, plus chosen write tools
+
+`vmware-pilot mcp` can now offer a subset of this server's tools (HLD §17 D-16, via vmware-policy 1.20.0):
+
+```bash
+vmware-pilot mcp --expose read --allow-write cancel_workflow
+```
+
+* `--expose read` (or `VMWARE_PILOT_MCP_EXPOSE=read`) keeps only tools annotated `readOnlyHint: true`; `--allow-write a,b`
+  (or `VMWARE_PILOT_MCP_ALLOW_WRITE`) keeps chosen write tools on top. The default is unchanged: every tool.
+* A bad value, or a name that is not a write tool of this server, stops the server before it serves (exit 2).
+  Flags and environment variables are not mixed; a blank flag counts as not given. Pre-2.0 names are accepted.
+* This limits what clients are offered; it is not authorization. See "Limiting which tools are offered" in
+  `references/setup-guide.md`, which also notes that an agent with a shell can bypass MCP, so the account itself
+  must be least-privilege.
+* Requires `vmware-policy>=1.20.0`.
+
 ## v2.0.0 — create_workflow_from_template, and VKS kubeconfig tools at their new names
 
 **Breaking: one of Pilot's own MCP tools is renamed.** `plan_workflow` → `create_workflow_from_template`.

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-pilot==2.0.0",
+        "vmware-pilot==2.1.0",
         "vmware-pilot-mcp"
       ]
     }

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-pilot",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Multi-step workflow orchestration for VMware MCP skills with approval gates and rollback.",
   "private": true,
   "license": "MIT",

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-pilot"
-version = "2.0.0"
+version = "2.1.0"
 description = "VMware workflow orchestration — multi-step state machine with approval gates"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.10"
 authors = [{ name = "Wei Zhou", email = "wei-wz.zhou@broadcom.com" }]
 dependencies = [
-    "vmware-policy>=1.19.0,<2.0",
+    "vmware-policy>=1.20.0,<2.0",
     "mcp[cli]>=1.0,<2.0",
     "pyyaml>=6.0,<7.0",
     "typer>=0.12,<1.0",

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-Pilot",
     "source": "github"
   },
-  "version": "2.0.0",
+  "version": "2.1.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-pilot",
-      "version": "2.0.0",
+      "version": "2.1.0",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/skills/vmware-pilot/SKILL.md

@@ -42,7 +42,7 @@ Multi-step workflow orchestration for VMware MCP skills — design, approve, exe
 ## Quick Install
 
 ```bash
-uv tool install vmware-pilot==2.0.0
+uv tool install vmware-pilot==2.1.0
 vmware-pilot mcp          # start the MCP server (stdio)
 ```
 
@@ -303,7 +303,7 @@ No vCenter credentials needed — pilot orchestrates other skills that handle co
 }
 ```
 
-> Fallback: `{"command": "uvx", "args": ["--from", "vmware-pilot==2.0.0", "vmware-pilot-mcp"]}` also
+> Fallback: `{"command": "uvx", "args": ["--from", "vmware-pilot==2.1.0", "vmware-pilot-mcp"]}` also
 > works, but `uvx` re-resolves the package against PyPI on every start and fails behind a
 > TLS-inspecting corporate proxy (`invalid peer certificate: UnknownIssuer`). The installed
 > entry point above touches the network zero times; set `UV_NATIVE_TLS=true` if you must use `uvx`.

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/skills/vmware-pilot/references/cli-reference.md

@@ -19,12 +19,12 @@ client.
 
 ```bash
 # Recommended: installed entry point, never touches the network
-uv tool install vmware-pilot==2.0.0
+uv tool install vmware-pilot==2.1.0
 vmware-pilot mcp
 
 # Fallback: uvx re-resolves against PyPI each start and fails behind a
 # TLS-inspecting corporate proxy — set UV_NATIVE_TLS=true if you must use it
-uvx --from vmware-pilot==2.0.0 vmware-pilot-mcp
+uvx --from vmware-pilot==2.1.0 vmware-pilot-mcp
 ```
 
 The server runs on **stdio** transport and exposes 13 MCP tools (4 read, 9 write).

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/skills/vmware-pilot/references/setup-guide.md

@@ -11,16 +11,16 @@
 ### Via uv (Recommended)
 
 ```bash
-uv tool install vmware-pilot==2.0.0
+uv tool install vmware-pilot==2.1.0
 ```
 
 ### Via pip
 
 ```bash
-uv tool install vmware-pilot==2.0.0
+uv tool install vmware-pilot==2.1.0
 
 # China mainland mirror
-pip install vmware-pilot==2.0.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
+pip install vmware-pilot==2.1.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
 ```
 
 ### Verify Installation
@@ -84,7 +84,7 @@ The `uvx` form still works and needs no prior install:
   "mcpServers": {
     "vmware-pilot": {
       "command": "uvx",
-      "args": ["--from", "vmware-pilot==2.0.0", "vmware-pilot-mcp"]
+      "args": ["--from", "vmware-pilot==2.1.0", "vmware-pilot-mcp"]
     }
   }
 }
@@ -100,11 +100,38 @@ invalid peer certificate: UnknownIssuer
 
 `uv` ships its own certificate bundle and ignores the system trust store, which is what breaks.
 Either set `UV_NATIVE_TLS=true` so it honours your corporate CA, or install the tool once
-(`uv tool install vmware-pilot==2.0.0`) and launch `vmware-pilot mcp`, which touches the network
+(`uv tool install vmware-pilot==2.1.0`) and launch `vmware-pilot mcp`, which touches the network
 zero times.
 
 ---
 
+## Limiting which tools are offered
+
+By default the MCP server offers every tool. To offer only read tools, start it with `--expose read`, or set
+`VMWARE_PILOT_MCP_EXPOSE=read` in the MCP client's `env` block (useful when the client launches `vmware-pilot mcp` itself). To offer
+chosen write tools as well, add `--allow-write` with a comma-separated list (or `VMWARE_PILOT_MCP_ALLOW_WRITE`):
+
+```bash
+vmware-pilot mcp --expose read --allow-write cancel_workflow
+```
+
+- A read tool is one annotated `readOnlyHint: true`; every other tool counts as a write.
+- An unknown setting, or a name that is not a write tool of this server, stops the server before it serves (exit
+  code 2), so it never offers more than you asked for. Pre-2.0 tool names are accepted.
+- With `--expose read`, the server prints one line to stderr saying what it exposes.
+- With `--expose read`, the server's instructions still describe the workflow tools it hides (`create_workflow`,
+  `create_workflow_from_template`, `run_workflow`, `approve`, `rollback`); a call to a hidden tool is answered `Unknown tool`.
+- Flags and environment variables are not mixed: if either flag is given, both environment variables are
+  ignored, so a leftover `_ALLOW_WRITE` in the shell cannot widen `--expose read`. A blank flag value counts as
+  not given.
+- A tool that runs other steps (a plan, workflow or batch tool) carries every write it can execute, including
+  writes this setting hides. Expose such a tool only if you would expose those writes too.
+- A launcher that imports the server object can call
+  `vmware_policy.exposure.restrict_tools(mcp, skill="pilot", expose="read", allow_write=[...])` before running it,
+  instead of editing the SDK's tool registry.
+- This limits what clients are offered. It is **not** authorization. This server's write tools change workflow state on this machine; the steps it runs act through the other skills' accounts;
+  deny rules in `~/.vmware/rules.yaml` still apply to every exposed tool.
+
 ## Configuration
 
 Pilot itself requires **no vCenter/NSX/AVI credentials**. It is a pure orchestrator that delegates all infrastructure calls to companion skills.

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/uv.lock

@@ -1142,7 +1142,7 @@ wheels = [
 
 [[package]]
 name = "vmware-pilot"
-version = "2.0.0"
+version = "2.1.0"
 source = { editable = "." }
 dependencies = [
     { name = "mcp", extra = ["cli"] },
@@ -1163,7 +1163,7 @@ requires-dist = [
     { name = "mcp", extras = ["cli"], specifier = ">=1.0,<2.0" },
     { name = "pyyaml", specifier = ">=6.0,<7.0" },
     { name = "typer", specifier = ">=0.12,<1.0" },
-    { name = "vmware-policy", specifier = ">=1.19.0,<2.0" },
+    { name = "vmware-policy", specifier = ">=1.20.0,<2.0" },
 ]
 
 [package.metadata.requires-dev]
@@ -1175,14 +1175,14 @@ dev = [
 
 [[package]]
 name = "vmware-policy"
-version = "1.19.0"
+version = "1.20.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pyyaml" },
     { name = "rich" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/91/ef/e8c02d7c6fe2efd2d4bced230372348c91f492505a8d6a540573fcac3c02/vmware_policy-1.19.0.tar.gz", hash = "sha256:ea89498ca642907491081d9e75e8b2fbe5457a121e29dd5c42cc1d978145ca22", size = 213283, upload-time = "2026-10-15T02:21:28.595Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/66/f3/cae0e18d269bd4764d5f9b34a838174e9668f931e44d41effab620aeecf4/vmware_policy-1.20.0.tar.gz", hash = "sha256:eb9875d3e94435a18d1dd6cf2c71905c46e2e812808556db3fb741ef322bee99", size = 220048, upload-time = "2026-10-15T06:33:35.174Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/23/90/14744a439862439d3e8cf122e997d3bd9eee22421fc2760bbc55992710a8/vmware_policy-1.19.0-py3-none-any.whl", hash = "sha256:125d6e7e97a77ad3a150f307cbd6138329d54e8bd695d8ef1c51b16d0e72f931", size = 82881, upload-time = "2026-10-15T02:21:26.952Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/cf/6c87f6b5439407c1c3b83b84a5ef53def7544b687efd6f16a6cb187acf78/vmware_policy-1.20.0-py3-none-any.whl", hash = "sha256:cea9451c70be96e3d7adc420a2ac001cf431c29b61350dd58c3771378058737a", size = 86684, upload-time = "2026-10-15T06:33:33.413Z" },
 ]

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/vmware_pilot/__init__.py

@@ -1,3 +1,3 @@
 """VMware Pilot — multi-step workflow orchestration with approval gates."""
 
-__version__ = "2.0.0"
+__version__ = "2.1.0"

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/vmware_pilot/cli.py

@@ -13,6 +13,7 @@ convention — every sibling skill exposes the same ``<skill> mcp`` subcommand.
 
 from __future__ import annotations
 
+from typing import Optional
 import typer
 
 from vmware_pilot import __version__
@@ -69,7 +70,19 @@ def version_cmd() -> None:
 
 @app.command("mcp")
 @cli_local("starts the MCP server; its tools audit themselves")
-def mcp_cmd() -> None:
+def mcp_cmd(
+    expose: Optional[str] = typer.Option(
+        None,
+        "--expose",
+        help="Which tools to offer: all (default) or read. Limits what clients see; "
+        "not authorization: the account's permissions still decide.",
+    ),
+    allow_write: Optional[str] = typer.Option(
+        None,
+        "--allow-write",
+        help="With --expose read: comma-separated write tools to offer as well.",
+    ),
+) -> None:
     """Start the MCP server (stdio transport).
 
     Single-command entry point for MCP clients:
@@ -96,7 +109,7 @@ def mcp_cmd() -> None:
 
     from vmware_pilot.mcp_server.server import main as _mcp_main
 
-    _mcp_main()
+    _mcp_main(expose=expose, allow_write=allow_write)
 
 
 if __name__ == "__main__":  # pragma: no cover

{vmware_pilot-2.0.0 → vmware_pilot-2.1.0}/vmware_pilot/mcp_server/server.py

@@ -15,6 +15,7 @@ Exposes 13 tools for AI agents to manage multi-step VMware workflows:
 
 from __future__ import annotations
 
+from typing import Optional
 import logging
 
 from vmware_policy import describe_tool_parameters
@@ -147,9 +148,11 @@ __all__ = [
 ]
 
 
-def main() -> None:
+def main(expose: Optional[str] = None, allow_write: Optional[str] = None) -> None:
     """Run the MCP server over stdio."""
     logging.basicConfig(level=logging.INFO)
+    from vmware_policy.exposure import apply_or_exit
+    apply_or_exit(mcp, skill="pilot", expose=expose, allow_write=allow_write)
     mcp.run(transport="stdio")
 
 # The docstrings above are the schema. `describe_tool_parameters` copies each