vmware-pilot 2.0.0__tar.gz → 2.2.0__tar.gz

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-pilot",
   "displayName": "VMware Pilot",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "Multi-step workflow orchestration for VMware MCP skills with approval gates and rollback.",
   "author": {
     "name": "Wei Zhou",

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-pilot==2.0.0",
+        "vmware-pilot==2.2.0",
         "vmware-pilot-mcp"
       ]
     }

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-pilot
-Version: 2.0.0
+Version: 2.2.0
 Summary: VMware workflow orchestration — multi-step state machine with approval gates
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Pilot
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Pilot
@@ -9,10 +9,10 @@ Project-URL: Changelog, https://github.com/vmware-skills/VMware-Pilot/blob/main/
 Author-email: Wei Zhou <wei-wz.zhou@broadcom.com>
 License-Expression: MIT
 Requires-Python: >=3.10
-Requires-Dist: mcp[cli]<2.0,>=1.0
+Requires-Dist: mcp[cli]<2.0,>=1.28
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: typer<1.0,>=0.12
-Requires-Dist: vmware-policy<2.0,>=1.19.0
+Requires-Dist: vmware-policy<2.0,>=1.21.0
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.vmware-skills/vmware-pilot -->

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/RELEASE_NOTES.md

@@ -1,3 +1,41 @@
+## v2.2.0 — serve MCP over HTTPS
+
+`vmware-pilot mcp` can now serve the network as well as stdio (HLD §16, via vmware-policy 1.21.0):
+
+```bash
+vmware-audit token create alice          # once per caller; shown once
+vmware-pilot mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert server.pem --key server-key.pem --public-name mcp.example.com
+```
+
+* Every request needs `Authorization: Bearer <token>`; the server will not start without a token, refuses Host or
+  Origin values outside `--public-name`, and checks itself (unauthenticated requests must get 401) before it
+  binds. `--transport http` binds loopback only, for a TLS-terminating reverse proxy.
+* Audit rows record the caller as `token:<name>` and the surface as `mcp-https`. Calls naming different targets
+  run in parallel; calls naming no target run one at a time.
+* Over HTTPS, `approve` records the authenticated caller as the approver and refuses a different free-text
+  name (HLD §16 D-12). stdio and the CLI are unchanged.
+* stdio remains the default; the `vmware-pilot-mcp` console script and `python -m` are unchanged.
+* Everyone who can reach the endpoint acts with this server's account; run one endpoint per privilege level.
+* Requires `vmware-policy>=1.21.0` and `mcp>=1.28`.
+
+## v2.1.0 — offer only read tools, plus chosen write tools
+
+`vmware-pilot mcp` can now offer a subset of this server's tools (HLD §17 D-16, via vmware-policy 1.20.0):
+
+```bash
+vmware-pilot mcp --expose read --allow-write cancel_workflow
+```
+
+* `--expose read` (or `VMWARE_PILOT_MCP_EXPOSE=read`) keeps only tools annotated `readOnlyHint: true`; `--allow-write a,b`
+  (or `VMWARE_PILOT_MCP_ALLOW_WRITE`) keeps chosen write tools on top. The default is unchanged: every tool.
+* A bad value, or a name that is not a write tool of this server, stops the server before it serves (exit 2).
+  Flags and environment variables are not mixed; a blank flag counts as not given. Pre-2.0 names are accepted.
+* This limits what clients are offered; it is not authorization. See "Limiting which tools are offered" in
+  `references/setup-guide.md`, which also notes that an agent with a shell can bypass MCP, so the account itself
+  must be least-privilege.
+* Requires `vmware-policy>=1.20.0`.
+
 ## v2.0.0 — create_workflow_from_template, and VKS kubeconfig tools at their new names
 
 **Breaking: one of Pilot's own MCP tools is renamed.** `plan_workflow` → `create_workflow_from_template`.

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-pilot==2.0.0",
+        "vmware-pilot==2.2.0",
         "vmware-pilot-mcp"
       ]
     }

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-pilot",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "Multi-step workflow orchestration for VMware MCP skills with approval gates and rollback.",
   "private": true,
   "license": "MIT",

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-pilot"
-version = "2.0.0"
+version = "2.2.0"
 description = "VMware workflow orchestration — multi-step state machine with approval gates"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.10"
 authors = [{ name = "Wei Zhou", email = "wei-wz.zhou@broadcom.com" }]
 dependencies = [
-    "vmware-policy>=1.19.0,<2.0",
-    "mcp[cli]>=1.0,<2.0",
+    "vmware-policy>=1.21.0,<2.0",
+    "mcp[cli]>=1.28,<2.0",
     "pyyaml>=6.0,<7.0",
     "typer>=0.12,<1.0",
 ]

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-Pilot",
     "source": "github"
   },
-  "version": "2.0.0",
+  "version": "2.2.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-pilot",
-      "version": "2.0.0",
+      "version": "2.2.0",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/skills/vmware-pilot/SKILL.md

@@ -42,7 +42,7 @@ Multi-step workflow orchestration for VMware MCP skills — design, approve, exe
 ## Quick Install
 
 ```bash
-uv tool install vmware-pilot==2.0.0
+uv tool install vmware-pilot==2.2.0
 vmware-pilot mcp          # start the MCP server (stdio)
 ```
 
@@ -303,7 +303,7 @@ No vCenter credentials needed — pilot orchestrates other skills that handle co
 }
 ```
 
-> Fallback: `{"command": "uvx", "args": ["--from", "vmware-pilot==2.0.0", "vmware-pilot-mcp"]}` also
+> Fallback: `{"command": "uvx", "args": ["--from", "vmware-pilot==2.2.0", "vmware-pilot-mcp"]}` also
 > works, but `uvx` re-resolves the package against PyPI on every start and fails behind a
 > TLS-inspecting corporate proxy (`invalid peer certificate: UnknownIssuer`). The installed
 > entry point above touches the network zero times; set `UV_NATIVE_TLS=true` if you must use `uvx`.

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/skills/vmware-pilot/references/cli-reference.md

@@ -19,12 +19,12 @@ client.
 
 ```bash
 # Recommended: installed entry point, never touches the network
-uv tool install vmware-pilot==2.0.0
+uv tool install vmware-pilot==2.2.0
 vmware-pilot mcp
 
 # Fallback: uvx re-resolves against PyPI each start and fails behind a
 # TLS-inspecting corporate proxy — set UV_NATIVE_TLS=true if you must use it
-uvx --from vmware-pilot==2.0.0 vmware-pilot-mcp
+uvx --from vmware-pilot==2.2.0 vmware-pilot-mcp
 ```
 
 The server runs on **stdio** transport and exposes 13 MCP tools (4 read, 9 write).

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/skills/vmware-pilot/references/setup-guide.md

@@ -11,16 +11,16 @@
 ### Via uv (Recommended)
 
 ```bash
-uv tool install vmware-pilot==2.0.0
+uv tool install vmware-pilot==2.2.0
 ```
 
 ### Via pip
 
 ```bash
-uv tool install vmware-pilot==2.0.0
+uv tool install vmware-pilot==2.2.0
 
 # China mainland mirror
-pip install vmware-pilot==2.0.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
+pip install vmware-pilot==2.2.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
 ```
 
 ### Verify Installation
@@ -84,7 +84,7 @@ The `uvx` form still works and needs no prior install:
   "mcpServers": {
     "vmware-pilot": {
       "command": "uvx",
-      "args": ["--from", "vmware-pilot==2.0.0", "vmware-pilot-mcp"]
+      "args": ["--from", "vmware-pilot==2.2.0", "vmware-pilot-mcp"]
     }
   }
 }
@@ -100,11 +100,38 @@ invalid peer certificate: UnknownIssuer
 
 `uv` ships its own certificate bundle and ignores the system trust store, which is what breaks.
 Either set `UV_NATIVE_TLS=true` so it honours your corporate CA, or install the tool once
-(`uv tool install vmware-pilot==2.0.0`) and launch `vmware-pilot mcp`, which touches the network
+(`uv tool install vmware-pilot==2.2.0`) and launch `vmware-pilot mcp`, which touches the network
 zero times.
 
 ---
 
+## Limiting which tools are offered
+
+By default the MCP server offers every tool. To offer only read tools, start it with `--expose read`, or set
+`VMWARE_PILOT_MCP_EXPOSE=read` in the MCP client's `env` block (useful when the client launches `vmware-pilot mcp` itself). To offer
+chosen write tools as well, add `--allow-write` with a comma-separated list (or `VMWARE_PILOT_MCP_ALLOW_WRITE`):
+
+```bash
+vmware-pilot mcp --expose read --allow-write cancel_workflow
+```
+
+- A read tool is one annotated `readOnlyHint: true`; every other tool counts as a write.
+- An unknown setting, or a name that is not a write tool of this server, stops the server before it serves (exit
+  code 2), so it never offers more than you asked for. Pre-2.0 tool names are accepted.
+- With `--expose read`, the server prints one line to stderr saying what it exposes.
+- With `--expose read`, the server's instructions still describe the workflow tools it hides (`create_workflow`,
+  `create_workflow_from_template`, `run_workflow`, `approve`, `rollback`); a call to a hidden tool is answered `Unknown tool`.
+- Flags and environment variables are not mixed: if either flag is given, both environment variables are
+  ignored, so a leftover `_ALLOW_WRITE` in the shell cannot widen `--expose read`. A blank flag value counts as
+  not given.
+- A tool that runs other steps (a plan, workflow or batch tool) carries every write it can execute, including
+  writes this setting hides. Expose such a tool only if you would expose those writes too.
+- A launcher that imports the server object can call
+  `vmware_policy.exposure.restrict_tools(mcp, skill="pilot", expose="read", allow_write=[...])` before running it,
+  instead of editing the SDK's tool registry.
+- This limits what clients are offered. It is **not** authorization. This server's write tools change workflow state on this machine; the steps it runs act through the other skills' accounts;
+  deny rules in `~/.vmware/rules.yaml` still apply to every exposed tool.
+
 ## Configuration
 
 Pilot itself requires **no vCenter/NSX/AVI credentials**. It is a pure orchestrator that delegates all infrastructure calls to companion skills.

vmware_pilot-2.2.0/tests/test_approver_is_caller.py

@@ -0,0 +1,67 @@
+"""Over HTTPS the approver is the authenticated caller (HLD §16 D-12).
+
+Token "bob" calling approve(approver="alice (CISO)") used to record an approval
+by "alice (CISO)". The audit row said token:bob; the workflow said otherwise.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from vmware_pilot.mcp_server.tools import lifecycle
+
+
+class _Store:
+    def load(self, workflow_id):
+        return object()
+
+
+class _Executor:
+    def __init__(self):
+        self.approvers = []
+
+    def resume_after_approval(self, wf, approver):
+        self.approvers.append(approver)
+        return {"state": "running"}
+
+
+@pytest.fixture
+def executor(monkeypatch):
+    ex = _Executor()
+    monkeypatch.setattr(lifecycle, "_get_store", lambda: _Store())
+    monkeypatch.setattr(lifecycle, "_get_executor", lambda: ex)
+    return ex
+
+
+def _as(monkeypatch, who):
+    import vmware_policy.caller as caller_mod
+
+    monkeypatch.setattr(caller_mod, "current_caller", lambda: who)
+
+
+def _approve(**kw):
+    fn = getattr(lifecycle.approve, "__wrapped__", lifecycle.approve)
+    return fn(**kw)
+
+
+@pytest.mark.unit
+def test_network_approval_is_recorded_as_the_caller(executor, monkeypatch):
+    _as(monkeypatch, "token:bob")
+    result = _approve(workflow_id="wf1")
+    assert "error" not in result
+    assert executor.approvers == ["token:bob"]
+
+
+@pytest.mark.unit
+def test_a_different_approver_name_over_the_network_is_refused(executor, monkeypatch):
+    _as(monkeypatch, "token:bob")
+    result = _approve(workflow_id="wf1", approver="alice (CISO)")
+    assert "error" in result and "token:bob" in result["error"]
+    assert executor.approvers == []
+
+
+@pytest.mark.unit
+def test_stdio_keeps_the_free_text_approver(executor, monkeypatch):
+    _as(monkeypatch, None)
+    _approve(workflow_id="wf1", approver="alice")
+    assert executor.approvers == ["alice"]

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/uv.lock

@@ -1142,7 +1142,7 @@ wheels = [
 
 [[package]]
 name = "vmware-pilot"
-version = "2.0.0"
+version = "2.2.0"
 source = { editable = "." }
 dependencies = [
     { name = "mcp", extra = ["cli"] },
@@ -1160,10 +1160,10 @@ dev = [
 
 [package.metadata]
 requires-dist = [
-    { name = "mcp", extras = ["cli"], specifier = ">=1.0,<2.0" },
+    { name = "mcp", extras = ["cli"], specifier = ">=1.28,<2.0" },
     { name = "pyyaml", specifier = ">=6.0,<7.0" },
     { name = "typer", specifier = ">=0.12,<1.0" },
-    { name = "vmware-policy", specifier = ">=1.19.0,<2.0" },
+    { name = "vmware-policy", specifier = ">=1.21.0,<2.0" },
 ]
 
 [package.metadata.requires-dev]
@@ -1175,14 +1175,14 @@ dev = [
 
 [[package]]
 name = "vmware-policy"
-version = "1.19.0"
+version = "1.21.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pyyaml" },
     { name = "rich" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/91/ef/e8c02d7c6fe2efd2d4bced230372348c91f492505a8d6a540573fcac3c02/vmware_policy-1.19.0.tar.gz", hash = "sha256:ea89498ca642907491081d9e75e8b2fbe5457a121e29dd5c42cc1d978145ca22", size = 213283, upload-time = "2026-10-15T02:21:28.595Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/87/5d/4221ea4a344ec33d6b54903682ce8ae2013bb0a2d6137c94ac769690ea8b/vmware_policy-1.21.0.tar.gz", hash = "sha256:f42b794ea69e52e1fa13aff8b5bc07631d82683b1c12872f2f2ec744e3853549", size = 303862, upload-time = "2026-10-15T10:13:33.719Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/23/90/14744a439862439d3e8cf122e997d3bd9eee22421fc2760bbc55992710a8/vmware_policy-1.19.0-py3-none-any.whl", hash = "sha256:125d6e7e97a77ad3a150f307cbd6138329d54e8bd695d8ef1c51b16d0e72f931", size = 82881, upload-time = "2026-10-15T02:21:26.952Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/b4/feb7015ae5f7870e8058ad713050f7fe3ddefa57aa7bdd4a83f2e3b9abb4/vmware_policy-1.21.0-py3-none-any.whl", hash = "sha256:a10c26816be09f9a2823cc58bc4eacb9b5eff8b6df49dfc5b504b3d76cb3b7ec", size = 99818, upload-time = "2026-10-15T10:13:31.67Z" },
 ]

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/vmware_pilot/__init__.py

@@ -1,3 +1,3 @@
 """VMware Pilot — multi-step workflow orchestration with approval gates."""
 
-__version__ = "2.0.0"
+__version__ = "2.2.0"

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/vmware_pilot/cli.py

@@ -13,6 +13,7 @@ convention — every sibling skill exposes the same ``<skill> mcp`` subcommand.
 
 from __future__ import annotations
 
+from typing import Optional
 import typer
 
 from vmware_pilot import __version__
@@ -69,13 +70,43 @@ def version_cmd() -> None:
 
 @app.command("mcp")
 @cli_local("starts the MCP server; its tools audit themselves")
-def mcp_cmd() -> None:
-    """Start the MCP server (stdio transport).
+def mcp_cmd(
+    expose: Optional[str] = typer.Option(
+        None,
+        "--expose",
+        help="Which tools to offer: all (default) or read. Limits what clients see; "
+        "not authorization: the account's permissions still decide.",
+    ),
+    allow_write: Optional[str] = typer.Option(
+        None,
+        "--allow-write",
+        help="With --expose read: comma-separated write tools to offer as well.",
+    ),
+    transport: Optional[str] = typer.Option(
+        None,
+        "--transport",
+        help="stdio (default), https, or http (loopback only, behind a TLS reverse proxy). "
+        "https/http need a token: 'vmware-audit token create NAME'.",
+    ),
+    host: Optional[str] = typer.Option(None, "--host", help="Bind address (default 127.0.0.1)."),
+    port: Optional[int] = typer.Option(None, "--port", help="Port (default 8443)."),
+    cert: Optional[str] = typer.Option(None, "--cert", help="TLS certificate (PEM) for https."),
+    key: Optional[str] = typer.Option(None, "--key", help="TLS private key (PEM) for https."),
+    public_name: Optional[str] = typer.Option(
+        None,
+        "--public-name",
+        help="Host names clients use, comma-separated; other Host/Origin values are refused.",
+    ),
+    token_file: Optional[str] = typer.Option(
+        None, "--token-file", help="Token hash file (default $OPS_HOME/mcp-tokens)."
+    ),
+) -> None:
+    """Start the MCP server (stdio by default; --transport https serves the network).
 
     Single-command entry point for MCP clients:
         vmware-pilot mcp
 
-    Equivalent to the legacy `vmware-pilot-mcp` console script.
+    Equivalent to the legacy `vmware-pilot-mcp` console script for stdio (the console script takes no flags).
     """
     import sys
 
@@ -96,7 +127,10 @@ def mcp_cmd() -> None:
 
     from vmware_pilot.mcp_server.server import main as _mcp_main
 
-    _mcp_main()
+    _mcp_main(
+        expose=expose, allow_write=allow_write, transport=transport, host=host, port=port,
+        cert=cert, key=key, public_name=public_name, token_file=token_file,
+    )
 
 
 if __name__ == "__main__":  # pragma: no cover

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/vmware_pilot/mcp_server/server.py

@@ -15,6 +15,7 @@ Exposes 13 tools for AI agents to manage multi-step VMware workflows:
 
 from __future__ import annotations
 
+from typing import Optional
 import logging
 
 from vmware_policy import describe_tool_parameters
@@ -147,10 +148,26 @@ __all__ = [
 ]
 
 
-def main() -> None:
+def main(
+    expose: Optional[str] = None,
+    allow_write: Optional[str] = None,
+    transport: Optional[str] = None,
+    host: Optional[str] = None,
+    port: Optional[int] = None,
+    cert: Optional[str] = None,
+    key: Optional[str] = None,
+    public_name: Optional[str] = None,
+    token_file: Optional[str] = None,
+) -> None:
     """Run the MCP server over stdio."""
     logging.basicConfig(level=logging.INFO)
-    mcp.run(transport="stdio")
+    from vmware_policy.serve import run_server
+    run_server(
+        mcp,
+        skill="pilot",
+        expose=expose, allow_write=allow_write, transport=transport, host=host, port=port,
+        cert=cert, key=key, public_name=public_name, token_file=token_file,
+    )
 
 # The docstrings above are the schema. `describe_tool_parameters` copies each
 # `Args:` entry into the JSON schema an agent actually reads, and closes the

{vmware_pilot-2.0.0 → vmware_pilot-2.2.0}/vmware_pilot/mcp_server/tools/lifecycle.py

@@ -291,7 +291,9 @@ def approve(workflow_id: str, approver: str = "") -> dict:
 
     Args:
         workflow_id: The workflow ID to approve.
-        approver: Name of the person approving (for audit trail).
+        approver: Name of the person approving (for audit trail). Over an
+            authenticated network transport leave it empty: the approver is
+            the caller's token name, and a different name is refused.
 
     Note: this server has no dispatcher — after approval, remaining steps
     are recorded as 'not_executed' and the result carries
@@ -306,6 +308,21 @@ def approve(workflow_id: str, approver: str = "") -> dict:
         if not wf:
             return {"error": f"Workflow '{workflow_id}' not found"}
 
+        # Over HTTPS the approver is who authenticated, not a free-text claim
+        # (HLD §16 D-12): token "bob" must not record an approval as "alice".
+        from vmware_policy.caller import current_caller
+
+        caller = current_caller()
+        if caller is not None:
+            if approver and approver != caller:
+                return {
+                    "error": f"approver {approver!r} differs from the authenticated caller "
+                    f"{caller!r}; over a network transport the approval is recorded as the "
+                    "caller.",
+                    "hint": "Call approve again without 'approver', or have that person "
+                    "approve with their own token.",
+                }
+            approver = caller
         # Non-empty approver enforcement lives in the executor so embedders
         # cannot bypass the audit-trail requirement.
         return _get_executor().resume_after_approval(wf, approver=approver)