vmware-pilot 2.2.0__tar.gz → 2.3.0__tar.gz

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-pilot",
   "displayName": "VMware Pilot",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Multi-step workflow orchestration for VMware MCP skills with approval gates and rollback.",
   "author": {
     "name": "Wei Zhou",

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-pilot==2.2.0",
+        "vmware-pilot==2.3.0",
         "vmware-pilot-mcp"
       ]
     }

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-pilot
-Version: 2.2.0
+Version: 2.3.0
 Summary: VMware workflow orchestration — multi-step state machine with approval gates
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Pilot
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Pilot
@@ -146,6 +146,71 @@ update it. Requires vmware-policy ≥ 1.19.0. Details: [RELEASE_NOTES.md](RELEAS
 > corporate proxy (`invalid peer certificate: UnknownIssuer`). The installed entry point above
 > touches the network zero times; set `UV_NATIVE_TLS=true` if you must use `uvx`.
 
+<!-- usage: remote-and-exposure -->
+## Remote access (HTTPS) and limiting tools
+
+By default `vmware-pilot mcp` speaks stdio to one local client and offers every tool. Two options change that
+(vmware-policy ≥ 1.21.0).
+
+**Serve over HTTPS** so clients on other machines can connect. Every caller needs a bearer token:
+
+```bash
+vmware-audit token create alice          # prints the token once; give it to alice
+vmware-audit token list                  # names only
+vmware-audit token revoke alice          # refused from its next request, no restart
+vmware-pilot mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+Connect a client (Claude Code shown; any MCP client that supports streamable HTTP and custom headers works):
+
+```bash
+claude mcp add --transport http vmware-pilot https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+```
+
+```json
+{
+  "mcpServers": {
+    "vmware-pilot": {
+      "type": "http",
+      "url": "https://mcp.example.com:8443/mcp",
+      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
+    }
+  }
+}
+```
+
+- The server will not start without a token, refuses Host/Origin values outside `--public-name`, and checks
+  before it binds that unauthenticated requests get 401. Use a certificate your clients trust for those names.
+- Behind a TLS-terminating reverse proxy on the same machine use `--transport http --host 127.0.0.1
+  --public-name mcp.example.com` and pass the `Authorization` header through.
+- Behind a load balancer or gateway on another machine, keep `--transport https` (a self-signed certificate is
+  fine), list in `--public-name` the host name the balancer sends as `Host`, and have it forward `Authorization`.
+  Its health probe can use `GET /healthz`, which needs no token and returns only `{"status": "ok"}`
+  (vmware-policy ≥ 1.23.0).
+- Send `traceparent` or `X-Request-ID` with each request to have it stored on the audit row;
+  `vmware-audit log --correlation-id ID` then finds the calls behind one platform request.
+- The audit log records each caller as `token:<name>`. Calls naming different targets run in parallel; calls that
+  name no target run one at a time, so name the target when several people share a server.
+- **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
+  nothing on the platform. Run one endpoint per privilege level.
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
+
+**Offer only read tools, plus the writes you choose:**
+
+```bash
+vmware-pilot mcp --expose read --allow-write cancel_workflow
+# or: VMWARE_PILOT_MCP_EXPOSE=read VMWARE_PILOT_MCP_ALLOW_WRITE=cancel_workflow vmware-pilot mcp
+```
+
+Tools not offered do not appear in the client's tool list. A bad value or an unknown write tool stops the server
+(exit 2). This limits what clients are offered; it is not authorization, so the account itself should be
+least-privilege.
+
+Details: `skills/vmware-pilot/references/setup-guide.md` ("Serving MCP over HTTPS", "Limiting which tools are offered").
+
 ## License
 
 MIT

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/README-CN.md

@@ -105,6 +105,69 @@ CLI 命令也不变。技能目录同时跟随 vmware-vks 的改名（`get_super
 - 查看最近操作：`vmware-audit log --last 20`
 - 查看被拒绝的操作：`vmware-audit log --status denied`
 
+<!-- usage: remote-and-exposure -->
+## 远程访问（HTTPS）与限制工具
+
+默认情况下 `vmware-pilot mcp` 通过 stdio 服务一个本地客户端，并提供全部工具。以下两个选项可以改变这一点
+（需 vmware-policy ≥ 1.21.0）。
+
+**通过 HTTPS 提供服务**，让其他机器上的客户端连接。每个调用者都需要一个 bearer token：
+
+```bash
+vmware-audit token create alice          # 只显示一次，交给 alice
+vmware-audit token list                  # 只列名字
+vmware-audit token revoke alice          # 下一个请求起即拒绝，无需重启
+vmware-pilot mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+连接客户端（以 Claude Code 为例；任何支持 streamable HTTP 和自定义请求头的 MCP 客户端都可以）：
+
+```bash
+claude mcp add --transport http vmware-pilot https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+```
+
+```json
+{
+  "mcpServers": {
+    "vmware-pilot": {
+      "type": "http",
+      "url": "https://mcp.example.com:8443/mcp",
+      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
+    }
+  }
+}
+```
+
+- 没有 token 时服务不会启动；`--public-name` 之外的 Host/Origin 一律拒绝；绑定端口前会自检，确认未认证请求得到 401。
+  证书要用客户端信任、且覆盖这些名字的证书。
+- 在同一台机器上由反向代理终结 TLS 时，用 `--transport http --host 127.0.0.1 --public-name mcp.example.com`，
+  并让代理透传 `Authorization` 头。
+- 负载均衡或网关在另一台机器上时，保持 `--transport https`（自签证书也可以），在 `--public-name` 里写上负载均衡
+  转发时带的 `Host` 名，并让它透传 `Authorization`。健康检查可以用 `GET /healthz`：不需要 token，只返回
+  `{"status": "ok"}`（需 vmware-policy ≥ 1.23.0）。
+- 每个请求带上 `traceparent` 或 `X-Request-ID`，它会记进审计记录；用 `vmware-audit log --correlation-id ID`
+  就能查到平台上某一次请求对应的调用。
+- 审计日志把每个调用者记为 `token:<名字>`。指定不同 target 的调用并行执行；不指定 target 的调用逐个执行，
+  所以多人共用一个 server 时请写明 target。
+- **能连到这个端点的人，都以该 server 配置的账号操作。** token 只用来识别调用者，不在平台上授予任何权限。
+  每个权限级别单独起一个端点。
+- **一个端点给多人或多种角色用：** 先运行一次 `vmware-audit roles enable`，再给每个 token 指定角色（`vmware-audit token create 名字 --role reader`，或在 `roles.yaml` 里定义可用的工具和 target；需 vmware-policy ≥ 1.24.0）。角色只能限定这个 token 在本端点上能调用什么，不能超出账号本身的权限。详见 vmware-policy README 的「网络调用者的角色」一节。
+
+**只提供读工具，加上你选定的写工具：**
+
+```bash
+vmware-pilot mcp --expose read --allow-write cancel_workflow
+# 或：VMWARE_PILOT_MCP_EXPOSE=read VMWARE_PILOT_MCP_ALLOW_WRITE=cancel_workflow vmware-pilot mcp
+```
+
+未提供的工具不会出现在客户端的工具列表里。取值错误或写工具名不存在时服务直接退出（exit 2）。
+这只限制提供给客户端的工具，不是授权；账号本身仍应遵循最小权限。
+
+详见 `skills/vmware-pilot/references/setup-guide.md`（"Serving MCP over HTTPS"、"Limiting which tools are offered"）。
+
 ## 许可证
 
 MIT

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/README.md

@@ -129,6 +129,71 @@ update it. Requires vmware-policy ≥ 1.19.0. Details: [RELEASE_NOTES.md](RELEAS
 > corporate proxy (`invalid peer certificate: UnknownIssuer`). The installed entry point above
 > touches the network zero times; set `UV_NATIVE_TLS=true` if you must use `uvx`.
 
+<!-- usage: remote-and-exposure -->
+## Remote access (HTTPS) and limiting tools
+
+By default `vmware-pilot mcp` speaks stdio to one local client and offers every tool. Two options change that
+(vmware-policy ≥ 1.21.0).
+
+**Serve over HTTPS** so clients on other machines can connect. Every caller needs a bearer token:
+
+```bash
+vmware-audit token create alice          # prints the token once; give it to alice
+vmware-audit token list                  # names only
+vmware-audit token revoke alice          # refused from its next request, no restart
+vmware-pilot mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+Connect a client (Claude Code shown; any MCP client that supports streamable HTTP and custom headers works):
+
+```bash
+claude mcp add --transport http vmware-pilot https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+```
+
+```json
+{
+  "mcpServers": {
+    "vmware-pilot": {
+      "type": "http",
+      "url": "https://mcp.example.com:8443/mcp",
+      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
+    }
+  }
+}
+```
+
+- The server will not start without a token, refuses Host/Origin values outside `--public-name`, and checks
+  before it binds that unauthenticated requests get 401. Use a certificate your clients trust for those names.
+- Behind a TLS-terminating reverse proxy on the same machine use `--transport http --host 127.0.0.1
+  --public-name mcp.example.com` and pass the `Authorization` header through.
+- Behind a load balancer or gateway on another machine, keep `--transport https` (a self-signed certificate is
+  fine), list in `--public-name` the host name the balancer sends as `Host`, and have it forward `Authorization`.
+  Its health probe can use `GET /healthz`, which needs no token and returns only `{"status": "ok"}`
+  (vmware-policy ≥ 1.23.0).
+- Send `traceparent` or `X-Request-ID` with each request to have it stored on the audit row;
+  `vmware-audit log --correlation-id ID` then finds the calls behind one platform request.
+- The audit log records each caller as `token:<name>`. Calls naming different targets run in parallel; calls that
+  name no target run one at a time, so name the target when several people share a server.
+- **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
+  nothing on the platform. Run one endpoint per privilege level.
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
+
+**Offer only read tools, plus the writes you choose:**
+
+```bash
+vmware-pilot mcp --expose read --allow-write cancel_workflow
+# or: VMWARE_PILOT_MCP_EXPOSE=read VMWARE_PILOT_MCP_ALLOW_WRITE=cancel_workflow vmware-pilot mcp
+```
+
+Tools not offered do not appear in the client's tool list. A bad value or an unknown write tool stops the server
+(exit 2). This limits what clients are offered; it is not authorization, so the account itself should be
+least-privilege.
+
+Details: `skills/vmware-pilot/references/setup-guide.md` ("Serving MCP over HTTPS", "Limiting which tools are offered").
+
 ## License
 
 MIT

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/RELEASE_NOTES.md

@@ -1,3 +1,17 @@
+## v2.3.0 — roles for network callers (HLD §18)
+
+* Workflows record their creator (`created_by`: the network caller `token:<name>`, or the OS user). Workflows saved
+  before this release have none.
+* With vmware-policy ≥ 1.24.0 and roles enabled, `approve` follows the caller's role: `approve: none` cannot
+  approve, `approve: others` cannot approve a workflow its own token created (nor one with no recorded creator),
+  `approve: any` can. The token also needs a role that allows the `approve` tool itself. Whoever edits a draft
+  (`update_draft`) or confirms it (`confirm_draft`) is recorded in `authors` and counts as its creator for
+  `others`; so is whoever saved a custom template, for workflows made from it (the YAML records `authors`).
+  A refusal is audited as `denied` with `rule=role:<name>`.
+* Approval is an audited attestation, not a gate on execution: this server does not run other skills' steps, it
+  returns them (`pending_dispatch`) and each skill's server checks the caller's own role there.
+* Declares role metadata (no tool takes a target). README and setup guide: one endpoint for several people or roles.
+
 ## v2.2.0 — serve MCP over HTTPS
 
 `vmware-pilot mcp` can now serve the network as well as stdio (HLD §16, via vmware-policy 1.21.0):
@@ -8,6 +22,15 @@ vmware-pilot mcp --transport https --host 0.0.0.0 --port 8443 \
     --cert server.pem --key server-key.pem --public-name mcp.example.com
 ```
 
+Connect a client and manage callers (Claude Code shown; any MCP client with streamable HTTP and custom headers works):
+
+```bash
+claude mcp add --transport http vmware-pilot https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+vmware-audit token list                  # names only
+vmware-audit token revoke alice          # refused from its next request, no restart
+```
+
 * Every request needs `Authorization: Bearer <token>`; the server will not start without a token, refuses Host or
   Origin values outside `--public-name`, and checks itself (unauthenticated requests must get 401) before it
   binds. `--transport http` binds loopback only, for a TLS-terminating reverse proxy.

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-pilot==2.2.0",
+        "vmware-pilot==2.3.0",
         "vmware-pilot-mcp"
       ]
     }

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-pilot",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Multi-step workflow orchestration for VMware MCP skills with approval gates and rollback.",
   "private": true,
   "license": "MIT",

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-pilot"
-version = "2.2.0"
+version = "2.3.0"
 description = "VMware workflow orchestration — multi-step state machine with approval gates"
 readme = "README.md"
 license = "MIT"

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-Pilot",
     "source": "github"
   },
-  "version": "2.2.0",
+  "version": "2.3.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-pilot",
-      "version": "2.2.0",
+      "version": "2.3.0",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/skills/vmware-pilot/SKILL.md

@@ -42,7 +42,7 @@ Multi-step workflow orchestration for VMware MCP skills — design, approve, exe
 ## Quick Install
 
 ```bash
-uv tool install vmware-pilot==2.2.0
+uv tool install vmware-pilot==2.3.0
 vmware-pilot mcp          # start the MCP server (stdio)
 ```
 
@@ -147,7 +147,7 @@ Deploy a backend VM, create a K8s namespace, and wire up AKO Ingress to the AVI
 
 This is intentional v2-style architecture: pilot's context stays small, state is always on disk, and there are no persistent agent threads. Full contract details: see [`references/integration-patterns.md`](references/integration-patterns.md#the-dispatch-contract).
 
-**`get_skill_catalog` is a curated design aid, not a whitelist.** It surfaces 100 hand-picked building blocks across 13 skills — a deliberate subset of what those skills expose (aiops alone has 60 tools; the catalog lists 19). A step's `skill` field is a free-form string handed to the calling agent, so a workflow may name any companion skill, including ones the catalog does not list — pilot itself (`pilot`) is used that way by built-in templates for approval gates. Use the catalog for inspiration; consult the target skill's own SKILL.md for its full tool surface.
+**`get_skill_catalog` is a curated design aid, not a whitelist.** It surfaces 100 hand-picked building blocks across 13 skills — a deliberate subset of what those skills expose (aiops alone has 61 tools; the catalog lists 19). A step's `skill` field is a free-form string handed to the calling agent, so a workflow may name any companion skill, including ones the catalog does not list — pilot itself (`pilot`) is used that way by built-in templates for approval gates. Use the catalog for inspiration; consult the target skill's own SKILL.md for its full tool surface.
 
 ## MCP Tools (13 — 4 read, 9 write/control)
 
@@ -303,7 +303,7 @@ No vCenter credentials needed — pilot orchestrates other skills that handle co
 }
 ```
 
-> Fallback: `{"command": "uvx", "args": ["--from", "vmware-pilot==2.2.0", "vmware-pilot-mcp"]}` also
+> Fallback: `{"command": "uvx", "args": ["--from", "vmware-pilot==2.3.0", "vmware-pilot-mcp"]}` also
 > works, but `uvx` re-resolves the package against PyPI on every start and fails behind a
 > TLS-inspecting corporate proxy (`invalid peer certificate: UnknownIssuer`). The installed
 > entry point above touches the network zero times; set `UV_NATIVE_TLS=true` if you must use `uvx`.

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/skills/vmware-pilot/references/capabilities.md

@@ -55,21 +55,21 @@ numbers matter here, and they are not the same thing:
 
 | Skill | Package | Skill tools | In design catalog | Domain |
 |-------|---------|:-----------:|:-----------------:|--------|
-| vmware-aiops | `vmware-aiops` | 60 | 19 | VM lifecycle, deployment, guest ops, clusters |
-| vmware-monitor | `vmware-monitor` | 32 | 5 | Read-only inventory, alarms, events |
+| vmware-aiops | `vmware-aiops` | 61 | 19 | VM lifecycle, deployment, guest ops, clusters |
+| vmware-monitor | `vmware-monitor` | 33 | 5 | Read-only inventory, alarms, events |
 | vmware-nsx | `vmware-nsx-mgmt` | 33 | 8 | NSX segments, gateways, NAT, routing, IPAM |
 | vmware-nsx-security | `vmware-nsx-security` | 22 | 7 | DFW policies/rules, security groups, traceflow |
-| vmware-aria | `vmware-aria` | 44 | 7 | Aria Ops metrics, alerts, capacity, anomalies |
-| vmware-vks | `vmware-vks` | 23 | 8 | Tanzu Supervisor, Namespaces, TKC clusters |
-| vmware-storage | `vmware-storage` | 14 | 5 | Datastores, iSCSI, vSAN, FC multipath |
+| vmware-aria | `vmware-aria` | 46 | 7 | Aria Ops metrics, alerts, capacity, anomalies |
+| vmware-vks | `vmware-vks` | 24 | 8 | Tanzu Supervisor, Namespaces, TKC clusters |
+| vmware-storage | `vmware-storage` | 15 | 5 | Datastores, iSCSI, vSAN, FC multipath |
 | vmware-avi | `vmware-avi` | 28 | 13 | AVI load balancing, pool members, AKO K8s ops |
 | vmware-debug | `vmware-debug` | 14 | 5 | Incident correlation, evidence-graded cases |
 | vmware-harden | `vmware-harden` | 8 | 5 | Compliance baselines, violations, drift |
 | vmware-log-insight | `vmware-log-insight` | 7 | 4 | Log search, aggregation, alerts |
-| vmware-privateai | `vmware-privateai` | 17 | 5 | GPU hosts, vGPU profiles, utilisation |
+| vmware-privateai | `vmware-privateai` | 18 | 5 | GPU hosts, vGPU profiles, utilisation |
 | vmware-vdi | `vmware-vdi` | 27 | 9 | Horizon pools, sessions, machines, images |
 
-**Totals**: 329 tools across the 13 companion skills; the design catalog covers 100 of them
+**Totals**: 336 tools across the 13 companion skills; the design catalog covers 100 of them
 across all 13. Pilot adds 13 orchestration tools of its own. The counts are checked against
 the companion snapshot by `tests/eval/regression/test_catalog_covers_the_family.py`.
 

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/skills/vmware-pilot/references/cli-reference.md

@@ -19,12 +19,12 @@ client.
 
 ```bash
 # Recommended: installed entry point, never touches the network
-uv tool install vmware-pilot==2.2.0
+uv tool install vmware-pilot==2.3.0
 vmware-pilot mcp
 
 # Fallback: uvx re-resolves against PyPI each start and fails behind a
 # TLS-inspecting corporate proxy — set UV_NATIVE_TLS=true if you must use it
-uvx --from vmware-pilot==2.2.0 vmware-pilot-mcp
+uvx --from vmware-pilot==2.3.0 vmware-pilot-mcp
 ```
 
 The server runs on **stdio** transport and exposes 13 MCP tools (4 read, 9 write).

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/skills/vmware-pilot/references/setup-guide.md

@@ -11,16 +11,16 @@
 ### Via uv (Recommended)
 
 ```bash
-uv tool install vmware-pilot==2.2.0
+uv tool install vmware-pilot==2.3.0
 ```
 
 ### Via pip
 
 ```bash
-uv tool install vmware-pilot==2.2.0
+uv tool install vmware-pilot==2.3.0
 
 # China mainland mirror
-pip install vmware-pilot==2.2.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
+pip install vmware-pilot==2.3.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
 ```
 
 ### Verify Installation
@@ -84,7 +84,7 @@ The `uvx` form still works and needs no prior install:
   "mcpServers": {
     "vmware-pilot": {
       "command": "uvx",
-      "args": ["--from", "vmware-pilot==2.2.0", "vmware-pilot-mcp"]
+      "args": ["--from", "vmware-pilot==2.3.0", "vmware-pilot-mcp"]
     }
   }
 }
@@ -100,7 +100,7 @@ invalid peer certificate: UnknownIssuer
 
 `uv` ships its own certificate bundle and ignores the system trust store, which is what breaks.
 Either set `UV_NATIVE_TLS=true` so it honours your corporate CA, or install the tool once
-(`uv tool install vmware-pilot==2.2.0`) and launch `vmware-pilot mcp`, which touches the network
+(`uv tool install vmware-pilot==2.3.0`) and launch `vmware-pilot mcp`, which touches the network
 zero times.
 
 ---
@@ -132,6 +132,42 @@ vmware-pilot mcp --expose read --allow-write cancel_workflow
 - This limits what clients are offered. It is **not** authorization. This server's write tools change workflow state on this machine; the steps it runs act through the other skills' accounts;
   deny rules in `~/.vmware/rules.yaml` still apply to every exposed tool.
 
+## Serving MCP over HTTPS
+
+By default the MCP server speaks stdio to one local client. To let clients on other machines reach it, serve it over
+HTTPS. Every caller then needs a bearer token.
+
+```bash
+vmware-audit token create alice                      # prints the token once; give it to alice
+vmware-pilot mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+- Clients connect to `https://mcp.example.com:8443/mcp` and send `Authorization: Bearer <token>`.
+- `--public-name` lists every host name clients use (comma-separated); requests for any other Host or Origin are
+  refused. Use a certificate your clients trust for those names.
+- Behind a reverse proxy that terminates TLS (Nginx, HAProxy) on the same machine, use
+  `--transport http --host 127.0.0.1 --public-name mcp.example.com` (the names the proxy forwards in `Host`), and
+  have the proxy pass the `Authorization` header through.
+- Behind a load balancer or gateway on another machine, keep `--transport https` (a self-signed certificate is
+  fine: the balancer is the client that has to trust it), list in `--public-name` the host name the balancer sends
+  as `Host`, and have it forward `Authorization`. Point its health probe at `GET /healthz`: it needs no token, returns
+  only `{"status": "ok"}` and accepts any `Host` (vmware-policy ≥ 1.23.0). Every other path still needs the token.
+- Correlation: each audit row stores the caller's `traceparent` trace-id, else its `X-Request-ID` /
+  `X-Correlation-ID`. Have the agent platform send one, and `vmware-audit log --correlation-id ID` lists the calls
+  behind one platform request.
+- `vmware-audit token list` / `token revoke NAME` manage callers; a revoked token is refused from its next request.
+  Replace a leaked token under a new name.
+- The server will not start without at least one token, and checks before it binds that unauthenticated requests
+  are refused.
+- Each audit row records the caller as `token:<name>`. Calls naming different targets run in parallel; calls that
+  name no target run one at a time, so name the target when several people use one server.
+- **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
+  nothing on the platform. Run one endpoint per privilege level (for example a read-only account behind
+  `--expose read`, and a separate endpoint for operators).
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
+
 ## Configuration
 
 Pilot itself requires **no vCenter/NSX/AVI credentials**. It is a pure orchestrator that delegates all infrastructure calls to companion skills.

{vmware_pilot-2.2.0 → vmware_pilot-2.3.0}/tests/fixtures/companion_tools.json

@@ -353,6 +353,13 @@
     "vm_name"
    ]
   },
+  "get_access_info": {
+   "properties": [
+    "target",
+    "tool"
+   ],
+   "required": []
+  },
   "get_cluster_health_summary": {
    "properties": [
     "cluster_filter",
@@ -827,6 +834,16 @@
     "alert_id"
    ]
   },
+  "get_api_path": {
+   "properties": [
+    "params",
+    "path",
+    "target"
+   ],
+   "required": [
+    "path"
+   ]
+  },
   "get_aria_health": {
    "properties": [
     "target"
@@ -1127,6 +1144,15 @@
     "query"
    ]
   },
+  "search_api_operations": {
+   "properties": [
+    "limit",
+    "query"
+   ],
+   "required": [
+    "query"
+   ]
+  },
   "set_alert_definition_state": {
    "properties": [
     "definition_id",
@@ -1625,6 +1651,13 @@
    ],
    "required": []
   },
+  "get_access_info": {
+   "properties": [
+    "target",
+    "tool"
+   ],
+   "required": []
+  },
   "get_alarms": {
    "properties": [
     "limit",
@@ -2526,6 +2559,13 @@
    ],
    "required": []
   },
+  "get_access_info": {
+   "properties": [
+    "target",
+    "tool"
+   ],
+   "required": []
+  },
   "get_gpu_host": {
    "properties": [
     "host_name",
@@ -2692,6 +2732,13 @@
     "host_name"
    ]
   },
+  "get_access_info": {
+   "properties": [
+    "target",
+    "tool"
+   ],
+   "required": []
+  },
   "get_iscsi_status": {
    "properties": [
     "host_name",
@@ -3136,6 +3183,13 @@
     "namespace"
    ]
   },
+  "get_access_info": {
+   "properties": [
+    "target",
+    "tool"
+   ],
+   "required": []
+  },
   "get_harbor_info": {
    "properties": [
     "target"