nutanix-aiops-x-3

内容来源：clawhub · 原始地址 · 查看安装指南

原始内容

name: nutanix-aiops slug: nutanix-aiops displayName: "Nutanix AIops" summary: "Governed Nutanix Prism Central v4 ops: clusters/VMs/storage/DR/LCM/RCA, ETag-safe, 51 tools." license: MIT homepage: https://github.com/AIops-tools/Nutanix-AIops tags: [aiops, mcp, governance, nutanix] description: > Use this skill whenever the user needs to operate a Nutanix estate through Prism Central (v4 REST API) — an estate/cluster health overview, cluster & host inventory and utilization, VM lifecycle across AHV and ESXi (list/get/power/create/update/clone/delete/migrate), storage containers, subnets/network, images & categories, data protection / DR (snapshots, recovery points, protection domains, VM protect, failover), alerts & events with alert RCA (analyze_alert), LCM firmware/software upgrades, capacity runway forecasting, and read-only diagnostics/RCA over the whole estate (cluster_health_rca, alert_triage_rca). Always use this skill for "Nutanix", "Prism Central", "AHV", "cluster health", "list VMs", "power on/off a VM", "clone/migrate a VM", "delete a VM", "snapshot", "recovery point", "protection domain", "failover", "why did this alert fire" / "root cause this alert", "LCM upgrade / firmware", "days until storage is full" / "capacity runway", "what's wrong with my cluster" / "diagnose the estate", "triage my alerts", when the context is a Nutanix cluster or Prism Central. Do NOT use when the target is a non-Nutanix platform — those belong to their own AIops-tools sibling; this skill is Prism Central v4 only. Governed Nutanix Prism Central operations with a built-in governance harness (audit, token budget, undo, descriptive risk-tier labels). installer: kind: uv package: nutanix-aiops argument-hint: "[VM/cluster extId or describe your Nutanix task]" allowed-tools:

  • Bash metadata: {"openclaw":{"requires":{"env":["NUTANIX_AIOPS_CONFIG"],"bins":["nutanix-aiops"],"config":["/.nutanix-aiops/config.yaml","/.nutanix-aiops/secrets.enc"]},"optional":{"env":["NUTANIX_AIOPS_MASTER_PASSWORD"]},"primaryEnv":"NUTANIX_AIOPS_CONFIG","homepage":"https://github.com/AIops-tools/Nutanix-AIops","emoji":"🧊","os":["macos","linux"]}} compatibility: > Standalone, self-governed Nutanix Prism Central operations. The governance harness (audit, token/runaway budget, undo, descriptive risk-tier labels) is bundled in the package — no external skill-family dependency. Connects to Prism Central on HTTPS :9440 with HTTP Basic auth (username + password). The v4 REST API requires an ETag/If-Match on every mutation; nutanix-aiops fetches and sends it automatically. All list tools paginate automatically; vm_list returns both AHV and ESXi VMs. All write operations are audited to a local SQLite DB under ~/.nutanix-aiops/ (relocatable via NUTANIX_AIOPS_HOME). Credentials: the Prism Central password is stored ENCRYPTED in ~/.nutanix-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'nutanix-aiops init' to onboard, or 'nutanix-aiops secret set ' to add one. The store is unlocked by a master password from NUTANIX_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var NUTANIX__PASSWORD is still honoured as a fallback with a deprecation warning (migrate with 'nutanix-aiops secret migrate'). The account needs REST API rights, not just Web UI access. State-changing operations require the @governed_tool decorator (budget guard + audit + risk-tier tagging). The skill does not decide whether a write is permitted — that is the agent's judgement or the connecting account's permissions. High-risk ops (vm_delete, vm_migrate, storage_container_delete, subnet_delete, snapshot_delete, snapshot_restore, pd_failover, image_delete, lcm_update) support dry_run and, at the CLI, double confirmation; reversible writes record an undo descriptor (vm_update → prior CPU/memory, vm_migrate → prior host). NUTANIX_AUDIT_APPROVED_BY and NUTANIX_AUDIT_RATIONALE are optional annotations recorded on the audit row (who/why); they are never required and never block a call. SSL: verify_ssl defaults to true; disable only for self-signed lab / Community Edition certificates. Transitive dependencies: httpx (HTTP client) and the MCP SDK. No post-install scripts or background services. Validation status: behaviour is currently validated against mocked v4 REST responses; the LCM update, PD failover, and ESXi-VM listing paths in particular still need live verification (self-testable free on Nutanix Community Edition + X-Small Prism Central). See docs/VERIFICATION.md in the repo for the live-verification checklist.

Nutanix AIops

Disclaimer: Community-maintained open-source project, not affiliated with, endorsed by, or sponsored by Nutanix. Product and trademark names belong to their owners. Source at github.com/AIops-tools/Nutanix-AIops under the MIT license.

Governed Nutanix Prism Central (v4 REST API) operations — 51 MCP tools, every one wrapped with the bundled @governed_tool harness: a local unified audit log under ~/.nutanix-aiops/, token/runaway budget guard, undo-token recording, and descriptive risk-tier labels. The Prism Central password is stored encrypted (~/.nutanix-aiops/secrets.enc, Fernet + scrypt) — never plaintext on disk.

What sets it apart from read-only Nutanix MCPs: (1) automatic ETag / If-Match on every mutation — the v4 footgun handled for you; (2) automatic pagination; (3) mixed-hypervisor VM listing (AHV + ESXi, relevant to hypervisor-migration estates); and (4) the governance harness with dry-run + double-confirm on destructive writes.

Standalone: the governance harness is bundled in the package (nutanix_aiops.governance) — no external skill-family dependency.

What This Skill Does

Group Tools Count Read / Write
Clusters cluster_list, cluster_health, host_list, cluster_utilization 4 4 read
VMs list, get, power_on, guest_shutdown, power_off, reboot, create, update, clone, delete, migrate 11 2 read · 9 write
Storage container list / create / update / delete 4 1 read · 3 write
Network subnet list / get / create / delete 4 2 read · 2 write
Catalog image list / delete, category list / create / assign 5 2 read · 3 write
Data protection / DR snapshot list/create/delete/restore, recovery_point_list, protection_domain_list, vm_protect, pd_failover 8 3 read · 5 write
Alerts alert_list, event_list, audit_list, analyze_alert (RCA), alert_acknowledge, alert_resolve 6 4 read · 2 write
LCM (upgrades) lcm_inventory, lcm_precheck, lcm_update 3 1 read · 2 write
Capacity task_list, capacity_runway 2 2 read
Diagnostics / RCA cluster_health_rca, alert_triage_rca 2 2 read
Undo undo_list, undo_apply 2 1 read · 1 write
Total 51 24 read · 27 write

The CLI is a convenience subset; the full 51-tool surface is via the MCP server. See references/capabilities.md for the tool → API-path → returns map.

Quick Install

uv tool install nutanix-aiops
nutanix-aiops init       # interactive wizard: PC host/port 9440/username + encrypted password
nutanix-aiops doctor     # connectivity + REST-RBAC preflight

When to Use This Skill

  • Diagnose the estate in one shot (diagnose cluster-health): degraded resiliency, storage pools/containers over 80% / 90%, nodes down or missing — worst-first, each finding citing the measured number
  • Triage the alert backlog (diagnose alert-triage): per-severity counts, unacknowledged criticals, the oldest unresolved alert and its age
  • Inspect the estate (overview, cluster health, cluster util): clusters, hosts, resiliency, utilization
  • VM lifecycle across AHV + ESXi (vm list/get/power/create/update/clone), and guarded destructive ops (vm delete, vm migrate) with dry-run + double-confirm
  • Root-cause an alert (analyze_alert) — correlate it with related events into a probable-cause + suggested-actions summary
  • Data protection: snapshots, recovery points, protection domains, vm_protect, pd_failover
  • Upgrades (lcm_inventory → lcm_precheck → lcm_update) and capacity forecasting (capacity_runway)

Do NOT use when the target is a non-Nutanix platform — this skill is Prism Central v4 only. For other infrastructure, use the appropriate other AIops-tools sibling.

Common Workflows

"Something is wrong with the estate" → diagnose, then act

  1. nutanix-aiops diagnose cluster-health → worst-first findings, e.g. critical · prod-cluster · storage container near full · 93.0% used >= 90.0% threshold
  2. storage_container_list → confirm which container it is and what its maxCapacityBytes / logicalUsageBytes actually are
  3. recovery_point_list / snapshot_list <vm_ext_id> → the usual culprit is snapshot sprawl in that container
  4. snapshot_delete <…> --dry-run to preview, then re-run to reclaim space — optionally set NUTANIX_AUDIT_APPROVED_BY first to annotate who authorized it; each deletion is audited and records an undo descriptor
  5. Re-run diagnose cluster-health → the finding should drop below the 80% warning threshold; the before/after percentages are your evidence

Triage a cluster alert (RCA)

  1. nutanix-aiops diagnose alert-triage (or alert_list) → per-severity counts and the oldest unresolved alert, so you know which extId to open first
  2. analyze_alert <alert_ext_id> → probable cause + suggested actions, built by correlating the alert with related event_list records
  3. Confirm blast radius with cluster_health / cluster_utilization, then alert_acknowledge (or alert_resolve once fixed)

Safely delete a VM (high-risk, audited)

  1. vm_get <vm_ext_id> → confirm it's the right VM (and see its ETag)
  2. nutanix-aiops vm delete <vm_ext_id> --dry-run → preview the exact DELETE call
  3. Optionally annotate who/why: export NUTANIX_AUDIT_APPROVED_BY=… NUTANIX_AUDIT_RATIONALE=…
  4. Re-run without --dry-run (double-confirm at the CLI); the call is audited with tier and any approver/rationale supplied

Snapshot sprawl cleanup

  1. recovery_point_list (or per-VM snapshot_list <vm_ext_id>) → find stale / redundant snapshots
  2. snapshot_delete <…> --dry-run on each candidate → preview
  3. Re-run without dry-run (HIGH risk, double-confirm at the CLI) to reclaim space; each deletion is audited

Capacity runway

  1. cluster_utilization <cluster_ext_id> → current CPU / memory / storage / IOPS
  2. capacity_runway → days-to-full forecast per resource; use it to schedule an lcm expansion or storage add before you hit the wall

Migrate a VM to another host (reversible)

  1. host_list → pick the destination host extId
  2. nutanix-aiops vm migrate <vm_ext_id> <target_host_ext_id> --dry-run → preview
  3. Re-run without dry-run (HIGH, double-confirm); the prior host is captured as an undo descriptor so a regression can be reversed

Governance & Safety

The skill delivers reads and writes and records them; it does not decide whether a write is permitted. That is your agent's judgement, or the permission of the account you connect it with (connect with a Prism Central account holding only a read-only (Viewer) role — writes then fail at the server). There is no read-only switch, policy file, or approval gate.

  • Audit is the guarantee, and it is not bypassable. Every operation — MCP and CLI alike — is logged to ~/.nutanix-aiops/audit.db (relocatable via NUTANIX_AIOPS_HOME): params, result, status, duration, and the risk tier. The CLI writes the same row the MCP path does.
  • NUTANIX_AUDIT_APPROVED_BY / NUTANIX_AUDIT_RATIONALE are optional annotations recorded on the audit row (who/why); they are never required and never block.
  • Runaway guard — a safety backstop, not authorization: the same call looped in a tight window trips a circuit breaker. Disable with NUTANIX_RUNAWAY_MAX=0.
  • Every mutation auto-handles ETag / If-Match; every list auto-paginates.
  • Destructive writes support dry_run / --dry-run and, at the CLI, double confirmation.
  • Reversible writes record an undo descriptor (vm_update → prior CPU/memory, vm_migrate → prior host).

References

  • references/capabilities.md — full 51-tool + API-path reference
  • references/cli-reference.md — CLI command reference
  • references/setup-guide.md — onboarding, credentials, REST-RBAC, CE self-test
  • references/agent-guardrails.md — which guardrails the harness enforces for you, and a ready-to-paste system prompt for smaller / local models

本页内容由上游仓库自动镜像，如有疑问请访问原始仓库。