MCP server for VMware Cloud Foundation Fleet Management, Operations, and SDDC Manager APIs
vcf-mcp exposes 4 well-named tools with clear verb-noun patterns (list_specs, search_endpoints, get_endpoint, call_api). Descriptions are present and substantive (100 - 250 chars), explaining WHAT each tool does and WHEN to use it. Input schemas are visible and typed. However, output schemas are not documented, callers cannot predict response structure. Parameter descriptions are good but lack format constraints (e.g., spec enum, limit bounds). Error handling is minimal; no recovery guidance. The design elegantly abstracts 300+ API operations into 4 composable tools, but lacks LLM-optimized output documentation and validation messaging.
Dynamically construct and execute an HTTP call for a given operation. Looks up the operation's method/path/parameter definitions from the spec, substitutes path_params into the URL template, attaches query_params, sends body as JSON if the operation accepts a request body, and adds the Authorization header automatically from the configured API token env var.
Get full details for one API operation: HTTP method, path template, all parameters (path/query/header, with type/required/description), and the resolved JSON schema for the request body (if any). Use this to know exactly what to pass into call_api.
List the API specs available on this server ('fleet', 'vcf-ops', and 'sddc'), including title, version, how many operations each has, and whether the required base URL and credential environment variables are currently configured.
Search for API operations within a spec ('fleet', 'vcf-ops', or 'sddc') by keyword. Matches against operation_id, path, summary, and tags. Use this first to find the operation_id you need, then call get_endpoint for full details before calling call_api.
Output schemas not documented. Callers cannot predict response structure for list_specs, search_endpoints, get_endpoint, or call_api. LLMs must infer field names and types, risking misuse.
Parameter 'spec' lacks enum constraint. Should declare spec: enum=['fleet', 'vcf-ops', 'sddc'] to prevent hallucinated values and guide LLM selection.
Parameter 'limit' in search_endpoints lacks bounds. Should specify min=1, max=100 (or appropriate cap) to prevent LLM from requesting thousands of results.
Error handling is minimal. call_api can fail (401 on stale token, 4xx on bad params, network timeout) but provides no recovery guidance. Errors should tell LLM: retry? ask user? or fatal?
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 69 | 2026-07-28+ | v2 |
call_api accepts 'body' as free-form object with no schema validation. LLMs cannot know what fields are required or their types. Should document expected body structure per operation or validate and return clear errors.