VMware Workstation MCP

Item: VMware Workstation MCP
Rating: 62
Author: M8ven

A stdio MCP server that controls VMware Workstation via vmrun, enabling VM lifecycle management and snapshot operations.

→ vnoiram/vmware-workstation-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tool annotations don’t match behaviour

2 read-only tools perform write/delete/exec — list_running_vms (line 95: spawn(vmrun, args, {); list_snapshots (line 35: /^\/mnt\/([a-zA-Z])\/(.*)$/.exec(path))

⚠️

Tool descriptions don’t match what handlers do

2 tools describe read intent but their handlers mutate — list_running_vms (line 95: spawn(vmrun, args, {); list_snapshots (line 35: /^\/mnt\/([a-zA-Z])\/(.*)$/.exec(path))

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configVMRUN_PATH— vmrun.exe が標準の VMware Workstation インストール先にあれば自動検出します。見つからない場合はを指定してください。

configVMRUN_TIMEOUT_MS

configVMWARE_VMX_ROOTS— 検索場所を固定したい場合はにパス区切りで指定できます。

configWSL_DISTRO_NAME

configWSL_INTEROP

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/vnoiram-vmware-workstation-mcp-ijg5q7)](https://m8ven.ai/mcp/vnoiram-vmware-workstation-mcp-ijg5q7)

commit: fc987a9df67065870cd20fe483d75a6e624fe709

code hash: 12bc1e7e2ff484bb73a1f327970f208a559e540bdd54fa136e2911f45cca2de0

verified: 6/26/2026, 9:38:46 AM

view raw JSON →