VCF Regulatory Compliance

An MCP server that interfaces with VMware Aria Operations to run regulatory compliance checks (ISO 27001, PCI DSS, CIS, etc.) against the VCF environment.

This skill appears to do what it says, but review a few operational-security items before installing: 1) Only provide ARIA_OPS_API_TOKEN that has the minimum privileges needed for read-only compliance queries and rotate the token regularly. 2) Run the MCP server on a host with restricted network access and ensure ARIA_OPS_HOST points to your internal Aria Operations instance (do not point to unknown external hosts). 3) Note server.py disables TLS verification (verify=False) to allow self-signed certs — accept this only if you trust the network path; consider replacing with a CA-trusted cert or enabling verification. 4) Inspect the included server.py yourself (or with your security team) before supplying secrets. 5) If you plan to allow autonomous invocation, be aware the agent could call the tool automatically — restrict token scope and monitor usage/logging.

Type: OpenClaw Skill Name: vcf-compliance-mcp Version: 1.0.1 The skill contains a security vulnerability in server.py where SSL certificate verification is explicitly disabled (verify=False), which could expose the ARIA_OPS_API_TOKEN to Man-in-the-Middle (MitM) attacks. Additionally, the script includes a hardcoded simulated payload that returns mock compliance data if the API call fails, which might lead an AI agent to report fabricated security status as factual.