Zero-dependency Python tool for VMware Sales Engineers, Solution Architects, and IT teams to assess server hardware for VMware Cloud Foundation 9.1 and vSAN Express Storage Architecture (ESA) repurposing.
Automated enterprise fleet telemetry, memory topology visualizer, ToR fabric mapping, vSAN ESA HCL validation & 84-point BMC security audit.
Watch short step-by-step video guides to get up and running, launch on macOS, and interpret generated assessment reports.
| Scanner Quick Start (1:19) | Report Overview (8:20) | Launch for Mac from Python (0:55) |
|---|---|---|
 |
 |
 |
| Target entry, credentials, TLS certificates, and initiating a fleet assessment | Detailed walkthrough of fleet summary badges, tabs, BIOS drift, and host sub-reports | Terminal launch with Python standard library on macOS workstations |
The recommended and verified installation runs directly from source using the Python 3.9+ standard library (zero external dependencies).
-2ea44f?style=for-the-badge&logo=github&logoColor=white){kind=icon}
Includes complete source code, web UI, CLI scanner, and offline HCL database. No pip install required.
Alternative: Pre-compiled standalone binaries (unsigned developer builds)
If Python is not available on your system, standalone executables are provided on the GitHub Release 9.11.0 page:
- Windows:
VCF-Readiness-Web-v9.11.0-win.zip(extract and double-click the executable; may show Windows SmartScreen notice). The archive includesLaunch-VCF-Readiness-Web.batas a shortcut to the executable. - macOS:
VCF-Readiness-Web-v9.11.0-mac.zip(contains launcher script; may require Gatekeeper right-click Open override).
Note: These are unsigned community convenience builds. To avoid operating system security prompts, running directly from source with Python 3.9+ is strongly recommended.
For other release options, view all release tags.
You need:
- Python 3.9 or newer.
- A current browser for the local web interface.
- Network access from this computer to each BMC management address.
- A BMC account intended for read-only inventory access.
- Permission from the system or network owner to assess the targets.
Check Python:
python3 --version # macOS or Linux
python --version # WindowsRun all commands below from the repository root, the directory containing vcfr_web.py.
- BMC: the out-of-band management controller, such as Dell iDRAC, HPE iLO, Lenovo XCC, Cisco IMC, or a generic Redfish controller.
- Redfish: the HTTPS management API used to read hardware inventory.
- VCF: VMware Cloud Foundation.
- vSAN ESA/OSA: vSAN storage architectures evaluated by the readiness rules.
- HCL/BCG: locally cached compatibility data and links to the Broadcom Compatibility Guide.
- Fleet report: one summary covering all successfully assessed hosts.
macOS or Linux:
python3 vcfr_web.pyWindows:
python vcfr_web.pySource bundles built with the Windows launcher also support double-clicking Launch-VCF-Readiness-Web.bat after extracting the complete ZIP. It finds Python 3.9 or newer using python, py -3, or python3. The standalone Windows ZIP launcher runs its bundled executable and does not require Python.
Launching through python3 or python needs no executable permission and no chmod. See installation guidance for direct execution on macOS/Linux.
The server binds to loopback and opens a one-time launch URL in your browser. If no browser opens, use the URL printed in the terminal. The preferred port is 7182; the server selects a nearby free port if it is occupied.
At launch, the browser scanner checks the public GitHub release metadata in the background. A small Update available link appears beside the version only when a newer stable release exists. It opens the release page; nothing is downloaded or installed automatically. Offline and rate-limit failures stay quiet. Set VCF_READINESS_CHECK_UPDATES=0 before launch to disable the check; see offline operation.
In the browser:
- Enter one BMC IP address or hostname that you are authorized to assess.
- Enter the read-only BMC username and password.
- Leave the scan profile at its default for the first run.
- Choose an output directory you control.
- Start the assessment and wait for the completed-host message.
Open the generated scan directory. A successful scan normally contains:
00_fleet_summary.html: fleet-level dashboard.00_fleet_combined.html: combined fleet and host view, unless disabled.- an
.xlsxworkbook, unless disabled. reports/vsphere_vsan_report_<target>.html: standalone host report.MANIFEST.jsonandReadme.txt: provenance and output guidance.data/: structured data when the selected options produce it.
Exact files depend on scan success and options such as --save-json, --csv-export, --obfuscate, --crawl, and --no-combined.
Use an environment variable so the password is not placed in shell history:
export REDFISH_PASSWORD='replace-me'
python3 vcfr_collector.py \
--targets 192.0.2.50 \
--username readonly \
--password-env REDFISH_PASSWORD \
--output-dir ./VCF-ScansOn Windows Command Prompt:
set REDFISH_PASSWORD=replace-me
python vcfr_collector.py --targets 192.0.2.50 --username readonly --password-env REDFISH_PASSWORD --output-dir VCF-ScansInspect the authoritative option list in your checkout:
python3 vcfr_collector.py --help
python3 -m vcf_hci.web --helpSupported target input is an IP address, hostname, comma-separated list, final-octet range such as 192.0.2.1-20, or CIDR. Use --profile readiness-lean or --lean for the supported faster readiness profile.
Previously saved summaries can be rendered without contacting BMCs:
python3 vcfr_collector.py --from-summary ./VCF-Scans/Scan_exampleEvery assessment run generates rich, standalone HTML deliverables (an aggregated Fleet Summary and individual Host Reports) with zero runtime external asset dependencies.
🎥 Video Tour: Watch the Report Overview Video (8:20) → for a guided walkthrough of the fleet summary, status badges, BIOS drift scorecard, and per-host sub-reports.
Start with Server Readiness, storage readiness and BMC security beside fleet raw-resource totals and sizing caveats. Server Readiness combines existing chassis qualification with CPU support and keeps vendor-support qualifications distinct from unsupported assessments. Click a count to inspect matching hosts, including unassessed results.
Fleet-wide power redundancy tracking, chassis power cap warnings, vSAN readiness distribution, and aggregate kilowatt telemetry:
- Detailed Telemetry: Fleet Metric Health Tiles
Sort, search, and filter servers by OEM vendor, CPU support tier, TPM 2.0 status, and vSAN ESA readiness with direct links into individual host sub-reports. Detailed Inventory offers Comfortable and Compact density, a Columns chooser and Reset view. Layout choices retain complete export data. Keyboard navigation and focus management support report tabs and reference help.
- Detailed Telemetry: Multi-Host Fleet Status Grid
Color-coded executive summary scorecards highlighting CPU compatibility, BIOS currency, TPM 2.0 status, and vSAN driver/firmware alignment against the Broadcom Compatibility Guide (BCG).
- Detailed Telemetry: Single-Host Assessment Tiles • Sub-Category Health Breakdown
Visualizer mapping installed DIMM modules to physical CPU sockets and memory channels, detecting unbalanced memory interleaving, unpopulated channels, and memory operating below peak rated speeds.
- Detailed Telemetry: Motherboard Channel Topology
Evaluates storage controllers, RAID pass-through modes, and NVMe SSDs. Performs exact PCI Quad matching (VID:DID:SVID:SSID) against the Broadcom vSAN HCL dataset, calculates SMART drive wear/endurance remaining %, and generates one-click BCG search links.
- Detailed Telemetry: vSAN ESA Drive Compliance • Drive SMART Telemetry • PCIe Lane Inventory
Identifies network adapters and port speeds (verifying ≥25 GbE ESA requirements), queries LLDP and Cisco CDP neighbor data to discover connected Top-of-Rack switches, and correlates leaf switch pairs to highlight single-homed hosts and cabling miswires.
- Detailed Telemetry: NIC Optics & LLDP Detection • LLDP / CDP Switch Neighbors
Extracts the latest Warning and Critical hardware alarms from the server's event log, integrating direct links to Dell EEMS diagnostic guides and HPE IML documentation.
- Detailed Telemetry: System Event Log Monitoring
Out-of-band security compliance audit evaluating 84 canonical controls aligned with the CISA & NSA Joint BMC Hardening Guide, VMware Cloud Foundation Security Configuration Guide (SCG 9.1), and NIST SP 800-193. Evaluates BIOS performance drift against Broadcom VCF 9.1 Golden Baselines.
- Detailed Telemetry: BMC Hardware Security Audit • Hardware Security Baseline • BIOS Golden Baseline Drift • BIOS Performance Settings
📖 Comprehensive Reference Guide: For an exhaustive tab-by-tab and field-by-field reference explaining every metric, evaluation rule, official VMware KB, and the 84-control BMC security audit, see the User Guide & Reference Manual (docs/USER_GUIDE_REFERENCE.md).
| BMC Platform | Architecture & Adapters | Assessment Depth |
|---|---|---|
| Dell iDRAC | DellCollector (iDRAC7/8/9/10) |
Full OEM telemetry (SKU, BIOS date, NVMe SMART wear, EEMS alerts, license) |
| HPE iLO | HPECollector (iLO 4/5/6) |
Full OEM hooks (SmartStorage, system usage, IML event logs, license) |
| Supermicro BMC | SupermicroCollector |
SimpleStorage, drive inventory, DCMS license detection |
| Cisco IMC | CiscoCollector (CIMC) |
/Managers/CIMC, physical drive metrics, Cisco CDP neighbor discovery |
| Lenovo XCC | LenovoCollector (XCC/XCC2) |
Drive metrics, LicenseService tiers, ThinkSystem inventory |
| Quanta / QCT | QuantaCollector |
Dynamic root discovery, RackScale drive OEM inventory |
| GIGABYTE BMC | GigabyteCollector |
Self-roots, Oem.GBT slot detection, SimpleStorage |
| Generic Redfish | GenericCollector |
Universal DMTF Redfish fallback for standard platforms |
The collector blocks BMC configuration changes. It permits read methods, Redfish session creation and teardown, and protocol-required read-semantic POSTs used by WS-Man and Cisco XML inventory. It does not invoke power, reset, firmware, account, BIOS, boot, or configuration actions.
A read-only BMC account is still required. A vendor may restrict some inventory endpoints, so missing fields can reflect account permissions or firmware behavior.
An ordinary scan contacts the targets you provide and writes reports locally. It does not send analytics, telemetry, crash reports, or scan results to the project.
Public-network egress is explicit:
--refresh-hcl,--bundle-hcl, or the equivalent web action downloads public Broadcom HCL data.- Dell TechDirect warranty enrichment contacts Dell only after credentials are supplied and the feature is enabled.
- External credential providers contact their configured service only when explicitly configured.
- Experimental jump-host execution uses SSH only when selected in the local web UI.
The CLI and web UI otherwise use existing local HCL data and packaged baselines. See Security Architecture for the protocol details.
BMC certificate verification is disabled by default to support self-signed management controllers. Prefer --verify-ssl and --ca-bundle when your environment has a trusted BMC CA. --legacy-tls deliberately weakens protocol compatibility and should be used only for an approved legacy controller.
The browser UI is local-only by default. For a headless host, keep it on loopback and use SSH port forwarding; see Installation.
Depending on what a BMC exposes, reports can include:
- CPU generation and VCF support classification.
- Memory inventory and topology observations.
- Storage controllers, physical drives, NVMe health, and vSAN readiness.
- Network adapters, link speeds, firmware data, and LLDP/CDP neighbors.
- BIOS, BMC firmware, TPM, boot, power, thermal, GPU, and event-log inventory.
- Read-only BMC security findings.
- Fleet HTML, host HTML, Excel, CSV, JSON, and obfuscated outputs.
Collectors include generic DMTF Redfish plus OEM handling for vendors represented in vcf_hci/collector/oem/. Support depth varies by model, BMC generation, firmware, license, and exposed schema.
- This is an assessment aid, not a substitute for current Broadcom product documentation, support policy, or a final design review.
- A green result does not certify a server or guarantee upgrade success.
- Compatibility data can become stale. The default-offline behavior does not refresh it automatically.
- Self-signed TLS is accepted unless verification is enabled.
- Some BMCs omit fields, rate-limit requests, require extra licenses, or return partial inventory.
- The tool does not configure hardware, remediate findings, install software, or change firmware.
- Remote jump-host execution is experimental and available through the local web UI; there is no standalone remote-scan CLI.
- This repository does not promise prebuilt binaries or release assets. Run from source unless a separately verified distribution is supplied by your organization.
Install Python 3.9 or newer from python.org or your operating system's approved package source, then open a new terminal.
Change to the repository root before launching:
cd /path/to/vcf-readiness
python3 vcfr_web.pyCopy the one-time URL printed by vcfr_web.py. For a headless machine, follow the SSH forwarding steps in docs/INSTALL.md.
Confirm the BMC address, username, password, account lockout state, and read privileges. Do not paste credentials into an issue or log.
Check the management VLAN or VPN route and HTTPS reachability. Reduce --threads, increase --host-timeout, or try --allow-partial for slow controllers. Review the generated failed-host CSV and debug log before sharing them; they may contain sensitive infrastructure data.
Use the correct enterprise CA with --ca-bundle, confirm the target hostname matches the certificate, and enable DNS lookup only if your environment permits it. Do not work around a production trust failure without approval.
The local dataset may be absent or stale. Import an approved offline bundle with --import-hcl, or explicitly refresh from an internet-connected environment with --refresh-hcl.
- Installation and headless use
- Architecture
- Security architecture
- Credential vault
- User Guide & Reference
- Customer Infographic
- Contributing
- License
- KB 428874 — vSphere/VCF 9.x CPU Deprecated Mode Support Policy
- Broadcom Compatibility Guide — Live hardware search matrix
- vSAN HCL JSON — Live vSAN drive certification dataset
- Michael Buraglio's Packet Buffer Reference (GitHub: buraglio/port-buffers)
- Jim Warner's UCSC Packet Buffer Research (ASIC Buffer History)
- Phong Le — For answering 40,000 hardware HCL questions.
- Onur Yuzseven & Brock Peterson — For the vCommunity plugins and VMware Aria/VCF Operations guidance.
- Spiceworks Community — For community hardware discussions and insights on server repurposing.
- Built with Clarity Design System design tokens (VMware/Broadcom, Apache-2.0 license).
CA, Inc. License — see LICENSE.md and NOTICE. For third-party components included in standalone distributions, see THIRD_PARTY_LICENSES.md.