Build a Nutanix Cloud Operations MCP Server with Prism V4 APIs

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

On August 10, 2026, Nutanix released an open-source Model Context Protocol server that lets AI assistants — including GitHub Copilot — interact with Nutanix Cloud Platform through Prism V4 APIs. The launch is part of the infrastructure-embraces-agents wave we have been tracking on latest AI news: virtualization vendors, storage platforms, and cloud providers are all shipping MCP surfaces because the next generation of operators will be agents. Nutanix's server is the connective tissue — it turns Prism V4 into a typed, governed tool surface that any MCP-compatible assistant can call for AI-driven cloud operations.

This guide builds the production-grade version of that pattern: a Python FastMCP server, prism-ops-mcp, that wraps Prism V4 into clean typed agent tools — cluster health, host inventory, VM listing, storage utilization, and safe remediation actions — with read-only defaults, OAuth 2.0 authentication, and an approval-gated action surface. If you are connecting agents to your infrastructure in 2026, this is the reference architecture for doing it safely, and the MCP directory is the map for the rest of the infrastructure connector ecosystem.

Why a gateway over the official Nutanix MCP server

The official open-source server is the fastest on-ramp: connect it, and an assistant can query the platform out of the box. A custom FastMCP gateway is the right call when you need any of these:

• Read-only by default, enforced at the tool level. The official server exposes what Prism V4 offers; a gateway can guarantee that every query tool runs with a read-only scope and that the only mutation tool is gated behind approval — a much tighter contract for autonomous agents.
• A safe-action catalog. The gateway decides exactly which operations are reversible (snapshot, drain) and which require human approval (reboot, reconfigure), instead of exposing the full API surface.
• Per-agent rate limits and audit. One key per agent, one audit row per tool call, and instant revocation when an agent is decommissioned.
• Combined workflows in one call. A single get_cluster_health call that returns normalized findings, or a monitor-then-escalate sequence, is painful to orchestrate against the raw API.

The deeper point is the same one that runs through the AI workflows library: an infrastructure MCP server is only as good as the governance around it. The gateway is where that governance lives.

The tool surface and architecture

The gateway exposes five tools against the Prism V4 API:

Every query tool is read-only, cached, and rate-limited. run_action is the only mutation surface, and it enforces the safe-action catalog server-side — an agent cannot invoke an action that is not in the catalog, and actions marked requires_approval are rejected unless an explicit approval token accompanies the call. That contract is what makes autonomous cloud operations defensible.

Step 1: Scaffold the Python FastMCP server

mkdir prism-ops-mcp && cd prism-ops-mcp
python -m venv .venv && source .venv/bin/activate
pip install "fastmcp[cli]" httpx

# server.py
import os
import time
import json
import threading

import httpx
from fastmcp import FastMCP

PRISM = os.environ.get("PRISM_BASE", "https://prism-cluster.internal/api/v4.0")
CLIENT_ID = os.environ["PRISM_CLIENT_ID"]
CLIENT_SECRET = os.environ["PRISM_CLIENT_SECRET"]
TOKEN_URL = os.environ.get("PRISM_TOKEN_URL", "https://prism-cluster.internal:9440/api/v4.0/auth/token")

mcp = FastMCP("prism-ops-mcp", instructions=(
    "Nutanix Prism V4 cloud operations tools. All query tools are read-only. "
    "run_action is approval-gated and limited to the safe-action catalog."
))

_token = {"value": None, "exp": 0}
_lock = threading.Lock()

def _access_token(scope: str = "read") -> str:
    with _lock:
        if _token["value"] and _token["exp"] > time.time() + 120:
            return _token["value"]
        r = httpx.post(TOKEN_URL, data={
            "grant_type": "client_credentials",
            "client_id": CLIENT_ID,
            "client_secret": CLIENT_SECRET,
            "scope": scope,
        }, timeout=15)
        r.raise_for_status()
        body = r.json()
        _token.update({"value": body["access_token"], "exp": time.time() + body.get("expires_in", 3600)})
        return _token["value"]

def _headers(scope: str = "read"):
    return {"Authorization": f"Bearer {_access_token(scope)}", "Accept": "application/json"}

@mcp.tool()
def get_cluster_health() -> str:
    \"\"\"Return cluster health checks with severity ratings.\"\"\"
    r = httpx.get(f"{PRISM}/clusters", headers=_headers(), timeout=20)
    r.raise_for_status()
    return json.dumps(r.json(), indent=2)

@mcp.tool()
def list_hosts(limit: int = 50) -> str:
    \"\"\"List hosts with CPU, memory, and controller statistics.\"\"\"
    r = httpx.get(f"{PRISM}/hosts", params={"limit": min(limit, 100)},
                  headers=_headers(), timeout=20)
    r.raise_for_status()
    return json.dumps(r.json(), indent=2)

@mcp.tool()
def list_vms(limit: int = 50) -> str:
    \"\"\"List VMs with power state, host, and configured resources.\"\"\"
    r = httpx.get(f"{PRISM}/vms", params={"limit": min(limit, 100)},
                  headers=_headers(), timeout=20)
    r.raise_for_status()
    return json.dumps(r.json(), indent=2)

@mcp.tool()
def get_storage_utilization() -> str:
    \"\"\"Return storage pools, capacity, and utilization trends.\"\"\"
    r = httpx.get(f"{PRISM}/storage", headers=_headers(), timeout=20)
    r.raise_for_status()
    return json.dumps(r.json(), indent=2)

SAFE_ACTIONS = {
    "snapshot_vm": {"requires_approval": False, "reversible": True},
    "drain_host":   {"requires_approval": True, "reversible": True},
    "reboot_host":  {"requires_approval": True, "reversible": False},
}

@mcp.tool()
def run_action(action: str, target: str, approval_token: str = "") -> str:
    \"\"\"Run a remediation action from the safe-action catalog; approval-gated.\"\"\"
    if action not in SAFE_ACTIONS:
        return json.dumps({"error": f"action '{action}' not in safe-action catalog"})
    spec = SAFE_ACTIONS[action]
    if spec["requires_approval"] and not verify_approval(approval_token, action, target):
        return json.dumps({"error": "approval required; action rejected"})
    r = httpx.post(f"{PRISM}/actions", json={"action": action, "target": target},
                   headers=_headers(scope="write"), timeout=60)
    r.raise_for_status()
    audit_log(action, target, r.status_code)
    return json.dumps(r.json(), indent=2)

if __name__ == "__main__":
    mcp.run()

Run the server with python server.py and it speaks MCP over stdio to whichever client you wire next. The critical design detail is run_action: the safe-action catalog is enforced server-side, not just promised in a prompt. reboot_host and drain_host require an approval token that a human gate issued; snapshot_vm is reversible and runs without approval. An agent cannot widen its own authority by being clever with arguments, because the catalog check happens before any request reaches Prism.

Step 2: inputSchema definitions published to agents

FastMCP derives JSON Schema from Python type hints, but pinning the contract helps agents and human reviewers alike:

{
  "run_action": {
    "type": "object",
    "properties": {
      "action": {
        "type": "string",
        "enum": ["snapshot_vm", "drain_host", "reboot_host"],
        "description": "Action from the safe-action catalog; reboot and drain require approval"
      },
      "target": { "type": "string", "description": "Host or VM identifier" },
      "approval_token": { "type": "string", "description": "Human-issued approval token for gated actions" }
    },
    "required": ["action", "target"]
  },
  "get_cluster_health": {
    "type": "object",
    "properties": {},
    "description": "Read-only cluster health check"
  }
}

The enum on the action parameter is the most important line in the whole schema: it tells the agent — and the human reviewing the tool — exactly what actions exist, and it makes the catalog self-documenting. An agent that knows reboot_host needs an approval token will ask for one instead of trying to sneak the action through. The same explicitness is what the MCP directory security guides recommend for every infrastructure tool.

Step 3: Wire into Claude Desktop and GitHub Copilot

{
  "mcpServers": {
    "prism-ops-mcp": {
      "command": "python",
      "args": ["/absolute/path/to/prism-ops-mcp/server.py"],
      "env": {
        "PRISM_BASE": "https://prism.internal/api/v4.0",
        "PRISM_CLIENT_ID": "your-client-id",
        "PRISM_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

The same mcpServers block works for Claude Desktop, GitHub Copilot, Cursor, or any MCP client. Because Nutanix's official server is open source, you can run it directly, or run this gateway when you need the tighter governance contract. The client secret belongs in your secret manager — never in a committed config file — and the token URL should sit behind your corporate network or VPN, since it carries write-scope credentials.

Step 4: OAuth 2.0 and the safe-action contract

The security posture of this gateway is worth spelling out, because it is the pattern every infrastructure MCP server should follow:

1. Read-only by default. Every query tool authenticates with a read scope. The gateway cannot mutate infrastructure through any query path, no matter how the agent phrases the request.
2. A single gated mutation tool. run_action is the only tool with write scope, and it enforces the safe-action catalog plus an approval token for destructive actions.
3. Approval tokens from a human gate. The workflow layer issues approval tokens only after a human approves a specific action on a specific target. The token is single-use, short-lived, and scoped to the action — an agent cannot bank an approval and reuse it later.
4. Audit everything. Every run_action call writes an audit row with the action, target, approval token ID, and outcome. When something goes wrong at 3am, the log is the evidence.

Pair this with per-agent rate limits and short cache TTLs on inventory queries, and the gateway is governable the way production infrastructure demands. It is the same governance logic the latest AI news coverage of agent security keeps emphasizing: bound the surface, gate the destructive, audit the rest.

Frequently Asked Questions

Q: What did Nutanix release on August 10, 2026?

A: Nutanix released an open-source Model Context Protocol server that lets AI assistants, including GitHub Copilot, interact with Nutanix Cloud Platform through Prism V4 APIs — the foundation for AI-driven cloud operations.

Q: Why build a custom Nutanix MCP server?

A: Use the official open-source server for a quick start. Build a custom FastMCP gateway when you need a narrower approved tool surface, read-only defaults enforced at the tool level, an approval-gated action catalog, or per-agent rate limits and audit.

Q: How do you keep infrastructure tools safe for agents?

A: Read-only by default: every query tool uses a read-only OAuth scope, and the only action tool is approval-gated and backed by an explicit safe-action catalog of reversible operations like snapshot and drain.

Q: What should an operations agent see before acting?

A: Cluster health, host utilization, VM inventory, storage curves, and controller latency — the telemetry that predicts incidents — plus an audit trail of every action it has taken.

Q: What is the realistic agent use case?

A: A monitoring agent that polls Prism V4, detects anomalies, prepares a remediation plan with evidence, and routes reversible actions through approval — turning the MCP surface into an operator, not just a query tool.

Closing thoughts

Nutanix's open-source MCP server is the infrastructure industry accepting the agent era — and the gateway in this guide is how you accept it safely. Typed tools over Prism V4, read-only by default, a single approval-gated action surface, and an audit trail on everything. Build it, wire it into a LangGraph operations agent, and the infrastructure starts operating itself within a contract you control. That is AI-driven cloud operations done right. Watch the latest AI news for the next infrastructure MCP launch, and keep the patterns in the AI workflows library and MCP directory close as you expand the catalog.