Collecting your vSphere inventory (and why the collector is safe to run)

Assessment needs an inventory, and an inventory typed in by hand is not one. The collector is a single read-only Python file you run on your own network.

Download it from the Collect tab, then read it. It is written to be read, and reading somebody else's code before pointing it at your own infrastructure is the right instinct.

What it will not do:

It never mutates anything. It calls exactly one vSphere API — a PropertyCollector retrieve — and no method that changes state exists anywhere in the file. Search it for Reconfig, Power, Destroy, Snapshot, Migrate; there are none.

Your vCenter credential never leaves your network. It is read from an environment variable rather than a command-line argument, so it stays out of your shell history and out of the process table. It is used to connect locally and is never included in the payload, never written to the output file, and never printed.

It collects the fields the assessment needs and stops. No VM notes or annotations — people keep passwords in those — no guest hostnames, no IP addresses, no custom attributes.

Prove it before you trust it:

Run it with --self-test. Its classification logic runs with no vCenter and no SDK at all, so you can check every rule it applies without connecting to anything.

Then collect to a file:

Use --out inventory.json. Nothing is transmitted without --post, so this path needs no outbound connectivity and no Turtini credential at all — which matters on a lab or classified network that cannot reach the internet. Read the file, then upload or paste it on the Collect tab.

The account to use is a vCenter role with Read-only on the inventory you want assessed. Nothing more is needed and nothing more should be granted.