A Nutanix TUI in Rust · Prism Central v4 · ratatui

Nutanix in your terminal.

Nutsh is a terminal UI for Nutanix Prism Central. It runs on your own machine and speaks the v4 REST API over HTTPS, with no SSH session and nothing installed on the cluster. Every kind sits behind one colon prompt, so an obscure networking resource behaves the same way the VM table does, and anything that changes state has to get past a guardrail first. The shape is borrowed from k9s: if you already live in that tool, your hands will know what to do.

try it in the browserLinux + macOSx86_64 + ARM64pre-release

Try it in your browser before you install anything.

A real Nutsh runs at nutsh.dev/try against two invented Prism Centrals, in a sandbox on a server of mine. Every page, table, detail pane and action is there, and the actions do what they say. No account, no download, and nothing you do reaches anything real.

$ open nutsh.dev/trylive session ↗
232resource kinds
20v4 API namespaces
478catalogued actions
74hand-tuned column sets
1,100+tests
nutsh · recorded session live

Why I built it.

I come from the Kubernetes world, where k9s is how I get work done: a colon prompt, contexts I switch in one command, tables I move through without taking my hands off the keyboard. I also look after several Nutanix environments, and nothing like that existed for them. Prism Central is a browser tab. The command-line tools that do exist, ncli, acli and nuclei, run on the cluster itself and need an SSH session before you can type anything.

So I built the thing I wanted: that way of working, pointed at Prism Central. Switching environment is one command. A table tells me what I need without a detour. And I never copy a UUID from one screen into another, because wherever the API hands back an identifier, Nutsh shows me the name.

The other half of it is restraint. Moving fast in production is fine right until it is not, so the things that change state sit behind more friction than the things that only read.

None of it was meant to leave my laptop. This is a pet project, written on evenings and weekends for an audience of one. A friend I showed it to made the point that plenty of other people look after Nutanix through the same browser tab I was trying to escape, and that keeping it to myself was a waste. That is the only reason there is a repository and a website.

It is also, and I would rather say so than let you wonder, built with a lot of AI assistance. I wrote the mockups and the rules about what it must never do, and Claude wrote most of the rest. I review and adapt what comes back before it goes anywhere near my lab or a client environment, and the safeguards against an accidental deletion were designed by a human, not generated. It has been running on my own laptop, against my own lab, for a few months now. The tests, the guard rails and the reasons behind them are all in the repository, and they are what I would judge it on.

Built around the keyboard and the v4 API.

:

Every catalog kind

232 kinds across 20 v4 namespaces, reachable by name or alias from the palette. 74 have columns picked by hand. The rest fall back to a layout derived from the schema, which is plainer but still beats reading raw JSON.

:ctx

Multiple environments

A context is one Prism Central: its TLS setting, the cluster you want to scope to, and whether the session is allowed to write. :ctx lab dr reads two of them in one table, each row in its own colour under a CONTEXT column, and a row acts against the Prism Central it came from. The password is not part of a context. That goes to the keychain or a 0600 file, never to the config, argv, or a child process.

⏎

Resource relationships

Press enter on a row and you get the kinds hanging off it. Where the API hands back a UUID, you see the name, so you stop ferrying identifiers between screens.

a

Guarded actions

A read-only session refuses before anything reaches the wire. Deleting makes you type the name back. Power-off and reboot ask first. Bulk actions stop at five rows, and every attempt lands in the session journal, including the ones that were refused.

:can-i

Permission preflight

Checks your actual IAM roles against what the action requires, before you run it. If the lookup itself fails it says unknown. It will not guess no.

^b

Several panes, one screen

Eight pages put several panes side by side. The Disaster Recovery page gathers registered Prism Centrals, protection policies, recovery plans and recent jobs in one place instead of sending you round four separate tables.

:skin

Seventeen skins, and a working mouse

Catppuccin, gruvbox, nord, dracula, tokyo-night and a dozen others. Clicking works on rows, menu entries and column headers, and shift-drag still selects text the way your terminal expects it to.

cache

What it costs your Prism Central

Responses are cached on disk, one directory per context. Requests run under per-namespace limits and a 30 req/s ceiling for the host. The status line shows the current rate and how much of it the cache absorbed.

--check

Namespace negotiation

It asks each of the 20 namespaces which version it serves and steps down when one answers 404. Whatever it settles on is pinned for the session. The same binary works against the pc.2024 line and against PC 7.x.

--snapshot

Useful outside the TUI

One frame to stdout, then exit. There are no colour codes and no request meter in the output, so two runs against the same state give you the same bytes and you can diff them. Handy in scripts, CI, docs and incident notes.

One thing at a time.

Short recordings, one feature each, from the same lab session. They play as they come into view; none has audio.

Guarded actions. Clone through the form, watch the task land, then delete: it asks for the name to be typed back.
Search everywhere. :search answers from what is loaded, then asks the Prism Central kind by kind and counts as answers land.
Pages, detail, actions. Disaster Recovery in four panes, Y and J on a policy, then the VM recovery points table and the action menu on one of them.
From the shell. nutsh --check asks all twenty namespaces which version they serve and prints what answered.
What it did, and what it is doing. :journal for every action attempted, :activity for every request, live.

One binary, direct to Prism Central.

catalogOpenAPI → 232 kinds and 478 actions, generated
transportreqwest · rustls · Basic auth · ETag · rate limits
runtimetokio tasks · bounded polling · on-disk cache
interfaceratatui · crossterm · no browser backend
secretsmacOS Keychain · Linux a 0600 file, or Secret Service when built for it

Questions people ask first.

Is this a Nutanix product?

No. Nutsh is an independent open-source project under the MIT licence, not affiliated with or endorsed by Nutanix, Inc.

Does it replace ncli, acli or nuclei?

No, it sits somewhere else. Those are reached by opening an SSH session to a CVM or a Prism Central VM and running a shell there. Nutsh runs on your own laptop and speaks the v4 REST API over HTTPS. You do not need SSH access to anything. The comparison page goes tool by tool.

Does anything get installed on the cluster?

Nothing. No agent, no collector, no CVM access. It is one binary on your machine making authenticated HTTPS calls, the same calls Prism Central's own web interface makes.

Which Prism Central versions work?

It asks each API namespace which version it serves and steps down until it finds one that answers, so the same binary works from the pc.2024 line through PC 7.x. nutsh --check prints exactly what your Prism Central answered.

Is it safe to point at production?

That is what read-only mode is for, and it refuses before anything reaches the wire. Beyond that: confirmations on anything destructive, a five-row ceiling on bulk actions, ETag preconditions so you cannot overwrite somebody else's change, and a request budget capped at 30 per second.

Was it written with AI?

Mostly, yes, and I would rather tell you than have you guess. The shape of it, the rules about what it must never do, and the review are mine; a lot of the code was drafted with AI assistance. What I would judge it on is the same thing you can read for yourself: the tests are in the repository, and CONTRIBUTING.md explains why the stricter rules are there.

Does it work with Prism Element?

No. The v4 REST API is served by Prism Central, and that is the only thing Nutsh talks to. A cluster that is not registered to a Prism Central is not reachable from it.

Windows?

Not yet. Releases are built for macOS and Linux on x86_64 and ARM64. On Windows, WSL2 with the Linux build works; a native build is not published.

What does it cost?

Nothing. MIT licensed, and there is no hosted service, no telemetry and no account.

Install Nutsh

Version 0.2.0 is out, with nutsh demo: two invented Prism Centrals in the binary, every page and action, no credentials. Builds are attested from this release on. It is for macOS and Linux on x86_64 and ARM64. The Linux archives come in two flavours: gnu, and musl for a static binary that runs on any distribution. Every archive ships with its SHA-256. One author, a few months of daily use against one Prism Central; nobody else has run it for a week yet, so expect rough edges and report what you find. Not on crates.io yet, so cargo install does not work.

homebrew · macOS and Linux$ brew install Fen0l/tap/nutsh
shell · any distribution$ curl -LsSf https://github.com/Fen0l/nutsh/releases/download/v0.2.0/nutsh-installer.sh | sh

Prefer to build it? The source is on GitHub under the MIT licence, and make release is the whole of it.