Winlog Mcp
@XD3an
About Winlog Mcp
A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Sysmon). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.
Config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"winlog-mcp": {
"command": "python",
"args": [
"\\PATH\\TO\\main.py",
"--storage-path",
"\\PATH\\TO\\logs\\"
]
}
}
}Tools
No tools detected
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is Winlog Mcp?
Winlog Mcp is a Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g., Sysmon). It provides programmatic access to ingest and query logs, making it useful for security monitoring, incident response, and log analysis automation.
How to use Winlog Mcp?
Install dependencies with pip install -r requirements.txt, then run the server using python main.py --storage-path \\PATH\\TO\\logs\\. Configure MCP clients (e.g., Claude Desktop) by adding the command and arguments to the appropriate configuration file. Two tools are available: ingest_syslog for ingesting recent Sysmon logs and query_syslog for querying logs by timestamp.
Key features of Winlog Mcp
- Ingest Windows Sysmon logs and store as files
- Query logs by timestamp for recent events
- Seamless interoperability with MCP tools and ecosystem
- Log files named
<timestamp>_<log_type>.log
Use cases of Winlog Mcp
- Security monitoring and incident response via Sysmon analysis
- Automated log analysis and troubleshooting
- Querying recent event entries for investigation
FAQ from Winlog Mcp
What are the system requirements?
Windows operating system, Python 3.7 or higher, and the pywin32 dependency are required.
How are logs stored?
Logs are stored as files named <timestamp>_<log_type>.log in a user-defined storage directory.
What tools does Winlog Mcp provide?
Two tools: ingest_syslog ingests recent Sysmon logs and writes them to a file; query_syslog queries ingested logs by timestamp and returns recent events.
How do I integrate Winlog Mcp with Claude Desktop?
Add the configuration to %APPDATA%\Claude\claude_desktop_config.json with the command python and arguments including the path to main.py and the --storage-path flag.
Does Winlog Mcp require Sysmon to be installed?
Yes, the README provides a Sysmon installation guideline and an install.bat script, indicating Sysmon should be installed before using the tool.
Frequently asked questions
What are the system requirements?
Windows operating system, Python 3.7 or higher, and the pywin32 dependency are required.
How are logs stored?
Logs are stored as files named `<timestamp>_<log_type>.log` in a user-defined storage directory.
What tools does Winlog Mcp provide?
Two tools: `ingest_syslog` ingests recent Sysmon logs and writes them to a file; `query_syslog` queries ingested logs by timestamp and returns recent events.
How do I integrate Winlog Mcp with Claude Desktop?
Add the configuration to `%APPDATA%\Claude\claude_desktop_config.json` with the command `python` and arguments including the path to `main.py` and the `--storage-path` flag.
Does Winlog Mcp require Sysmon to be installed?
Yes, the README provides a Sysmon installation guideline and an `install.bat` script, indicating Sysmon should be installed before using the tool.
Basic information
More Developer Tools MCP servers
TranscriptFetch MCP Server
TranscriptFetchModel Context Protocol (MCP) server for TranscriptFetch: fetch YouTube transcripts, search, channels, and playlists from any MCP client.
Vibgrate MCP
VibgrateQuery your team's drift, vulnerability, and migration data from any AI assistant. Vibgrate MCP connects Cursor, Claude, ChatGPT, Windsurf, or VS Code to Vibgrate Cloud: 51 tools for DriftScores, CVEs and EOL runtimes, up
extentos
Asger mølgaardExtentos is a multi-vendor development platform for adding smart-glasses capabilities to existing iOS and Android apps. The simplest analogy is Stripe for smart glasses:
AptiBuild AI — Career Intelligence
ParklandBuildsAptiBuild AI MCP Server — career, labor market, and business idea intelligence for AI agents. 11 tools covering real-time FRED labor market signals, BLS wage data (126 occupations), AI-generated app ideas, career paths,
DevDocs by CyberAGI 🚀
cyberagiincCompletely free, private, UI based Tech Documentation MCP server. Designed for coders and software developers in mind. Easily integrate into Cursor, Windsurf, Cline, Roo Code, Claude Desktop App
Comments