WinLog-mcp

🪟 WinLog-mcp

A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Application, System, Security). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.

⚠️ Warning: This tool must be run with Administrator privileges. Please exercise caution to avoid causing unintended changes to your system.

✨ Features

Ingest Windows Sysmon logs and store them as files in a user-defined directory
Query logs by timestamp, returning recent event entries for analysis or troubleshooting
Seamless interoperability with MCP tools and ecosystem

📄 Log files format

Log files are named with the format <timestamp>_<log_type>.log in the chosen storage path

MCP Server (tool, prompts,...)

🛠️ Available Tools

ingest_syslog: Ingests recent Sysmon logs and writes them to a file
query_syslog: Queries ingested logs by timestamp and returns recent events

📋 Requirements

Operating System: Windows
Python: 3.7 or higher
Dependencies:
- pywin32
- mcp.server.fastmcp (or your MCP server implementation)

💾 Installation

Clone the repository and install dependencies:

pip install -r requirements.txt

🚀 Usage

🖥️ Sysmon Installation

Reference: Sysmon Installation Guideline

cd sysmon
install.bat

▶️ Running Directly

Run the tool as an MCP server:

python main.py --storage-path \\PATH\\TO\\logs\\

🧑‍💻 Development Mode

You can inspect or debug using the MCP Inspector:

# Run in development mode
python \\PATH\\TO\\main.py --storage-path \\PATH\\TO\\logs\\

# Run in inspector mode
npx @modelcontextprotocol/inspector python \\PATH\\TO\\main.py --storage-path \\PATH\\TO\\logs\\

⚙️ Configuration

MCP configuration to run winlog-mcp tool.

{
  "mcpServers": {
    "winlog-mcp": {
      "command": "python",
      "args": [
        "\\PATH\\TO\\main.py",
        "--storage-path",
        "\\PATH\\TO\\logs\\"
      ]
    }
  }
}

🤖 MCP Clients Integration

💬 Claude Desktop Integration

The configuration file is located at:

Windows: %APPDATA%\Claude\claude_desktop_config.json

Once integrated with Claude Desktop, you can ask Claude to:

Please show me the last 10 events in the last 24 hours, and Analyze them.

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

This server cannot be installed

security - not tested

license - permissive license

quality - not tested

How are these scores calculated?

local-only server

The server can only run on the client's local machine because it depends on local resources.

Provides programmatic access to ingest and query Windows event logs (especially Sysmon logs), enabling security monitoring, incident response, and log analysis automation.

Related MCP Servers

MCP server for LogSeq
ergut
A
security
F
license
A
quality
Interacts with LogSeq via its API.
Last updated -
2
85
Python
MCP Sumo Logic Server
samwang0723
-
security
F
license
-
quality
Integrates with Sumo Logic's API to enable log search with configurable queries and time ranges, supporting error handling and easy deployment via Docker.
Last updated -
4
TypeScript
MCP Vulnerability Management System
nesirat
-
security
A
license
-
quality
A comprehensive system that helps organizations track, manage, and respond to security vulnerabilities effectively through features like vulnerability tracking, user management, support tickets, API key management, and SSL certificate management.
Last updated -
Python
MIT License
SEQ MCP Server
RoeeJ
A
security
A
license
A
quality
Enables LLMs to query and analyze logs from SEQ structured logging server with capabilities for searching events, retrieving event details, analyzing log patterns, and accessing saved searches.
Last updated -
5
JavaScript
MIT License

View all related MCP servers