Winlog Mcp

Created By
XD3ana year ago
A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Sysmon). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.
Overview

what is Winlog Mcp?

Winlog Mcp is a Model Context Protocol (MCP) tool designed for retrieving and analyzing Windows event logs, such as Sysmon logs. It provides programmatic access to ingest and query these logs, making it an essential tool for security monitoring, incident response, and log analysis automation.

how to use Winlog Mcp?

To use Winlog Mcp, clone the repository, install the required dependencies, and run the tool as an MCP server. You can ingest Sysmon logs and query them by timestamp for analysis.

key features of Winlog Mcp?

  • Ingests Windows Sysmon logs and stores them in a user-defined directory.
  • Queries logs by timestamp, returning recent event entries for analysis.
  • Seamless interoperability with other MCP tools and ecosystems.

use cases of Winlog Mcp?

  1. Automating the retrieval and analysis of Windows event logs for security audits.
  2. Assisting incident response teams in analyzing recent security events.
  3. Integrating with other tools for enhanced log analysis capabilities.

FAQ from Winlog Mcp?

  • What operating system is required to run Winlog Mcp?

Winlog Mcp requires Windows OS and Python 3.7 or higher.

  • How do I install Winlog Mcp?

Clone the repository and run pip install -r requirements.txt to install the dependencies.

  • Can I integrate Winlog Mcp with other tools?

Yes! Winlog Mcp can be integrated with other MCP clients for enhanced functionality.

Server Config

{
  "mcpServers": {
    "winlog-mcp": {
      "command": "python",
      "args": [
        "\\PATH\\TO\\main.py",
        "--storage-path",
        "\\PATH\\TO\\logs\\"
      ]
    }
  }
}
Project Info
Created At
a year ago
Updated At
a year ago
Author Name
XD3an
Star
-
Language
-
License
-

Recommend Servers

View All
Bring your real authenticated browser session to AI coding agents. Local-first MCP server + Chrome MV3 extension. No cloud. No telemetry.
@Cubenest

peek records the user's actual logged-in browser (DOM via rrweb, console events, network metadata, optional response bodies via opt-in Deep capture) through a Chrome MV3 extension. The extension ships events through a native-messaging stdio bridge to a local MCP server (peek-mcp), which persists them to a SQLite database at ~/.peek/sessions.db. AI coding agents (Claude Code, Cursor, Cline, Windsurf) read sessions from the database via 10 MCP tools: Tool What it does list_recent_sessions List recently recorded sessions (id, origin, ts, event count). get_session_summary LLM-readable narrative summary of a session. get_session_console_errors Console errors recorded in a session. get_session_network_errors Failed/notable network requests in a session. get_user_action_before_error Last N user actions before a console error. generate_playwright_repro Generate a runnable Playwright test from a session. get_dom_snapshot Reconstruct the DOM at a given timestamp. query_dom_history Timeline of attribute/text changes for a selector. request_authorization Side-panel consent for write actions (Level 3). execute_action Dispatch a UI action (gated by permission level + destructive blocklist). Why local-first matters Every other "browser session for AI" tool ships to a vendor cloud. peek's SQLite + extension live on the user's machine — no remote endpoints, no telemetry. The privacy policy (docs/peek/PRIVACY_POLICY.md) is the source of truth. Install # 1. Add the MCP server to Claude Code claude mcp add peek -- npx -y @peekdev/mcp # 2. Install the Chrome extension from the Chrome Web Store # (link added once the CWS listing is approved)

a day ago
Crevio

2 days ago