🪟 WinLog-mcp

A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Application, System, Security). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.

⚠️ Warning: This tool must be run with Administrator privileges. Please exercise caution to avoid causing unintended changes to your system.

✨ Features

• Ingest Windows Sysmon logs and store them as files in a user-defined directory

• Query logs by timestamp, returning recent event entries for analysis or troubleshooting

• Seamless interoperability with MCP tools and ecosystem

📄 Log files format

• Log files are named with the format <timestamp>_<log_type>.log in the chosen storage path

Related MCP server: Windows Forensics MCP Server

MCP Server (tool, prompts,...)

🛠️ Available Tools

• ingest_syslog: Ingests recent Sysmon logs and writes them to a file

• query_syslog: Queries ingested logs by timestamp and returns recent events

📋 Requirements

• Operating System: Windows

• Python: 3.7 or higher

• Dependencies:

  • pywin32

  • mcp.server.fastmcp (or your MCP server implementation)

💾 Installation

Clone the repository and install dependencies:

pip install -r requirements.txt

🚀 Usage

🖥️ Sysmon Installation

Reference: Sysmon Installation Guideline

cd sysmon
install.bat

▶️ Running Directly

Run the tool as an MCP server:

python main.py --storage-path \\PATH\\TO\\logs\\

🧑‍💻 Development Mode

You can inspect or debug using the MCP Inspector:

# Run in development mode
python \\PATH\\TO\\main.py --storage-path \\PATH\\TO\\logs\\

# Run in inspector mode
npx @modelcontextprotocol/inspector python \\PATH\\TO\\main.py --storage-path \\PATH\\TO\\logs\\

⚙️ Configuration

MCP configuration to run winlog-mcp tool.

{
  "mcpServers": {
    "winlog-mcp": {
      "command": "python",
      "args": [
        "\\PATH\\TO\\main.py",
        "--storage-path",
        "\\PATH\\TO\\logs\\"
      ]
    }
  }
}

🤖 MCP Clients Integration

💬 Claude Desktop Integration

The configuration file is located at:

• Windows: %APPDATA%\Claude\claude_desktop_config.json

Once integrated with Claude Desktop, you can ask Claude to:

Please show me the last 10 events in the last 24 hours, and Analyze them.

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.