windows-admin-mcp

AI SRE Agent for Windows. An MCP server that gives AI assistants (Claude Desktop, Cursor, Windsurf, Claude Code) the ability to manage, monitor, and diagnose Windows systems.

Not just a PowerShell wrapper: includes multi-step diagnostics, trend analysis, safety controls, and audit logging.

42 tools across 8 modules + 3 MCP resources.

Quick Start

Interactive setup — detects your MCP clients and configures them automatically:

npx windows-admin-mcp --setup

Or configure manually — add to your client's config:

Claude Desktop

Add to %APPDATA%\Claude\claude_desktop_config.json:

{
  "mcpServers": {
    "windows-admin": {
      "command": "npx",
      "args": ["-y", "windows-admin-mcp"]
    }
  }
}

Cursor / VS Code / Windsurf

Add to your MCP config (.cursor/mcp.json, .vscode/mcp.json, etc.):

{
  "servers": {
    "windows-admin": {
      "command": "npx",
      "args": ["-y", "windows-admin-mcp"]
    }
  }
}

Claude Code

claude mcp add windows-admin -- npx -y windows-admin-mcp

Related MCP server: Skills MCP AD

Modules

Services (6 tools)

Event Viewer (5 tools)

Task Scheduler (8 tools)

Processes (4 tools)

Network (4 tools)

Diagnostics (4 tools)

Observability (5 tools)

Safety & Audit (6 tools)

MCP Resources

Safety Features

Destructive operations (kill, stop, restart, delete, bulk) are protected:

• Confirmation flow: Returns a preview + confirmationId. Call confirm_action to proceed.

• Blocklist: Critical processes (lsass, csrss, svchost, winlogon, etc.) are blocked by default.

• Bulk limits: Maximum 20 operations per bulk call (configurable).

• Audit log: All operations logged to JSONL file with timestamps.

Disable confirmation for trusted environments:

{
  "safety": {
    "requireConfirmation": false
  }
}

Configuration

Create a config.json next to the installed package, or set WINDOWS_ADMIN_MCP_CONFIG env var:

{
  "modules": {
    "services": true,
    "events": true,
    "scheduler": true,
    "processes": true,
    "network": true,
    "diagnostics": true,
    "safety": true,
    "observability": true
  },
  "safety": {
    "requireConfirmation": true,
    "confirmationTimeoutMs": 300000,
    "blocklist": ["lsass", "csrss", "svchost", "winlogon", "smss"],
    "allowlist": []
  },
  "limits": {
    "maxProcessesToKill": 5,
    "maxEventsToReturn": 500,
    "maxBulkOperations": 20
  },
  "audit": {
    "enabled": true,
    "path": "./windows-admin-mcp-audit.jsonl",
    "maxSizeMB": 50
  }
}

Usage Examples

"Why is SQL Server not working?"

diagnose_service(name: "MSSQLSERVER", port: 1433)

Runs 4-step chain: service status, port check, recent errors, dependencies. Returns hypothesis.

"Is the system healthy?"

system_health()

Single call: CPU, RAM, disk, top processes, recent errors, stopped auto-start services.

"Are errors increasing?"

error_trends(logName: "System", hours: 24)

Hourly breakdown with trend (growing/shrinking/stable), top sources, top event IDs.

"What changed in the last hour?"

system_changes(hours: 1)

New services installed, service state changes, new scheduled tasks.

"Kill the process on port 3000"

processes_ports(port: 3000)     # Find the process
processes_kill(pid: 12345)      # Returns confirmationId
confirm_action(confirmationId: "...")  # Execute

Requirements

• Windows 10/11 or Windows Server 2016+

• Node.js 18+

• PowerShell 5.1+ (included with Windows)

• Administrator privileges (for service control and some event logs)

Contributing

See CONTRIBUTING.md for guidelines.

License

MIT

windows-admin-mcp (RU)

AI SRE агент для Windows. MCP-сервер, позволяющий AI-ассистентам управлять, мониторить и диагностировать Windows.

Не просто обертка над PowerShell: многошаговая диагностика, анализ трендов, система безопасности, аудит.

42 инструмента, 8 модулей, 3 MCP-ресурса.

Быстрый старт

Автоматическая настройка — определяет установленные MCP-клиенты и конфигурирует их:

npx windows-admin-mcp --setup

Или вручную — добавьте в конфиг Claude Desktop (%APPDATA%\Claude\claude_desktop_config.json):

{
  "mcpServers": {
    "windows-admin": {
      "command": "npx",
      "args": ["-y", "windows-admin-mcp"]
    }
  }
}

Модули

• Services (6): управление службами Windows

• Event Viewer (5): запросы, объяснение Event ID, сводки

• Task Scheduler (8): полное управление планировщиком

• Processes (4): список, детали, kill, порты

• Network (4): ping, порты, DNS, соединения

• Diagnostics (4): diagnose_service, system_health, bulk-операции

• Observability (5): watch mode, обнаружение изменений, тренды ошибок

• Safety & Audit (6): конфигурация, подтверждение, аудит

Безопасность

• Деструктивные операции требуют подтверждения через confirm_action

• Критические процессы (lsass, csrss, svchost) в блок-листе

• Лимит на массовые операции (20 по умолчанию)

• Все действия логируются в JSONL-файл

Лицензия

MIT