winlog-mcp

winlog-mcp

0
securitymonitoring

WinLog-mcp is a tool designed for retrieving and analyzing Windows event logs using the Model Context Protocol (MCP). It supports security monitoring, incident response, and log analysis through programmatic access to Sysmon logs.

🪟 WinLog-mcp

A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Application, System, Security). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.

⚠️ Warning: This tool must be run with Administrator privileges. Please exercise caution to avoid causing unintended changes to your system.

✨ Features

  • Ingest Windows Sysmon logs and store them as files in a user-defined directory
  • Query logs by timestamp, returning recent event entries for analysis or troubleshooting
  • Seamless interoperability with MCP tools and ecosystem

📄 Log files format

  • Log files are named with the format <timestamp>_<log_type>.log in the chosen storage path

MCP Server (tool, prompts,...)

🛠️ Available Tools

  • ingest_syslog: Ingests recent Sysmon logs and writes them to a file
  • query_syslog: Queries ingested logs by timestamp and returns recent events

📋 Requirements

  • Operating System: Windows
  • Python: 3.7 or higher
  • Dependencies:

💾 Installation

Clone the repository and install dependencies:

pip install -r requirements.txt

🚀 Usage

🖥️ Sysmon Installation

Reference: 

cd sysmon
install.bat

▶️ Running Directly

Run the tool as an MCP server:

python main.py --storage-path \\PATH\\TO\\logs\\

🧑‍💻 Development Mode

You can inspect or debug using the MCP Inspector:

# Run in development mode
python \\PATH\\TO\\main.py --storage-path \\PATH\\TO\\logs\\

# Run in inspector mode
npx @modelcontextprotocol/inspector python \\PATH\\TO\\main.py --storage-path \\PATH\\TO\\logs\\

⚙️ Configuration

MCP configuration to run winlog-mcp tool.

{
  "mcpServers": {
    "winlog-mcp": {
      "command": "python",
      "args": [
        "\\PATH\\TO\\main.py",
        "--storage-path",
        "\\PATH\\TO\\logs\\"
      ]
    }
  }
}

🤖 MCP Clients Integration

💬 Claude Desktop Integration

The configuration file is located at:

  • Windows: %APPDATA%\Claude\claude_desktop_config.json

Once integrated with Claude Desktop, you can ask Claude to:

Please show me the last 10 events in the last 24 hours, and Analyze them.

📄 License

This project is licensed under the MIT License - see the file for details.