Winlog Mcp

by XD3an

371 downloads

Not rated

GitHub

About

A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Sysmon). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.

Details

Author: XD3an
Downloads: 371
Categories: Developer Tools, Security

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Winlog Mcp

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

From the repository

Install dependencies with pip install -r requirements.txt, then run the server using python main.py --storage-path \\PATH\\TO\\logs\\. Configure MCP clients (e.g., Claude Desktop) by adding the command and arguments to the appropriate configuration file. Two tools are available: ingest_syslog for ingesting recent Sysmon logs and query_syslog for querying logs by timestamp.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "winlog mcp": {
            "winlog-mcp": {
                "command": "python",
                "args": [
                    "\\PATH\\TO\\main.py",
                    "--storage-path",
                    "\\PATH\\TO\\logs\\"
                ]
            }
        }
    }
}

McpServers

{
    "winlog-mcp": {
        "command": "python",
        "args": [
            "\\PATH\\TO\\main.py",
            "--storage-path",
            "\\PATH\\TO\\logs\\"
        ]
    }
}

🪟 WinLog-mcp

---

✨ Features

- Ingest Windows Sysmon logs and store them as files in a user-defined directory
- Query logs by timestamp, returning recent event entries for analysis or troubleshooting
- Seamless interoperability with MCP tools and ecosystem

📄 Log files format

- Log files are named with the format <timestamp>_<log_type>.log in the chosen storage path

MCP Server (tool, prompts,...)

🛠️ Available Tools

- ingest_syslog: Ingests recent Sysmon logs and writes them to a file
- query_syslog: Queries ingested logs by timestamp and returns recent events

📋 Requirements

- Operating System: Windows
- Python: 3.7 or higher
- Dependencies:
- pywin32
- mcp.server.fastmcp (or your MCP server implementation)

💾 Installation

Clone the repository and install dependencies:

pip install -r requirements.txt

🚀 Usage

🖥️ Sysmon Installation

Reference: Sysmon Installation Guideline

cd sysmon
install.bat

▶️ Running Directly

Run the tool as an MCP server:

python main.py --storage-path \\PATH\\TO\\logs\\

🧑‍💻 Development Mode

You can inspect or debug using the MCP Inspector:

```sh

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

🪟 WinLog-mcp

✨ Features

📄 Log files format

MCP Server (tool, prompts,...)

🛠️ Available Tools

📋 Requirements

💾 Installation

🚀 Usage

🖥️ Sysmon Installation

▶️ Running Directly

🧑‍💻 Development Mode

Install

More like this

Sentry

Github

Git

GitLab

Context 7

Playwright