Logs are stored as files named ` _ .log` in a user-defined storage directory.

Winlog MCP Server

@XD3an

リポジトリ

基本情報

カテゴリ

開発者ツール

トランスポート

stdio

作者

XD3an

投稿者

XD3an

Winlog MCP Server について

A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Sysmon). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.

#winlog-mcp#cybersecurity #log-analysis

Winlog MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "winlog-mcp": {
      "command": "python",
      "args": [
        "\\PATH\\TO\\main.py",
        "--storage-path",
        "\\PATH\\TO\\logs\\"
      ]
    }
  }
}

Winlog MCP Server のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is Winlog Mcp?

Winlog Mcp is a Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g., Sysmon). It provides programmatic access to ingest and query logs, making it useful for security monitoring, incident response, and log analysis automation.

How to use Winlog Mcp?

Install dependencies with pip install -r requirements.txt, then run the server using python main.py --storage-path \\PATH\\TO\\logs\\. Configure MCP clients (e.g., Claude Desktop) by adding the command and arguments to the appropriate configuration file. Two tools are available: ingest_syslog for ingesting recent Sysmon logs and query_syslog for querying logs by timestamp.

Key features of Winlog Mcp

Ingest Windows Sysmon logs and store as files
Query logs by timestamp for recent events
Seamless interoperability with MCP tools and ecosystem
Log files named <timestamp>_<log_type>.log

Use cases of Winlog Mcp

Security monitoring and incident response via Sysmon analysis
Automated log analysis and troubleshooting
Querying recent event entries for investigation

よくある質問

What are the system requirements?

Windows operating system, Python 3.7 or higher, and the pywin32 dependency are required.

How are logs stored?

Logs are stored as files named `<timestamp>_<log_type>.log` in a user-defined storage directory.

What tools does Winlog Mcp provide?

Two tools: `ingest_syslog` ingests recent Sysmon logs and writes them to a file; `query_syslog` queries ingested logs by timestamp and returns recent events.

How do I integrate Winlog Mcp with Claude Desktop?

Add the configuration to `%APPDATA%\Claude\claude_desktop_config.json` with the command `python` and arguments including the path to `main.py` and the `--storage-path` flag.

Does Winlog Mcp require Sysmon to be installed?

Yes, the README provides a Sysmon installation guideline and an `install.bat` script, indicating Sysmon should be installed before using the tool.

「開発者ツール」の他のコンテンツ

PubShip

pubship

Open-source MCP server for Google Play developer workflows. Runs locally with your own credentials.

Banking Assistant (Metabind demo)

Metabind

Interactive MCP App demo built on Metabind: personal-finance answers render as UI cards (net worth, spending, subscriptions) in Claude and ChatGPT, and natively in iOS/Android apps.

Foremerge

naw103

Catch intent conflicts before code conflicts. The open-source coordination protocol for coding agents, built above Git.

Casefile

azimov777

One case file per task — shared by every session, agent and person that touches it. Self-hosted MCP server and live board. MIT.

Vibgrate MCP

Vibgrate

Query your team's drift, vulnerability, and migration data from any AI assistant. Vibgrate MCP connects Cursor, Claude, ChatGPT, Windsurf, or VS Code to Vibgrate Cloud: 51 tools for DriftScores, CVEs and EOL runtimes, up