Logs are stored as files named ` _ .log` in a user-defined storage directory.

Winlog MCP Server

@XD3an

Basic information

About Winlog MCP Server

A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Sysmon). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.

#winlog-mcp#cybersecurity #log-analysis

Winlog MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "winlog-mcp": {
      "command": "python",
      "args": [
        "\\PATH\\TO\\main.py",
        "--storage-path",
        "\\PATH\\TO\\logs\\"
      ]
    }
  }
}

Winlog MCP Server tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Winlog Mcp?

Winlog Mcp is a Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g., Sysmon). It provides programmatic access to ingest and query logs, making it useful for security monitoring, incident response, and log analysis automation.

How to use Winlog Mcp?

Install dependencies with pip install -r requirements.txt, then run the server using python main.py --storage-path \\PATH\\TO\\logs\\. Configure MCP clients (e.g., Claude Desktop) by adding the command and arguments to the appropriate configuration file. Two tools are available: ingest_syslog for ingesting recent Sysmon logs and query_syslog for querying logs by timestamp.

Key features of Winlog Mcp

Ingest Windows Sysmon logs and store as files
Query logs by timestamp for recent events
Seamless interoperability with MCP tools and ecosystem
Log files named <timestamp>_<log_type>.log

Use cases of Winlog Mcp

Security monitoring and incident response via Sysmon analysis
Automated log analysis and troubleshooting
Querying recent event entries for investigation

Frequently asked questions

What are the system requirements?

Windows operating system, Python 3.7 or higher, and the pywin32 dependency are required.

How are logs stored?

Logs are stored as files named `<timestamp>_<log_type>.log` in a user-defined storage directory.

What tools does Winlog Mcp provide?

Two tools: `ingest_syslog` ingests recent Sysmon logs and writes them to a file; `query_syslog` queries ingested logs by timestamp and returns recent events.

How do I integrate Winlog Mcp with Claude Desktop?

Add the configuration to `%APPDATA%\Claude\claude_desktop_config.json` with the command `python` and arguments including the path to `main.py` and the `--storage-path` flag.

Does Winlog Mcp require Sysmon to be installed?

Yes, the README provides a Sysmon installation guideline and an `install.bat` script, indicating Sysmon should be installed before using the tool.

Comments

More Developer Tools MCP servers

Cronwatch

cronwatchdev

CronWatch records every run of your scheduled jobs in your own database, and speaks up when one is missed, fails, gets stuck, runs slow or costs too much. CronWatch is free and open-source.

Yocoolab

MCP server for AI Agents — exposes Yocoolab feedback threads and design selections as tools

Termany

thinkany-ai

Agent-Native Terminal

174

LocalCan

Gives AI agents public URLs (tunnels) for localhost, live HTTP traffic inspection, snapshot publishing, and access control. Part of LocalCan, the ngrok alternative for Mac, Windows and Linux. Free plan.

Leadpages MCP

Leadpages

Leadpages MCP is a remote MCP server available at https://mcp.leadpages.com.