ProcmonMCP

Name: ProcmonMCP
Author: JameZUK

@JameZUK

代码仓库

关于 ProcmonMCP

An MCP server for procmon files

基本信息

分类

其他

运行时

python

传输方式

stdio

发布者

JameZUK

配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "ProcmonMCP": {
      "command": "python",
      "args": [
        "procmon-mcp.py",
        "--input-file",
        "/path/to/logs/my_capture.xml.gz"
      ]
    }
  }
}

工具

未检测到工具

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is ProcmonMCP?

ProcmonMCP is a Model Context Protocol server that parses and analyzes Process Monitor (Procmon) XML log files. It allows LLMs connected via MCP clients to autonomously investigate system activity captured in these logs by pre-loading a specific Procmon XML file for in-memory analysis using string interning.

How to use ProcmonMCP?

Install Python dependencies (modelcontextprotocol, recommended lxml and optional psutil). Run the server script with --input-file <path> pointing to the Procmon XML file (.xml, .xml.gz, .xml.bz2, or .xml.xz). Optionally specify transport (--transport stdio or sse), host/port, debug logging, and flags like --no-stack-traces or --no-extra-data. The server then exposes MCP tools for querying and analyzing the loaded log.

Key features of ProcmonMCP

Loads a single Procmon XML file (compressed or uncompressed) at startup.
Optimizes data with in-memory string interning for reduced memory usage.
Provides MCP tools for event querying, process listing, and stack trace retrieval.
Supports filtering by process, operation, result, path, regex, and timestamps.
Can export filtered results to CSV or JSON files.
Offers basic analysis functions like counting events and timing statistics.

Use cases of ProcmonMCP

Security analysts investigating suspicious process behavior in Procmon logs.
Malware reverse engineering to examine file, registry, and network operations.
Troubleshooting system errors by filtering events by result codes (e.g., ACCESS DENIED).
Identifying persistence mechanisms via registry and startup folder modifications.
Exporting large filtered event sets for offline analysis.

FAQ from ProcmonMCP

Can I load more than one Procmon file at a time?

No. ProcmonMCP loads and analyzes only a single file specified via --input-file at startup. To analyze a different file, you must restart the server.

What are the runtime requirements?

Python 3.10+, the modelcontextprotocol package, and optionally lxml (faster XML parsing) and psutil (memory usage reporting).

Where does the loaded data reside?

All data is loaded into memory from the specified file. No external database or persistent storage is used.

What are the main limitations?

Very large files (millions of events) can consume significant RAM, even with interning. Filtering with string contains or regex is slower than exact matches. Stack trace availability depends on Procmon’s symbol configuration. Loading takes time, especially for compressed files.

Which transports and authentication are supported?

ProcmonMCP supports stdio and sse MCP transport protocols. No authentication mechanism is documented. It is intended for trusted, local environments only.