ProcmonMCP MCP Server

What is ProcmonMCP?

ProcmonMCP is a Model Context Protocol server that parses and analyzes Process Monitor (Procmon) XML log files. It allows LLMs connected via MCP clients to autonomously investigate system activity captured in these logs by pre-loading a specific Procmon XML file for in-memory analysis using string interning.

How to use ProcmonMCP?

Install Python dependencies (modelcontextprotocol, recommended lxml and optional psutil). Run the server script with --input-file <path> pointing to the Procmon XML file (.xml, .xml.gz, .xml.bz2, or .xml.xz). Optionally specify transport (--transport stdio or sse), host/port, debug logging, and flags like --no-stack-traces or --no-extra-data. The server then exposes MCP tools for querying and analyzing the loaded log.

Key features of ProcmonMCP

• Loads a single Procmon XML file (compressed or uncompressed) at startup.
• Optimizes data with in-memory string interning for reduced memory usage.
• Provides MCP tools for event querying, process listing, and stack trace retrieval.
• Supports filtering by process, operation, result, path, regex, and timestamps.
• Can export filtered results to CSV or JSON files.
• Offers basic analysis functions like counting events and timing statistics.

Use cases of ProcmonMCP

• Security analysts investigating suspicious process behavior in Procmon logs.
• Malware reverse engineering to examine file, registry, and network operations.
• Troubleshooting system errors by filtering events by result codes (e.g., ACCESS DENIED).
• Identifying persistence mechanisms via registry and startup folder modifications.
• Exporting large filtered event sets for offline analysis.