procmon-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_processesA | List processes with optional name or PID filter. Returns handles, threads, working set, path, parent PID, start time. |
| get_process_detailsA | Deep process details: modules, handle count, threads, command line, memory breakdown. May warn on protected processes. |
| capture_snapshotC | Point-in-time snapshot of matching processes: processes, modules, network connections. |
| timed_captureA | Repeated snapshots over a duration with optional shell trigger command launched at start. |
| start_etw_traceA | Start a kernel ETW trace via logman (requires elevation). providers are Microsoft-Windows-Kernel-* names or GUID strings. |
| stop_etw_traceA | Stop ETW trace, run tracerpt to CSV and summary, return parsed preview (requires elevation). |
| list_etw_providersC | Parse logman query providers with optional keyword filter. |
| get_network_connectionsC | TCP and/or UDP endpoints with owning process. protocol: tcp, udp, both, all. |
| list_servicesA | Enumerate services via Win32_Service (name, state, start mode, display name, path). |
| list_driversC | Enumerate kernel drivers via Win32_SystemDriver. |
| get_minifiltersB | Run fltmc filters and instances and return raw parsed lines. |
| analyze_peC | Parse a PE file with pefile: imports, exports, category summary. |
| find_pe_filesB | Recursively discover PE files under a directory. |
| query_event_logC | Query a Windows event log via Get-WinEvent FilterHashtable. |
| get_security_eventsB | Security log convenience: IDs 4688, 4624, 4672, 4648 (requires elevation). |
| get_system_infoB | OS build, architecture, hostname, SecurityCenter2 AV products, PowerShell version. |
| check_elevationA | Whether the server is elevated plus a capability matrix for all tools. |
| request_elevationC | Launch a cmd script via UAC (Start-Process -Verb RunAs) to run the given command. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 18 tools
Most tools have distinct purposes, but capture_snapshot bundles process listing and network connections that overlap with list_processes and get_network_connections. However, descriptions clarify the composite nature, reducing ambiguity.
All tool names follow a consistent verb_noun pattern using snake_case (e.g., analyze_pe, list_processes, start_etw_trace), with no mixing of conventions.
18 tools cover a broad monitoring domain, slightly exceeding the typical 3-15 range, but each tool addresses a specific need, and no tool feels redundant.
The tool set covers core process monitoring aspects: process listing, deep details, network, security events, ETW tracing, services, drivers, PE analysis, and elevation handling. There are no obvious gaps for its intended scope.