Skip to main content
Glama
InfraMCP

Win MCP Server

by InfraMCP

Win MCP Server

Python 3.10+ License: MIT Pylint Safety Security Scan Dependency Security Check

A Model Context Protocol (MCP) server that provides AI agents with the ability to interact with Windows servers using Windows Remote Management (WinRM). This server enables secure remote PowerShell execution and system management tasks on Windows hosts.

Features

  • Secure Authentication: Uses domain credentials stored in macOS Keychain with TouchID authentication

  • PowerShell Execution: Execute arbitrary PowerShell commands on remote Windows hosts

  • System Information: Get basic system information, running services, and disk space

  • Error Handling: Comprehensive error handling with helpful error messages

  • Memory Safety: Credentials are cleared from memory immediately after use

Related MCP server: Windows Admin MCP

Installation

pip install win-mcp-server

From Source

git clone https://github.com/rorymcmahon/win-mcp-server.git
cd win-mcp-server
pip install -e .

Configuration

Prerequisites

  1. WinRM Configuration: Ensure target Windows hosts have WinRM enabled and configured.

  2. Credential Setup: The server will prompt for credentials on first use and cache them securely in macOS Keychain with 4-hour expiration.

    For non-interactive/CI environments you can skip the prompt entirely by setting environment variables. When both are present they take precedence over any cached Keychain entry:

    export WINRM_USER="myuser"
    export WINRM_PWD="mypassword"

    The hyphenated names WINRM-USER / WINRM-PWD are also accepted if your launcher can set them.

MCP Configuration

Add to your MCP settings file (e.g., ~/.config/mcp/settings.json):

{
  "mcpServers": {
    "winrm": {
      "command": "winrm-mcp-server"
    }
  }
}

Available Tools

setup_credentials(hostname: str)

Setup credentials for a Windows host (interactive mode).

Parameters:

  • hostname: The target Windows hostname (FQDN)

Returns:

  • status: Success or error status

  • message: Confirmation message

execute_powershell(hostname: str, command: str)

Execute arbitrary PowerShell commands on a remote Windows host.

Parameters:

  • hostname: The target Windows hostname (FQDN)

  • command: PowerShell command to execute

Returns:

  • status: Exit code of the command

  • stdout: Standard output from the command

  • stderr: Standard error from the command

get_system_info(hostname: str)

Get basic system information from a Windows host.

Returns: JSON with Windows product name, total physical memory, and processor information.

get_running_services(hostname: str)

Get list of running services from a Windows host.

Returns: JSON array of running services with name, status, and start type.

get_disk_space(hostname: str)

Get disk space information from a Windows host.

Returns: JSON array of logical disks with device ID, total size, and free space in GB.

Usage Examples

Initial Setup

"Setup credentials for server01.domain.local"

Basic System Check

"Get system info and disk space for server01.domain.local"

Service Management

"Check if IIS is running on webserver.domain.local"
"Get running services on server01.domain.local"

Custom PowerShell Commands

"Run 'Get-EventLog -LogName System -Newest 10' on server01.domain.local"
"Execute 'Get-Process | Sort-Object CPU -Descending | Select-Object -First 10' on server01.domain.local"

Security

  • Credential Storage: Domain credentials are securely stored in macOS Keychain

  • TouchID Authentication: Credentials require TouchID authentication for access

  • Memory Safety: Passwords are immediately cleared from memory after use

  • Transport Security: Uses NTLM authentication over HTTP (configurable for HTTPS)

  • Automatic Expiration: Cached credentials expire after 4 hours

  • Secure Prompting: Password input is hidden and never logged

Development

Setup Development Environment

git clone https://github.com/rorymcmahon/winrm-mcp-server.git
cd winrm-mcp-server
pip install -e ".[dev]"

Running Tests

pytest

Code Formatting

black src/
isort src/

Requirements

  • Python 3.10+

  • macOS (for Keychain integration)

  • Target Windows hosts with WinRM enabled

License

MIT License - see LICENSE file for details.

Contributing

  1. Fork the repository

  2. Create a feature branch

  3. Make your changes

  4. Add tests if applicable

  5. Submit a pull request

Support

For issues and questions:

Available Tools

6 tools
win_clear_credentialsC

Clear cached credentials for a Windows host

NameRequiredDescriptionDefault
hostnameYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It implies a destructive or state-changing operation by saying credentials are cleared but does not disclose impact, reversibility, required permissions, host connectivity requirements, or expected behavior after clearing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It efficiently states the action and target scope, though it is under-specified in other dimensions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool, the description gives enough to understand the basic action and target. However, with no annotations, no output schema, and zero schema description coverage, it leaves important mutation context and parameter details unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not explain the single required hostname parameter beyond referring to a "Windows host." It omits format expectations, whether an IP address is acceptable, and any targeting constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb, "Clear," and a specific resource, "cached credentials," scoped to a "Windows host." This clearly distinguishes the action from sibling tools like win_setup_credentials, though it does not explicitly name alternatives or exclusions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as win_setup_credentials or win_execute_powershell. Usage is only implied by the action itself, with no prerequisites, exclusions, or conditions stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

win_execute_powershellC

Execute PowerShell command on remote Windows host

NameRequiredDescriptionDefault
commandYes
hostnameYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and discloses almost nothing: it does not say arbitrary code execution is possible, whether actions are reversible, that credentials must be established first, what timeout applies, or what the response contains. Only the word 'remote' hints at the execution model.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero wasted words. However, the terseness reflects under-specification rather than discipline, so it does not reach a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-risk remote code execution tool with no annotations, no output schema, and undocumented parameters, the description is far too thin. It should at minimum state credential prerequisites and the shape of returned output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters have 0% schema description coverage, so the description must compensate and does not. It gives no hostname format (FQDN, IP, alias), no indication of whether command is a single statement, pipeline, or script block.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Execute) and resource (PowerShell command) against a named target (remote Windows host). Implicitly distinguishes itself from the read-only get_* siblings, but never names them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus the informational siblings, no prerequisites, and no exclusions. The presence of win_setup_credentials suggests a credential prerequisite the description never mentions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

win_get_disk_spaceC

Get disk space information from Windows host

NameRequiredDescriptionDefault
hostnameYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden but only implies a read operation. It does not state whether credentials are required (despite the sibling win_setup_credentials), what happens if the host is unreachable, or what the returned disk-space data includes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single sentence is front-loaded and free of waste. However, its brevity borders on under-specification rather than efficient conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations, no output schema, and an undocumented required parameter, the description leaves critical context missing. An agent cannot determine authentication needs, failure behavior, or return shape from this definition alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the only parameter, hostname, has no documented format in either schema or description. The description implies hostname identifies the Windows host but does not clarify whether it expects an FQDN, IP address, or credential reference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (Get) and resource (disk space information) scoped to a Windows host. It is distinguishable from win_get_running_services or win_get_system_info at a glance, though it does not explicitly name those siblings as alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus win_get_system_info or win_execute_powershell, and no prerequisites such as credential setup or host reachability are mentioned. Usage is only implied by the phrase 'from Windows host.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

win_get_running_servicesC

Get running services from Windows host

NameRequiredDescriptionDefault
hostnameYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It doesn't state that credentials must be configured first, what transport/permissions are needed, whether the call is read-only (implied but unstated), or what form the service list takes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence with the key noun front-loaded and no filler. It is efficient, though the brevity leaves gaps addressed elsewhere in the scoring.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a remote-host query with zero annotation coverage, no output schema, and an undocumented required parameter, the description should mention the credential/host-access prerequisite and roughly what comes back. As written, an agent knows the intent but not whether it can safely call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single parameter (hostname) has no documented format, FQDN vs NetBIOS vs IP. The phrase 'Windows host' hints at the parameter's role but adds no usable syntax detail for the agent to construct a valid call.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Get') and resource ('running services') scoped to a Windows host. It is clearly distinguishable from siblings like win_get_disk_space and win_get_system_info by resource, though it doesn't explicitly contrast with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus win_get_system_info or win_execute_powershell for service inspection. No prerequisites mentioned, despite win_setup_credentials being a sibling that presumably gates access to the host.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

win_get_system_infoC

Get basic system information from Windows host

NameRequiredDescriptionDefault
hostnameYes

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. 'Get' implies a read, but there is no disclosure of required credentials (notable given the win_setup_credentials sibling), permissions, latency, or output shape. The agent knows only that it is likely non-mutating.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short, front-loaded sentence with no filler, which is appropriate. However, brevity here comes at the cost of specification rather than earned conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a remote-host read tool with no output schema and no annotations, the description omits the essentials: what information is returned, authentication requirements, and hostname semantics. Only the bare purpose is covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single required parameter 'hostname' is never mentioned in the description. No format, target eligibility, or default behavior is conveyed, so the agent must infer parameter meaning entirely.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a verb and resource ('Get basic system information from Windows host'), and the resource is distinct from siblings like disk space or running services. But 'basic system information' is vague about what is actually retrieved (OS version, uptime, hardware?), leaving the agent guessing at scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No indication of when to use this over siblings such as win_get_disk_space or win_get_running_services, nor any prerequisites. The agent gets a label, not routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

win_setup_credentialsC

Setup credentials for a Windows host using GUI prompts

NameRequiredDescriptionDefault
hostnameYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. 'Using GUI prompts' is a genuinely useful disclosure (interactive, requires a desktop session, blocks on user input), but it omits what happens to existing credentials, whether the operation is destructive, where secrets are stored, and what permissions are needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. It is efficient, though its brevity contributes to the specification gaps captured elsewhere.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a credential-writing tool with no annotations, no output schema, and an undocumented parameter, the description leaves too much unknown: interactivity requirements, overwrite behavior, security implications, and what the caller gets back on success or cancellation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one required parameter (hostname) at 0% schema description coverage, and the description never references it — no format, target resolution, or example. The description does not compensate for the undocumented parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Setup credentials for a Windows host') and adds the mechanism ('GUI prompts'), which lets an agent distinguish this from the sibling win_clear_credentials. It stops short of naming alternatives or the scope of the credentials being created.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance, and no mention of the sibling win_clear_credentials or win_execute_powershell alternatives. The only usable signal is 'GUI prompts', which is a behavioral trait rather than a routing instruction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.3.0
    • First observedwin_clear_credentials
    • First observedwin_execute_powershell
    • First observedwin_get_disk_space
    • First observedwin_get_running_services
    • First observedwin_get_system_info
    • First observedwin_setup_credentials

TDQS

B3.2/5.0

Scored across 6 tools

Disambiguation4/5

Each tool has a distinct role: credentials setup/clear, targeted system queries, and PowerShell execution. The only overlap is that win_execute_powershell could also retrieve system, service, or disk information, but the dedicated getters are clearly named and scoped.

Naming Consistency5/5

All tools share a consistent win_ prefix followed by a verb_noun pattern such as win_get_system_info or win_execute_powershell. The convention is predictable throughout.

Tool Count5/5

Six tools is well-scoped for basic remote Windows host management. Each tool covers a distinct operational need without excessive fragmentation.

Completeness4/5

The surface covers command execution, system information, services, disk space, and credential lifecycle. Minor gaps exist around service/process mutation and file transfer, though arbitrary PowerShell execution provides a workaround.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    A
    maintenance
    Enables AI agents to run PowerShell commands and manage Windows services without intrusive console windows, while also supporting remote execution via SSH and WinRM.
    20
    394 npm
    1
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI agents to securely connect to and manage remote servers via SSH, with tools for running commands, file operations, log inspection, service management, and system monitoring under configurable access controls and audit logging.
    12
    5 npm
    1
    MIT