F
licenseNot graded
qualityB
maintenanceEnables an LLM client to scan Windows event log files (EVTX) for suspicious activity using Hayabusa, and browse its detection rules directly in conversation.
-
mcp-hayabusa
by chiomao23
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-hayabusascan C:\Logs\security.evtx for high severity detections"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-hayabusa
MCP server that wraps the Hayabusa CLI for EVTX (Windows Event Log) analysis, exposing scan_evtx and get_hayabusa_rules tools.
Prerequisites
Python 3.10+ (this machine's default
python/pyis 3.8 — usepy -3.13explicitly; see below)The Hayabusa binary —
download_hayabusa.py(below) fetches it into./hayabusa/, whichserver.pyfinds automatically. Alternatively, setHAYABUSA_PATHor puthayabusaonPATH.
Related MCP server: hayabusa-mcp
Setup
py -3.13 -m pip install -r requirements.txt
py -3.13 download_hayabusa.py # downloads Hayabusa for this platform into ./hayabusa/server.py finds the downloaded binary automatically — no env var needed. On Linux, set HAYABUSA_LIBC=musl at download time if you need the musl build instead of the glibc default.
Run
py -3.13 server.pyThis starts the server on stdio, for use with an MCP client (e.g. Claude Code, Claude Desktop).
Tool: scan_evtx
Argument | Type | Default | Description |
| str | required | Path to a single |
| str |
| Minimum severity to include: |
Returns a formatted JSON string (total_detections + a detections array), or {"error": ...} on failure (missing file, missing Hayabusa binary, non-zero exit, timeout, locked/inaccessible file, invalid min_severity).
Tool: get_hayabusa_rules
Argument | Type | Default | Description |
| str |
| Case-insensitive substring matched against each rule's title/id/tags/category. Empty = all rules. |
| int |
| Max rules returned, clamped to |
Returns a formatted JSON string: total_rules_scanned, total_matches, returned, truncated, and a rules array (each with title, id, level, status, category, tags, source, path), sorted highest-severity-first. The first call per server process takes a few seconds (parsing ~5000 YAML rule files); results are cached in memory afterward, so subsequent calls are near-instant regardless of keyword/limit.
Status
Verified against a real, locally downloaded Hayabusa v3.10.0 and real EVTX data (including a locked live Windows event log, to confirm error handling). See CLAUDE.md for architecture notes and known gaps.
This server cannot be deployed
Maintenance
ActivityStale
ResponsivenessNo issues
Related MCP Connectors
Offline methodology engine for authorized penetration testing, CTF, and security research.
Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.
55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables Windows Event Log (EVTX) analysis by wrapping Hayabusa, exposing scan and rule retrieval tools.MIT
- FlicenseNot gradedqualityBmaintenanceAnalyze Windows event logs (EVTX files) using Hayabusa, with tools to scan EVTX files for detections and list Hayabusa detection rules.-
- FlicenseNot gradedqualityBmaintenanceEnables Windows Event Log (EVTX) analysis using Hayabusa, with options to filter by severity, rule, and output format.-