Skip to main content
Glama
sandraschi

Windows Operations MCP

by sandraschi
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault

No arguments

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": true
}
logging
{}
prompts
{
  "listChanged": false
}
resources
{
  "subscribe": false,
  "listChanged": false
}
extensions
{
  "io.modelcontextprotocol/ui": {}
}
experimental
{}

Tools

Functions exposed to the LLM to take actions

NameDescription
agentic_system_hardeningA

Autonomous Windows security hardening with SEP-1577 sampling.

Phases: (1) Inventory the target subsystem, (2) LLM audit for hardening recommendations, (3) Apply HIGH-priority fixes in live mode.

Return Format

{
  "success": bool,
  "target": str,
  "dry_run": bool,
  "audit_recommendations": str,
  "actions_taken": [{"action": str, "status": str}]
}

Examples

agentic_system_hardening(target="services", dry_run=True)
agentic_system_hardening(target="accounts", dry_run=False)

Notes:

  • ctx is required; returns error if called without it.

  • dry_run=False will queue up to 5 HIGH-priority actions.

autonomous_troubleshooterA

Diagnose why a Windows operation failed using event logs, process list, and LLM sampling.

Phases: (1) Query recent System log errors, (2) Snapshot running processes, (3) LLM root-cause analysis with remediation steps.

Return Format

{
  "success": bool,
  "failure_reported": str,
  "event_log_summary": any,
  "root_cause_analysis": str
}

Examples

autonomous_troubleshooter(operation_failure="Could not start WinRM service — access denied")

Notes:

  • ctx is required for sampling.

system_health_cardA

Display a rich system health card with CPU, memory, and disk IO stats. Returns a Prefab UI card in capable MCP hosts; plain text fallback otherwise.

process_list_cardA

Display a rich card listing running processes, optionally filtered by name. Returns a Prefab UI card in capable MCP hosts; plain text fallback otherwise.

winops_cmd_powershellA

Execute a PowerShell command and return stdout, stderr, exit_code, execution_time.

Return Format

{
  "success": bool,
  "message": str,
  "stdout": str,
  "stderr": str,
  "exit_code": int,
  "execution_time": float,
  "next_steps": str | [],
  "sampling_advice": str
}

Examples

powershell(command="Get-Service | Where-Object Status -eq 'Running'")
powershell(command="Get-Process | Sort-Object CPU -Descending | Select -First 10")

Notes:

  • Uses asyncio.to_thread — never blocks the event loop.

  • ctx.sample() capped at 10s to prevent hang on unsupported clients.

  • Safety guards block Linux-isms (grep, tail, rm -rf, etc.) and em dashes.

  • stdout/stderr truncated at max_output_size chars each.

winops_cmd_cmdA

Execute a CMD (cmd.exe) command and return stdout, stderr, exit_code, execution_time.

Return Format

{
  "success": bool,
  "message": str,
  "stdout": str,
  "stderr": str,
  "exit_code": int,
  "execution_time": float,
  "next_steps": str | [],
  "sampling_advice": str
}

Examples

cmd(command="dir /s /b *.log", working_directory="C:\Logs")
cmd(command="ipconfig /all")

Notes:

  • Uses asyncio.to_thread — never blocks the event loop.

  • ctx.sample() capped at 10s to prevent hang on unsupported clients.

  • Safety guards block Linux-isms (grep, tail, rm -rf, etc.) and em dashes.

  • stdout/stderr truncated at max_output_size chars each.

winops_container_execA

Execute a command inside a Docker container.

Uses subprocess directly (not CMD/PowerShell wrapper) to avoid nested-quoting issues and list2cmdline mangling. stdin_data is piped directly to the container command — no need for docker cp + exec dance.

Return Format

{"success": bool, "stdout": str, "stderr": str, "exit_code": int}

Examples

exec(container="postgres", command="psql -U user -d db -c 'SELECT 1'")
exec(container="python-app", command="python /tmp/run.py", stdin_data="input data")
exec(container="nginx", command="nginx -t", timeout_seconds=10)
winops_container_cpA

Copy files between the host and a Docker container.

Direction is determined by the source prefix:

  • source="container:/tmp/data.json", destination="host:./out/" copies FROM container TO host

  • source="host:./script.py", destination="container:/tmp/" copies FROM host TO container

Return Format

{"success": bool, "source": str, "destination": str}

Examples

cp(container="app", source="host:./script.py", destination="container:/tmp/")
cp(container="db", source="container:/tmp/result.csv", destination="host:./output/")
winops_archive_listA

List the contents of a ZIP or TAR archive.

Return Format

{"success": bool, "path": str, "items": [str], "count": int}

Examples

list(path="D:\\backups\\data.zip")
winops_archive_extractA

Extract a ZIP or TAR archive to a directory.

Return Format

{"success": bool, "path": str, "target_dir": str}

Examples

extract(path="D:\\backups\\data.zip", target_dir="D:\\extracted")
winops_archive_createA

Create a new ZIP or TAR archive from a list of files/directories.

Return Format

{"success": bool, "path": str, "archive_type": str, "file_count": int}

Examples

create(path="D:\\backups\\logs.zip", source_files=["C:\\Logs\\app.log"])
winops_archive_addA

Add files to an existing ZIP archive.

Return Format

{"success": bool, "path": str, "added": int}

Examples

add(path="D:\\backups\\data.zip", source_files=["D:\\new_file.txt"])

Notes:

  • Only ZIP archives are supported for add. Use create for TAR.

winops_archive_expand_cabA

Expand a Windows CAB archive using expand.exe.

Return Format

{"success": bool, "path": str, "target_dir": str}

Examples

expand_cab(path="C:\\Windows\\system32\\cabinet.cab", target_dir="D:\\expanded")
winops_json_readA

Read and parse a JSON file.

Return Format

{"success": bool, "data": any}

Examples

read(path="D:\\config\\settings.json")
winops_json_writeA

Write data to a JSON file, creating parent directories as needed.

Return Format

{"success": bool, "path": str}

Examples

write(path="D:\\config\\settings.json", data={"debug": true})
winops_json_validateA

Validate whether a string is valid JSON.

Return Format

{"success": true, "valid": bool, "error": str | null}

Examples

validate(text='{"key": "value"}')
winops_json_patchA

Deep-merge patch data into an existing JSON file (creates file if missing).

Return Format

{"success": bool, "path": str, "updated_keys": [str]}

Examples

patch(path="D:\\config\\app.json", data={"logging": {"level": "DEBUG"}})
winops_json_extract_from_textA

Extract all valid JSON objects/arrays found in unstructured text.

Return Format

{"success": true, "found": int, "items": [any]}

Examples

extract_from_text(text="log output: {\"status\": 200} and more text")
winops_json_formatA

Parse and pretty-print a JSON string.

Return Format

{"success": bool, "formatted": str}

Examples

format(text='{"a":1,"b":2}')
winops_process_listA

List running Windows processes with CPU and memory usage.

Return Format

{
  "success": true,
  "processes": [{"pid": int, "name": str, "user": str, "cpu": float, "mem": float}],
  "count": int,
  "has_more": bool
}

Examples

list(name_filter="python", limit=20)
list(include_system=True, limit=100)

Notes:

  • Result is bounded by limit. If count == limit, has_more may be true.

winops_process_infoA

Get detailed information for a single process by PID.

Return Format

{
  "success": bool,
  "pid": int, "name": str, "status": str, "started": str,
  "cmdline": [str], "cpu_percent": float, "memory_info": {...}, "num_threads": int
}

Examples

info(pid=1234)

Errors:

  • Returns success=false with error="Process not found" if PID does not exist.

winops_process_resourcesA

Snapshot system-wide CPU and memory utilisation.

Return Format

{"success": true, "cpu_percent": float, "virtual_memory": {...}}

Examples

resources()
winops_process_killA

Terminate a process by PID (SIGTERM).

Return Format

{"success": bool, "terminated_pid": int}

Examples

kill(pid=9876)

Errors:

  • Returns success=false if process not found or access denied.

winops_svc_listA

List Windows services, optionally filtered by status.

Return Format

{"success": true, "services": [{"name": str, "display_name": str, "status": str}], "count": int}

Examples

list(filter_status="running")
list(include_system=False)

Errors:

  • Returns success=false if pywin32 is not installed.

winops_svc_statusA

Query the current status of a Windows service.

Return Format

{"success": bool, "name": str, "status": str}

Examples

status(service_name="wuauserv")
winops_svc_startA

Start a Windows service and wait for it to reach running state.

Return Format

{"success": bool, "name": str, "status": str}

Examples

start(service_name="wuauserv")
winops_svc_stopA

Stop a Windows service and wait for it to reach stopped state.

Return Format

{"success": bool, "name": str, "status": str}

Examples

stop(service_name="wuauserv")
winops_svc_restartA

Restart a Windows service and wait for running state.

Return Format

{"success": bool, "name": str, "status": str}

Examples

restart(service_name="spooler")
winops_sys_infoA

Return OS platform, Python version, CPU core count, and total memory.

Return Format

{"success": true, "platform": str, "python": str, "machine": str,
 "cpu_cores": int, "memory_total": int,
 "boot_time": float, "users": [str], "cpu_freq": {...}}  // detailed only

Examples

info()
info(detailed=True)
winops_sys_healthA

Check system health against CPU/memory/disk thresholds.

Return Format

{
  "success": true,
  "status": "healthy" | "degraded" | "unhealthy",
  "cpu_percent": float, "memory_percent": float, "disk_percent": float,
  "sampling_advice": str  // only when degraded/unhealthy and sampling available
}

Examples

health()
health(detailed=True)

Notes:

  • degraded: cpu>70% or mem>80% or disk>85%

  • unhealthy: cpu>90% or mem>90% or disk>95%

winops_sys_test_portA

Test TCP connectivity to a host:port.

Return Format

{"success": true, "host": str, "port": int, "reachable": bool}

Examples

test_port(host="8.8.8.8", port=53)
test_port(host="localhost", port=10800)
winops_evtlog_queryA

Query recent events from a Windows Event Log channel.

Return Format

{
  "success": bool,
  "log_name": str,
  "events": [{"timestamp": str, "id": int, "source": str, "level": str, "message": str}],
  "count": int,
  "has_more": bool
}

Examples

query(log_name="System", max_events=20, time_range_hours=1)
query(log_name="Application", event_id=1000)

Errors:

  • Returns success=false if pywin32 is not installed or log_name is invalid.

winops_evtlog_listA

List all available Windows Event Log channels.

Return Format

{"success": bool, "channels": [str], "count": int}

Examples

list()
winops_evtlog_exportB

Export a Windows Event Log channel to an .evtx file.

Return Format

{"success": bool, "log_name": str, "output_path": str}

Examples

export(log_name="System", output_path="D:\\logs\\system.evtx")
winops_evtlog_clearA

Clear all events from a Windows Event Log channel. Requires Administrator.

Return Format

{"success": bool, "cleared_log": str}

Examples

clear(log_name="Application")
winops_perf_systemA

Snapshot system-wide CPU (per-core), memory, disk I/O, and optionally network I/O.

Return Format

{
  "success": true,
  "cpu_percent_per_core": [float],
  "memory": {...},
  "disk_io": {...},
  "network_io": {...}  // only if include_network=true
}

Examples

system()
system(include_network=False, sample_interval=0.5)

Notes:

  • CPU sampling blocks for sample_interval seconds in a thread pool (not the event loop).

winops_perf_processA

Get CPU, memory, thread count, and I/O counters for a specific process.

Return Format

{
  "success": bool,
  "pid": int, "name": str,
  "cpu_percent": float, "memory_info": {...},
  "num_threads": int, "io_counters": {...}
}

Examples

process(pid=1234)

Errors:

  • Returns success=false with error if PID does not exist.

winops_acl_getA

View the ACL (Access Control List) for a file or directory.

Return Format

{"success": bool, "path": str, "raw_acl": str}

Examples

get(path="C:\\Users\\Public")
winops_acl_grantA

Grant a permission level to a user or group on a file or directory.

Return Format

{"success": bool, "path": str, "user": str, "permission": str}

Examples

grant(path="D:\\data", user="jsmith", permission="M")
winops_acl_revokeA

Revoke all explicit permissions for a user or group on a file or directory.

Return Format

{"success": bool, "path": str, "user": str}

Examples

revoke(path="D:\\data", user="jsmith")
winops_acl_inheritanceA

Enable or disable ACL inheritance on a file or directory.

Return Format

{"success": bool, "path": str, "inheritance_enabled": bool}

Examples

inheritance(path="D:\\secure", enable=False)
winops_accounts_list_usersA

List local Windows user accounts.

Return Format

{"success": bool, "raw_output": str}

Examples

list_users()
winops_accounts_add_userB

Create a new local Windows user account.

Return Format

{"success": bool, "username": str}

Examples

add_user(username="jsmith", password="P@ssw0rd!")
winops_accounts_remove_userA

Delete a local Windows user account.

Return Format

{"success": bool, "username": str}

Examples

remove_user(username="jsmith")
winops_accounts_set_passwordB

Set the password for a local Windows user account.

Return Format

{"success": bool, "username": str}

Examples

set_password(username="jsmith", password="NewP@ss!")
winops_accounts_list_groupsB

List local Windows groups.

Return Format

{"success": bool, "raw_output": str}

Examples

list_groups()
winops_accounts_group_membersA

List members of a local Windows group.

Return Format

{"success": bool, "group": str, "members": [str]}

Examples

group_members(group="Administrators")
winops_accounts_manage_groupA

Add or remove a user from a local Windows group.

Return Format

{"success": bool, "group": str, "username": str, "action": str}

Examples

manage_group(group="Administrators", username="jsmith", action="add")
manage_group(group="Administrators", username="jsmith", action="remove")
winops_auto_task_listA

List all Windows Scheduled Tasks.

Return Format

{"success": bool, "raw_tasks": str}

Examples

task_list()
winops_auto_task_createA

Create a Windows Scheduled Task.

Return Format

{"success": bool, "task_name": str}

Examples

task_create(task_name="DailyBackup", task_path="C:\\scripts\\backup.bat", schedule="DAILY")
winops_auto_task_deleteA

Delete a Windows Scheduled Task.

Return Format

{"success": bool, "task_name": str}

Examples

task_delete(task_name="DailyBackup")
winops_auto_task_runA

Trigger a Windows Scheduled Task to run immediately.

Return Format

{"success": bool, "task_name": str}

Examples

task_run(task_name="DailyBackup")
winops_auto_wmi_queryA

Query a WMI class and return the raw output.

Return Format

{"success": bool, "wmi_class": str, "result": str}

Examples

wmi_query(wmi_class="Win32_Processor")
wmi_query(wmi_class="Win32_BIOS")
winops_net_firewall_listB

List all Windows Firewall rules via netsh.

Return Format

{"success": bool, "raw_rules": str}

Examples

firewall_list()
winops_net_firewall_addA

Add a Windows Firewall rule.

Return Format

{"success": bool, "rule_name": str}

Examples

firewall_add(rule_name="Allow SSH", direction="in", action="allow", port="22")
winops_net_firewall_deleteA

Delete a Windows Firewall rule by name.

Return Format

{"success": bool, "rule_name": str}

Examples

firewall_delete(rule_name="Allow SSH")
winops_net_diagA

Flush DNS cache and return full ipconfig output.

Return Format

{"success": bool, "dns_flushed": bool, "ipconfig": str}

Examples

diag()
winops_apps_listA

List installed AppX/Windows Store packages.

Return Format

{"success": bool, "apps": [...]}

Examples

list(name_filter="Xbox")
list(all_users=True)
winops_apps_uninstallA

Uninstall an AppX/Windows Store package by its PackageFullName.

Return Format

{"success": bool, "package_name": str}

Examples

uninstall(package_name="Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe")

Notes:

  • Get PackageFullName from winops_apps/list.

  • Requires elevation for system/all-user packages.

Prompts

Interactive templates invoked by user choice

NameDescription
registry_hardening_wizardGuide for identifying and fixing insecure registry keys in a given hive.
powershell_agent_scaffoldGenerate a robust, error-tolerant PowerShell script scaffold for a given Windows task.
system_account_auditReview local user accounts and group memberships for security and privilege alignment.
data_surgery_forensicsGuide for using JSON and Archive tools to collect and analyze system configuration artifacts.

Resources

Contextual data attached and managed by the client

NameDescription
get_llms_txtLLM-friendly summary of all tools and capabilities in this server.
get_llms_full_txtFull LLM corpus for windows-operations-mcp (llms-full.txt).
get_expert_skill_legacy[Legacy] SOTA Windows Expert skill instructions (use skill://windows-expert/SKILL.md instead).
windows-expert/SKILL.md🛠️ Skill: Windows Native Hardening & Data Surgery
windows-expert/_manifestFile listing for windows-expert
Prefab Renderer (system_health_card)
Prefab Renderer (process_list_card)

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/sandraschi/windows-operations-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server