winrm-mcp
WinRM-MCP is an MCP server that allows remote control of Windows guest VMs from a Windows host via WinRM. Key capabilities include:
Remote Execution
run_ps– Run PowerShell scripts on the guest VMrun_cmd– Run CMD commands on the guest VMstart_process– Launch executables or scripts, with optional wait for exit code
Shell Session Management
open_shell/session_run/close_shell– Manage persistent shell sessions that preserve working directory and environment
File Transfer
copy_to_guest– Copy files from host to guest (with SHA256 integrity verification)copy_from_guest– Copy files from guest back to hosttest_file_copy– Test file copy functionality using a temporary file
Connectivity & Health
health_check– Verify WinRM connectivity and configurationwait_for_winrm/reboot_and_wait– Poll and wait for WinRM availability after reboots
VM Lifecycle
reboot– Reboot the guest VM
System Information & Process Management
get_processes,get_dlls,get_system_info– Enumerate processes, loaded DLLs, and system infofind_processes_by_dll,list_dlls_of_process,check_process,file_exists– Helper functions for analysisrun_sysinternals– Run Sysinternals tools on the guest
Code Coverage
litecov_spawn/litecov_attach– Spawn or attachlitecov.exefor code coverage analysisdownload_coverage/upload_build_file– Manage coverage files and build artifacts
Kernel Debugging (KDNET)
query_debug_settings– Query current boot debug settings viabcdeditconfigure_kdnet– Configure KDNET kernel debugging and optionally write a shared state file for KD-MCP integration
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@winrm-mcpconfigure KDNET debugging on guest"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
WinRM-MCP
winrm-mcp는 Windows 호스트에서 Windows 게스트 VM을 WinRM으로 제어하기 위한 MCP(Model Context Protocol) 서버입니다.
이 서버는 Codex 또는 MCP Client에서 호출되며, 게스트 VM에 파일을 복사하거나, PowerShell/CMD 명령을 실행하거나, 분석 대상 프로그램을 실행하고, KDNET 커널 디버깅 준비 작업을 자동화하는 데 사용됩니다.
Features
이 프로젝트는 다음 기능을 제공합니다.
게스트 VM에서 PowerShell 스크립트 실행
게스트 VM에서 CMD 명령 실행
호스트에서 게스트로 파일 복사
게스트에서 호스트로 파일 복사
SHA256 기반 파일 무결성 검증
파일 복사 검증용
test_file_copy()도구게스트에서 실행 파일 또는 스크립트 실행
현재 디렉터리를 유지하는 논리 쉘 세션
Sysinternals 기반 분석 편의 도구
litecov 실행 및 attach helper
coverage 파일 다운로드 helper
build 파일 업로드 helper
게스트 VM 재부팅
KDNET 설정 자동화
KD-MCP와 연동하기 위한 상태 파일 생성
Related MCP server: kd-mcp
Architecture
WinRM-MCP는 게스트 VM 안에서 실행하는 프로그램이 아닙니다.
WinRM-MCP는 호스트 Windows에서 실행되고, 게스트 Windows는 WinRM 서비스로 요청을 받는 구조입니다.
Host Windows
├─ Claude Code / Codex CLI / MCP Client
├─ winrm-mcp
├─ kd-mcp
└─ kd.exe / WinDbg
Guest Windows VM
├─ WinRM Service
├─ Analysis Target
└─ KDNET Target Configuration즉, 게스트에서는 WinRM 서비스를 활성화해야 하고, 호스트에서는 이 MCP 서버를 실행해야 합니다.
Requirements
호스트에는 다음이 필요합니다.
Windows 10/11 또는 Windows Server
Python 3.10 이상
Claude Code, Codex CLI 또는 MCP Client
게스트 WinRM 엔드포인트에 접근 가능한 네트워크 연결
게스트에는 다음이 필요합니다.
Windows 10/11 또는 Windows Server
관리자 계정
WinRM 서비스 활성화
호스트에서 접근 가능한 방화벽 규칙
KDNET까지 사용할 경우, 게스트가 Windows 네트워크 커널 디버깅을 지원해야 합니다.
Enable WinRM on Guest
게스트 VM에서 관리자 PowerShell을 열고 다음 명령을 실행합니다.
Enable-PSRemoting -Force네트워크 프로필이 Public이면 WinRM 방화벽 예외가 실패할 수 있습니다. 이 경우 게스트에서 네트워크 프로필을 Private으로 변경한 뒤 다시 실행합니다.
Get-NetConnectionProfile
Set-NetConnectionProfile -NetworkCategory Private
Enable-PSRemoting -Force호스트에서 연결을 확인합니다.
Test-WSMan <guest-ip>정상이라면 WSMan 응답 정보가 출력됩니다.
Install
호스트 Windows에서 레포지토리를 클론한 뒤 설치합니다.
git clone https://github.com/haoylle/26_WinRM-MCP.git
cd 26_WinRM-MCP
.\scripts\install.ps1설치 후 examples/config.yaml을 복사하여 실제 설정 파일을 만듭니다.
Copy-Item .\examples\config.yaml .\config.yamlConfiguration
config.yaml은 WinRM 연결 정보, 출력 제한, 파일 복사 청크 크기, 재연결 대기 정책, 분석 도구 경로, KDNET 설정을 포함합니다.
예시는 다음과 같습니다.
guest:
host: "192.168.122.50"
username: "Administrator"
password: null
transport: "ntlm"
scheme: "http"
port: 5985
server_cert_validation: "ignore"
operation_timeout_sec: 60
read_timeout_sec: 90
allow_unencrypted: true
path: "/wsman"
limits:
max_stdout_chars: 200000
copy_chunk_bytes: 2048
command_timeout_sec: 300
recovery:
reconnect_timeout_sec: 300
reconnect_interval_sec: 5
reconnect_settle_sec: 10
reboot_offline_timeout_sec: 60
analysis:
sysinternals_dir: "C:\\Users\\Administrator\\Desktop\\SysinternalsSuite"
litecov_path: "C:\\Users\\Administrator\\Desktop\\covcheck\\litecov.exe"
coverage_file: "C:\\Users\\Administrator\\Desktop\\covcheck\\sym_cov.txt"
build_files_dir: "C:\\Users\\Administrator\\Desktop\\build_files"
kdnet:
host_ip: "192.168.122.1"
port: 50000
key: "1.2.3.4"
state_file: "C:\\mcp-state\\kd-session.json"
bcdedit_path: "bcdedit.exe"server.py의 기본 copy_chunk_bytes 값은 8192입니다. 하지만 config.yaml에 값이 있으면 설정 파일 값이 우선 적용됩니다.
파일 복사가 불안정하거나 The command line is too long 오류가 발생하면 2048 또는 1024처럼 작은 값으로 낮추는 것이 좋습니다.
recovery 설정은 재부팅 또는 KD break 해제 후 WinRM이 다시 살아날 때까지 얼마나 기다릴지 결정합니다.
reconnect_timeout_sec: WinRM 재연결 최대 대기 시간reconnect_interval_sec: 재시도 간격reconnect_settle_sec: 연결 직후 추가 안정화 대기 시간reboot_offline_timeout_sec: 재부팅 후 WinRM down 상태를 관찰하는 최대 시간
analysis 설정은 기존 분석 환경에서 쓰던 Sysinternals/litecov helper가 사용할 guest 경로를 정의합니다.
sysinternals_dir:pslist.exe,Listdlls.exe,PsInfo.exe가 있는 디렉터리litecov_path: guest에서 실행할litecov.exe경로coverage_file:download_coverage가 가져올 guest coverage 파일build_files_dir:upload_build_file가 업로드할 guest 디렉터리
비밀번호는 config.yaml에 직접 저장하는 것보다 환경 변수로 지정하는 방식을 권장합니다.
$env:WINRM_PASSWORD = "guest-admin-password"
$env:WINRM_MCP_CONFIG = "C:\\tools\\26_WinRM-MCP\\config.yaml"MCP Client Setup
이 MCP 서버는 stdio 기반 로컬 MCP 서버로 실행됩니다.
아래 예시는 레포지토리를 C:\tools\26_WinRM-MCP에 설치했다고 가정합니다. 실제 경로에 맞게 수정해야 합니다.
Claude Code
Claude Code에서 프로젝트 단위로 등록하려면 프로젝트 루트에서 다음 명령을 실행합니다.
claude mcp add winrm `
--env WINRM_MCP_CONFIG="C:\tools\26_WinRM-MCP\config.yaml" `
--env WINRM_PASSWORD="guest-admin-password" `
-- "C:\tools\26_WinRM-MCP\.venv\Scripts\winrm-mcp.exe"사용자 전체 설정으로 등록하고 싶다면 Claude Code의 MCP scope 옵션을 사용하여 user scope로 추가합니다.
claude mcp add winrm `
--scope user `
--env WINRM_MCP_CONFIG="C:\tools\26_WinRM-MCP\config.yaml" `
--env WINRM_PASSWORD="guest-admin-password" `
-- "C:\tools\26_WinRM-MCP\.venv\Scripts\winrm-mcp.exe"수동으로 .mcp.json을 사용하는 경우에는 다음처럼 작성할 수 있습니다.
{
"mcpServers": {
"winrm": {
"command": "C:\\tools\\26_WinRM-MCP\\.venv\\Scripts\\winrm-mcp.exe",
"env": {
"WINRM_MCP_CONFIG": "C:\\tools\\26_WinRM-MCP\\config.yaml",
"WINRM_PASSWORD": "guest-admin-password"
}
}
}
}등록 후 Claude Code를 다시 시작하거나 MCP 서버 목록을 갱신한 뒤 winrm.health_check를 호출해 연결을 확인합니다.
Codex CLI
Codex CLI에서는 사용자 설정 파일에 MCP 서버를 추가합니다.
Windows 기준 설정 파일 위치 예시는 다음과 같습니다.
%USERPROFILE%\.codex\config.toml다음 항목을 추가합니다.
[mcp_servers.winrm]
command = "C:\\tools\\26_WinRM-MCP\\.venv\\Scripts\\winrm-mcp.exe"
env = { WINRM_MCP_CONFIG = "C:\\tools\\26_WinRM-MCP\\config.yaml", WINRM_PASSWORD = "guest-admin-password" }Codex CLI를 다시 시작한 뒤 MCP tool 목록에서 winrm 서버가 보이는지 확인합니다.
WinRM 연결 확인은 다음 tool을 먼저 호출하는 방식으로 진행합니다.
winrm.health_checkUsing WinRM-MCP and KD-MCP Together
WinRM-MCP와 KD-MCP를 둘 다 사용하는 경우 Claude Code 또는 Codex CLI에 두 MCP 서버를 모두 등록해야 합니다.
WinRM-MCP는 게스트 파일 복사, 명령 실행, KDNET 설정을 담당하고 KD-MCP는 kd.exe 연결과 커널 디버거 명령 실행을 담당합니다.
Tools
health_check
설정 파일을 읽고 게스트 VM에 WinRM 연결이 가능한지 확인합니다.
내부적으로 PowerShell 버전, 사용자 이름, 호스트 이름을 조회합니다.
run_ps
게스트 VM에서 PowerShell 스크립트를 실행합니다.
예시는 다음과 같습니다.
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersionrun_cmd
게스트 VM에서 cmd.exe /c 명령을 실행합니다.
예시는 다음과 같습니다.
whoami && hostnameopen_shell / session_run / close_shell
MCP 요청/응답 방식에 맞춘 논리 쉘 세션을 제공합니다.
완전한 대화형 터미널은 아니지만, 현재 디렉터리를 유지하면서 여러 명령을 순차적으로 실행할 수 있습니다.
copy_to_guest
호스트 파일을 게스트 VM으로 복사합니다.
파일은 Base64 청크로 나누어 WinRM을 통해 전송됩니다. 복사 후 verify_hash=true이면 로컬 파일과 원격 파일의 SHA256 해시를 비교합니다.
정상 결과 예시는 다음과 같습니다.
{
"ok": true,
"hash_ok": true
}hash_ok가 false이면 파일이 손상되었을 수 있으므로 실행하지 않는 것이 좋습니다.
test_file_copy
파일 복사 기능을 검증하는 테스트 도구입니다.
32KB 임시 파일을 생성하여 게스트에 복사하고, SHA256 검증 후 임시 파일을 삭제합니다.
정상 결과 예시는 다음과 같습니다.
{
"ok": true,
"hash_ok": true
}copy_from_guest
게스트 VM의 파일을 호스트로 복사합니다.
이 기능도 copy_chunk_bytes 설정을 사용하여 파일을 청크 단위로 읽어옵니다.
start_process
게스트 VM에서 실행 파일 또는 스크립트를 시작합니다.
wait=true이면 프로세스 종료까지 기다리고, 가능한 경우 ExitCode를 반환합니다.
get_processes / get_dlls / get_system_info / run_sysinternals
Sysinternals 기반 분석 보조 도구입니다.
analysis.sysinternals_dir가 설정되어 있어야 합니다.
find_processes_by_dll / list_dlls_of_process / check_process / is_litecov_running / file_exists
분석 중 자주 필요한 helper입니다.
find_processes_by_dll: 특정 DLL을 로드한 프로세스 찾기list_dlls_of_process: 특정 프로세스의 DLL 목록 조회check_process: 프로세스 존재 여부와 PID 확인is_litecov_running: litecov 실행 여부 확인file_exists: guest 경로 존재 여부와 기본 metadata 확인
litecov_spawn / litecov_attach
litecov.exe를 새 프로세스로 실행하거나 기존 PID에 attach합니다.
analysis.litecov_path가 설정되어 있어야 합니다.
download_coverage / upload_build_file
분석 산출물 전송 helper입니다.
download_coverage:analysis.coverage_file을 호스트로 다운로드upload_build_file: 로컬 빌드 파일을 guest의analysis.build_files_dir아래에 unique name으로 업로드
reboot
게스트 VM을 WinRM을 통해 재부팅합니다.
재부팅 후에는 WinRM 연결이 잠시 끊길 수 있습니다.
단순히 재부팅 요청만 보내므로, 실제로 부팅이 끝날 때까지 기다리려면 reboot_and_wait를 사용하는 것이 좋습니다.
wait_for_winrm
게스트가 재부팅 중이거나 KD break에서 복귀한 뒤 WinRM이 다시 응답할 때까지 polling합니다.
각 시도마다 새 WinRM 세션을 만들어 stale connection을 재사용하지 않습니다.
reboot_and_wait
게스트에 재부팅을 요청한 뒤 WinRM이 한 번 끊기는지 관찰하고, 부팅 후 다시 응답할 때까지 기다립니다.
재부팅 중 연결이 끊겨 예외가 발생해도 expected disconnect로 처리하고 재접속 단계로 넘어갑니다.
query_debug_settings
게스트 VM에서 현재 부팅 디버깅 설정을 조회합니다.
내부적으로 bcdedit /enum {current} 및 bcdedit /dbgsettings를 실행합니다.
configure_kdnet
게스트 VM에서 KDNET 커널 디버깅 설정을 적용합니다.
성공하면 호스트에 state_file을 생성합니다. 이 파일은 KD-MCP의 start_from_state가 읽어 커널 디버거 연결에 사용합니다.
KD-MCP Workflow
WinRM-MCP와 KD-MCP를 함께 사용할 때의 일반적인 순서는 다음과 같습니다.
1. winrm-mcp: configure_kdnet
2. winrm-mcp: reboot_and_wait
3. kd-mcp: start_from_state
4. kd-mcp: kd_command
5. KD가 break 상태면 kd-mcp: resume_for_winrm
6. winrm-mcp: wait_for_winrm두 레포지토리는 동일한 state_file, port, key 값을 사용해야 합니다.
Troubleshooting
WinRM connection fails
호스트에서 다음 명령으로 게스트 WinRM 연결을 확인합니다.
Test-WSMan <guest-ip>게스트 네트워크가 Public이면 방화벽 예외가 적용되지 않을 수 있습니다.
게스트가 재부팅 중이거나 KD break에서 막 풀린 직후라면 wait_for_winrm 또는 reboot_and_wait를 먼저 호출하는 편이 낫습니다.
File hash mismatch
파일 복사 후 호스트와 게스트의 SHA256이 다르면 복사 중 손상된 것입니다.
이 경우 다음을 확인합니다.
copy_to_guest결과의hash_ok호스트/게스트 파일 크기
copy_chunk_bytes설정MCP 서버 재시작 여부
복사 결과가 hash_ok=true가 아니면 파일을 실행하지 않는 것이 좋습니다.
Executable is not valid for this OS platform
실행 파일이 손상되었거나 현재 OS와 맞지 않는 형식일 때 발생할 수 있습니다.
먼저 호스트 파일과 게스트 파일의 SHA256을 비교해야 합니다.
Get-FileHash .\target.exe -Algorithm SHA256Security Notes
이 프로젝트는 실험실 VM, 취약점 분석 환경, 커널 디버깅 환경을 대상으로 합니다.
신뢰할 수 없는 네트워크에 WinRM을 노출하지 않는 것이 좋습니다.
가능하면 다음 방식을 사용합니다.
WinRM over HTTPS
비밀번호 환경 변수 사용
방화벽 접근 제한
명령 실행 전 검토
공유 환경에서는
allowed_command_prefixes설정
License
MIT License
Available Tools
12 toolsclose_shellC
Close a logical shell session.
| Name | Required | Description | Default |
|---|---|---|---|
| shell_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the burden of behavioral disclosure. It fails to mention side effects (e.g., termination of running processes, resource cleanup) or any permissions needed for closing a shell.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence, which is concise but overly sparse. It lacks details that could be conveyed without adding significant length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and parameter descriptions, the tool's definition is incomplete. Even for a simple tool with one parameter, more context is needed for proper use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and no parameter details in the description, the parameter 'shell_id' is merely listed as a string type. The description adds no meaning beyond the schema, leaving the agent uncertain about what value to provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Close) and the resource (a logical shell session), directly indicating the tool's purpose. It distinguishes from the sibling 'open_shell'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, or any prerequisites (e.g., needing an active shell session). The description leaves the agent without context for proper invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
configure_kdnetC
Configure guest boot settings for KDNET kernel debugging and optionally write a shared state file for kd-mcp.
| Name | Required | Description | Default |
|---|---|---|---|
| host_ip | No | ||
| port | No | ||
| key | No | ||
| write_state | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It mentions configuring boot settings and optionally writing a state file, but fails to clarify whether the operation is destructive, requires specific privileges, persists across reboots, or what the impact is on the guest. This lack of transparency is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is appropriately front-loaded with the purpose. However, for a tool with 4 parameters and no schema descriptions, it is too sparse. It would benefit from additional context without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the presence of an output schema, the description lacks information about parameter usage, behavioral effects, and usage context. The tool modifies debugging settings, which could be critical, yet the description omits essential completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the schema has no descriptions for any of the 4 parameters. The description only hints at the 'write_state' parameter via 'optionally write a shared state file' but does not explain host_ip, port, or key. The parameters are mostly self-documenting from their names, but the tool's complex debugging purpose deserves more detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool configures guest boot settings for KDNET kernel debugging and optionally writes a shared state file. It specifies the verb (configure), resource (guest boot settings for KDNET debugging), and a notable side effect, distinguishing it from sibling tools which focus on shell, file operations, and other tasks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as query_debug_settings or other configuration tools. It does not mention prerequisites, when not to use it, or how it fits into a workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
copy_from_guestC
Copy a file from the Windows guest to the host running this MCP server.
| Name | Required | Description | Default |
|---|---|---|---|
| remote_path | Yes | ||
| local_path | Yes | ||
| overwrite | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description lacks details on file overwrite behavior, permissions, error handling, or constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very concise, single sentence, but overly terse given the lack of supporting details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter file copy with no annotations and an output schema, description omits critical context like overwrite behavior, path formats, and return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Description does not explain parameters beyond their names; schema has 0% description coverage, leaving the agent to infer meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Copy a file), the source (Windows guest), and the destination (host), differentiating it from sibling copy_to_guest.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like copy_to_guest or other file operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
copy_to_guestB
Copy a file from the host running this MCP server to the Windows guest.
| Name | Required | Description | Default |
|---|---|---|---|
| local_path | Yes | ||
| remote_path | Yes | ||
| overwrite | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states the basic action, with no information about destructive behavior (overwrite defaults to true), permissions needed, error handling, or side effects. The description is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence with no wasted words. However, it is so brief that it sacrifices useful context. It is appropriately sized for a simple tool but could include more detail without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters (2 required), no annotations, and an output schema that is not referenced in the description, the description is incomplete. It does not explain return values, error conditions, or prerequisites. The tool is simple but the description lacks contextual information needed for safe and correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description offers no explanation of the three parameters. The 'local_path' and 'remote_path' are mentioned implicitly as source and destination, but no format, restrictions, or allowed values are provided. The 'overwrite' boolean is not described at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific verb 'copy' and identifies the resource as 'a file from the host running this MCP server to the Windows guest'. It distinguishes from sibling 'copy_from_guest' by specifying directionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is provided. The description implies usage for copying files to the guest, but does not state prerequisites, alternatives, or context. The distinction from 'copy_from_guest' is clear from the name but not elaborated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
health_checkA
Verify config loading and WinRM connectivity by running a harmless command on the guest.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description indicates it is harmless and runs on the guest but does not detail output format or state changes. Output schema may compensate, but description alone is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with immediate purpose; no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool with no parameters and output schema present; description sufficiently covers what the tool does and its effect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. The description adds nothing beyond schema, but baseline 4 is appropriate for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool verifies config loading and WinRM connectivity by running a harmless command on the guest. This distinguishes it from sibling tools like run_cmd or reboot.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies use for initial environment validation before other operations, but lacks explicit when-not-to-use or alternative tool references.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_shellA
Create a logical shell session. It preserves cwd and environment between session_run calls.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | C:\ |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; the description discloses state preservation behavior but omits potential side effects, permissions, or limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no wasted words, front-loading the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and an output schema, the description adequately covers the essential context needed for correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has one parameter (cwd) with 0% schema description coverage; description adds only that cwd is preserved, not explaining its format or impact beyond default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a logical shell session that preserves cwd and environment between session_run calls, distinguishing it from sibling tools like session_run and close_shell.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage before session_run but does not explicitly state when to use vs not use alternatives, nor mention any prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_debug_settingsA
Return bcdedit debug settings from the guest.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description fully shoulders behavioral disclosure. It only states the action, but omits critical details such as whether the operation is read-only (likely), requires special permissions, or has any side effects on the guest system.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence of 7 words conveys the entire purpose with no wasted words. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While an output schema exists (not shown), the description is minimal. It does not clarify that the tool is non-destructive or that it retrieves settings from the guest VM. For a simple tool, this may be sufficient, but more context (such as 'read-only' or 'no side effects') would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters with 100% coverage, so the description adds no additional parameter meaning. Per guidelines, 0 params warrants a baseline of 4, which is appropriate since there is nothing to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Return' and clearly identifies the resource 'bcdedit debug settings from the guest', making the purpose unambiguous. It distinguishes itself from sibling tools like run_cmd or run_ps which are general command executors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. While its purpose is implied (retrieve debug settings), there is no mention of prerequisites, exclusions, or comparison with similar tools like run_cmd which could achieve the same goal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rebootC
Reboot the guest VM via WinRM.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Does not disclose effects like whether reboot is graceful or asynchronous, or dependencies beyond WinRM. No annotations to compensate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with action, no redundancy. Very concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given lack of annotations and minimal schema, description fails to provide enough context for correct invocation (e.g., force parameter meaning, return values).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and description does not explain the only parameter 'force'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states action (reboot), target (guest VM), and method (via WinRM). Distinguishes from siblings like copy, shell, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives, no prerequisites or exclusions mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_cmdC
Run a cmd.exe command on the guest through WinRM.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as whether the command blocks, captures output, requires admin rights, or has side effects. The description carries the full burden but fails to add value beyond the obvious.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loaded, but it is too succinct and lacks necessary detail. Conciseness is good, but not at the expense of completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a single parameter and no annotations, the description is incomplete. It does not explain return values, error behavior, or output schema (though one exists). Sibling tools are not differentiated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate for the parameter 'command' but only mentions it is a command without specifying format, encoding, or examples. Adds minimal meaning beyond the schema definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Run'), the resource ('cmd.exe command on the guest'), and the mechanism ('through WinRM'), distinguishing it from sibling tools like run_ps (PowerShell) or start_process.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like run_ps or start_process. Missing prerequisites or context for usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_psC
Run a PowerShell script on the guest through WinRM.
| Name | Required | Description | Default |
|---|---|---|---|
| script | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It only states the execution method (WinRM) but omits behavioral details: return values, error handling, authentication, timeouts.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise and front-loaded with key verb and resource. No extraneous words, but could be slightly expanded to improve clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Minimal description for a tool with one parameter and output schema. Does not explain output structure or how it relates to siblings. Lacks depth for effective agent decision-making.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It implies the 'script' parameter is the script content but does not clarify if inline or file path, nor add formatting constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states action 'Run' and resource 'PowerShell script' with context 'on the guest through WinRM'. It clearly identifies the tool's function but does not explicitly differentiate from siblings like run_cmd.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as run_cmd or start_process. Missing context on use cases or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_runA
Run a command in a logical shell session preserving cwd. shell must be powershell or cmd.
| Name | Required | Description | Default |
|---|---|---|---|
| shell_id | Yes | ||
| command | Yes | ||
| shell | No | powershell |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must cover behavior. It mentions 'preserving cwd' and shell constraint, but lacks details on output, error handling, or what happens if shell parameter is omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence of 17 words is concise and front-loaded. Could be more structured but efficiently conveys core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description omits key context like how shell_id is obtained, expected output, or prerequisites, making it incomplete for effective agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must add meaning. It adds allowed values for 'shell' (powershell or cmd), but no additional info for 'shell_id' or 'command'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Run' and resource 'command in a logical shell session preserving cwd', which distinguishes it from sibling tools like run_cmd and run_ps that likely execute one-off commands.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies usage for session-persistent commands but does not explicitly state when to use this tool over alternatives like run_cmd or start_process.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_processC
Start a process on the guest. Use wait=true to wait for exit code.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| arguments | No | ||
| wait | No | ||
| cwd | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden. It fails to disclose behavioral traits such as whether the process runs in background, potential side effects, permission requirements, or that it may block if 'wait=true'. The sole mention of 'wait' is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence plus a hint), but it is not overly verbose. However, it sacrifices completeness for brevity, so it is not optimally structured. It earns a 3 for being concise but lacking necessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists but is not described, and the input has 4 parameters with only 1 covered, the description is incomplete. The agent would need to infer behavior from the schema alone. The description does not sufficiently complement the structured data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only explains the 'wait' parameter. No details are given for 'file_path', 'arguments', or 'cwd', leaving the agent without semantic understanding of these parameters beyond their schema names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool starts a process on the guest, which is a specific verb and resource. It distinguishes from siblings like 'health_check' or 'reboot', but does not differentiate from similar tools like 'run_cmd' or 'run_ps'. However, the core purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description only hints at using 'wait=true' to wait for exit code, but provides no guidance on when to use this tool over alternatives like 'run_cmd' or 'open_shell'. No exclusions or contextual indicators are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
12 tool updates
v1.0.0- First observed
close_shell - First observed
configure_kdnet - First observed
copy_from_guest - First observed
copy_to_guest - First observed
health_check - First observed
open_shell - First observed
query_debug_settings - First observed
reboot - First observed
run_cmd - First observed
run_ps - First observed
session_run - First observed
start_process
TDQS
Each tool has a clearly distinct purpose: shell session management, file transfer, debugging, reboot, process execution, health check, and command execution. No overlap between tools; an agent can easily differentiate.
All tool names follow a consistent verb_noun or verb_preposition_noun pattern, all lowercase with underscores. Examples: close_shell, copy_from_guest, run_ps. No mixing of styles.
With 12 tools covering shell sessions, file transfer, debugging, reboot, process execution, command execution, and health check, the count is well-scoped for a WinRM remote management server. Each tool earns its place.
The tool surface covers core WinRM operations: shell management, file transfer, debugging, reboot, process execution, and health check. Minor gaps exist (e.g., no tool to list running processes or manage services), but the set is complete for its primary use case.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for Superserve sandboxes: create, exec, and manage Firecracker microVMs
The MCP server for Azure DevOps, bringing the power of Azure DevOps directly to your agents.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA direct kernel debugger MCP server for Windows security research that connects to VM kernels via kdnet using DbgEng COM interfaces. It exposes over 60 tools for memory inspection, breakpoint management, and coordinated execution control between the host and target VM.3Do What The F*ck You Want To Public
- AlicenseBqualityDmaintenanceControls kd.exe for KDNET kernel debugging on Windows, often paired with winrm-mcp for guest VM setup over WinRM.9MIT
- FlicenseAqualityBmaintenanceCross-platform MCP server for policy-controlled command execution on Linux and Windows, with no SSH dependency.3-
- AlicenseNot gradedqualityBmaintenanceAn MCP server that gives an LLM full control over a VMware-hosted Windows VM: lifecycle, snapshots, remote execution, file transfer, and kernel debugging.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/uzhaoy/26_WinRM-MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server