Skip to main content
Glama
x746b

Windows Forensics MCP Server

by x746b
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Hybrid

disk_parse_srum

Parse SRUDB.dat to extract application resource usage and network bytes sent/received, with time and application filters for Windows forensic analysis.

Instructions

Parse SRUDB.dat for raw application resource counters and network bytes sent/received. Supports application and UTC time filters, derived MB/MiB, and optional network aggregation. Resource counters are not interpreted as elapsed runtime.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum entries; all uses limit // 2 per table. Does not limit aggregate inputs.
tableNoWhich SRUM table to parseapp_resource_usage
srum_pathYesPath to SRUDB.dat file
app_filterNoApplication filter; interpreted using app_match_mode
aggregate_byNoNetwork tables only (network_data_usage or all). Adds aggregates over all matching rows, independent of the entries limit. Existing entries remain in the response.none
app_match_modeNoCase-insensitive matching. Exact basename compares only the executable filename; exact path normalizes case and slashes. Regex searches the raw application name and executable.substring
time_range_endNoInclusive ISO end for both tables; naive times use UTC
time_range_startNoInclusive ISO start for both tables; naive times use UTC

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed7 schema fields changedv1.4.5
    • addedInput schema / properties / aggregate_by
      Added value: +{
+  "default": "none",
+  "description": "Network tables only (network_data_usage or all). Adds aggregates over all matching rows, independent of the entries limit. Existing entries remain in the response.",
+  "enum": [
+    "none",
+    "application",
+    "user",
+    "interface",
+    "application_user",
+    "application_interface"
+  ],
+  "type": "string"
+}
    • changedInput schema / properties / app_filter / description
      Previous value: -"Filter by application name (case-insensitive substring)"New value: +"Application filter; interpreted using app_match_mode"
    • addedInput schema / properties / app_match_mode
      Added value: +{
+  "default": "substring",
+  "description": "Case-insensitive matching. Exact basename compares only the executable filename; exact path normalizes case and slashes. Regex searches the raw application name and executable.",
+  "enum": [
+    "substring",
+    "exact_basename",
+    "exact_path",
+    "regex"
+  ],
+  "type": "string"
+}
    • changedInput schema / properties / limit / description
      Previous value: -"Maximum number of entries to return"New value: +"Maximum entries; all uses limit // 2 per table. Does not limit aggregate inputs."
    • addedInput schema / properties / limit / minimum
      Added value: +0
    • changedInput schema / properties / time_range_end / description
      Previous value: -"ISO format datetime - filter entries before this time"New value: +"Inclusive ISO end for both tables; naive times use UTC"
    • changedInput schema / properties / time_range_start / description
      Previous value: -"ISO format datetime - filter entries after this time"New value: +"Inclusive ISO start for both tables; naive times use UTC"
  2. Addedv1.3.0

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It adds useful caveats such as 'Resource counters are not interpreted as elapsed runtime' and mentions derived MB/MiB and optional network aggregation, but it does not state read-only behavior, output format, or potential side effects/requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences, front-loaded with the core purpose. Each sentence adds non-redundant information: what is parsed, supported capabilities, and an important interpretive caveat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides a high-level summary of the output categories and caveats, which is helpful given there is no output schema. It is adequate for an 8-parameter tool with fully documented schema parameters, though it stops short of describing response structure or row-level details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description mentions application/time filters, derived units, and network aggregation, but these are already documented in the input schema and it adds little semantic value beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Parse') and resource ('SRUDB.dat'), and clearly states what data it extracts: raw application resource counters and network bytes sent/received. This distinguishes it from sibling disk_parse_* tools by naming the exact artifact it targets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage through its focus on SRUDB.dat, but it does not explicitly state when to use this tool over siblings or provide exclusions. There are no alternative-tool references or when-not-to-use guidance, leaving usage to be inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools