Windows Forensics MCP Server

Overview Schema Source Related Servers Discussions Admin

evtx_search

Search Windows Event Log (EVTX) records by time, Event ID, keywords, or provider to filter and retrieve structured forensic results.

Instructions

Search EVTX events by time, Event ID, keywords, or provider. Supports compact structured projection, whole-record budgets, and source-bound continuation cursors. File-record order is preserved.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`limit`	No
`where`	No	Field-specific AND predicates. Missing fields fail comparisons, including neq. Use exists for presence; ordering uses numeric operands or aware ISO timestamps on TimeCreated.
`cursor`	No	Continuation bound to the same source and query. Do not combine with offset.
`fields`	No	System fields, dotted EventData/UserData paths, or unambiguous aliases.
`offset`	No
`compact`	No	Compact rows with event references; selects structured output by default.
`contains`	No
`end_time`	No
`max_scan`	No	Maximum source records examined. A capped result reports an inexact total.
`provider`	No
`event_ids`	No
`evtx_path`	Yes
`max_chars`	No	MCP result JSON character budget, including metadata; default 12000 compact, otherwise 40000.
`start_time`	No	ISO format datetime
`not_contains`	No
`output_format`	No	Defaults to structured for compact queries, otherwise legacy JSON text.
`timestamp_precision`	No	both adds timestamp_second in UTC without changing TimeCreated.	full
`where_case_sensitive`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed14 schema fields changedv1.5.0Oct 2, 2026

addedInput schema / properties / compact

Added value: +{
+  "default": false,
+  "description": "Compact rows with event references; selects structured output by default.",
+  "type": "boolean"
+}

addedInput schema / properties / cursor

Added value: +{
+  "description": "Continuation bound to the same source and query. Do not combine with offset.",
+  "maxLength": 4096,
+  "minLength": 1,
+  "type": "string"
+}

addedInput schema / properties / fields

Added value: +{
+  "description": "System fields, dotted EventData/UserData paths, or unambiguous aliases.",
+  "items": {
+    "maxLength": 256,
+    "minLength": 1,
+    "type": "string"
+  },
+  "maxItems": 100,
+  "minItems": 1,
+  "type": "array",
+  "uniqueItems": true
+}

removedInput schema / properties / limit / description

Removed value: -"Max results to return (default 50)"

addedInput schema / properties / limit / maximum
```
Added value: +1000
```
addedInput schema / properties / limit / minimum
```
Added value: +1
```

addedInput schema / properties / max_chars

Added value: +{
+  "description": "MCP result JSON character budget, including metadata; default 12000 compact, otherwise 40000.",
+  "maximum": 40000,
+  "minimum": 1024,
+  "type": "integer"
+}

addedInput schema / properties / max_scan

Added value: +{
+  "default": 100000,
+  "description": "Maximum source records examined. A capped result reports an inexact total.",
+  "maximum": 1000000,
+  "minimum": 1,
+  "type": "integer"
+}

removedInput schema / properties / offset / description

Removed value: -"Skip first N matches for pagination"

addedInput schema / properties / offset / minimum
```
Added value: +0
```

addedInput schema / properties / output_format

Added value: +{
+  "description": "Defaults to structured for compact queries, otherwise legacy JSON text.",
+  "enum": [
+    "text",
+    "structured"
+  ],
+  "type": "string"
+}

addedInput schema / properties / timestamp_precision

Added value: +{
+  "default": "full",
+  "description": "both adds timestamp_second in UTC without changing TimeCreated.",
+  "enum": [
+    "full",
+    "both"
+  ],
+  "type": "string"
+}

addedInput schema / properties / where

Added value: +{
+  "additionalProperties": {
+    "additionalProperties": false,
+    "minProperties": 1,
+    "properties": {
+      "eq": {
+        "type": [
+          "string",
+          "number",
+          "boolean",
+          "null"
+        ]
+      },
+      "exists": {
+        "type": "boolean"
+      },
+      "gt": {
+        "type": [
+          "number",
+          "string"
+        ]
+      },
+      "gte": {
+        "type": [
+          "number",
+          "string"
+        ]
+      },
+      "in": {
+        "items": {
+          "type": [
+            "string",
+            "number",
+            "boolean",
+            "null"
+          ]
+        },
+        "maxItems": 1000,
+        "minItems": 1,
+        "type": "array"
+      },
+      "lt": {
+        "type": [
+          "number",
+          "string"
+        ]
+      },
+      "lte": {
+        "type": [
+          "number",
+          "string"
+        ]
+      },
+      "neq": {
+        "type": [
+          "string",
+          "number",
+          "boolean",
+          "null"
+        ]
+      }
+    },
+    "type": "object"
+  },
+  "description": "Field-specific AND predicates. Missing fields fail comparisons, including neq. Use exists for presence; ordering uses numeric operands or aware ISO timestamps on TimeCreated.",
+  "maxProperties": 64,
+  "propertyNames": {
+    "maxLength": 256,
+    "minLength": 1,
+    "type": "string"
+  },
+  "type": "object"
+}

addedInput schema / properties / where_case_sensitive

Added value: +{
+  "default": true,
+  "type": "boolean"
+}

Changed3 schema fields changedv1.3.0May 4, 2026

changedInput schema / properties / limit / default
```
Previous value: -100New value: +40
```

addedInput schema / properties / limit / description

Added value: +"Max results to return (default 50)"

addedInput schema / properties / offset

Added value: +{
+  "default": 0,
+  "description": "Skip first N matches for pagination",
+  "type": "integer"
+}

First observedv1.0.0Jan 6, 2026

TDQS

B3.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does add real behavioral context — result-order preservation, source-bound cursors, and projection/budget semantics — which is more than most. However it says nothing about read-only safety, error behavior, or the cost/cap behavior beyond the passing mention of budgets.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tightly packed sentences, front-loaded with purpose before capabilities. Efficient, though the second sentence is a dense feature list that would benefit from slightly more specificity about what 'whole-record budgets' implies.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 18-parameter, nested-object search tool with no output schema and no annotations, the description covers core behaviors but leaves combination rules (cursor vs offset is only in the schema), required-path semantics, and result-shape expectations to other sources — adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% on 18 parameters, so the description must compensate. It does group the filter params (time/event-id/keywords/provider) and names the projection/budget/cursor concepts, but ignores limit, offset, where, timestamp_precision, and where_case_sensitive, which remain undocumented in both places.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Search') and resource ('EVTX events') plus the four filter dimensions (time, Event ID, keywords, provider). An agent can tell what it does, but the description never distinguishes it from siblings like evtx_security_search or evtx_get_event, which overlap heavily on the same EVTX data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, prerequisites, or alternatives are given. With 7+ sibling evtx_* tools, the agent is left to infer from the name alone whether this is the general-purpose search versus evtx_security_search or evtx_get_event.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

evtx_search

Instructions

Input Schema

Schema Changelog

TDQS

Other Tools