Windows Forensics MCP Server

Overview Schema Source Related Servers Discussions Admin

evtx_security_search

Search Windows Security event logs by named event type, filter by fields, and page compact results for incident triage.

Instructions

Search Security events by named type, with the same compact fields, response budgets, and continuation controls as evtx_search.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`limit`	No
`where`	No	Field-specific AND predicates. Missing fields fail comparisons, including neq. Use exists for presence; ordering uses numeric operands or aware ISO timestamps on TimeCreated.
`cursor`	No	Continuation bound to the same source and query. Do not combine with offset.
`fields`	No	System fields, dotted EventData/UserData paths, or unambiguous aliases.
`offset`	No
`compact`	No	Compact rows with event references; selects structured output by default.
`max_scan`	No	Maximum source records examined. A capped result reports an inexact total.
`evtx_path`	Yes
`max_chars`	No	MCP result JSON character budget, including metadata; default 12000 compact, otherwise 40000.
`event_type`	Yes
`output_format`	No	Defaults to structured for compact queries, otherwise legacy JSON text.
`timestamp_precision`	No	both adds timestamp_second in UTC without changing TimeCreated.	full
`where_case_sensitive`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed14 schema fields changedv1.5.0Oct 2, 2026

addedInput schema / properties / compact

Added value: +{
+  "default": false,
+  "description": "Compact rows with event references; selects structured output by default.",
+  "type": "boolean"
+}

addedInput schema / properties / cursor

Added value: +{
+  "description": "Continuation bound to the same source and query. Do not combine with offset.",
+  "maxLength": 4096,
+  "minLength": 1,
+  "type": "string"
+}

addedInput schema / properties / fields

Added value: +{
+  "description": "System fields, dotted EventData/UserData paths, or unambiguous aliases.",
+  "items": {
+    "maxLength": 256,
+    "minLength": 1,
+    "type": "string"
+  },
+  "maxItems": 100,
+  "minItems": 1,
+  "type": "array",
+  "uniqueItems": true
+}

removedInput schema / properties / limit / description

Removed value: -"Max results to return (default 50)"

addedInput schema / properties / limit / maximum
```
Added value: +1000
```
addedInput schema / properties / limit / minimum
```
Added value: +1
```

addedInput schema / properties / max_chars

Added value: +{
+  "description": "MCP result JSON character budget, including metadata; default 12000 compact, otherwise 40000.",
+  "maximum": 40000,
+  "minimum": 1024,
+  "type": "integer"
+}

addedInput schema / properties / max_scan

Added value: +{
+  "default": 100000,
+  "description": "Maximum source records examined. A capped result reports an inexact total.",
+  "maximum": 1000000,
+  "minimum": 1,
+  "type": "integer"
+}

removedInput schema / properties / offset / description

Removed value: -"Skip first N matches for pagination"

addedInput schema / properties / offset / minimum
```
Added value: +0
```

addedInput schema / properties / output_format

Added value: +{
+  "description": "Defaults to structured for compact queries, otherwise legacy JSON text.",
+  "enum": [
+    "text",
+    "structured"
+  ],
+  "type": "string"
+}

addedInput schema / properties / timestamp_precision

Added value: +{
+  "default": "full",
+  "description": "both adds timestamp_second in UTC without changing TimeCreated.",
+  "enum": [
+    "full",
+    "both"
+  ],
+  "type": "string"
+}

addedInput schema / properties / where

Added value: +{
+  "additionalProperties": {
+    "additionalProperties": false,
+    "minProperties": 1,
+    "properties": {
+      "eq": {
+        "type": [
+          "string",
+          "number",
+          "boolean",
+          "null"
+        ]
+      },
+      "exists": {
+        "type": "boolean"
+      },
+      "gt": {
+        "type": [
+          "number",
+          "string"
+        ]
+      },
+      "gte": {
+        "type": [
+          "number",
+          "string"
+        ]
+      },
+      "in": {
+        "items": {
+          "type": [
+            "string",
+            "number",
+            "boolean",
+            "null"
+          ]
+        },
+        "maxItems": 1000,
+        "minItems": 1,
+        "type": "array"
+      },
+      "lt": {
+        "type": [
+          "number",
+          "string"
+        ]
+      },
+      "lte": {
+        "type": [
+          "number",
+          "string"
+        ]
+      },
+      "neq": {
+        "type": [
+          "string",
+          "number",
+          "boolean",
+          "null"
+        ]
+      }
+    },
+    "type": "object"
+  },
+  "description": "Field-specific AND predicates. Missing fields fail comparisons, including neq. Use exists for presence; ordering uses numeric operands or aware ISO timestamps on TimeCreated.",
+  "maxProperties": 64,
+  "propertyNames": {
+    "maxLength": 256,
+    "minLength": 1,
+    "type": "string"
+  },
+  "type": "object"
+}

addedInput schema / properties / where_case_sensitive

Added value: +{
+  "default": true,
+  "type": "boolean"
+}

Changed3 schema fields changedv1.3.0May 4, 2026

changedInput schema / properties / limit / default
```
Previous value: -100New value: +40
```

addedInput schema / properties / limit / description

Added value: +"Max results to return (default 50)"

addedInput schema / properties / offset

Added value: +{
+  "default": 0,
+  "description": "Skip first N matches for pagination",
+  "type": "integer"
+}

First observedv1.0.0Jan 6, 2026

TDQS

B3.4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that output uses compact fields, a response budget, and cursor-based continuation, which is useful behavioral context, but it says nothing about read-only semantics, result shape, or how capping/inexact totals behave (left to the schema).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that names the resource and the inherited behavior with no filler. Nothing redundant or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-parameter tool with a nested where object, heavy enums, and no output schema, the description is very thin. It defers almost everything to evtx_search, which the agent may not know, and provides no return-value or paging context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 62%, so many parameters already carry their own descriptions. The phrase 'compact fields, response budgets, and continuation controls' loosely maps to compact/max_chars/cursor, but the description adds no operational detail for the 13 parameters and leaves the nested where object entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Search') plus resource ('Security events') and a scoping mechanism ('by named type'), which is enough to tell it apart from evtx_search. It stops short of fully disambiguating what evtx_search returns that this one does not, but the purpose is concrete.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies a division of labor with evtx_search (named event types vs. general search) and inheritance of its controls, but never states when to prefer this tool or when-not. Usage is inference-based rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

evtx_security_search

Instructions

Input Schema

Schema Changelog

TDQS

Other Tools