A
licenseNot graded
qualityB
maintenanceEnables automated graphics capture and replay with RenderDoc, allowing agents to launch executables, inspect captures, and export thumbnails or timeline JSON for regression triage.
52 PyPI
1
MIT
API Monitor MCP
by zxcvbbq
This server lets you analyze Rohitab API Monitor APMX captures headlessly and control the API Monitor GUI for live traffic capture on Windows.
Inspect capture metadata, processes, modules, API definitions, call records, arguments, return values, and payloads.
Search captures by API, module, thread, error code, timestamp, duration, text, bytes, or decoded arguments.
Decode strings and typed values, compare calls, build call sequences, and extract ZIP entries or raw payloads.
Run bounded blue-team/CTF triage: validation, error checks, indicators, entropy, behavior, and security reports.
Export evidence as JSON, CSV, or raw files.
Launch API Monitor, open/save APMX captures, monitor or attach to processes, and collect live traffic.
Control the GUI in the background: read UI trees, controls, list views, traffic panes, summary panes, and take screenshots.
Add display filters, start/stop monitoring, detach hooks, and manage monitored processes.
Search and parse Rohitab's installed XML API definition files.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@API Monitor MCP attach API Monitor to notepad.exe and start live capture"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Rohitab API Monitor MCP
Windows MCP server for Rohitab API Monitor. It analyzes .apmx86/.apmx64 captures headlessly and can also control the installed API Monitor GUI for live traffic collection.
Requirements
Windows 10 or later
Rohitab API Monitor for live capture and GUI tools
uvfor local use
Capture analysis works without opening the GUI. Set APIMONITOR_HOME when API Monitor is installed outside its default location.
Related MCP server: procmon-mcp
Install
Claude Code
claude plugin marketplace add https://github.com/zxcvbbq/API-Monitor-MCP.git
claude plugin install api-monitor-mcp@api-monitor-mcpCodex
codex plugin marketplace add zxcvbbq/API-Monitor-MCP
codex plugin add api-monitor-mcp@api-monitor-mcpRestart the client after installation or an update.
Main capabilities
Inspect capture metadata, processes, modules, API definitions, call records, arguments, return values, and payloads.
Search calls by API, module, thread, error code, timestamp, duration, text, or bytes.
Decode strings and typed values, compare calls, build call sequences/graphs, and extract ZIP entries.
Run bounded blue-team/CTF triage: validation, errors, indicators, entropy, behavior, and security reports.
Export evidence as JSON, CSV, or raw files.
Start/attach to processes, collect live traffic, apply display filters, and take GUI screenshots.
Local development
uv run python .\server.py --self-test
uv run python .\server.py --transport streamable-http --port 8745Typical headless workflow: start with capture_overview or capture_security_report, narrow results with capture_search_calls, then inspect matching records with capture_decode_call or an export tool.
Useful tools
Headless: capture_overview, capture_security_report, capture_search_calls, capture_decode_call, capture_compare_calls, capture_extract_entry.
Live/GUI: api_monitor_capture_process, api_monitor_attach_process, api_monitor_traffic, api_monitor_add_display_filter, api_monitor_gui_screenshot.
Available Tools
59 toolsapi_monitor_add_display_filterC
Add a Rohitab Display Filter through its background GUI dialog.
Inputs: field (required), value (required), operator (required), action, +4 more. Returns: object
api_monitor_attach_processC
Select a running process and start monitoring it in Rohitab's background GUI.
Inputs: pid (required), architecture, process_name, timeout_seconds. Returns: object
api_monitor_capture_processC
Capture one executable in the background and save the resulting APMX file.
Inputs: output_path (required), process_path (required), start_in, arguments, +5 more. Returns: object
api_monitor_detach_allC
Detach pending Rohitab API Monitor hooks through its background safeguard dialog.
Inputs: timeout_seconds. Returns: object
api_monitor_gui_actionD
Act on a Rohitab GUI control using background Win32 messages.
Inputs: action (required), text, title, handle, +3 more. Returns: object
api_monitor_gui_click_pointC
Click a point inside an exact Rohitab control without foregrounding it.
Inputs: x (required), y (required), control_handle (required), button, +1 more. Returns: object
api_monitor_gui_keyC
Send one navigation key to an exact Rohitab control in the background.
Inputs: key (required), control_handle (required), modifiers, window_title. Returns: object
api_monitor_gui_listsC
Read Rohitab list views through background Windows UI Automation.
Inputs: limit, window_title, window_handle. Returns: object
api_monitor_gui_readC
Read one Rohitab GUI control without focusing or raising the window.
Inputs: title, handle, max_chars, class_name, +2 more. Returns: object
api_monitor_gui_screenshotC
Capture an API Monitor window in the background as a PNG data URL.
Inputs: max_width, max_height, window_title, window_handle. Returns: object
api_monitor_gui_scrollC
Scroll an exact Rohitab control in the background.
Inputs: direction (required), control_handle (required), amount, window_title. Returns: object
api_monitor_gui_selectB
Select a Rohitab list row by index or text without foregrounding the app.
Inputs: list_handle (required), query, row_index. Returns: object
api_monitor_gui_select_optionC
Select a native Rohitab combo-box option without focusing the window.
Inputs: option (required), control_id (required), window_title. Returns: object
api_monitor_gui_treeC
Read Rohitab's native API/filter tree, including checkbox states, in the background.
Inputs: limit, max_depth, tree_handle, window_title. Returns: object
api_monitor_gui_tree_checkC
Set one Rohitab native API/filter tree checkbox without foregrounding the app.
Inputs: checked (required), item_handle (required), tree_handle, window_title. Returns: object
api_monitor_launchC
Launch the installed Rohitab API Monitor x86 or x64 executable.
Inputs: architecture, install_root. Returns: object
api_monitor_monitoring_controlC
Start or stop the selected Rohitab monitoring session in the background.
Inputs: action (required), architecture, window_handle, timeout_seconds. Returns: object
api_monitor_monitor_processC
Start monitoring an executable through Rohitab's native Monitor Process dialog.
Inputs: process_path (required), start_in, arguments, architecture, +1 more. Returns: object
api_monitor_open_captureC
Open an APMX capture with the real Rohitab API Monitor application.
Inputs: file_path (required), install_root, window_handle. Returns: object
api_monitor_parse_api_definitionC
Return structured Rohitab API signatures from one XML definition.
Inputs: definition_path (required), limit, api_name, install_root. Returns: object
api_monitor_process_controlC
Remove or terminate the selected process in Rohitab's monitor window.
Inputs: action (required), confirm, architecture, window_handle, +1 more. Returns: object
api_monitor_read_api_definitionB
Read a bounded Rohitab XML API definition returned by the API search tool.
Inputs: definition_path (required), max_chars, install_root. Returns: object
api_monitor_save_captureC
Save the current Rohitab capture through its background GUI.
Inputs: output_path (required), overwrite, window_handle, timeout_seconds. Returns: object
api_monitor_search_apisC
Search Rohitab API Monitor's installed XML API definitions.
Inputs: query (required), limit, install_root. Returns: object
api_monitor_statusB
List running Rohitab API Monitor x86/x64 processes.
Inputs: no named parameters. Returns: object
api_monitor_summaryC
Read Rohitab Summary panes without foregrounding the application.
Inputs: window_title, window_handle. Returns: object
api_monitor_target_processesC
List current Windows processes that can be selected for API Monitor attach.
Inputs: limit, query. Returns: object
api_monitor_trafficC
Read captured API-call rows from Rohitab's background traffic panes.
Inputs: limit, window_title, window_handle. Returns: object
api_monitor_traffic_detailsC
Select one captured API call and return its related GUI detail panes.
Inputs: limit, query, row_index, window_title, +1 more. Returns: object
api_monitor_ui_treeB
Inspect Rohitab API Monitor top-level windows and immediate controls.
Inputs: no named parameters. Returns: object
api_monitor_wait_for_trafficC
Wait for a Rohitab Summary call count, then return the current traffic panes.
Inputs: limit, window_title, minimum_calls, window_handle, +1 more. Returns: object
api_monitor_window_controlC
Move or change API Monitor window state without activating it.
Inputs: action (required), top, left, width, +3 more. Returns: object
capture_call_recordsC
Decode saved process call offsets and their raw data references.
Inputs: file_path (required), limit, start_index, include_data, +3 more. Returns: object
capture_calls_aroundC
Return a bounded raw call-record window around one saved call.
Inputs: file_path (required), record_index (required), process_index (required), after, +4 more. Returns: object
capture_call_statsC
Summarize saved raw call streams without returning every record.
Inputs: file_path (required), max_records, process_index. Returns: object
capture_compareC
Compare two APMX captures by their stored entry sizes and CRCs.
Inputs: first_file (required), second_file (required), limit. Returns: object
capture_compare_callsC
Compare saved call traffic by index and bounded payload fingerprints.
Inputs: first_file (required), second_file (required), limit, max_records, +3 more. Returns: object
capture_decode_callC
Return one saved call with exact encoded args plus bounded candidates.
Inputs: file_path (required), record_index (required), process_index (required), max_items, +2 more. Returns: object
capture_export_callsC
Export a bounded saved call-record page as JSON or CSV.
Inputs: file_path (required), output_path (required), limit, overwrite, +6 more. Returns: object
capture_extract_call_payloadC
Extract one bounded raw payload referenced by a saved call record.
Inputs: slot (required), file_path (required), output_path (required), record_index (required), +3 more. Returns: object
capture_extract_entryC
Extract one bounded APMX ZIP entry to a caller-selected file.
Inputs: file_path (required), entry_name (required), output_path (required), max_bytes, +1 more. Returns: object
capture_find_bytesC
Find a hexadecimal byte pattern in an APMX file and return raw offsets.
Inputs: file_path (required), pattern_hex (required), limit, start_offset. Returns: object
capture_hexC
Return a bounded hex/ASCII view of raw bytes from an APMX capture.
Inputs: file_path (required), length, offset. Returns: object
capture_infoB
Inspect an APMX file header and list its ZIP container entries.
Inputs: file_path (required). Returns: object
capture_list_apisC
List resolved API definitions ordered by saved call frequency.
Inputs: file_path (required), limit, max_records, process_index. Returns: object
capture_list_directoryC
List Rohitab APMX captures in a directory.
Inputs: directory (required), limit, recursive. Returns: object
capture_list_entriesC
List files stored inside an APMX capture container.
Inputs: file_path (required), limit. Returns: object
capture_list_processesC
List process records and executable paths recoverable from an APMX capture.
Inputs: file_path (required), limit. Returns: object
capture_monitoring_logC
Read and search the monitoring log stored in an APMX capture.
Inputs: file_path (required), limit, query. Returns: object
capture_read_definitionC
Resolve one API definition node from an APMX definitions entry.
Inputs: file_path (required), definition_offset (required). Returns: object
capture_read_entryC
Read one APMX ZIP entry, returning text when printable or base64 otherwise.
Inputs: file_path (required), entry_name (required), max_bytes. Returns: object
capture_read_process_dataC
Read a bounded logical slice from a saved process data entry.
Inputs: file_path (required), process_index (required), length, offset. Returns: object
capture_read_typeC
Resolve one type descriptor from an APMX definitions entry.
Inputs: file_path (required), type_offset (required). Returns: object
capture_search_callsC
Search saved call payloads, API definitions, and decoded arguments.
Inputs: query (required), file_path (required), limit, max_records, +4 more. Returns: object
capture_search_directoryC
Search printable strings across all APMX captures in a directory.
Inputs: query (required), directory (required), limit, recursive. Returns: object
capture_search_entriesC
Search printable strings inside each APMX ZIP entry.
Inputs: query (required), file_path (required), limit, max_entry_bytes. Returns: object
capture_stringsC
Extract/search printable ANSI and UTF-16LE strings from an APMX capture.
Inputs: file_path (required), limit, query, minimum_length. Returns: object
capture_validateC
Validate an APMX prefix, ZIP entries, process metadata, and call streams.
Inputs: file_path (required), deep, max_records. Returns: object
capture_xml_entryC
Parse one bounded XML entry, such as an APMX display/filter tree.
Inputs: file_path (required), limit, query, max_bytes, +1 more. Returns: object
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
C2.7/5.0
Scored across 59 tools
Disambiguation3/5
Descriptions do a decent job of binding each tool to a specific control or artifact, but there are clear clusters of overlapping purpose: api_monitor_monitor_process vs capture_process vs attach_process, and multiple string/search readers (capture_strings, capture_search_entries, capture_search_directory, capture_search_calls), plus several API-definition readers (api_monitor_search_apis, parse_api_definition, read_api_definition, capture_read_definition, capture_list_apis). An agent must read carefully to avoid misselection across the GUI-control family and the entry-reading family.
Naming Consistency4/5
Names are uniformly snake_case and split cleanly into two predictable prefixes: live-control tools (api_monitor_*) and capture-file tools (capture_*). Minor deviations exist where tools are noun-only (api_monitor_status, api_monitor_summary, capture_info) rather than verb_noun, but the pattern remains readable and largely predictable.
Tool Count2/5
59 tools is far beyond what an agent can reliably select from, even for a broad domain combining Windows GUI automation with APMX capture forensics. Many closely related operations (scroll, key, click_point, action, select_option, tree_check) could have been consolidated into one parameterized control tool.
Completeness4/5
The surface covers the full lifecycle: launch/attach/monitor/stop/detach, GUI reading and manipulation, screenshotting, capture export/extract, validation/comparison, and extensive call decoding and search. Only minor gaps exist, such as first-class capture deletion/creation or diffing beyond entry-size/CRC comparison.
Maintenance
ActivitySlowing
ResponsivenessOutdated data
Related MCP Connectors
Find, document and execute authenticated API calls across 1000+ apps via one MCP server
Governed data discovery, exact queries, decisions, simulations, and runtime utilities over MCP.
Securely control computers you explicitly pair through files, terminals, processes, screenshots, desktop UI/input, clipboard, browser automation, diagnostics, and document tools.
Clean PNG/JPEG screenshots via REST or MCP, with goal-driven multi-step navigation.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceEnables AI assistants to drive Sysinternals Process Monitor on Windows through MCP, capturing and analyzing process activity by PID or process name, with summaries, event queries, and capture comparisons.-
- AlicenseBqualityCmaintenanceEnables analysis of Microsoft PIX GPU and timing captures, including event inspection, counter queries, resource views, pipeline state, and GPU timing through an MCP interface.67MIT
- AlicenseNot gradedqualityCmaintenanceEnables Claude Desktop to run tshark queries and statistics against packet capture files and to queue GUI display-filter, highlighting, column, and frame-navigation actions for the packet analyzer.GPL 3.0