AI SRE Agent for Windows. An MCP server that gives AI assistants (Claude Desktop, Cursor, Windsurf, Claude Code) the ability to manage, monitor, and diagnose Windows systems.
Not just a PowerShell wrapper: includes multi-step diagnostics, trend analysis, safety controls, and audit logging.
42 tools across 8 modules + 3 MCP resources.
Interactive setup — detects your MCP clients and configures them automatically:
npx windows-admin-mcp --setupOr configure manually — add to your client's config:
Add to %APPDATA%\Claude\claude_desktop_config.json:
{
"mcpServers": {
"windows-admin": {
"command": "npx",
"args": ["-y", "windows-admin-mcp"]
}
}
}Add to your MCP config (.cursor/mcp.json, .vscode/mcp.json, etc.):
{
"servers": {
"windows-admin": {
"command": "npx",
"args": ["-y", "windows-admin-mcp"]
}
}
}claude mcp add windows-admin -- npx -y windows-admin-mcp| Tool | Description |
|---|---|
services_list |
List services with optional status/name filter |
services_get |
Get detailed info including dependencies |
services_start |
Start a service |
services_stop |
Stop a service (confirmation required) |
services_restart |
Restart a service (confirmation required) |
services_set_startup |
Change startup type (Automatic, Manual, Disabled) |
| Tool | Description |
|---|---|
events_query |
Query events by log, level, source, time range, keyword |
events_logs_list |
List available event logs with record counts |
events_sources_list |
List event sources for a specific log |
events_explain |
Explain Event ID: description, causes, fixes (built-in KB) |
events_summary |
Summary of recent events grouped by level |
| Tool | Description |
|---|---|
scheduler_list |
List tasks with optional path/state filter |
scheduler_get |
Get task details: triggers, actions, last run info |
scheduler_enable |
Enable a task |
scheduler_disable |
Disable a task |
scheduler_run |
Run a task immediately |
scheduler_create |
Create a new scheduled task |
scheduler_delete |
Delete a task (confirmation required) |
scheduler_history |
Get task execution history |
| Tool | Description |
|---|---|
processes_list |
List processes sorted by CPU/Memory/Name |
processes_get |
Detailed process info (CPU, memory, path, threads) |
processes_kill |
Kill a process by name or PID (confirmation + blocklist) |
processes_ports |
Which process holds which TCP port |
| Tool | Description |
|---|---|
network_ping |
ICMP ping to a host |
network_check_port |
Check if a TCP port is open on a remote host |
network_dns |
DNS lookup (A, AAAA, MX, CNAME, NS, TXT, etc.) |
network_connections |
List active TCP connections with process info |
| Tool | Description |
|---|---|
diagnose_service |
Multi-step diagnosis: status, port, errors, deps, hypothesis |
system_health |
Full health overview: CPU, RAM, disk, top processes, errors |
services_bulk |
Bulk start/stop/restart services by pattern (with limits) |
scheduler_bulk |
Bulk enable/disable tasks by pattern (with limits) |
| Tool | Description |
|---|---|
events_watch |
Poll for new Critical/Error events (delta only, watermark) |
services_watch |
Detect auto-start services that are stopped |
system_changes |
What changed in last N hours (new services, tasks, state) |
error_trends |
Error rate trend analysis (growing/shrinking/stable) |
service_restarts |
Service restart frequency, crash detection |
| Tool | Description |
|---|---|
config_get |
View current safety/audit configuration |
config_reload |
Reload config from file |
confirm_action |
Confirm a pending destructive action |
pending_actions |
List pending confirmations |
cancel_action |
Cancel a pending action |
audit_query |
Query the audit log |
| Resource | URI | Description |
|---|---|---|
| System Info | system://info |
OS, CPU, RAM, uptime, hostname |
| System Health | system://health |
Live health status with overall rating |
| Services Summary | system://services |
Service counts by status and startup type |
Destructive operations (kill, stop, restart, delete, bulk) are protected:
- Confirmation flow: Returns a preview +
confirmationId. Callconfirm_actionto proceed. - Blocklist: Critical processes (
lsass,csrss,svchost,winlogon, etc.) are blocked by default. - Bulk limits: Maximum 20 operations per bulk call (configurable).
- Audit log: All operations logged to JSONL file with timestamps.
Disable confirmation for trusted environments:
{
"safety": {
"requireConfirmation": false
}
}Create a config.json next to the installed package, or set WINDOWS_ADMIN_MCP_CONFIG env var:
{
"modules": {
"services": true,
"events": true,
"scheduler": true,
"processes": true,
"network": true,
"diagnostics": true,
"safety": true,
"observability": true
},
"safety": {
"requireConfirmation": true,
"confirmationTimeoutMs": 300000,
"blocklist": ["lsass", "csrss", "svchost", "winlogon", "smss"],
"allowlist": []
},
"limits": {
"maxProcessesToKill": 5,
"maxEventsToReturn": 500,
"maxBulkOperations": 20
},
"audit": {
"enabled": true,
"path": "./windows-admin-mcp-audit.jsonl",
"maxSizeMB": 50
}
}"Why is SQL Server not working?"
diagnose_service(name: "MSSQLSERVER", port: 1433)
Runs 4-step chain: service status, port check, recent errors, dependencies. Returns hypothesis.
"Is the system healthy?"
system_health()
Single call: CPU, RAM, disk, top processes, recent errors, stopped auto-start services.
"Are errors increasing?"
error_trends(logName: "System", hours: 24)
Hourly breakdown with trend (growing/shrinking/stable), top sources, top event IDs.
"What changed in the last hour?"
system_changes(hours: 1)
New services installed, service state changes, new scheduled tasks.
"Kill the process on port 3000"
processes_ports(port: 3000) # Find the process
processes_kill(pid: 12345) # Returns confirmationId
confirm_action(confirmationId: "...") # Execute
- Windows 10/11 or Windows Server 2016+
- Node.js 18+
- PowerShell 5.1+ (included with Windows)
- Administrator privileges (for service control and some event logs)
See CONTRIBUTING.md for guidelines.
MIT
AI SRE агент для Windows. MCP-сервер, позволяющий AI-ассистентам управлять, мониторить и диагностировать Windows.
Не просто обертка над PowerShell: многошаговая диагностика, анализ трендов, система безопасности, аудит.
42 инструмента, 8 модулей, 3 MCP-ресурса.
Автоматическая настройка — определяет установленные MCP-клиенты и конфигурирует их:
npx windows-admin-mcp --setupИли вручную — добавьте в конфиг Claude Desktop (%APPDATA%\Claude\claude_desktop_config.json):
{
"mcpServers": {
"windows-admin": {
"command": "npx",
"args": ["-y", "windows-admin-mcp"]
}
}
}- Services (6): управление службами Windows
- Event Viewer (5): запросы, объяснение Event ID, сводки
- Task Scheduler (8): полное управление планировщиком
- Processes (4): список, детали, kill, порты
- Network (4): ping, порты, DNS, соединения
- Diagnostics (4): diagnose_service, system_health, bulk-операции
- Observability (5): watch mode, обнаружение изменений, тренды ошибок
- Safety & Audit (6): конфигурация, подтверждение, аудит
- Деструктивные операции требуют подтверждения через
confirm_action - Критические процессы (lsass, csrss, svchost) в блок-листе
- Лимит на массовые операции (20 по умолчанию)
- Все действия логируются в JSONL-файл
MIT