{"repo":"JameZUK/ProcmonMCP","free":true,"listed":false,"github":"https://github.com/JameZUK/ProcmonMCP","clone":"git clone https://github.com/JameZUK/ProcmonMCP.git","description":"An MCP server for procmon","language":"Python","stars":49,"topics":[],"license":"MIT","category":"mcp-servers","readme_excerpt":"ProcmonMCP ProcmonMCP is a Model Context Protocol (MCP) server that allows LLMs to autonomously analyse Process Monitor (Procmon) XML log files . It exposes a comprehensive set of analysis tools to any MCP-compatible client, including Claude Code, Claude Desktop, Cline, and others. As seen on REMnux Overview Process Monitor captures detailed system activity — file access, registry operations, network connections, process creation, and more. ProcmonMCP parses these XML logs into an optimised in-memory representation and exposes them as MCP tools, enabling an LLM to investigate system behaviour without manual data wrangling. Key capabilities: - Load files at runtime — no need to restart the server to analyse a different capture - Parsed-capture cache — reloading an unchanged file is near-instant (parsing is skipped) - String interning for reduced memory footprint on large logs - Indexed lookups by process name, operation, PID, and file path for fast filtering - Multiple transport protocols — stdio (recommended), Streamable HTTP, and SSE (deprecated) - Progress feedback during file loading via MCP notifications This project was inspired by the approach taken in GhidraMCP. Security Warning Process Monitor logs can contain extremely sensitive system information (keystrokes, passwords in command lines, file contents, network traffic details, etc.). - This tool loads any file path that the user running the script has read permissions for. There is no directory sandboxing. - Only run","default_branch":null,"files":null,"tree":[],"storefront":"/r/JameZUK","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/JameZUK/ProcmonMCP/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}