v1.0.0 — System Informer MCP

System Informer MCP v1.0.0

First public release. A native C Model Context Protocol server that gives AI agents the full inspection-and-control surface of System Informer (Process Hacker) on Windows.

Download

Asset	Notes
si-mcp-v1.0.0-windows-x64.exe	Prebuilt server, Windows 10/11 x64, ~340 KB, no runtime dependencies
SHA256SUMS.txt	Checksum for verification

No installer. Drop the exe anywhere and point your MCP client at it:

{ "mcpServers": { "system-informer": { "command": "C:\\path\\to\\si-mcp-v1.0.0-windows-x64.exe" } } }

Run your MCP client as Administrator for full coverage. Call server_status to see what you have.

What's inside — 54 tools

• System: overview, CPU usage, memory, uptime, server status
• Processes: list (sortable, CPU-sampled), tree, details, token/privileges
• Process control: launch (normal / elevated via UAC), terminate, terminate tree, suspend/resume, priority, affinity, empty working set, critical flag, minidump
• Threads: list (CPU-sampled, symbolic start address), details, suspend/resume/terminate, priority, affinity
• Memory: regions, summary, read, write, protect, byte/string search, strings extraction
• Handles: list (with timeout-guarded name resolution), type summary, find-by-name (what locks this file?), close
• Services: list, details, start/stop/pause/continue/restart, start type, create, delete
• Network: all TCP/UDP endpoints with owning process, port owner lookup
• Modules / Drivers: loaded DLLs per process, kernel drivers
• Windows: enumerate, close/minimize/maximize/restore/show/hide/flash
• Files: metadata + version info, Authenticode signature verification
• GUI hand-off: launch System Informer (optionally selecting a pid), launch PE Viewer

Safety

Every mutating or irreversible tool refuses to run without "confirm": true. Terminating a Windows-critical process requires an additional allow_critical gate. Handlers run under structured-exception guards so faults return errors rather than crashing the server.

Verification

Built with MSVC 14.44 against the vendored System Informer phnt headers. End-to-end tested on Windows 11 (build 26200): 56/56 checks passed, 54/54 tools covered.

Notes

• Protected processes (PPL / antimalware) additionally require System Informer's KSystemInformer kernel driver; server_status reports whether it is present.
• Windows may flag a freshly-built unsigned exe. Verify the SHA-256 above, or build from source with build.bat.