sysmon-live MCP

sysmon-live is a Windows MCP server for near-live process analysis through Sysmon and Windows Event Log.

It lets Codex or another MCP client launch a Windows program or watch an existing PID, collect Sysmon telemetry, and return a structured process/network/file/registry summary.

Features

• Launch an executable and monitor its process tree.
• Watch an already-running PID and optionally include child processes.
• Collect process, network, DNS, file, registry, and optional ProcessAccess events.
• Temporarily apply a broad Sysmon config before a capture and restore a quiet config afterward.
• Filter observer noise generated by the MCP server itself.
• Save captures as JSON or CSV.
• Generate timestamped capture filenames with output_dir.
• Generate a compact Markdown report with output_report.
• Use return_events=false for long captures so large event lists stay on disk.

Requirements

• Windows 10/11
• Python 3.10+
• Codex CLI or another MCP client
• Microsoft Sysmon installed

Install Python dependencies:

python -m pip install -r .\scripts\requirements.txt

Register with Codex:

codex mcp add sysmon-live -- python C:\Path\To\sysmon-live\scripts\sysmon_live_mcp.py

Restart Codex after registration or after changing the MCP server script.

Example

start_launch_capture(
  command="C:\Path\To\App.exe",
  seconds=600,
  deep=true,
  filter_self_noise=true,
  output_dir="C:\captures",
  output_report="C:\captures\app-report.md",
  sysmon_config_before="C:\Path\To\sysmon-live\assets\sysmon-universal-lab.xml",
  sysmon_config_after="C:\Path\To\sysmon-live\assets\sysmon-quiet.xml"
)

For long captures, use background tools:

start_watch_capture(pid=1234, include_children=true, seconds=1800, output_dir="C:\captures")
get_capture_status(capture_id="<id>")
stop_capture(capture_id="<id>")
get_capture_result(capture_id="<id>")

Background captures return immediately, write JSON/Markdown files on disk, and avoid MCP client request timeouts.

Sysmon Configs

• assets/sysmon-quiet.xml: low-noise baseline for normal operation.
• assets/sysmon-universal-lab.xml: broad lab config for short analysis windows.
• assets/sysmon-notepadpp-test.xml: narrow example config for Notepad++.

Sysmon configs are global. Use broad configs only for deliberate analysis windows, then restore the quiet config.

Documentation

See references/windows-setup.md for installation, troubleshooting, and usage notes.