query_history

MCP tool from Appcontrol MCP Go by AppControlLabs

Query security event history — binary first-seen events, quarantine blocks, alerts, and process starts. Filterable by event type, time range, and binary ID.

How to use it

Project documentation lists query_history for the Appcontrol MCP Go MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install Appcontrol MCP Go

$claude mcp add appcontrol C:\MCP\appcontrol-mcp.exe

FULL APPCONTROL MCP GO LISTING

Other tools in Appcontrol MCP Go (8)

get_binary

Get detailed info for one or more binaries by ID (batch with comma-separated IDs) — path, hash, signature, publisher, first-seen time, and running status.

get_hardware

Get CPU, GPU, and temperature sensor info for the monitored system.

get_monitoring

Get time-series resource metrics — system-wide (CPU, memory, disk, GPU, temps) or per-binary with top-N/min-value filtering to find heavy resource consumers.

get_stats

Get service stats, current timestamp, and uptime/idle intervals showing when the PC was on, off, or idle.

list_binaries

List tracked binaries with filters — unsigned-only, currently-running, first-seen-after date, path substring, or publisher ID.

list_processes

List currently running processes with binary ID, name, path, PID, and start time. Filterable by fields.

list_publishers

List code-signing publishers (certificate identities) — name, country, and linked binary/rule counts.

list_rules

List quarantine rules — blocked binaries and publishers with rule type and creation time.