MCPVault

capture_snapshot

MCP tool from ProcMon MCP by 0xhackerfren

Point-in-time process, module, and network snapshot

How to use it

capture_snapshot is exposed by the ProcMon MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the capture_snapshot tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.

Install ProcMon MCP

$uvx procmon-mcp
FULL PROCMON MCP LISTING

Other tools in ProcMon MCP (17)

analyze_pe

Static PE imports and exports

check_elevation

Capability matrix

find_pe_files

Recursive PE file discovery

get_minifilters

fltmc filter and instance output

get_network_connections

TCP/UDP endpoints by process

get_process_details

Modules, threads, command line, memory

get_security_events

Security log (IDs 4688, 4624, 4672, 4648)

get_system_info

OS build and AV snapshot

list_drivers

Kernel drivers via WMI

list_etw_providers

Parse logman query providers

list_processes

Processes with optional name/PID filter

list_services

Win32 services with paths

query_event_log

Get-WinEvent FilterHashtable query

request_elevation

UAC helper for a shell command

start_etw_trace

Start a kernel ETW trace (requires elevation)

stop_etw_trace

Stop trace and convert ETL output

timed_capture

Repeated snapshots over a duration