windows_event_logs

MCP tool from Windows Operations MCP by sandraschi

Query, clear, export event logs across all channels

How to use it

Project documentation lists windows_event_logs for the Windows Operations MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

FULL WINDOWS OPERATIONS MCP LISTING

Other tools in Windows Operations MCP (14)

agentic_operations

Autonomous system hardening and troubleshooting (LLM sampling)

archive_management

Create, list, extract ZIP, TAR, and Windows CAB archives

command_execution

Execute PowerShell and CMD commands with reliable output capture

container_execution

Docker exec and file copy inside containers

json_operations

Read, write, deep-merge, validate, fuzzy-extract JSON

windows_accounts

List/add/remove users and groups, manage group membership

windows_apps

List and uninstall AppX/Store packages

windows_automation

Scheduled tasks (schtasks) and WMI/CIM queries

windows_environment

Get, set, delete persistent user/system env vars

windows_network

Firewall rule management (netsh) and adapter diagnostics

windows_performance

CPU, memory, disk, network metrics per-process and system-wide

windows_permissions

View, grant, revoke NTFS ACLs (ICACLS) with inheritance control

windows_registry

Read, write, delete, export registry keys with auto-backup

windows_services

List, start, stop, restart Windows services