ProcmonMCP

ProcmonMCP is a Model Context Protocol (MCP) server that allows LLMs to autonomously analyse Process Monitor (Procmon) XML log files. It exposes a comprehensive set of analysis tools to any MCP-compatible client, including Claude Code, Claude Desktop, Cline, and others.

As seen on REMnux

Overview

Process Monitor captures detailed system activity — file access, registry operations, network connections, process creation, and more. ProcmonMCP parses these XML logs into an optimised in-memory representation and exposes them as MCP tools, enabling an LLM to investigate system behaviour without manual data wrangling.

Key capabilities:

• Load files at runtime — no need to restart the server to analyse a different capture
• Parsed-capture cache — reloading an unchanged file is near-instant (parsing is skipped)
• String interning for reduced memory footprint on large logs
• Indexed lookups by process name, operation, PID, and file path for fast filtering
• Multiple transport protocols — stdio (recommended), Streamable HTTP, and SSE (deprecated)
• Progress feedback during file loading via MCP notifications

This project was inspired by the approach taken in GhidraMCP.

> Security Warning

>

> Process Monitor logs can contain extremely sensitive system information (keystrokes, passwords in command lines, file contents, network traffic details, etc.).

>

> - This tool loads any file path that the user running the script has read permissions for. There is no directory sandboxing.

> - Only run this server in trusted environments.

> - Never run this server with Procmon logs captured from systems containing sensitive production or personal data unless you fully understand and accept the risks.

> - Review the logs you intend to load for sensitive information before using this tool.

Installation

Prerequisites

• Python 3.7 or newer (developed and tested with 3.10+)
• `pip` (Python package installer)

Install from source

git clone https://github.com/JameZUK/ProcmonMCP
cd ProcmonMCP
pip install -r requirements.txt

Or install the package itself (provides a `procmon-mcp` console script):

pip install .            # core only (mcp[cli])
pip install ".[all]"     # core + optional lxml and psutil
pip install -e ".[dev]"  # editable install with test tooling

Dependencies

Install all at once:

pip install "mcp[cli]>=1.8.0" lxml psutil

Quick Start with Claude Code

The recommended way to use ProcmonMCP is via stdio transport with Claude Code. The server starts without any file loaded — you (or the LLM) can then use the `load_file` tool to open a Procmon capture.

Option 1: Add via Claude Code CLI

# Add ProcmonMCP as a stdio server (user-wide)
claude mcp add procmon --scope user -- python -m procmon_mcp

# Or with a file pre-loaded at startup
claude mcp add procmon --scope user -- python -m procmon_mcp --input-file /path/to/capture.xml.gz

# Or scoped to the current project only
claude mcp add procmon --scope project -- python -m procmon_mcp

Option 2: Add via JSON

claude mcp add-json procmon '{
  "type": "stdio",
  "command": "python",
  "args": ["-m", "procmon_mcp"]
}'

Option 3: Edit configuration files directly

Claude Code reads MCP server configuration from these locations:

Example `.mcp.json` for a shared project:

{
  "mcpServers": {
    "procmon": {
      "type": "stdio",
      "command": "python",
      "args": ["-m", "procmon_mcp"]
    }
  }
}

Example with a pre-loaded file and options:

{
  "mcpServers": {
    "procmon": {
      "type": "stdio",
      "command": "python",
      "args": [
        "-m", "procmon_mcp",
        "--input-file", "/path/to/capture.xml.gz",
        "--no-stack-traces"
      ]
    }
  }
}

Option 4: Streamable HTTP transport

For network access or multi-client scenarios, use Streamable HTTP:

# Add as an HTTP server (start the server separately first)
claude mcp add --transport http procmon http://127.0.0.1:8081/mcp

Then start the server:

python -m procmon_mcp --transport streamable-http --mcp-port 8081

Verify the connection

Once configured, verify that Claude Code can see ProcmonMCP:

claude mcp list

Inside a Claude Code session, you can also type `/mcp` to check the status of connected servers.

Usage

Typical workflow

1. Start the server (Claude Code does this automatically for stdio servers)

2. Check status: The LLM calls `get_status` to see if a file is loaded

3. Load a file: The LLM calls `load_file` with a path to a Procmon XML capture

4. Analyse: The LLM uses the analysis tools to investigate the log data

Command-line arguments

Examples

Start with stdio (no file pre-loaded — use `load_file` from the client):

python -m procmon_mcp

Pre-load a compressed XML file:

python -m procmon_mcp --input-file /path/to/capture.xml.gz

Start with Streamable HTTP on a custom port:

python -m procmon_mcp --transport streamable-http --mcp-port 9000

Skip stack traces for a very large file:

python -m procmon_mcp --input-file /path/to/huge_capture.xml --no-stack-traces --no-extra-data

Transport Protocols

stdio (recommended)

The simplest and most reliable transport. Claude Code spawns the server as a child process and communicates over stdin/stdout. No network configuration required.

Streamable HTTP

Uses a single HTTP endpoint (`/mcp`) for all communication. Supports session management, optional SSE streaming for long-running operations, and is designed for scalability.

python -m procmon_mcp --transport streamable-http --mcp-host 0.0.0.0 --mcp-port 8081

The server will be available at `http://:/mcp`.

SSE (deprecated)

> Deprecated since MCP specification 2025-03-26. SSE is retained for backwards compatibility but will be removed in a future release. Please migrate to `streamable-http` or `stdio`.

python -m procmon_mcp --transport sse --mcp-port 8081

User Configuration

ProcmonMCP stores user preferences in `~/.procmonmcp/config.json`. This file is created automatically and remembers:

• The last loaded file path (shown as a hint in `get_status` when no file is loaded)
• Loading preferences (`no_stack_traces`, `no_extra_data`)

No API keys or authentication tokens are required — ProcmonMCP is a purely local analysis tool.

Parsed-capture cache

Parsing a large capture is expensive (tens of seconds to minutes). After a successful

parse, ProcmonMCP serializes the optimised in-memory representation (events, interners,

indices, process tables) to `~/.procmonmcp/cache/`, keyed on the source file's path,

size, and modification time plus the load options. Reloading the same unchanged file is

then served from the cache and is near-instant — in practice a 20s parse drops to well

under a second.

• The cache is invalidated automatically when the file changes (mtime/size) or when the

cache format version changes. Different `no_stack_traces`/`no_extra_data` options are

cached separately.

• Bypass it with `--no-cache` (CLI) or `no_cache: true` (the `load_file` tool); the

`from_cache` field in the load response indicates whether the cache was used.

• Clear it with `--clear-cache` (CLI) or the `clear_cache` tool. The cache is

size-bounded with LRU eviction (default 5 GiB; override with the

`PROCMONMCP_CACHE_MAX_BYTES` environment variable).

• Security: cache files are serialized with Python's `pickle` and are read back only

from your user-owned `~/.procmonmcp/cache` directory (only this tool's own output is

ever deserialized). Do not point the cache at a location other users can write to.

Available MCP Tools

Lifecycle Tools

Data Retrieval Tools

Analysis Tools

Export Tools

MCP Clients

ProcmonMCP works with any MCP-compatible client. Below are setup instructions for popular clients.

Claude Code (recommended)

See the Quick Start with Claude Code section above.

Claude Desktop

Add the following to your Claude Desktop configuration file:

• macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
• Windows: `%APPDATA%\Claude\claude_desktop_config.json`

{
  "mcpServers": {
    "procmon": {
      "command": "python",
      "args": ["-m", "procmon_mcp"]
    }
  }
}

Cline

For Cline with Streamable HTTP transport, first start the server:

python -m procmon_mcp --transport streamable-http --mcp-port 8081

Then in Cline, select MCP Servers and add:

• Server Name: ProcmonMCP
• Server URL: `http://127.0.0.1:8081/mcp`

Example LLM Prompts for Malware Analysis

*(Assuming a Procmon XML file is loaded)*

Initial Triage

• "Get the summary of the loaded file."
• "List the unique processes found in the log."
• "Count the events per process." *(Identify high-activity processes)*
• "Calculate timing statistics grouped by process." *(Identify long-duration events)*

Investigating a Suspicious Process

• "Get details for process PID 4568." *(Check command line, parent PID, image path)*
• "Summarise operations for process `suspicious.exe`."
• "Query events where filter_process is `suspicious.exe` and filter_operation is `RegSetValue`, limit 10."
• "Find network connections for process `suspicious.exe`." *(Enriched: directions, results, counts, first/last-seen)*
• "List network connections across the whole capture." *(Capture-wide triage, busiest first)*
• "Show the network top talkers." *(Rank remote endpoints by event count)*
• "Find file access containing `temp\\suspicious_data`, limit 50."

Looking for Persistence

• "Query events where filter_operation is `RegSetValue` and filter_path_contains is `CurrentVersion\\Run`, limit 20."
• "Query events where filter_operation is `CreateFile` and filter_path_contains is `StartUp`, limit 10."

Troubleshooting Errors

• "Query events where filter_result is `ACCESS DENIED`, limit 10."
• "Query events where filter_result is `NAME NOT FOUND`, limit 10."
• "Get details for event 987."
• "Get stack trace for event 987."

Exporting Data

• "Export query results to `suspicious_reg_writes.csv` where filter_process is `suspicious.exe` and filter_operation contains `RegSet`."
• "Export query results to `network_activity.json` in json format."

Performance and Indexing

ProcmonMCP builds four indices during file loading for fast filtered lookups:

For filters not backed by an index (e.g., regex, path contains, stack module path), ProcmonMCP falls back to a linear scan of all events. Use indexed filters first to narrow results, then apply more expensive filters.

Limitations

• Memory usage: Whilst optimised with string interning, loading extremely large XML files (millions of events with stack traces) can consume significant RAM. Use `--no-stack-traces` and `--no-extra-data` for very large files.
• Loading time: Parsing and optimising large XML files takes time, particularly compressed ones. Progress is reported during loading. Reloading an unchanged file is near-instant thanks to the parsed-capture cache; only the first parse pays the full cost.
• XML structure: Relies on the standard Procmon XML export structure. Malformed or non-standard XML will likely cause parsing errors.
• Non-ASCII names: Procmon's XML export double-encodes non-ASCII process/path names (e.g. Japanese filenames). ProcmonMCP detects and repairs this on load so names are readable and matchable by their true value; if a process name is still awkward to type exactly, filter by `filter_pid` instead.
• Stack traces: Stack trace quality depends on what Procmon resolved and included in the XML export. Requires running Procmon with symbols configured correctly.
• Single file at a time: Only one file can be loaded at any given time. Loading a new file replaces the previous data.

Changelog

Notable changes are recorded in CHANGELOG.md.

Contributing

Contributions are welcome! Please feel free to submit pull requests or open issues on GitHub.

License

This project is licensed under the MIT License — see the LICENSE file for details.