About Etw MCP
Etw MCP is an MCP server published by nijosmsft in the Data category: mCP server for analyzing Windows ETW (.etl) traces — xperf / native ETW / .NET sidecar + WPR & pktmon capture authoring.
The repository has 12 stars and 1 forks, with the last commit a month ago. Recent commit activity is the strongest signal that reported issues will get attention.
Install
git clone https://github.com/nijosmsft/etw-mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (10)
check_symbolsCheck symbol resolution by `trace_id` with honest 3-category classification (OK / EXPORT_ONLY / MISSING). Accepts `extra_symbol_paths` to append local PDB dirs.
Parameters not published.
clean_stale_symbol_filesRemove stale `C:\SymCache\<pdb>\<GUID+Age>\` subfolders that don't match the current EXE's RSDS record (dry_run by default).
Parameters not published.
diagnose_symbol_loadExplain why a module is EXPORT_ONLY / MISSING by reconciling the EXE's RSDS record, all candidate PDBs on disk, and what dbghelp actually loaded.
Parameters not published.
get_load_statusReturn JSON status for a background load by `etl_path`, `trace_id`, or `job_id` (`extracting`, `ready`, `failed`, `not_found`)
Parameters not published.
list_loaded_tracesShow trace IDs currently loaded in memory and active load jobs
Parameters not published.
list_tracesFind `.etl` files in a directory
Parameters not published.
load_traceLoad an ETL file. Decodes events via the .NET sidecar (when configured), the in-process native consumer, or xperf — see [Trace Loading Modes](#trace-loading-modes). Caches as parquet. Set `force=True` to re-export. Long extracts run in the background by default; tune the inline wait with `wait_seconds`.
Parameters not published.
resolve_symbolsDownload PDBs from symbol servers and reload trace by `trace_id`. Accepts `extra_symbol_paths`.
Parameters not published.
trace_infoShow loaded trace metadata by `trace_id`
Parameters not published.
unload_traceRemove a loaded trace from memory
Parameters not published.
Ask AI
Ask AI about Etw MCP
Powered by Claude
Security checks
6 checks have not been run yet.