AppControl Windows System History

What can you do with AppControl Windows System History MCP?

- Query blocked process events— Ask for allquery_historyevents of type "quarantine_block" within a specific time window to review what AppControl stopped.
- Find unsigned or risky binaries— Uselist_binariesto filter for unsigned binaries, those running from Temp/Downloads paths, or binaries first seen after a given date.
- Investigate a specific binary's details— Retrieve signature, publisher, hash, and first-seen time for one or more binary IDs viaget_binary.
- Identify top resource consumers— Callget_monitoringwith top-N filtering to surface which processes drove CPU, memory, disk, or GPU spikes during a past interval.
- Audit running elevated processes— Combinelist_processeswithlist_binariesto find non-Microsoft processes running with elevated privileges.
- Review quarantine rules— Uselist_rulesto see which binaries and publishers are currently blocked by AppControl rules.

AnMCPserver that gives AI agents and IDEs like Claude, Cursor, and Windsurfread-onlyaccess to historical resource usage and system security data gathered by theAppControlWindows app, including binaries, publishers, quarantine rules, events, and monitoring, all through natural language.

- AppControlrunning with MCP API enabled
- Windows only

/plugin marketplace add appcontrollabs/appcontrol-mcp-go

/plugin install appcontrol-mcp@appcontrollabs

- Downloadappcontrol-mcp.exefrom thelatest release.
- Place it somewhere permanent, e.g.C:\MCP\appcontrol-mcp.exe.
- Configure your AI client as shown below.

claude mcp add appcontrol C:\MCP\appcontrol-mcp.exe

codex mcp add appcontrol C:\MCP\appcontrol-mcp.exe

{ "mcpServers": { "appcontrol": { "command": "C:/MCP/appcontrol-mcp.exe", "args": [], "timeout": 15000 } } }

Add to your workspace.vscode/mcp.json:

{ "servers": { "appcontrol": { "command": "C:/MCP/appcontrol-mcp.exe" } } }

Add to.cursor/mcp.jsonin your project root:

{ "mcpServers": { "appcontrol": { "command": "C:/MCP/appcontrol-mcp.exe" } } }

Add to~/.codeium/windsurf/mcp_config.json:

{ "mcpServers": { "appcontrol": { "command": "C:/MCP/appcontrol-mcp.exe" } } }

Once connected, try asking your AI assistant:

- "What unsigned applications have been running on this system?"
- "What binaries on my PC originate from outside the United States and what are the top countries?"
- "Show me all AppControl blocked process events from the last 24 hours"
- "Are there any binaries running from Temp or Downloads folders?"
- "What's currently quarantined? Are unsigned apps blocked?"
- "What new binaries appeared today? Are any of them suspicious?"
- "While I walked up to my locked PC my fan was roaring, what was causing that?"
- "Which publishers have the most binaries on this system?"
- "Show me processes running with elevated privileges that aren't from Microsoft"
- "Which binaries have had their hash change recently?"
- "Did any applications access my webcam while my PC was idle, and if so which ones?"

The MCP server exposes 9 read-only tools:

All tools areread-only. The MCP server cannot modify rules, block/allow binaries, or change any service configuration.

go build -ldflags "-s -w" -o appcontrol-mcp.exe .

This repository contains the open MCP server for AppControl. The AppControl desktop application remains proprietary.

Claude is a trademark of Anthropic, PBC. Cursor, Windsurf, Gemini, VS Code, Copilot, and OpenAI Codex are trademarks of their respective owners. AppControl is not affiliated with or endorsed by any of these companies.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Scout's official MCP pipes error, trace and metric data from production to your AI agent

Real-time system monitoring MCP server built with Python and FastMCP - exposes CPU, memory, disk, and process metrics to any MCP-compatible AI client.

Real User Monitoring for Core Web Vitals. Query LCP, INP, CLS field data from real visitors at the p75 percentile.

Get web performance tests and data in your AI workflow

Official Sentry MCP server for investigating issues, error reports, traces, and performance monitoring data from AI coding agents.

Access and manage Grafana resources, including dashboards, datasources, Prometheus, Loki, and alerting.

A server for monitoring and analyzing Java Virtual Machine (JVM) processes using Arthas, with a Python interface.

Access and interact with your Kibana instance using natural language or programmatic requests.

AI-powered live runtime debugging with Lightrun production context.

Probe LLM API endpoints and report health metrics including time to first token, latency, and throughput. Check single models or run full config-based health checks.