# Procmon MCP server

Agent View of the PolicyLayer registry record for Procmon: identity, probed posture, risk grade, and all 18 tools classified. HTML page: https://policylayer.com/tools/0xhackerfren-procmon-mcp

## Facts

- Server id: `0xhackerfren/procmon-mcp`
- Homepage: https://github.com/0xhackerfren/ProcMon-MCP
- Registry record: grade F, identity unverified
- Lifecycle: active
- Rate-limited: no
- Tools: 18
- Tool categories present: Execute, Read
- Tags: 0xhackerfren procmon mcp, automation
- Record last modified: 2026-06-11T09:57:28.724Z

## Tools (18)

| Tool | Category | Risk | Record |
| --- | --- | --- | --- |
| `request_elevation` | Execute | High | https://policylayer.com/tools/0xhackerfren-procmon-mcp/request-elevation.md |
| `start_etw_trace` | Execute | High | https://policylayer.com/tools/0xhackerfren-procmon-mcp/start-etw-trace.md |
| `stop_etw_trace` | Execute | High | https://policylayer.com/tools/0xhackerfren-procmon-mcp/stop-etw-trace.md |
| `timed_capture` | Execute | High | https://policylayer.com/tools/0xhackerfren-procmon-mcp/timed-capture.md |
| `analyze_pe` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/analyze-pe.md |
| `capture_snapshot` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/capture-snapshot.md |
| `check_elevation` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/check-elevation.md |
| `find_pe_files` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/find-pe-files.md |
| `get_minifilters` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/get-minifilters.md |
| `get_network_connections` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/get-network-connections.md |
| `get_process_details` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/get-process-details.md |
| `get_security_events` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/get-security-events.md |
| `get_system_info` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/get-system-info.md |
| `list_drivers` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/list-drivers.md |
| `list_etw_providers` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/list-etw-providers.md |
| `list_processes` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/list-processes.md |
| `list_services` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/list-services.md |
| `query_event_log` | Read | Low | https://policylayer.com/tools/0xhackerfren-procmon-mcp/query-event-log.md |

## Tool descriptions

- `request_elevation` — Launch a cmd script via UAC (Start-Process -Verb RunAs) to run the given command.
- `start_etw_trace` — Start a kernel ETW trace via logman (requires elevation).
- `stop_etw_trace` — Stop ETW trace, run tracerpt to CSV and summary, return parsed preview (requires elevation).
- `timed_capture` — Repeated snapshots over a duration with optional shell trigger command launched at start.
- `analyze_pe` — Parse a PE file with pefile: imports, exports, category summary.
- `capture_snapshot` — Point-in-time snapshot of matching processes: processes, modules, network connections.
- `check_elevation` — Whether the server is elevated plus a capability matrix for all tools.
- `find_pe_files` — Recursively discover PE files under a directory.
- `get_minifilters` — Run fltmc filters and instances and return raw parsed lines.
- `get_network_connections` — TCP and/or UDP endpoints with owning process. protocol: tcp, udp, both, all.
- `get_process_details` — Deep process details: modules, handle count, threads, command line,
- `get_security_events` — Security log convenience: IDs 4688, 4624, 4672, 4648 (requires elevation).
- `get_system_info` — OS build, architecture, hostname, SecurityCenter2 AV products, PowerShell version.
- `list_drivers` — Enumerate kernel drivers via Win32_SystemDriver.
- `list_etw_providers` — Parse logman query providers with optional keyword filter.
- `list_processes` — List processes with optional name or PID filter.
- `list_services` — Enumerate services via Win32_Service (name, state, start mode, display name, path).
- `query_event_log` — Query a Windows event log via Get-WinEvent FilterHashtable.

## Related servers

- UnClick (1658 tools) — https://policylayer.com/tools/io-github-malamutemayhem-unclick-mcp-server.md
- Nodebench (824 tools) — https://policylayer.com/tools/io-github-homenshum-nodebench.md
- Binance MCP Server (734 tools) — https://policylayer.com/tools/nirholas-binance-mcp.md
- Crawlora (728 tools) — https://policylayer.com/tools/crawlora-mcp.md
- Yaver (646 tools) — https://policylayer.com/tools/io-github-kivanccakmak-yaver.md
- MCP Framework Personal (643 tools) — https://policylayer.com/tools/inggerman-mcps.md
- Crow (587 tools) — https://policylayer.com/tools/kh0pper-crow.md
- Fortimanager (584 tools) — https://policylayer.com/tools/jmpijll-fortimanager-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=0xhackerfren-procmon-mcp · API: https://policylayer.com/registry/api · Recommended policies for every tool: https://policylayer.com/policies/0xhackerfren-procmon-mcp