# event_log_clear

Clear a Windows Event Log (requires admin privileges)

Agent View of the PolicyLayer registry record for `event_log_clear`. HTML page: https://policylayer.com/tools/mukul975-mcp-windows-automation/event-log-clear

## Facts

- Tool: `event_log_clear`
- Server: Mcp Windows (`mukul975/mcp-windows-automation`) — https://policylayer.com/tools/mukul975-mcp-windows-automation.md
- Homepage: https://github.com/mukul975/mcp-windows-automation
- Risk category: Destructive (Critical risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Hidden

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "event_log_clear",
    "arguments": {}
  }
}
```

## Why event_log_clear is rated Critical

This tool permanently deletes Windows Event Log entries, which constitutes irreversible destruction of data. Event logs are critical for security auditing, compliance, and forensic investigation. An AI agent misusing this tool could destroy evidence of malicious activity, violate compliance requirements (SOC2, HIPAA, etc.), or hide system compromise.

From the tool's own definition: "Tool name 'event_log_clear' and description 'Clear a Windows Event Log' indicate irreversible deletion of event log data. Clearing event logs destroys audit trails and forensic evidence that cannot be recovered."

Risk signals: Admin/system-level operation

## Use case

AI agents call event_log_clear to permanently remove resources in Mcp Windows, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.

## Recommended policy (PolicyLayer)

Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Mcp Windows:

```json
{
  "version": "1",
  "default": "deny",
  "hide": [
    "event_log_clear"
  ]
}
```

## Other tools on Mcp Windows (440)

- `clean_empty_directories` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/clean-empty-directories.md
- `clean_temp_files` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/clean-temp-files.md
- `drop_event` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/drop-event.md
- `drop_partition` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/drop-partition.md
- `drop_role` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/drop-role.md
- `drop_stored_function` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/drop-stored-function.md
- `drop_stored_procedure` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/drop-stored-procedure.md
- `mysql_alter_table_drop_column` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-alter-table-drop-column.md
- `mysql_delete_data` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-delete-data.md
- `mysql_drop_database` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-drop-database.md
- `mysql_drop_foreign_key` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-drop-foreign-key.md
- `mysql_drop_index` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-drop-index.md
- `mysql_drop_primary_key` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-drop-primary-key.md
- `mysql_drop_table` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-drop-table.md
- `mysql_drop_user` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-drop-user.md
- `mysql_drop_view` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-drop-view.md
- `mysql_kill_process` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-kill-process.md
- `mysql_reset_query_cache` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-reset-query-cache.md
- `mysql_revoke_privileges` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-revoke-privileges.md
- `mysql_truncate_table` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/mysql-truncate-table.md
- `revoke_role_from_user` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/revoke-role-from-user.md
- `spotify_delete_downloaded_content` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/spotify-delete-downloaded-content.md
- `spotify_remove_track_from_library` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/spotify-remove-track-from-library.md
- `sync_directories` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/sync-directories.md
- `wifi_delete_profile` — Destructive — https://policylayer.com/tools/mukul975-mcp-windows-automation/wifi-delete-profile.md
- `advanced_network_diagnostics` — Execute — https://policylayer.com/tools/mukul975-mcp-windows-automation/advanced-network-diagnostics.md
- `advanced_process_manager` — Execute — https://policylayer.com/tools/mukul975-mcp-windows-automation/advanced-process-manager.md
- `auto_optimize_system` — Execute — https://policylayer.com/tools/mukul975-mcp-windows-automation/auto-optimize-system.md
- `automate_calculator` — Execute — https://policylayer.com/tools/mukul975-mcp-windows-automation/automate-calculator.md
- `automate_notepad` — Execute — https://policylayer.com/tools/mukul975-mcp-windows-automation/automate-notepad.md
- …and 410 more: https://policylayer.com/tools/mukul975-mcp-windows-automation.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=mukul975-mcp-windows-automation · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/mukul975-mcp-windows-automation