AppControl Windows System History

official

An MCP server that gives AI agents like Claude, Cursor, and Gemini access to historical Windows CPU, GPU, temperature, and privacy data gathered by the AppControl Windows app.

GitHub

AppControl logo

AppControl MCP Server

An MCP server that gives AI agents and IDEs like Claude, Cursor, and Windsurf read-only access to historical resource usage and system security data gathered by the AppControl Windows app, including binaries, publishers, quarantine rules, events, and monitoring, all through natural language.

Download Latest Release

Prerequisites

  • AppControl running with MCP API enabled
  • Windows only

Installation

There are two ways to install the server: as an MCPB package (recommended for Claude Desktop) or as a standalone executable.

Option A — MCPB Package (Claude Desktop)

  1. Download appcontrol.mcpb from the latest release.
  2. Open Claude Desktop app, go to Settings -> Extensions -> Advanced Settings and click "Install Extension". Choose your newly downloaded .mcpb file — Claude Desktop will install it automatically.
  3. Restart Claude Desktop app by right-clicking the Claude tray icon and selecting "Quit" then start it again.

Option B - Claude Code plugin marketplace (Claude Code)

Add the marketplace in Claude Code:

/plugin marketplace add appcontrollabs/appcontrol-mcp-go

Install the plugin:

/plugin install appcontrol-mcp@appcontrollabs

Reload plugins:

/reload-plugins

Option C — Standalone Executable

  1. Download appcontrol-mcp.exe from the latest release.
  2. Place it somewhere permanent, e.g. C:\MCP\appcontrol-mcp.exe.
  3. Configure your AI client as shown below.

Configuration

If you installed via the MCPB package in Claude Desktop, no further configuration is needed. For the standalone executable, add the server to your AI client's MCP configuration.

Claude Code (CLI) 
claude mcp add appcontrol C:\MCP\appcontrol-mcp.exe
OpenAI Codex (CLI) 
codex mcp add appcontrol C:\MCP\appcontrol-mcp.exe
OpenAI Codex (Codex Desktop)

Open your Codex desktop app and navigate to File -> Settings -> MCP servers. Click "Add server" and fill the following fields:

  • Name: AppControl
  • Command to launch: C:\MCP\appcontrol-mcp.exe

Leave the rest unchanged and click Save.

Gemini (CLI)

Add to your Gemini configuration ~\.gemini\settings.json:

{
  "mcpServers": {
    "appcontrol": {
      "command": "C:/MCP/appcontrol-mcp.exe",
      "args": [],
      "timeout": 15000
    }
  }

}
VS Code (Copilot / Continue / Cline)

Add to your workspace .vscode/mcp.json:

{
  "servers": {
    "appcontrol": {
      "command": "C:/MCP/appcontrol-mcp.exe"
    }
  }
}
Cursor

Add to .cursor/mcp.json in your project root:

{
  "mcpServers": {
    "appcontrol": {
      "command": "C:/MCP/appcontrol-mcp.exe"
    }
  }
}
Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "appcontrol": {
      "command": "C:/MCP/appcontrol-mcp.exe"
    }
  }
}

Example Prompts

Once connected, try asking your AI assistant:

  • "What unsigned applications have been running on this system?"
  • "What binaries on my PC originate from outside the United States and what are the top countries?"
  • "Show me all AppControl blocked process events from the last 24 hours"
  • "Are there any binaries running from Temp or Downloads folders?"
  • "What's currently quarantined? Are unsigned apps blocked?"
  • "What new binaries appeared today? Are any of them suspicious?"
  • "While I walked up to my locked PC my fan was roaring, what was causing that?"
  • "Which publishers have the most binaries on this system?"
  • "Show me processes running with elevated privileges that aren't from Microsoft"
  • "Which binaries have had their hash change recently?"
  • "Did any applications access my webcam while my PC was idle, and if so which ones?"

Available Tools

The MCP server exposes 9 read-only tools:

ToolDescription
get_statsGet service stats, current timestamp, and uptime/idle intervals showing when the PC was on, off, or idle.
list_binariesList tracked binaries with filters — unsigned-only, currently-running, first-seen-after date, path substring, or publisher ID.
get_binaryGet detailed info for one or more binaries by ID (batch with comma-separated IDs) — path, hash, signature, publisher, first-seen time, and running status.
list_processesList currently running processes with binary ID, name, path, PID, and start time. Filterable by fields.
list_publishersList code-signing publishers (certificate identities) — name, country, and linked binary/rule counts.
list_rulesList quarantine rules — blocked binaries and publishers with rule type and creation time.
query_historyQuery security event history — binary first-seen events, quarantine blocks, alerts, and process starts. Filterable by event type, time range, and binary ID.
get_monitoringGet time-series resource metrics — system-wide (CPU, memory, disk, GPU, temps) or per-binary with top-N/min-value filtering to find heavy resource consumers.
get_hardwareGet CPU, GPU, and temperature sensor info for the monitored system.

All tools are read-only. The MCP server cannot modify rules, block/allow binaries, or change any service configuration.

Building from Source

go build -ldflags "-s -w" -o appcontrol-mcp.exe .

License

MIT

This repository contains the open MCP server for AppControl. The AppControl desktop application remains proprietary.

Claude is a trademark of Anthropic, PBC. Cursor, Windsurf, Gemini, VS Code, Copilot, and OpenAI Codex are trademarks of their respective owners. AppControl is not affiliated with or endorsed by any of these companies.

Related Servers