AppControl Windows System History

AppControl MCP Server

An MCP server that gives AI agents and IDEs like Claude, Cursor, and Windsurf read-only access to historical resource usage and system security data gathered by the AppControl Windows app, including binaries, publishers, quarantine rules, events, and monitoring, all through natural language.

Prerequisites

• AppControl running with MCP API enabled
• Windows only

Installation

There are two ways to install the server: as an MCPB package (recommended for Claude Desktop) or as a standalone executable.

Option A — MCPB Package (Claude Desktop)

1. Download appcontrol.mcpb from the latest release.
2. Open Claude Desktop app, go to Settings -> Extensions -> Advanced Settings and click "Install Extension". Choose your newly downloaded .mcpb file — Claude Desktop will install it automatically.
3. Restart Claude Desktop app by right-clicking the Claude tray icon and selecting "Quit" then start it again.

Option B - Claude Code plugin marketplace (Claude Code)

Add the marketplace in Claude Code:

/plugin marketplace add appcontrollabs/appcontrol-mcp-go

Install the plugin:

/plugin install appcontrol-mcp@appcontrollabs

Reload plugins:

/reload-plugins

Option C — Standalone Executable

1. Download appcontrol-mcp.exe from the latest release.
2. Place it somewhere permanent, e.g. C:\MCP\appcontrol-mcp.exe.
3. Configure your AI client as shown below.

Configuration

If you installed via the MCPB package in Claude Desktop, no further configuration is needed. For the standalone executable, add the server to your AI client's MCP configuration.

claude mcp add appcontrol C:\MCP\appcontrol-mcp.exe

codex mcp add appcontrol C:\MCP\appcontrol-mcp.exe

{
  "mcpServers": {
    "appcontrol": {
      "command": "C:/MCP/appcontrol-mcp.exe",
      "args": [],
      "timeout": 15000
    }
  }

}

{
  "servers": {
    "appcontrol": {
      "command": "C:/MCP/appcontrol-mcp.exe"
    }
  }
}

{
  "mcpServers": {
    "appcontrol": {
      "command": "C:/MCP/appcontrol-mcp.exe"
    }
  }
}

{
  "mcpServers": {
    "appcontrol": {
      "command": "C:/MCP/appcontrol-mcp.exe"
    }
  }
}

Example Prompts

Once connected, try asking your AI assistant:

• "What unsigned applications have been running on this system?"
• "What binaries on my PC originate from outside the United States and what are the top countries?"
• "Show me all AppControl blocked process events from the last 24 hours"
• "Are there any binaries running from Temp or Downloads folders?"
• "What's currently quarantined? Are unsigned apps blocked?"
• "What new binaries appeared today? Are any of them suspicious?"
• "While I walked up to my locked PC my fan was roaring, what was causing that?"
• "Which publishers have the most binaries on this system?"
• "Show me processes running with elevated privileges that aren't from Microsoft"
• "Which binaries have had their hash change recently?"
• "Did any applications access my webcam while my PC was idle, and if so which ones?"

Available Tools

The MCP server exposes 9 read-only tools:

All tools are read-only. The MCP server cannot modify rules, block/allow binaries, or change any service configuration.

Building from Source

go build -ldflags "-s -w" -o appcontrol-mcp.exe .

License

MIT

This repository contains the open MCP server for AppControl. The AppControl desktop application remains proprietary.

Claude is a trademark of Anthropic, PBC. Cursor, Windsurf, Gemini, VS Code, Copilot, and OpenAI Codex are trademarks of their respective owners. AppControl is not affiliated with or endorsed by any of these companies.