EventWhisper 通过 MCP（模型上下文协议）服务器，快速、可脚本化访问 Windows .evtx 日志。 它纯粹是Python（使用evtx库），而不是PowerShell封装器，并且不在主机上执行命令——更适合事件响应、数字取证和威胁狩猎。

服务器提供两个主要工具：

• 为任意目录列出EVTX文件（可选递归）。
• 通过筛选事件直接搜索特定记录。

专为红外/DFIR和狩猎设计，不用整天查事件ID。设计、开发并测试于Windows上，使用Claude——可在任何MCP客户端使用。

---

特色

• 定向过滤：时间窗口、事件ID和大小写不区分的关键词（包含/排除）
• 场投影：只返回你需要的虚线路径（输出大幅减少）
• 输入规范化：接受灵活的输入格式，因此即使类型/格式不完美也能正常工作。
• MCP 支持：可插入 Claude Desktop（及其他 MCP 客户端）

---

演示

https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b

---

需求（Windows）

EventWhisper — A Windows Event Log MCP

EventWhisper exposes fast, scriptable access to Windows .evtx logs via an MCP (Model Context Protocol) server. It’s pure Python (uses the evtx library), instead of a PowerShell wrapper and does not execute commands on the host — safer for incident response, digital forensics, and threat hunting.

The server exposes two primary tools:

• List EVTX files (optionally recursive) for any directory.
• Filter events to directly search for specific records.

Built specifically for IR/DFIR & hunting so you don’t need to look up Event IDs all day. Designed, developed, and tested on Windows with Claude — and usable from any MCP client.

---

Features

• Targeted filtering: time window, EventID(s), and case-insensitive keywords (include/exclude)
• Field projection: return only the dotted paths you need (huge output reduction)
• Input normalization: accepts flexible input formats so it still works if types/format aren’t perfect.
• MCP-ready: plugs into Claude Desktop (and other MCP clients)

---

Demo

https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b

---

Requirements (Windows)

EventWhisper can be set up with Poetry, whether you run it inside Claude or standalone. On Windows, make sure Poetry is on your PATH.

Install Poetry (PowerShell):

(Invoke-WebRequest -Uri https://install.python-poetry.org -UseBasicParsing).Content | py -

Add Poetry to PATH (user install):

C:\Users\\AppData\Roaming\Python\Scripts

Verify:

poetry --version

---

Install & Run

Primarily developed for use with Claude, but you can run the MCP server standalone and plug it into other LLMs.

Clone and install:

git clone https://github.com/hexastrike/eventwhisper
cd eventwhisper
poetry install

Run the MCP server:

poetry run python -m eventwhisper.mcp.server
# (or) plain Python if deps are installed globally:
python -m eventwhisper.mcp.server

---

Claude MCP configuration

Add this to Claude Desktop’s MCP config (e.g., %AppData%\Claude\claude_desktop_config.json):

{
  "mcpServers": {
    "EventWhisper": {
      "type": "stdio",
      "command": "poetry",
      "args": [
        "-C",
        "C:\\Path\\To\\eventwhisper",
        "run",
        "python",
        "-m",