LabscoMCP early access ↗
AppControlLabsMCP SERVER · OFFICIAL PROJECT

AppControl Windows System History

Ask what your Windows PC was doing three hours ago, and which binary did it.

by AppControlLabs ↗Threat Intelligence & Digital Forensics✓ Official

LABSCO SUMMARY

Task Manager shows you now; this answers about earlier.

The value is in the join: the server that knows a process pinned the GPU also knows whether that binary is signed, who signed it, when it first appeared on the machine, and whether you were even at the keyboard — so "the fan was roaring while I was away" becomes an answerable question.

What it is

A local, read-only bridge to the history the AppControl Windows app keeps: tracked binaries and their signatures, running processes, code-signing publishers, quarantine rules, security events, and time-series resource and temperature data.

What you get

  • get_monitoring returns time-series resource metrics — CPU, memory, disk, GPU and temperatures — system-wide or per binary, with top-N and minimum-value filters for finding the heavy consumer
  • list_binaries filters tracked binaries by signature status, running state, first-seen date, path substring or publisher; get_binary returns path, hash, signature, publisher and first-seen time for one or several at once
  • query_history searches the security event log — first-seen binaries, quarantine blocks, alerts and process starts — by event type, time range or binary
  • list_processes reports what is running now with binary ID, PID, path and start time; list_publishers reports the signing identities behind those binaries and how many are linked to each
  • list_rules shows the quarantine rules in force: which binaries and publishers are blocked, the rule type, and when it was created
  • get_stats reports service uptime and the on, off and idle intervals of the machine — what turns a bare timestamp into "while I was away"
  • get_hardware reports the CPU, GPU and temperature sensors being monitored
  • Every tool reads. The server cannot change a rule, block or unblock a binary, or alter the service configuration

Requirements

Windows, with the AppControl desktop app installed, running, and its MCP API enabled. Install it as an MCPB package into Claude Desktop, through the Claude Code plugin marketplace, or as a standalone executable your client launches.

Setup effort

Follow the published steps

See installation options