WinDiag MCP Server - Lecture Demo

A comprehensive Model Context Protocol (MCP) server demonstrating Windows diagnostics capabilities with AI-powered workflows. Built with .NET 10 and showcasing MCP tools, resources, and prompts.

What This Demo Shows

This is a production-ready MCP server with:

✅ Tools: System information, process management, event log snapshots
✅ Resources: Event log snapshot resources with pagination support
✅ Prompts: AI-guided diagnostic workflows
✅ AI Chat Client: Interactive diagnostics with Azure OpenAI
✅ Streamable HTTP transport (/mcp)
✅ .NET 10 implementation
✅ Multiple testing methods
✅ C# MCP client implementation

Perfect for learning MCP concepts and building AI-powered diagnostics!

Quick Start

1. Build the Server

dotnet build

2. Quick Test Script (No LLM)

./test-mcp-server.ps1

This runs a full smoke test:

Builds the server
Starts it locally
Discovers tools
Executes get_system_info

3. Test with MCP Inspector (Visual Interface)

# Install (one-time)
npm install -g @modelcontextprotocol/inspector

# Launch visual testing UI
.\launch-inspector.ps1

Then in the browser:

Click "Connect"
Explore Tools, Resources, and Prompts tabs
Test tools and view resources
Try MCP prompts for diagnostic workflows

4. Use the AI Chat Client

cd WinDiagMcpChat
dotnet run

Interactive diagnostics with:

Azure OpenAI integration
Automatic prompt discovery
AI-guided workflows
Resource pagination handling

The Tools

System Information

get_system_info - Returns comprehensive Windows system diagnostics

Process Management

get_all_processes - Lists all running processes with CPU, memory, threads, handles
get_process_info - Gets detailed information for a specific process by ID

Event Log Management

create_event_log_snapshot - Creates a snapshot of Windows Event Log entries
- Returns an MCP resource URI for pagination support
- Supports XPath queries for filtering
- Stores snapshots for later access

WMI Troubleshooting

troubleshoot_with_wmi - AI-assisted WMI diagnostics
- Uses MCP Sampling to generate safe WMI queries from natural language
- Executes queries with guardrails
- Analyzes results automatically

The Resources

`eventlog://snapshot/{id}`

MCP resource containing event log snapshot data in JSON format with pagination support.

Query Parameters:

limit - Number of events per page (default: 100)
offset - Starting position (default: 0)

Example: eventlog://snapshot/abc123?limit=20&offset=0

Returns:

{
  "SnapshotId": "abc123...",
  "LogName": "Application",
  "CreatedAt": "2025-01-15T10:30:00Z",
  "Pagination": {
    "TotalCount": 150,
    "ReturnedCount": 20,
    "Offset": 0,
    "Limit": 20,
    "HasMore": true,
    "NextOffset": 20
  },
  "Events": [...]
}

The Prompts

MCP Prompts provide AI-guided diagnostic workflows:

Event Log Analysis

AnalyzeRecentApplicationErrors - Analyzes recent application errors from event logs
- Parameters: hoursBack (default: 24)

System Diagnostics

ExplainHighCpu - Investigates processes causing high CPU usage
DetectSecurityAnomalies - Detects security issues (requires elevation)
DiagnoseSystemHealth - Comprehensive health check without elevation ⭐
- Analyzes memory usage, crashes, performance issues
- Correlates processes with event logs
- Provides actionable recommendations

Usage Example:

Ask the chat client: "Do a system health check"
It will:
1. Retrieve the DiagnoseSystemHealth prompt
2. Follow the step-by-step workflow
3. Call get_all_processes
4. Create event log snapshots
5. Read resources with pagination
6. Analyze patterns
7. Present comprehensive health report

Projects