Microsoft is testing ETW MCP, a Model Context Protocol server that lets MCP-compatible assistants analyze Windows Event Tracing data in .etl files through natural-language queries.
Microsoft has introduced an early preview of ETW MCP, a Model Context Protocol (MCP) server for analyzing Windows Event Tracing (ETW) performance traces through natural-language prompts.
In a post on the Microsoft Performance and Diagnostics Blog, Microsoft said ETW MCP can connect MCP-aware assistants, including GitHub Copilot, to ETW data stored in .etl files. Developers can ask questions about a trace and use the captured events as context for the assistant’s response.
ETW is a Windows instrumentation framework that records detailed events from the operating system and applications. Those events can be collected in ETL trace files and used to investigate issues involving CPU activity, disk I/O, memory use, and application responsiveness.
Microsoft describes ETW MCP as a headless, terminal-oriented way to work with those traces. Its early use cases include finding major performance bottlenecks and examining the activity associated with them, according to the company’s introduction to the project.
A developer might ask which processes consumed the most CPU time during a capture, identify expensive disk operations, or investigate activity surrounding a delay. The assistant’s conclusions still depend on the information recorded in the trace and the specificity of the question, but the conversational interface can provide another way to begin an investigation.
Microsoft’s eventtracing-processing repository on GitHub identifies the preview Microsoft.Windows.EventTracing.MCP packages as a .NET MCP server for analyzing Windows ETW performance data.
The project is based on Microsoft’s trace-processing technology. Microsoft Learn documents TraceProcessor as a .NET API for accessing and processing data in ETW trace files. That API provides programmatic access to captured Windows events and forms the technical foundation for the MCP server described in Microsoft’s blog post.
MCP is an open protocol intended to let AI applications connect to external tools and data sources through a consistent interface. For ETW MCP, the connected data source is a Windows performance trace. This enables an assistant to request analysis of structured telemetry rather than relying only on a developer’s written description of a problem.
Microsoft labels ETW MCP an early preview, meaning its packages, capabilities, and workflows may change as development continues. The project does not replace ETW collection or the underlying trace-processing tools. Instead, it places an assistant interface in front of captured performance data.
For Windows developers who already collect ETL traces, the preview offers an experimental way to investigate those files from a terminal using conversational queries alongside conventional performance-analysis tools. Its usefulness will depend on the coverage of the trace data, the available analysis capabilities, and the accuracy of the assistant’s interpretation.
In a post on the Microsoft Performance and Diagnostics Blog, Microsoft said ETW MCP can connect MCP aware assistants, including GitHub Copilot, to ETW data stored in .etl files.
Developers can ask questions about a trace and use the captured events as context for the assistant’s response.
A conversational interface for ETL files ETW is a Windows instrumentation framework that records detailed events from the operating system and applications.
Continue reading
