ETW MCP Early Preview

Event Tracing for Windows (ETW) is the kernel-level tracing infrastructure built into Windows, and an ETL trace can include hundreds of data tables spanning CPU, memory, disk, networking, scheduling, input, and other system activity. The ETW MCP is an Early Preview feature that connects ETW trace data to GitHub Copilot, or any MCP-aware AI assistant, so you can read, query, and reason over ETL traces in natural language, the same way an experienced engineer would. No UI required.

The ETW MCP is a local, headless Model Context Protocol (MCP) server. Instead of streaming raw events at the model, it exposes a set of well-defined tools: process a trace, list available data sources, query CPU usage, filter by process or time range, aggregate, compare two traces, walk a critical path, and more. It's powered by the same .NET TraceProcessing engine that drives Windows Performance Analyzer (WPA) and XPerf, so the data you get from the MCP is the data you'd see in WPA, just shaped for an LLM to consume.

The ETW MCP is the headless companion to WPA MCP, which brings the same AI-assisted experience inside Windows Performance Analyzer. Same data layer, no WPA needed, works anywhere you can run Copilot or any MCP-aware AI assistant.

A quick acronym cheat sheet

Before you go further, here are a couple of acronyms you'll see throughout:

• ETW – Event Tracing for Windows, the kernel-level tracing infrastructure built into Windows.
• ETL – the binary trace file (.etl) that ETW emits.
• WPA – Windows Performance Analyzer, the UI for exploring ETL traces.
• WPR / XPerf – the recorders that produce ETL traces.
• MCP – Model Context Protocol, the open standard that lets AI assistants call into tools like this one. "MCP" is also commonly used to reference an MCP server.

Current support

The current Early Preview release ships as a NuGet package, Microsoft.Windows.EventTracing.MCP, published to NuGet.org. It works with GitHub Copilot and any MCP-aware client (VS Code, GitHub Copilot CLI, and others).

A one-click listing on the GitHub MCP Registry is coming soon. Until then, adding a small config block to your MCP client's config file is the supported path.

Why use ETW MCP?

Performance analysis on Windows is gated by expert knowledge. If you already know which WPA table answers your question, you move fast. If you don't, you can spend an hour learning the tool before you learn anything about your trace.

The ETW MCP helps reduce that complexity by letting you:

• Start an investigation with a plain-language question instead of a table name.
• Triage a folder of traces headlessly and rank them before you open any of them.
• Compare a baseline against a trial run and ask for the biggest deltas.
• Get module!function-level evidence on hot stacks when symbols are configured.
• Automate repetitive investigations, the same prompt against many traces, in CI or in a script.

And because it's headless, it composes. You can run it from Windows Terminal, drop it into an agentic workflow, or call it from your own tooling alongside other MCP servers.

Who this is for

• Software engineers chasing a regression or a slow startup.
• Driver developers and hardware engineers profiling power, stutter, or driver-side CPU cost.
• Performance investigators who already live in WPA and want a faster on-ramp.
• Teams running batch performance gates who want trace analysis built into their pipelines.
• Anyone who has an .etl on their desk and isn't sure where to begin.

Prerequisites

Before you start, make sure you have:

• A Windows device.
• The .NET 10 SDK (required by dnx, which launches the MCP server).
• An MCP-aware client, such as VS Code or GitHub Copilot CLI, with an active GitHub Copilot subscription.
• A trace file (.etl) to analyze.

Install the ETW MCP

Add the ETW server to your client's MCP config file (VS Code, GitHub Copilot CLI, or any MCP-aware client) and restart the client.

{
    "servers": {
        "ETW": {
            "type": "stdio",
            "command": "dnx",
            "args": [
                "Microsoft.Windows.EventTracing.MCP",
                "--yes"
            ]
        }
    }
}

Example prompts

The fastest way to understand what the ETW MCP can do is to see real prompts. The fundamental workflow is process → explore → query, and it usually starts with one open-ended question. Every follow-up question is one prompt away.

For A/B comparisons, process two traces and ask one question to get a delta, for example, "the target process uses ~57% more CPU time but the system has 36% fewer context switches." For the showcase workflow, hand the MCP a Regions XML (named time intervals defined by ETW events), ask it to walk a real end-to-end scenario, then drill into the slowest region with Critical Path Analysis, all in one prompt.

Validate Copilot results

The MCP acts as a context and data-retrieval layer, grounding responses in real ETW data, but the reasoning on top of that data still comes from a large language model (LLM). Responses may vary between runs. Treat Copilot analysis as an assistant-generated starting point, not as a final diagnosis.

When using the ETW MCP:

• Validate findings against the underlying trace data.
• Review the tables, graphs, time ranges, and call stacks referenced in the analysis.
• Use follow-up prompts to ask for supporting evidence. Because every claim the model makes is backed by a tool call against the trace, "show me the evidence" is always a valid follow-up prompt.
• Confirm conclusions before making engineering, product, or release decisions.

Known limitations in Early Preview

• This is an early external release, and capabilities are still expanding.
• An MCP-aware client with an active GitHub Copilot subscription is required.
• Responses can vary between runs due to the nature of LLMs.
• Some analysis may require follow-up prompts to narrow the time range, process, thread, or subsystem.
• Feature behavior and available tools may change during the Early Preview period.

Troubleshooting

ETW MCP vs. WPA MCP: which one do I use?

Both use the same data layer, and the analysis they produce is largely the same. The difference is where they run:

• ETW MCP is headless. No WPA window required. Best for terminal-driven workflows, batch analysis, CI pipelines, IDEs like VS Code, and anywhere you want to script trace analysis.
• WPA MCP lives inside WPA and reasons over the tables processed. Best when you want the AI's findings linked to graphs and tables you can see in the UI.

Use the ETW MCP when you're investigating. Use the WPA MCP when you want to dig into the results with an AI companion. Use both when you want to do one and then the other.

Found a bug? Have feedback?

This is an early external release and we want to hear from you. File issues, bugs, and feature requests against the microsoft/eventtracing-processing repo on GitHub, the same place that tracks the Microsoft.Windows.EventTracing.* NuGet packages the MCP is built on.

We're especially interested in:

• Prompts that worked unexpectedly well (or unexpectedly badly).
• Scenarios you wish the MCP understood out of the box.
• Trace sizes and shapes that stress the MCP server.
• Places where the MCP should expose more supporting evidence.

See also

• WPA MCP Early Preview
• .NET TraceProcessing
• Windows Performance Analyzer features
• Windows Performance Toolkit