Microsoft Unveils ETW MCP for AI-Powered Trace Analysis

Microsoft has unveiled ETW MCP, a new Model Context Protocol server that lets AI assistants analyze Windows Event Trace Log files using natural-language prompts.

The preview works with GitHub Copilot and other MCP-compatible assistants. Developers can ask questions about an ETL trace instead of manually searching through large volumes of performance data.

ETW MCP aims to make Windows performance investigations faster and more accessible, especially for developers who lack deep experience with Event Tracing for Windows.

ETW MCP provides structured access to trace data

Windows uses Event Tracing for Windows to collect detailed diagnostic and performance information. Developers traditionally inspect ETL files with specialist tools such as Windows Performance Analyzer.

Large traces can contain millions of events, which makes manual analysis slow and difficult.

ETW MCP does not send raw trace events directly to an AI model. It gives the assistant controlled, read-only access to processed and structured results.

Microsoft’s TraceProcessor engine performs the resource-intensive analysis locally. The AI assistant then interprets the results and explains what they may mean.

Developers can ask questions such as:

• Which processes consumed the most CPU time?
• Which threads caused the highest activity?
• What changed between two performance traces?
• Which execution paths contributed to a slowdown?
• What evidence supports a specific conclusion?

This approach limits the model’s ability to produce conclusions that the trace data does not support.

Microsoft stresses evidence-based findings

ETW MCP bases its responses on information extracted from the selected ETL file rather than general assumptions about Windows behavior.

Developers can request evidence for a finding and use follow-up questions to investigate suspicious processes, threads, or execution paths. This helps teams validate conclusions before changing code or system configurations.

Microsoft still recommends treating AI-generated explanations as guidance. Developers should compare important findings with the original trace data before acting on them.

ETW MCP targets automated performance testing

The tool could help application developers identify bottlenecks and investigate performance regressions. Driver and hardware engineers could also use it to examine processor activity, power consumption, and system behavior.

Organizations could add ETW MCP to continuous-integration systems that collect and compare performance traces across builds. Since the server does not require a graphical interface, it can work in terminal-based, scripted, and automated environments.

Teams could also use it to run repeated comparisons between software versions or test configurations.

ETW MCP will complement WPA MCP

Microsoft designed ETW MCP for automation, command-line workflows, and environments without a graphical interface.

The company is also developing WPA MCP, which will add similar AI-assisted analysis directly to Windows Performance Analyzer. Microsoft intends the two tools to complement each other.

Developers who prefer visual trace inspection can use WPA MCP, while automated systems and scripts can rely on ETW MCP.

ETW MCP preview now available

The preview is available through the Microsoft.Windows.EventTracing.MCP NuGet package.

Microsoft wants feedback on prompt quality, supported workflows, large-trace performance, and additional analysis features. The company also plans to connect the tool more closely with the broader Windows Performance Toolkit.

The release comes as Microsoft continues changing Windows and its Copilot ecosystem. The company recently explained why Windows 11 modernization is progressing slowly.

Microsoft also pulled Copilot Domain Exclusion shortly after launch, while administrators criticized the company after it installed OneDrive Photos on enterprise PCs without approval.