Microsoft previews ETW MCP query

Microsoft released an early preview of ETW MCP on July 21, adding a Model Context Protocol server that lets GitHub Copilot and other MCP-aware assistants query Windows Event Tracing files in natural language. Microsoft said the tool is local, headless and read-only, and is aimed at engineers who work with ETL trace files for performance and diagnostics. The launch gives Copilot-style tools access to one of Windows’ deepest telemetry layers through structured queries rather than manual navigation in Windows Performance Analyzer. One day before broad coverage of that preview, Microsoft also rolled back a separate Microsoft 365 Copilot admin feature called Domain Exclusion after rollout, saying only that it was “actively evaluating next steps.” ### What exactly did Microsoft ship on July 21? Microsoft’s July 21 developer post described ETW MCP as an early preview of a local STDIO-based MCP server for Event Tracing for Windows data. The company said the server lets GitHub Copilot, or any MCP-aware AI assistant, “read, query, and reason over” ETW traces without requiring a separate user interface. (devblogs.microsoft.com) Event Tracing for Windows is the kernel-level tracing system built into Windows, and ETL files can contain data across CPU, memory, disk, networking, scheduling and input activity, according to Microsoft Learn. Microsoft said ETW MCP exposes structured tools instead of raw event streams, including functions to process a trace, list data sources, query CPU usage, filter by process or time range, aggregate results, compare traces and walk a critical path. (devblogs.microsoft.com) ### Why does the “local, read-only” design matter? Microsoft Learn said ETW MCP is a local, headless MCP server, and Microsoft’s developer blog said it gives an AI assistant “structured, read-only access” to data inside an ETL trace. Microsoft said that design avoids “streaming raw events at the model” and instead has the MCP server do the trace processing while the language model reasons over the results. (learn.microsoft.com) The same July 21 post said the server is powered by the TraceProcessor engine that also drives Windows Performance Analyzer and XPerf. Microsoft said that means the data returned through ETW MCP is the same data users would see in WPA, but formatted for an LLM workflow. ### How is this different from using Windows Performance Analyzer directly? (learn.microsoft.com) Windows Performance Analyzer remains Microsoft’s main interface for exploring ETL traces, while ETW MCP is the headless companion for Copilot-style querying, according to Microsoft Learn. Microsoft said the tool is intended to lower the expertise barrier for engineers who do not already know which WPA table or filter answers a given question. (devblogs.microsoft.com) Microsoft’s documentation said the current early preview ships as a NuGet package, Microsoft.Windows.EventTracing.MCP, and works with GitHub Copilot and other MCP-aware clients including VS Code and GitHub Copilot CLI. Microsoft also said a one-click listing on the GitHub MCP Registry is “coming soon,” and warned that behavior, availability and supported scenarios may change before general availability. (learn.microsoft.com) ### Why are people tying this to Microsoft’s broader Copilot governance? Neowin reported on August 5 that Microsoft rolled back Domain Exclusion, a newly announced Microsoft 365 Copilot admin feature that had let IT administrators exclude up to 1,000 domains from Copilot web grounding through PowerShell. Neowin said Microsoft removed the capability even from early adopters and did not explain the reason, beyond saying it was “actively evaluating next steps.” (learn.microsoft.com) Microsoft’s most recent earnings call, as cited by Neowin, put Microsoft 365 Copilot at 30 million paid seats, underscoring the scale of enterprise deployment around these controls. The ETW MCP preview and the Domain Exclusion rollback are separate products, but they place new AI access and withdrawn AI controls side by side inside Microsoft’s Copilot portfolio. That makes provenance, rollback and validation details more likely to matter to enterprise users evaluating where Copilot can inspect system data. (neowin.net) This last point is an inference based on the two releases occurring together, not a stated Microsoft position. ### What should users watch next? Microsoft Learn said ETW MCP remains an “Early Preview” and that a GitHub MCP Registry listing is coming soon. Microsoft also said users can validate Copilot results and submit bugs or feedback through the preview documentation flow. Microsoft has not yet given a date for Domain Exclusion’s return. (neowin.net) Neowin said the company told customers it was still evaluating next steps and would share more later. (learn.microsoft.com)