Quick Install

Copy the config for your editor. Some servers may need additional setup — check the README.

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mcp-hayabusa": {
      "command": "uvx",
      "args": [
        "mcp-hayabusa"
      ]
    }
  }
}

Or install with pip: pip install mcp-hayabusa

README Excerpt

See [CHANGELOG.md](CHANGELOG.md) for release notes. An MCP (Model Context Protocol) server that wraps [Hayabusa](https://github.com/Yamato-Security/hayabusa), the Rust-based Windows event log (.evtx) fast forensic timeline generator and threat hunting tool. It shells out to a local `hayabusa` binary and exposes its analysis capabilities as MCP tools that an LLM client (Claude Desktop, Claude Code, etc.) can call directly against `.evtx` files.

Tools (13)

hayabusa_computer_metricshayabusa_config_critical_systemshayabusa_csv_timelinehayabusa_eid_metricshayabusa_extract_base64hayabusa_json_timelinehayabusa_list_profileshayabusa_log_metricshayabusa_logon_summaryhayabusa_pivot_keywords_listhayabusa_searchhayabusa_update_ruleshayabusa_version

Topics

blue-teamclaudeclaude-codecybersecuritydigital-forensicsevtxhayabusamcpmodel-context-protocolpythonsigmasocthreat-huntingwindows-event-log

mcp-hayabusa

Quick Install

README Excerpt

Tools (13)

Topics

Related Code/Dev Tools Servers