@mokoconsulting/mcp-windows 3.0.0

package/src/tools/firewall.ts

@@ -0,0 +1,125 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * Tools: windows_firewall_get (#57), windows_firewall_manage (#58)
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { runPowerShell } from '../shell.js';
+
+export function registerFirewallTools(server: McpServer): void {
+	server.tool(
+		'windows_firewall_get',
+		'Get Windows Firewall status and list rules.',
+		{
+			filter: z.string().optional().describe('Filter rules by name (substring)'),
+			direction: z.enum(['inbound', 'outbound', 'all']).default('all').describe('Rule direction'),
+			enabled_only: z.boolean().default(true).describe('Only show enabled rules'),
+			limit: z.number().default(30).describe('Max rules to return'),
+		},
+		async ({ filter, direction, enabled_only, limit }) => {
+			const dirFilter = direction === 'inbound' ? "| Where-Object { \\$_.Direction -eq 'Inbound' }"
+				: direction === 'outbound' ? "| Where-Object { \\$_.Direction -eq 'Outbound' }" : '';
+			const nameFilter = filter ? `| Where-Object { \\$_.DisplayName -like '*${filter.replace(/'/g, "''")}*' }` : '';
+			const enabledFilter = enabled_only ? "| Where-Object { \\$_.Enabled -eq 'True' }" : '';
+
+			const ps = `
+$profiles = Get-NetFirewallProfile -ErrorAction SilentlyContinue | ForEach-Object {
+  [PSCustomObject]@{ Name = $_.Name; Enabled = $_.Enabled; DefaultInbound = $_.DefaultInboundAction; DefaultOutbound = $_.DefaultOutboundAction }
+}
+
+$rules = Get-NetFirewallRule ${dirFilter} ${nameFilter} ${enabledFilter} -ErrorAction SilentlyContinue |
+  Select-Object -First ${limit} | ForEach-Object {
+    $port = ($_ | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue)
+    [PSCustomObject]@{
+      Name = $_.DisplayName
+      Direction = $_.Direction.ToString()
+      Action = $_.Action.ToString()
+      Enabled = $_.Enabled.ToString()
+      Protocol = if ($port) { $port.Protocol } else { 'Any' }
+      Port = if ($port.LocalPort) { $port.LocalPort -join ',' } else { 'Any' }
+      Program = ($_ | Get-NetFirewallApplicationFilter -ErrorAction SilentlyContinue).Program
+    }
+  }
+
+[PSCustomObject]@{
+  Profiles = $profiles
+  Rules = $rules
+} | ConvertTo-Json -Depth 4 -Compress`;
+
+			const result = await runPowerShell(ps, { timeout: 30000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+
+			const data = JSON.parse(result.stdout);
+			const lines: string[] = ['Firewall Profiles:'];
+			const profiles = Array.isArray(data.Profiles) ? data.Profiles : [data.Profiles];
+			for (const p of profiles.filter(Boolean)) {
+				lines.push(`  ${p.Name}: ${p.Enabled ? 'ON' : 'OFF'} (In: ${p.DefaultInbound}, Out: ${p.DefaultOutbound})`);
+			}
+
+			const rules = Array.isArray(data.Rules) ? data.Rules : data.Rules ? [data.Rules] : [];
+			if (rules.length > 0) {
+				lines.push('', `Rules (${rules.length}):`);
+				for (const r of rules) {
+					const dir = r.Direction === 'Inbound' ? 'IN ' : 'OUT';
+					const act = r.Action === 'Allow' ? 'ALLOW' : 'BLOCK';
+					lines.push(`  [${dir}] [${act}]  ${(r.Name || '').padEnd(35).slice(0, 35)}  ${r.Protocol}/${r.Port}`);
+				}
+			}
+
+			return { content: [{ type: 'text', text: lines.join('\n') }] };
+		},
+	);
+
+	server.tool(
+		'windows_firewall_manage',
+		'Create, enable, disable, or delete a firewall rule.',
+		{
+			action: z.enum(['create', 'enable', 'disable', 'delete']).describe('Action'),
+			name: z.string().describe('Rule name'),
+			direction: z.enum(['inbound', 'outbound']).optional().describe('Direction (for create)'),
+			rule_action: z.enum(['allow', 'block']).optional().describe('Allow or block (for create)'),
+			port: z.string().optional().describe('Port number or range (for create)'),
+			protocol: z.enum(['TCP', 'UDP', 'Any']).optional().describe('Protocol (for create)'),
+			program: z.string().optional().describe('Program path (for create)'),
+		},
+		async ({ action, name, direction, rule_action, port, protocol, program }) => {
+			let ps: string;
+
+			switch (action) {
+				case 'create': {
+					if (!direction || !rule_action) {
+						return { content: [{ type: 'text', text: 'Create requires direction and rule_action.' }], isError: true };
+					}
+					const dir = direction === 'inbound' ? 'Inbound' : 'Outbound';
+					const act = rule_action === 'allow' ? 'Allow' : 'Block';
+					const parts = [`New-NetFirewallRule -DisplayName '${name.replace(/'/g, "''")}' -Direction ${dir} -Action ${act}`];
+					if (port) parts.push(`-LocalPort ${port}`);
+					if (protocol && protocol !== 'Any') parts.push(`-Protocol ${protocol}`);
+					if (program) parts.push(`-Program '${program.replace(/'/g, "''")}'`);
+					parts.push('-ErrorAction Stop');
+					ps = `${parts.join(' ')} | Select-Object DisplayName,Direction,Action,Enabled | ConvertTo-Json -Compress`;
+					break;
+				}
+				case 'enable':
+					ps = `Enable-NetFirewallRule -DisplayName '${name.replace(/'/g, "''")}' -ErrorAction Stop; "Enabled: ${name}"`;
+					break;
+				case 'disable':
+					ps = `Disable-NetFirewallRule -DisplayName '${name.replace(/'/g, "''")}' -ErrorAction Stop; "Disabled: ${name}"`;
+					break;
+				case 'delete':
+					ps = `Remove-NetFirewallRule -DisplayName '${name.replace(/'/g, "''")}' -ErrorAction Stop; "Deleted: ${name}"`;
+					break;
+			}
+
+			const result = await runPowerShell(ps, { timeout: 15000 });
+			return {
+				content: [{ type: 'text', text: result.stdout || result.stderr }],
+				isError: result.exitCode !== 0,
+			};
+		},
+	);
+}

package/src/tools/hosts.ts

@@ -0,0 +1,135 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * Tool: windows_hosts_file (#51)
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { readFile, writeFile, copyFile } from 'node:fs/promises';
+
+const HOSTS_PATH = 'C:\\Windows\\System32\\drivers\\etc\\hosts';
+
+export function registerHostsTools(server: McpServer): void {
+	server.tool(
+		'windows_hosts_file',
+		'Read and manage the Windows hosts file. List, add, remove, or toggle entries.',
+		{
+			action: z.enum(['list', 'add', 'remove', 'enable', 'disable']).default('list').describe('Action'),
+			ip: z.string().optional().describe('IP address (for add)'),
+			hostname: z.string().optional().describe('Hostname (for add/remove/enable/disable)'),
+			comment: z.string().optional().describe('Comment (for add)'),
+		},
+		async ({ action, ip, hostname, comment }) => {
+			try {
+				const content = await readFile(HOSTS_PATH, 'utf-8');
+				const lines = content.split(/\r?\n/);
+
+				if (action === 'list') {
+					const entries: Array<{ line: number; enabled: boolean; ip: string; host: string; comment: string }> = [];
+					lines.forEach((line, i) => {
+						const trimmed = line.trim();
+						if (!trimmed || trimmed.startsWith('#') && !trimmed.match(/^#\s*\d/)) {
+							// Check if it's a commented-out entry
+							const commented = trimmed.replace(/^#\s*/, '');
+							const parts = commented.split(/\s+/);
+							if (parts.length >= 2 && parts[0].match(/^\d+\.\d+\.\d+\.\d+$|^[a-f0-9:]+$/i)) {
+								entries.push({
+									line: i + 1,
+									enabled: false,
+									ip: parts[0],
+									host: parts[1],
+									comment: parts.slice(2).join(' ').replace(/^#\s*/, ''),
+								});
+							}
+							return;
+						}
+						const parts = trimmed.split(/\s+/);
+						if (parts.length >= 2 && parts[0].match(/^\d+\.\d+\.\d+\.\d+$|^[a-f0-9:]+$/i)) {
+							entries.push({
+								line: i + 1,
+								enabled: true,
+								ip: parts[0],
+								host: parts[1],
+								comment: parts.slice(2).join(' ').replace(/^#\s*/, ''),
+							});
+						}
+					});
+
+					const output = entries.map(e => {
+						const status = e.enabled ? '[ON] ' : '[OFF]';
+						return `${status}  ${e.ip.padEnd(18)}  ${e.host.padEnd(35)}  ${e.comment}`;
+					});
+
+					const header = `State  ${'IP'.padEnd(18)}  ${'Hostname'.padEnd(35)}  Comment`;
+					return {
+						content: [{ type: 'text', text: `${HOSTS_PATH}\n${header}\n${'─'.repeat(80)}\n${output.join('\n')}\n\n${entries.length} entries` }],
+					};
+				}
+
+				// Backup before modification
+				await copyFile(HOSTS_PATH, HOSTS_PATH + '.bak');
+
+				if (action === 'add') {
+					if (!ip || !hostname) {
+						return { content: [{ type: 'text', text: 'Add requires ip and hostname.' }], isError: true };
+					}
+					const entry = comment ? `${ip}\t${hostname}\t# ${comment}` : `${ip}\t${hostname}`;
+					const newContent = content.trimEnd() + '\n' + entry + '\n';
+					await writeFile(HOSTS_PATH, newContent, 'utf-8');
+					return { content: [{ type: 'text', text: `Added: ${ip} ${hostname}` }] };
+				}
+
+				if (action === 'remove') {
+					if (!hostname) {
+						return { content: [{ type: 'text', text: 'Remove requires hostname.' }], isError: true };
+					}
+					const filtered = lines.filter(line => {
+						const parts = line.trim().replace(/^#\s*/, '').split(/\s+/);
+						return !(parts.length >= 2 && parts[1] === hostname);
+					});
+					await writeFile(HOSTS_PATH, filtered.join('\n'), 'utf-8');
+					return { content: [{ type: 'text', text: `Removed entries for: ${hostname}` }] };
+				}
+
+				if (action === 'disable') {
+					if (!hostname) {
+						return { content: [{ type: 'text', text: 'Disable requires hostname.' }], isError: true };
+					}
+					const updated = lines.map(line => {
+						const parts = line.trim().split(/\s+/);
+						if (parts.length >= 2 && parts[1] === hostname && !line.trim().startsWith('#')) {
+							return '# ' + line;
+						}
+						return line;
+					});
+					await writeFile(HOSTS_PATH, updated.join('\n'), 'utf-8');
+					return { content: [{ type: 'text', text: `Disabled: ${hostname}` }] };
+				}
+
+				if (action === 'enable') {
+					if (!hostname) {
+						return { content: [{ type: 'text', text: 'Enable requires hostname.' }], isError: true };
+					}
+					const updated = lines.map(line => {
+						const trimmed = line.trim();
+						if (trimmed.startsWith('#')) {
+							const uncommented = trimmed.replace(/^#\s*/, '');
+							const parts = uncommented.split(/\s+/);
+							if (parts.length >= 2 && parts[1] === hostname) {
+								return uncommented;
+							}
+						}
+						return line;
+					});
+					await writeFile(HOSTS_PATH, updated.join('\n'), 'utf-8');
+					return { content: [{ type: 'text', text: `Enabled: ${hostname}` }] };
+				}
+
+				return { content: [{ type: 'text', text: 'Unknown action.' }], isError: true };
+			} catch (err) {
+				return { content: [{ type: 'text', text: `Error: ${err}. Hosts file modification may require elevation.` }], isError: true };
+			}
+		},
+	);
+}

package/src/tools/maintenance.ts

@@ -0,0 +1,299 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * Tools: windows_updates (#59), windows_event_log (#60),
+ *        windows_restore_point (#61), windows_certificate_list (#62),
+ *        windows_performance_monitor (#63)
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { runPowerShell } from '../shell.js';
+
+export function registerMaintenanceTools(server: McpServer): void {
+
+	server.tool(
+		'windows_updates',
+		'Check Windows Update status, pending updates, and recent history.',
+		{
+			action: z.enum(['status', 'history']).default('status').describe('Check status or view history'),
+			limit: z.number().default(20).describe('Max history entries'),
+		},
+		async ({ action, limit }) => {
+			if (action === 'history') {
+				const ps = `
+$session = New-Object -ComObject Microsoft.Update.Session
+$searcher = $session.CreateUpdateSearcher()
+$count = $searcher.GetTotalHistoryCount()
+$history = $searcher.QueryHistory(0, [math]::Min($count, ${limit}))
+$history | ForEach-Object {
+  [PSCustomObject]@{
+    Date = $_.Date.ToString('yyyy-MM-dd HH:mm')
+    Title = $_.Title
+    Result = switch ($_.ResultCode) { 0 {'Not Started'} 1 {'In Progress'} 2 {'Succeeded'} 3 {'Succeeded with Errors'} 4 {'Failed'} 5 {'Aborted'} default {'Unknown'} }
+  }
+} | ConvertTo-Json -Depth 3 -Compress`;
+
+				const result = await runPowerShell(ps, { timeout: 30000 });
+				if (result.exitCode !== 0) {
+					return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+				}
+				if (!result.stdout) {
+					return { content: [{ type: 'text', text: 'No update history.' }] };
+				}
+
+				const entries = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+				const lines = entries.map((e: { Date: string; Title: string; Result: string }) =>
+					`${e.Result.padEnd(10)}  ${e.Date}  ${(e.Title || '').slice(0, 70)}`,
+				);
+				return { content: [{ type: 'text', text: `Recent updates:\n${lines.join('\n')}` }] };
+			}
+
+			// Status
+			const ps = `
+$reboot = Test-Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired'
+$lastCheck = (Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\Results\\Detect' -Name LastSuccessTime -ErrorAction SilentlyContinue).LastSuccessTime
+[PSCustomObject]@{
+  RestartPending = $reboot
+  LastCheckTime = $lastCheck
+} | ConvertTo-Json -Compress`;
+
+			const result = await runPowerShell(ps, { timeout: 15000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+			const info = JSON.parse(result.stdout);
+			return {
+				content: [{
+					type: 'text',
+					text: `Windows Update:\n  Restart pending: ${info.RestartPending}\n  Last check: ${info.LastCheckTime || 'Unknown'}`,
+				}],
+			};
+		},
+	);
+
+	server.tool(
+		'windows_event_log',
+		'Read Windows Event Log entries. Filter by log, level, source, or time.',
+		{
+			log: z.string().default('System').describe('Log name (System, Application, Security, etc.)'),
+			level: z.enum(['Critical', 'Error', 'Warning', 'Information', 'All']).default('All').describe('Event level'),
+			source: z.string().optional().describe('Event source filter'),
+			limit: z.number().default(20).describe('Max entries'),
+			hours: z.number().optional().describe('Only events from last N hours'),
+		},
+		async ({ log, level, source, limit, hours }) => {
+			const levelMap: Record<string, string> = {
+				Critical: '1', Error: '2', Warning: '3', Information: '4',
+			};
+			const levelFilter = level !== 'All' ? `-Level ${levelMap[level]}` : '';
+			const sourceFilter = source ? `-ProviderName '${source.replace(/'/g, "''")}'` : '';
+			const timeFilter = hours ? `-After (Get-Date).AddHours(-${hours})` : '';
+
+			const ps = `
+Get-WinEvent -LogName '${log.replace(/'/g, "''")}' -MaxEvents ${limit} ${levelFilter ? `| Where-Object { $_.Level -eq ${levelMap[level]} }` : ''} -ErrorAction SilentlyContinue |
+  ${source ? `Where-Object { $_.ProviderName -like '*${source.replace(/'/g, "''")}*' } |` : ''}
+  ${hours ? `Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-${hours}) } |` : ''}
+  Select-Object -First ${limit} |
+  ForEach-Object {
+    [PSCustomObject]@{
+      Time = $_.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')
+      Level = $_.LevelDisplayName
+      Source = $_.ProviderName
+      EventId = $_.Id
+      Message = ($_.Message -split [char]10)[0].Substring(0, [math]::Min(($_.Message -split [char]10)[0].Length, 100))
+    }
+  } | ConvertTo-Json -Depth 3 -Compress`;
+
+			const result = await runPowerShell(ps, { timeout: 20000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+			if (!result.stdout) {
+				return { content: [{ type: 'text', text: 'No events found.' }] };
+			}
+
+			const events = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+			const lines = events.map((e: { Time: string; Level: string; Source: string; EventId: number; Message: string }) =>
+				`${(e.Level || '').padEnd(12)}  ${e.Time}  ${String(e.EventId).padStart(5)}  ${(e.Source || '').padEnd(25).slice(0, 25)}  ${(e.Message || '').slice(0, 50)}`,
+			);
+
+			const header = `${'Level'.padEnd(12)}  ${'Time'.padEnd(19)}  ${'ID'.padStart(5)}  ${'Source'.padEnd(25)}  Message`;
+			return { content: [{ type: 'text', text: `${log} log:\n${header}\n${'─'.repeat(120)}\n${lines.join('\n')}` }] };
+		},
+	);
+
+	server.tool(
+		'windows_restore_point',
+		'List or create System Restore points.',
+		{
+			action: z.enum(['list', 'create']).default('list').describe('Action'),
+			description: z.string().optional().describe('Description for new restore point'),
+		},
+		async ({ action, description }) => {
+			if (action === 'create') {
+				const desc = description || 'mcp_windows restore point';
+				const ps = `Checkpoint-Computer -Description '${desc.replace(/'/g, "''")}' -RestorePointType MODIFY_SETTINGS -ErrorAction Stop; "Restore point created: ${desc}"`;
+				const result = await runPowerShell(ps, { timeout: 60000 });
+				return { content: [{ type: 'text', text: result.stdout || result.stderr }], isError: result.exitCode !== 0 };
+			}
+
+			const ps = `
+try {
+  $points = Get-ComputerRestorePoint -ErrorAction Stop
+  if (-not $points) { Write-Output '[]'; return }
+  $points | ForEach-Object {
+    [PSCustomObject]@{
+      SequenceNumber = $_.SequenceNumber
+      Description = $_.Description
+      Type = switch ($_.RestorePointType) { 0 {'Application Install'} 1 {'Application Uninstall'} 10 {'Device Install'} 12 {'Modify Settings'} 13 {'Cancel'} default {'Other'} }
+      Date = $_.ConvertToDateTime($_.CreationTime).ToString('yyyy-MM-dd HH:mm')
+    }
+  } | ConvertTo-Json -Depth 3 -Compress
+} catch {
+  Write-Output "RESTORE_ERROR:$($_.Exception.Message)"
+}`;
+
+			const result = await runPowerShell(ps, { timeout: 15000 });
+			if (result.stdout?.startsWith('RESTORE_ERROR:')) {
+				const msg = result.stdout.replace('RESTORE_ERROR:', '');
+				return { content: [{ type: 'text', text: `System Restore: ${msg || 'Requires elevation or System Restore is disabled.'}` }] };
+			}
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr || 'Requires elevation.'}` }], isError: true };
+			}
+			if (!result.stdout || result.stdout === '[]') {
+				return { content: [{ type: 'text', text: 'No restore points found (System Restore may be disabled or requires elevation).' }] };
+			}
+
+			const points = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+			const lines = points.map((p: { SequenceNumber: number; Description: string; Type: string; Date: string }) =>
+				`  #${p.SequenceNumber}  ${p.Date}  ${(p.Type || '').padEnd(20)}  ${p.Description}`,
+			);
+			return { content: [{ type: 'text', text: `System Restore points:\n${lines.join('\n')}` }] };
+		},
+	);
+
+	server.tool(
+		'windows_certificate_list',
+		'List certificates in the Windows certificate store.',
+		{
+			store: z.string().default('Cert:\\CurrentUser\\My').describe('Certificate store path'),
+			expiring_days: z.number().optional().describe('Only show certs expiring within N days'),
+			filter: z.string().optional().describe('Filter by subject (substring)'),
+		},
+		async ({ store, expiring_days, filter }) => {
+			const expiryFilter = expiring_days
+				? `| Where-Object { $_.NotAfter -lt (Get-Date).AddDays(${expiring_days}) -and $_.NotAfter -gt (Get-Date) }`
+				: '';
+			const nameFilter = filter
+				? `| Where-Object { $_.Subject -like '*${filter.replace(/'/g, "''")}*' }`
+				: '';
+
+			// Map store path to .NET enums
+			// Cert:\CurrentUser\My -> CurrentUser, My
+			const storeMatch = store.match(/Cert:\\\\?(CurrentUser|LocalMachine)\\\\?(\w+)/i);
+			const storeLocation = storeMatch ? storeMatch[1] : 'CurrentUser';
+			const storeName = storeMatch ? storeMatch[2] : 'My';
+
+			const ps = `
+$store = New-Object System.Security.Cryptography.X509Certificates.X509Store('${storeName}', '${storeLocation}')
+$store.Open('ReadOnly')
+$certs = $store.Certificates
+${expiring_days ? `$certs = $certs | Where-Object { $_.NotAfter -lt (Get-Date).AddDays(${expiring_days}) -and $_.NotAfter -gt (Get-Date) }` : ''}
+${filter ? `$certs = $certs | Where-Object { $_.Subject -like '*${filter.replace(/'/g, "''")}*' }` : ''}
+$certs | ForEach-Object {
+  [PSCustomObject]@{
+    Subject = $_.Subject
+    Issuer = $_.Issuer
+    Thumbprint = $_.Thumbprint
+    Expires = $_.NotAfter.ToString('yyyy-MM-dd')
+    KeyUsage = ($_.Extensions | Where-Object { $_ -is [System.Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension] } | ForEach-Object { ($_.EnhancedKeyUsages | ForEach-Object { $_.FriendlyName }) -join ', ' })
+  }
+} | ConvertTo-Json -Depth 3 -Compress
+$store.Close()`;
+
+			const result = await runPowerShell(ps, { timeout: 15000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+			if (!result.stdout) {
+				return { content: [{ type: 'text', text: 'No certificates found.' }] };
+			}
+
+			const certs = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+			const lines = certs.map((c: { Subject: string; Expires: string; Thumbprint: string; KeyUsage: string }) =>
+				`  ${c.Expires}  ${(c.Thumbprint || '').slice(0, 16)}...  ${(c.Subject || '').slice(0, 60)}`,
+			);
+
+			const header = `  ${'Expires'.padEnd(10)}  ${'Thumbprint'.padEnd(19)}  Subject`;
+			return { content: [{ type: 'text', text: `${store}\n${header}\n${'─'.repeat(90)}\n${lines.join('\n')}\n\n${certs.length} certificates` }] };
+		},
+	);
+
+	server.tool(
+		'windows_performance_monitor',
+		'Get real-time system performance: CPU per core, RAM, disk I/O, network throughput, top processes.',
+		{},
+		async () => {
+			const ps = `
+$cpu = Get-CimInstance Win32_Processor | Select-Object -First 1
+$os = Get-CimInstance Win32_OperatingSystem
+$cs = Get-CimInstance Win32_ComputerSystem
+$perfDisk = Get-CimInstance Win32_PerfFormattedData_PerfDisk_LogicalDisk -Filter "Name='_Total'" -ErrorAction SilentlyContinue
+$perfNet = Get-CimInstance Win32_PerfFormattedData_Tcpip_NetworkInterface -ErrorAction SilentlyContinue | Select-Object -First 1
+
+$topCPU = Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 | ForEach-Object {
+  [PSCustomObject]@{ Name = $_.ProcessName; PID = $_.Id; CPU = [math]::Round($_.CPU, 1); MemMB = [math]::Round($_.WorkingSet64 / 1MB, 1) }
+}
+$topMem = Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 5 | ForEach-Object {
+  [PSCustomObject]@{ Name = $_.ProcessName; PID = $_.Id; MemMB = [math]::Round($_.WorkingSet64 / 1MB, 1) }
+}
+
+[PSCustomObject]@{
+  CPUUsage = "$([math]::Round($cpu.LoadPercentage, 0))%"
+  CPUCores = $cpu.NumberOfLogicalProcessors
+  RAMTotalGB = [math]::Round($cs.TotalPhysicalMemory / 1GB, 1)
+  RAMUsedGB = [math]::Round(($cs.TotalPhysicalMemory - $os.FreePhysicalMemory * 1KB) / 1GB, 1)
+  RAMUsedPct = [math]::Round(($cs.TotalPhysicalMemory - $os.FreePhysicalMemory * 1KB) / $cs.TotalPhysicalMemory * 100, 1)
+  DiskReadBps = if ($perfDisk) { "$([math]::Round($perfDisk.DiskReadBytesPersec / 1MB, 2)) MB/s" } else { 'N/A' }
+  DiskWriteBps = if ($perfDisk) { "$([math]::Round($perfDisk.DiskWriteBytesPersec / 1MB, 2)) MB/s" } else { 'N/A' }
+  NetSentBps = if ($perfNet) { "$([math]::Round($perfNet.BytesSentPersec / 1MB, 2)) MB/s" } else { 'N/A' }
+  NetRecvBps = if ($perfNet) { "$([math]::Round($perfNet.BytesReceivedPersec / 1MB, 2)) MB/s" } else { 'N/A' }
+  TopCPU = $topCPU
+  TopMem = $topMem
+} | ConvertTo-Json -Depth 4 -Compress`;
+
+			const result = await runPowerShell(ps, { timeout: 30000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+
+			const p = JSON.parse(result.stdout);
+			const topCpu = Array.isArray(p.TopCPU) ? p.TopCPU : [p.TopCPU].filter(Boolean);
+			const topMem = Array.isArray(p.TopMem) ? p.TopMem : [p.TopMem].filter(Boolean);
+
+			return {
+				content: [{
+					type: 'text',
+					text: [
+						`CPU: ${p.CPUUsage} (${p.CPUCores} threads)`,
+						`RAM: ${p.RAMUsedGB}/${p.RAMTotalGB} GB (${p.RAMUsedPct}%)`,
+						`Disk: Read ${p.DiskReadBps} / Write ${p.DiskWriteBps}`,
+						`Net:  Send ${p.NetSentBps} / Recv ${p.NetRecvBps}`,
+						'',
+						'Top by CPU:',
+						...topCpu.map((t: { Name: string; PID: number; CPU: number; MemMB: number }) =>
+							`  ${String(t.PID).padStart(6)}  ${t.Name.padEnd(20)}  ${String(t.CPU).padStart(8)}s  ${String(t.MemMB).padStart(8)} MB`,
+						),
+						'',
+						'Top by Memory:',
+						...topMem.map((t: { Name: string; PID: number; MemMB: number }) =>
+							`  ${String(t.PID).padStart(6)}  ${t.Name.padEnd(20)}  ${String(t.MemMB).padStart(8)} MB`,
+						),
+					].join('\n'),
+				}],
+			};
+		},
+	);
+}

package/src/tools/netstat.ts

@@ -0,0 +1,72 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * Tool: windows_network_connections (#23)
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { runPowerShell } from '../shell.js';
+
+export function registerNetstatTools(server: McpServer): void {
+	server.tool(
+		'windows_network_connections',
+		'List active TCP/UDP network connections (like netstat). Shows local/remote address, state, and owning process.',
+		{
+			state: z.enum(['all', 'listen', 'established', 'time_wait', 'close_wait']).default('all').describe('Filter by state'),
+			port: z.number().optional().describe('Filter by port number'),
+			process_name: z.string().optional().describe('Filter by process name'),
+			limit: z.number().default(50).describe('Max results'),
+		},
+		async ({ state, port, process_name, limit }) => {
+			const stateMap: Record<string, string> = {
+				listen: "| Where-Object { $_.State -eq 'Listen' }",
+				established: "| Where-Object { $_.State -eq 'Established' }",
+				time_wait: "| Where-Object { $_.State -eq 'TimeWait' }",
+				close_wait: "| Where-Object { $_.State -eq 'CloseWait' }",
+				all: '',
+			};
+
+			const portFilter = port
+				? `| Where-Object { $_.LocalPort -eq ${port} -or $_.RemotePort -eq ${port} }`
+				: '';
+
+			const procFilter = process_name
+				? `| Where-Object { $procName -like '*${process_name.replace(/'/g, "''")}*' }`
+				: '';
+
+			const ps = `
+Get-NetTCPConnection -ErrorAction SilentlyContinue ${stateMap[state]} ${portFilter} | ForEach-Object {
+  $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
+  $procName = if ($proc) { $proc.ProcessName } else { '?' }
+  [PSCustomObject]@{
+    Proto = 'TCP'
+    LocalAddr = "$($_.LocalAddress):$($_.LocalPort)"
+    RemoteAddr = "$($_.RemoteAddress):$($_.RemotePort)"
+    State = $_.State.ToString()
+    PID = $_.OwningProcess
+    Process = $procName
+  }
+} ${procFilter} | Select-Object -First ${limit} | ConvertTo-Json -Depth 3 -Compress`;
+
+			const result = await runPowerShell(ps, { timeout: 15000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+
+			if (!result.stdout) {
+				return { content: [{ type: 'text', text: 'No connections found.' }] };
+			}
+
+			const conns = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+			const lines = conns.map((c: { Proto: string; LocalAddr: string; RemoteAddr: string; State: string; PID: number; Process: string }) =>
+				`${c.Proto}  ${c.LocalAddr.padEnd(22)}  ${c.RemoteAddr.padEnd(22)}  ${c.State.padEnd(12)}  ${String(c.PID).padStart(6)}  ${c.Process}`,
+			);
+
+			const header = `Proto  ${'Local Address'.padEnd(22)}  ${'Remote Address'.padEnd(22)}  ${'State'.padEnd(12)}  ${'PID'.padStart(6)}  Process`;
+			return {
+				content: [{ type: 'text', text: `${header}\n${'─'.repeat(100)}\n${lines.join('\n')}\n\n${conns.length} connections` }],
+			};
+		},
+	);
+}