@mokoconsulting/mcp-windows 3.0.0

package/src/tools/registry.ts

@@ -0,0 +1,165 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * Tools: windows_registry_read (#29), windows_registry_write (#30)
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { runPowerShell } from '../shell.js';
+
+function expandHive(path: string): string {
+	return path
+		.replace(/^HKLM[:\\\/]/i, 'HKLM:\\')
+		.replace(/^HKCU[:\\\/]/i, 'HKCU:\\')
+		.replace(/^HKCR[:\\\/]/i, 'HKCR:\\')
+		.replace(/^HKU[:\\\/]/i, 'HKU:\\')
+		.replace(/^HKCC[:\\\/]/i, 'HKCC:\\');
+}
+
+export function registerRegistryTools(server: McpServer): void {
+	server.tool(
+		'windows_registry_read',
+		'Read Windows Registry keys, subkeys, and values. Supports HKLM, HKCU, HKCR abbreviations.',
+		{
+			path: z.string().describe('Registry path (e.g. "HKCU:\\Software\\Microsoft")'),
+			value: z.string().optional().describe('Specific value name to read (omit to list all values)'),
+			subkeys: z.boolean().default(false).describe('List subkeys instead of values'),
+		},
+		async ({ path, value, subkeys }) => {
+			const regPath = expandHive(path);
+
+			if (subkeys) {
+				const ps = `
+Get-ChildItem -Path '${regPath.replace(/'/g, "''")}' -ErrorAction Stop | ForEach-Object {
+  [PSCustomObject]@{
+    Name = $_.PSChildName
+    SubKeyCount = $_.SubKeyCount
+    ValueCount = $_.ValueCount
+  }
+} | ConvertTo-Json -Depth 3 -Compress`;
+
+				const result = await runPowerShell(ps, { timeout: 10000 });
+				if (result.exitCode !== 0) {
+					return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+				}
+				if (!result.stdout) {
+					return { content: [{ type: 'text', text: 'No subkeys found.' }] };
+				}
+
+				const keys = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+				const lines = keys.map((k: { Name: string; SubKeyCount: number; ValueCount: number }) =>
+					`  ${k.Name.padEnd(40)}  ${k.SubKeyCount} subkeys, ${k.ValueCount} values`,
+				);
+				return { content: [{ type: 'text', text: `${regPath}\n${'─'.repeat(70)}\n${lines.join('\n')}` }] };
+			}
+
+			if (value) {
+				const ps = `
+$v = Get-ItemProperty -Path '${regPath.replace(/'/g, "''")}' -Name '${value.replace(/'/g, "''")}' -ErrorAction Stop
+$raw = $v.'${value.replace(/'/g, "''")}'
+$kind = (Get-Item -Path '${regPath.replace(/'/g, "''")}' -ErrorAction Stop).GetValueKind('${value.replace(/'/g, "''")}')
+[PSCustomObject]@{
+  Name = '${value.replace(/'/g, "''")}'
+  Type = $kind.ToString()
+  Value = $raw
+} | ConvertTo-Json -Depth 3 -Compress`;
+
+				const result = await runPowerShell(ps, { timeout: 10000 });
+				if (result.exitCode !== 0) {
+					return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+				}
+				const v = JSON.parse(result.stdout);
+				return { content: [{ type: 'text', text: `${regPath}\\${v.Name}\nType: ${v.Type}\nValue: ${JSON.stringify(v.Value)}` }] };
+			}
+
+			// List all values
+			const ps = `
+$key = Get-Item -Path '${regPath.replace(/'/g, "''")}' -ErrorAction Stop
+$key.GetValueNames() | ForEach-Object {
+  $name = $_
+  $val = $key.GetValue($name)
+  $kind = $key.GetValueKind($name)
+  [PSCustomObject]@{
+    Name = if ($name) { $name } else { '(Default)' }
+    Type = $kind.ToString()
+    Value = $val
+  }
+} | ConvertTo-Json -Depth 3 -Compress`;
+
+			const result = await runPowerShell(ps, { timeout: 10000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+			if (!result.stdout) {
+				return { content: [{ type: 'text', text: 'No values found.' }] };
+			}
+
+			const values = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+			const lines = values.map((v: { Name: string; Type: string; Value: unknown }) => {
+				const valStr = typeof v.Value === 'string' ? v.Value : JSON.stringify(v.Value);
+				return `  ${v.Name.padEnd(30)}  ${v.Type.padEnd(12)}  ${valStr.slice(0, 60)}`;
+			});
+
+			const header = `  ${'Name'.padEnd(30)}  ${'Type'.padEnd(12)}  Value`;
+			return { content: [{ type: 'text', text: `${regPath}\n${header}\n${'─'.repeat(80)}\n${lines.join('\n')}` }] };
+		},
+	);
+
+	server.tool(
+		'windows_registry_write',
+		'Write Windows Registry values. Restricted to HKCU by default. Use hklm_override for HKLM writes.',
+		{
+			path: z.string().describe('Registry path'),
+			name: z.string().describe('Value name'),
+			value: z.string().describe('Value data'),
+			type: z.enum(['String', 'DWord', 'QWord', 'Binary', 'ExpandString', 'MultiString']).default('String').describe('Value type'),
+			hklm_override: z.boolean().default(false).describe('Allow writing to HKLM (requires elevation)'),
+			action: z.enum(['set', 'delete', 'create_key', 'delete_key']).default('set').describe('Action'),
+		},
+		async ({ path, name, value, type, hklm_override, action }) => {
+			const regPath = expandHive(path);
+
+			// Safety check
+			if (regPath.startsWith('HKLM:') && !hklm_override) {
+				return {
+					content: [{ type: 'text', text: 'HKLM writes are restricted. Set hklm_override=true and ensure elevation.' }],
+					isError: true,
+				};
+			}
+
+			let ps: string;
+
+			switch (action) {
+				case 'set': {
+					const typeMap: Record<string, string> = {
+						String: 'String', DWord: 'DWord', QWord: 'QWord',
+						Binary: 'Binary', ExpandString: 'ExpandString', MultiString: 'MultiString',
+					};
+					ps = `
+if (-not (Test-Path '${regPath.replace(/'/g, "''")}')) {
+  New-Item -Path '${regPath.replace(/'/g, "''")}' -Force | Out-Null
+}
+Set-ItemProperty -Path '${regPath.replace(/'/g, "''")}' -Name '${name.replace(/'/g, "''")}' -Value '${value.replace(/'/g, "''")}' -Type ${typeMap[type]} -ErrorAction Stop
+"Set ${regPath}\\${name} = ${value} (${type})"`;
+					break;
+				}
+				case 'delete':
+					ps = `Remove-ItemProperty -Path '${regPath.replace(/'/g, "''")}' -Name '${name.replace(/'/g, "''")}' -ErrorAction Stop; "Deleted ${regPath}\\${name}"`;
+					break;
+				case 'create_key':
+					ps = `New-Item -Path '${regPath.replace(/'/g, "''")}' -Force -ErrorAction Stop | Out-Null; "Created key ${regPath}"`;
+					break;
+				case 'delete_key':
+					ps = `Remove-Item -Path '${regPath.replace(/'/g, "''")}' -Recurse -Force -ErrorAction Stop; "Deleted key ${regPath}"`;
+					break;
+			}
+
+			const result = await runPowerShell(ps, { timeout: 10000 });
+			return {
+				content: [{ type: 'text', text: result.stdout || result.stderr }],
+				isError: result.exitCode !== 0,
+			};
+		},
+	);
+}

package/src/tools/scheduler.ts

@@ -0,0 +1,140 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * Tools: windows_task_scheduler_list (#27), windows_task_scheduler_manage (#28)
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { runPowerShell } from '../shell.js';
+
+export function registerSchedulerTools(server: McpServer): void {
+	server.tool(
+		'windows_task_scheduler_list',
+		'List Windows Task Scheduler tasks with status, last/next run, and trigger type.',
+		{
+			folder: z.string().default('\\').describe('Task folder path (e.g. "\\" for root, "\\Microsoft\\")'),
+			filter: z.string().optional().describe('Filter by task name (substring)'),
+		},
+		async ({ folder, filter }) => {
+			const filterClause = filter
+				? `| Where-Object { $_.TaskName -like '*${filter.replace(/'/g, "''")}*' }`
+				: '';
+
+			const ps = `
+Get-ScheduledTask -TaskPath '${folder.replace(/'/g, "''")}*' -ErrorAction SilentlyContinue ${filterClause} | ForEach-Object {
+  $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
+  [PSCustomObject]@{
+    Name = $_.TaskName
+    Path = $_.TaskPath
+    State = $_.State.ToString()
+    LastRun = if ($info.LastRunTime -and $info.LastRunTime.Year -gt 1999) { $info.LastRunTime.ToString('yyyy-MM-dd HH:mm') } else { 'Never' }
+    NextRun = if ($info.NextRunTime -and $info.NextRunTime.Year -gt 1999) { $info.NextRunTime.ToString('yyyy-MM-dd HH:mm') } else { 'N/A' }
+    LastResult = if ($info) { '0x{0:X}' -f $info.LastTaskResult } else { 'N/A' }
+    Triggers = ($_.Triggers | ForEach-Object { $_.CimClass.CimClassName -replace 'MSFT_Task',''-replace 'Trigger','' }) -join ', '
+  }
+} | ConvertTo-Json -Depth 3 -Compress`;
+
+			const result = await runPowerShell(ps, { timeout: 30000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+
+			if (!result.stdout) {
+				return { content: [{ type: 'text', text: 'No tasks found.' }] };
+			}
+
+			const tasks = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+			const lines = tasks.map((t: { Name: string; State: string; LastRun: string; NextRun: string; Triggers: string }) => {
+				const state = t.State === 'Ready' ? '[RDY]' : t.State === 'Running' ? '[RUN]' : t.State === 'Disabled' ? '[OFF]' : `[${t.State.slice(0, 3).toUpperCase()}]`;
+				return `${state}  ${t.Name.padEnd(40).slice(0, 40)}  ${t.LastRun.padEnd(16)}  ${t.NextRun.padEnd(16)}  ${t.Triggers}`;
+			});
+
+			const header = `State  ${'Name'.padEnd(40)}  ${'Last Run'.padEnd(16)}  ${'Next Run'.padEnd(16)}  Triggers`;
+			return {
+				content: [{ type: 'text', text: `${header}\n${'─'.repeat(110)}\n${lines.join('\n')}\n\n${tasks.length} tasks` }],
+			};
+		},
+	);
+
+	server.tool(
+		'windows_task_scheduler_manage',
+		'Create, delete, enable, disable, or run a scheduled task.',
+		{
+			action: z.enum(['create', 'delete', 'enable', 'disable', 'run']).describe('Action to perform'),
+			name: z.string().describe('Task name'),
+			command: z.string().optional().describe('Command to execute (for create)'),
+			arguments: z.string().optional().describe('Command arguments (for create)'),
+			trigger: z.enum(['once', 'daily', 'weekly', 'hourly', 'logon', 'startup']).optional().describe('Trigger type (for create)'),
+			time: z.string().optional().describe('Time for trigger as HH:mm (for create with once/daily/weekly)'),
+			interval: z.number().optional().describe('Repetition interval in minutes (for create with hourly)'),
+		},
+		async ({ action, name, command, arguments: args, trigger, time, interval }) => {
+			let ps: string;
+
+			switch (action) {
+				case 'run':
+					ps = `Start-ScheduledTask -TaskName '${name.replace(/'/g, "''")}' -ErrorAction Stop; "Task '${name}' started"`;
+					break;
+				case 'enable':
+					ps = `Enable-ScheduledTask -TaskName '${name.replace(/'/g, "''")}' -ErrorAction Stop | Select-Object TaskName,State | ConvertTo-Json -Compress`;
+					break;
+				case 'disable':
+					ps = `Disable-ScheduledTask -TaskName '${name.replace(/'/g, "''")}' -ErrorAction Stop | Select-Object TaskName,State | ConvertTo-Json -Compress`;
+					break;
+				case 'delete':
+					ps = `Unregister-ScheduledTask -TaskName '${name.replace(/'/g, "''")}' -Confirm:$false -ErrorAction Stop; "Task '${name}' deleted"`;
+					break;
+				case 'create': {
+					if (!command) {
+						return { content: [{ type: 'text', text: 'Create requires command.' }], isError: true };
+					}
+					if (!trigger) {
+						return { content: [{ type: 'text', text: 'Create requires trigger type.' }], isError: true };
+					}
+
+					const actionPart = args
+						? `$action = New-ScheduledTaskAction -Execute '${command.replace(/'/g, "''")}' -Argument '${args.replace(/'/g, "''")}'`
+						: `$action = New-ScheduledTaskAction -Execute '${command.replace(/'/g, "''")}'`;
+
+					let triggerPart: string;
+					switch (trigger) {
+						case 'once':
+							triggerPart = `$trigger = New-ScheduledTaskTrigger -Once -At '${time || '00:00'}'`;
+							break;
+						case 'daily':
+							triggerPart = `$trigger = New-ScheduledTaskTrigger -Daily -At '${time || '00:00'}'`;
+							break;
+						case 'weekly':
+							triggerPart = `$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Monday -At '${time || '00:00'}'`;
+							break;
+						case 'hourly':
+							triggerPart = `$trigger = New-ScheduledTaskTrigger -Once -At '00:00' -RepetitionInterval (New-TimeSpan -Minutes ${interval || 60}) -RepetitionDuration (New-TimeSpan -Days 9999)`;
+							break;
+						case 'logon':
+							triggerPart = `$trigger = New-ScheduledTaskTrigger -AtLogOn`;
+							break;
+						case 'startup':
+							triggerPart = `$trigger = New-ScheduledTaskTrigger -AtStartup`;
+							break;
+					}
+
+					ps = `
+${actionPart}
+${triggerPart}
+$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
+Register-ScheduledTask -TaskName '${name.replace(/'/g, "''")}' -Action $action -Trigger $trigger -Settings $settings -Force -ErrorAction Stop |
+  Select-Object TaskName,State | ConvertTo-Json -Compress`;
+					break;
+				}
+			}
+
+			const result = await runPowerShell(ps, { timeout: 15000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+
+			return { content: [{ type: 'text', text: result.stdout }] };
+		},
+	);
+}

package/src/tools/service.ts

@@ -0,0 +1,102 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * Tools: windows_service_list (#4), windows_service_control (#5)
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { runPowerShell } from '../shell.js';
+
+export function registerServiceTools(server: McpServer): void {
+	server.tool(
+		'windows_service_list',
+		'List Windows services with status, startup type, and description.',
+		{
+			filter: z.string().optional().describe('Filter by service name or display name (substring)'),
+			status: z.enum(['running', 'stopped', 'all']).default('all').describe('Filter by status'),
+		},
+		async ({ filter, status }) => {
+			const filterClause = filter
+				? `| Where-Object { $_.Name -like '*${filter.replace(/'/g, "''") }*' -or $_.DisplayName -like '*${filter.replace(/'/g, "''")}*' }`
+				: '';
+			const statusClause = status === 'running'
+				? `| Where-Object { $_.Status -eq 'Running' }`
+				: status === 'stopped'
+					? `| Where-Object { $_.Status -eq 'Stopped' }`
+					: '';
+
+			const ps = `
+$wmiCache = @{}
+Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | ForEach-Object { $wmiCache[$_.Name] = $_.Description }
+Get-Service ${filterClause} ${statusClause} | Sort-Object DisplayName | ForEach-Object {
+  [PSCustomObject]@{
+    Name = $_.Name
+    DisplayName = $_.DisplayName
+    Status = $_.Status.ToString()
+    StartType = $_.StartType.ToString()
+    Description = if ($wmiCache[$_.Name]) { $wmiCache[$_.Name] } else { '' }
+  }
+} | ConvertTo-Json -Depth 3 -Compress`;
+
+			const result = await runPowerShell(ps, { timeout: 45000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+
+			if (!result.stdout) {
+				return { content: [{ type: 'text', text: 'No services found.' }] };
+			}
+
+			const services = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+			const lines = services.map((s: { Name: string; DisplayName: string; Status: string; StartType: string }) =>
+				`${s.Status === 'Running' ? '[RUN]' : '[STP]'}  ${s.StartType.padEnd(10)}  ${s.Name.padEnd(35).slice(0, 35)}  ${s.DisplayName}`,
+			);
+
+			const header = `${'State'.padEnd(5)}  ${'Startup'.padEnd(10)}  ${'Name'.padEnd(35)}  Display Name`;
+			return {
+				content: [{ type: 'text', text: `${header}\n${'─'.repeat(100)}\n${lines.join('\n')}\n\n${services.length} services` }],
+			};
+		},
+	);
+
+	server.tool(
+		'windows_service_control',
+		'Start, stop, restart, or change startup type of a Windows service.',
+		{
+			name: z.string().describe('Service name or display name'),
+			action: z.enum(['start', 'stop', 'restart', 'enable', 'disable']).describe('Action to perform'),
+		},
+		async ({ name, action }) => {
+			let ps: string;
+
+			switch (action) {
+				case 'start':
+					ps = `Start-Service -Name '${name.replace(/'/g, "''")}' -ErrorAction Stop; Get-Service -Name '${name.replace(/'/g, "''")}' | Select-Object Name,Status,StartType | ConvertTo-Json -Compress`;
+					break;
+				case 'stop':
+					ps = `Stop-Service -Name '${name.replace(/'/g, "''")}' -Force -ErrorAction Stop; Get-Service -Name '${name.replace(/'/g, "''")}' | Select-Object Name,Status,StartType | ConvertTo-Json -Compress`;
+					break;
+				case 'restart':
+					ps = `Restart-Service -Name '${name.replace(/'/g, "''")}' -Force -ErrorAction Stop; Get-Service -Name '${name.replace(/'/g, "''")}' | Select-Object Name,Status,StartType | ConvertTo-Json -Compress`;
+					break;
+				case 'enable':
+					ps = `Set-Service -Name '${name.replace(/'/g, "''")}' -StartupType Automatic -ErrorAction Stop; Get-Service -Name '${name.replace(/'/g, "''")}' | Select-Object Name,Status,StartType | ConvertTo-Json -Compress`;
+					break;
+				case 'disable':
+					ps = `Set-Service -Name '${name.replace(/'/g, "''")}' -StartupType Disabled -ErrorAction Stop; Get-Service -Name '${name.replace(/'/g, "''")}' | Select-Object Name,Status,StartType | ConvertTo-Json -Compress`;
+					break;
+			}
+
+			const result = await runPowerShell(ps, { timeout: 15000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+
+			const svc = JSON.parse(result.stdout);
+			return {
+				content: [{ type: 'text', text: `Service "${svc.Name}": ${action} → Status: ${svc.Status}, StartType: ${svc.StartType}` }],
+			};
+		},
+	);
+}

package/src/tools/startup.ts

@@ -0,0 +1,180 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * Tools: windows_startup_list (#33), windows_startup_manage (#34)
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { runPowerShell } from '../shell.js';
+
+export function registerStartupTools(server: McpServer): void {
+	server.tool(
+		'windows_startup_list',
+		'List all startup items from registry (Run/RunOnce), startup folder, and scheduled logon tasks.',
+		{},
+		async () => {
+			const ps = `
+$items = [System.Collections.Generic.List[PSObject]]::new()
+
+# Registry: HKCU Run
+$regPaths = @(
+  @{ Path = 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'; Scope = 'User'; Source = 'Registry Run' }
+  @{ Path = 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'; Scope = 'User'; Source = 'Registry RunOnce' }
+  @{ Path = 'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'; Scope = 'System'; Source = 'Registry Run' }
+  @{ Path = 'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'; Scope = 'System'; Source = 'Registry RunOnce' }
+)
+
+foreach ($rp in $regPaths) {
+  if (Test-Path $rp.Path) {
+    $props = Get-ItemProperty -Path $rp.Path -ErrorAction SilentlyContinue
+    if ($props) {
+      $props.PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object {
+        $items.Add([PSCustomObject]@{
+          Name = $_.Name
+          Command = $_.Value
+          Source = $rp.Source
+          Scope = $rp.Scope
+          Enabled = $true
+        })
+      }
+    }
+  }
+}
+
+# Startup folder
+$userStartup = [Environment]::GetFolderPath('Startup')
+$commonStartup = [Environment]::GetFolderPath('CommonStartup')
+foreach ($folder in @(@{Path=$userStartup;Scope='User'}, @{Path=$commonStartup;Scope='System'})) {
+  if (Test-Path $folder.Path) {
+    Get-ChildItem -Path $folder.Path -File -ErrorAction SilentlyContinue | ForEach-Object {
+      $items.Add([PSCustomObject]@{
+        Name = $_.BaseName
+        Command = $_.FullName
+        Source = 'Startup Folder'
+        Scope = $folder.Scope
+        Enabled = $true
+      })
+    }
+  }
+}
+
+# Scheduled tasks at logon
+Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
+  $_.Triggers | Where-Object { $_ -is [CimInstance] -and $_.CimClass.CimClassName -eq 'MSFT_TaskLogonTrigger' }
+} | ForEach-Object {
+  $items.Add([PSCustomObject]@{
+    Name = $_.TaskName
+    Command = ($_.Actions | ForEach-Object { $_.Execute }) -join ' '
+    Source = 'Task Scheduler (Logon)'
+    Scope = 'System'
+    Enabled = $_.State -eq 'Ready'
+  })
+}
+
+$items | ConvertTo-Json -Depth 3 -Compress`;
+
+			const result = await runPowerShell(ps, { timeout: 20000 });
+			if (result.exitCode !== 0) {
+				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
+			}
+
+			if (!result.stdout) {
+				return { content: [{ type: 'text', text: 'No startup items found.' }] };
+			}
+
+			const items = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
+			const lines = items.map((i: { Name: string; Command: string; Source: string; Scope: string; Enabled: boolean }) => {
+				const status = i.Enabled ? '[ON] ' : '[OFF]';
+				return `${status}  ${i.Scope.padEnd(6)}  ${i.Source.padEnd(24)}  ${i.Name.padEnd(30).slice(0, 30)}  ${(i.Command || '').slice(0, 50)}`;
+			});
+
+			const header = `State  ${'Scope'.padEnd(6)}  ${'Source'.padEnd(24)}  ${'Name'.padEnd(30)}  Command`;
+			return {
+				content: [{ type: 'text', text: `${header}\n${'─'.repeat(110)}\n${lines.join('\n')}\n\n${items.length} startup items` }],
+			};
+		},
+	);
+
+	server.tool(
+		'windows_startup_manage',
+		'Add, remove, enable, or disable a startup item.',
+		{
+			action: z.enum(['add', 'remove', 'enable', 'disable']).describe('Action'),
+			name: z.string().describe('Startup item name'),
+			command: z.string().optional().describe('Command to run at startup (for add)'),
+			location: z.enum(['registry', 'startup_folder']).default('registry').describe('Where to add (for add)'),
+		},
+		async ({ action, name, command, location }) => {
+			let ps: string;
+
+			switch (action) {
+				case 'add':
+					if (!command) {
+						return { content: [{ type: 'text', text: 'Add requires a command.' }], isError: true };
+					}
+					if (location === 'startup_folder') {
+						ps = `
+$startupPath = [Environment]::GetFolderPath('Startup')
+$shortcutPath = Join-Path $startupPath '${name.replace(/'/g, "''")}.lnk'
+$ws = New-Object -ComObject WScript.Shell
+$sc = $ws.CreateShortcut($shortcutPath)
+$sc.TargetPath = '${command.replace(/'/g, "''")}'
+$sc.Save()
+"Added startup shortcut: $shortcutPath"`;
+					} else {
+						ps = `
+Set-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '${name.replace(/'/g, "''")}' -Value '${command.replace(/'/g, "''")}' -ErrorAction Stop
+"Added to HKCU Run: ${name}"`;
+					}
+					break;
+
+				case 'remove':
+					ps = `
+$removed = $false
+# Try registry
+$regPath = 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'
+if ((Get-ItemProperty -Path $regPath -Name '${name.replace(/'/g, "''")}' -ErrorAction SilentlyContinue)) {
+  Remove-ItemProperty -Path $regPath -Name '${name.replace(/'/g, "''")}' -ErrorAction Stop
+  $removed = $true
+}
+# Try startup folder
+$startupPath = [Environment]::GetFolderPath('Startup')
+$lnk = Join-Path $startupPath '${name.replace(/'/g, "''")}.lnk'
+if (Test-Path $lnk) { Remove-Item $lnk -Force; $removed = $true }
+if ($removed) { "Removed: ${name}" } else { "Not found: ${name}" }`;
+					break;
+
+				case 'disable':
+					ps = `
+$regPath = 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'
+$val = (Get-ItemProperty -Path $regPath -Name '${name.replace(/'/g, "''")}' -ErrorAction SilentlyContinue).'${name.replace(/'/g, "''")}'
+if ($val) {
+  Remove-ItemProperty -Path $regPath -Name '${name.replace(/'/g, "''")}' -ErrorAction Stop
+  $disabledPath = 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run_Disabled'
+  if (-not (Test-Path $disabledPath)) { New-Item -Path $disabledPath -Force | Out-Null }
+  Set-ItemProperty -Path $disabledPath -Name '${name.replace(/'/g, "''")}' -Value $val
+  "Disabled: ${name}"
+} else { "Not found in registry Run: ${name}" }`;
+					break;
+
+				case 'enable':
+					ps = `
+$disabledPath = 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run_Disabled'
+$val = (Get-ItemProperty -Path $disabledPath -Name '${name.replace(/'/g, "''")}' -ErrorAction SilentlyContinue).'${name.replace(/'/g, "''")}'
+if ($val) {
+  Set-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '${name.replace(/'/g, "''")}' -Value $val
+  Remove-ItemProperty -Path $disabledPath -Name '${name.replace(/'/g, "''")}' -ErrorAction SilentlyContinue
+  "Enabled: ${name}"
+} else { "Not found in disabled items: ${name}" }`;
+					break;
+			}
+
+			const result = await runPowerShell(ps, { timeout: 10000 });
+			return {
+				content: [{ type: 'text', text: result.stdout || result.stderr }],
+				isError: result.exitCode !== 0,
+			};
+		},
+	);
+}