Loading ToolBench
MCP server that wraps the Hayabusa Windows event log forensic timeline tool
Strong tool definitions with consistent naming (verb_noun pattern), comprehensive descriptions (avg 180 chars), and well-structured JSON schemas. All 15 tools have input schemas with typed parameters and descriptions. Output schemas are documented via docstrings. Key gaps: no enum constraints on string parameters (profile, min_level, output_format), missing error recovery guidance, no tool annotations (readOnlyHint/destructiveHint), and limited parameter validation hints. Composition is sound, tools are single-purpose and chainable. Security is adequate (no secrets exposed). Descriptions are LLM-friendly but could be more concise (some exceed 200 chars). Baseline: 549 production tools avg 194 chars description, 100% A+ tools have docstrings, this server meets that bar.
List available Hayabusa detection rules (the installed rule catalog). Unlike other tools here, this reads the Sigma rule YAML files directly from hayabusa's local rules directory instead of shelling out to hayabusa -- hayabusa has no subcommand that lists its full rule catalog, only rules that actually fired during a scan.
Count events per computer name across .evtx file(s).
Find likely domain controllers and file servers from .evtx event logs. Detects domain controllers via Security EID 4768 (Kerberos TGT requests, only logged by DCs) and file servers via Security EID 5145 (network share access, excluding the universal IPC$ share). Unlike other tools here, hayabusa has no file-output option for this subcommand and normally asks an interactive yes/no question about saving each found category to its local config. That prompt can't be answered non-interactively, so on a hit this call may take close to its timeout to return; when it does, prompt_interrupted will be true in the result and any category not present in "categories" was never reached, not confirmed as empty.
Run hayabusa csv-timeline over an .evtx file or a directory of them. Produces a detection timeline and returns up to max_rows result rows plus the total row count so large results stay bounded.
String parameters lack enum constraints. 'profile', 'min_level', and 'output_format' accept free-form strings instead of enums, inviting hallucinated values. LLMs cannot validate against undeclared options.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All tools are READ_ONLY except hayabusa_update_rules (WRITE), but this is not declared in the MCP schema. Agents cannot distinguish safe from risky operations.
Error handling lacks recovery guidance. No tool documents what to do on failure (e.g., 'If hayabusa binary not found, check HAYABUSA_BIN env var'). Agents receive errors but no actionable next steps.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | 2026-07-28+ | v2 |
Count event occurrences by Event ID across .evtx file(s).
Extract and decode base64-encoded strings found in .evtx event fields. Useful for catching obfuscated PowerShell/command-line payloads.
Run hayabusa json-timeline over an .evtx file or a directory of them. Same behavior as hayabusa_csv_timeline but returns structured JSON detection records instead of CSV rows.
List the output profiles available in this hayabusa installation.
Output evtx file metadata (channels, event count, date range, etc.).
Summarize successful and failed logon events across .evtx file(s). Returns two bounded result sets, "successful" and "failed", each with its own total_rows/returned_rows/truncated/rows.
Extract pivot keywords (users, computers, IPs, etc.) from .evtx file(s). Returns a dict of category name -> bounded keyword list, e.g. "Users", "IP Addresses", "Processes", "Command Lines" (categories come from hayabusa's pivot_keywords.txt config).
Search .evtx event records for one or more keywords or regex patterns.
Download or update hayabusa's Sigma detection rule set.
Get the installed hayabusa binary's version string.
Run a high-level first-pass scan of an .evtx file or directory. A convenience tool that combines hayabusa_log_metrics, hayabusa_csv_timeline (filtered by min_level), and hayabusa_eid_metrics into one call, plus a compact "summary" section, so a first look at a target doesn't require several separate tool calls.
Parameter descriptions lack format/constraint hints. 'target' accepts file or directory paths but does not specify validation (e.g., 'must exist', 'must be .evtx or directory of .evtx'). LLMs may pass invalid paths.
Output schemas not formally documented in JSON Schema. Docstrings describe return structure (e.g., 'dict of category -> bounded keyword list') but no explicit schema definition. Agents must infer structure from text.