Microsoft's ETW MCP: Copilot Now Reads Windows Traces (2026)
Microsoft just released ETW MCP, a preview tool that lets Copilot and other AI assistants read Windows performance traces in plain English. Here is what it means for you, explained without jargon.
📰 What Happened: Microsoft Released ETW MCP
In early August 2026, Microsoft's Performance and Diagnostics team announced ETW MCP, a preview tool that connects AI assistants to Windows performance data. ETW stands for Event Tracing for Windows, the built-in system that records what your PC is doing under the hood: which programs use the CPU, what the disk is busy with, and why something froze for three seconds.
Until now, reading those trace files (called ETL files) required specialist tools like Windows Performance Analyzer and years of experience. ETW MCP changes that. It is an MCP server, meaning it speaks the Model Context Protocol, an open standard that lets AI assistants safely use external tools. Plug it into GitHub Copilot, Claude, or any MCP-compatible assistant, and you can ask questions like 'which process used the most CPU in this trace?' in normal English.
Microsoft shipped the preview as a NuGet package called Microsoft.Windows.EventTracing.MCP, and it runs headless, meaning it works in a plain terminal without any special app. BetaNews, Neowin, and Windows Report all covered the release, with Neowin framing it as part of Microsoft's broader push to make Windows 11 faster through better diagnostics.
✈️ ETW in Plain English: Your PC's Flight Recorder
Think of ETW as the flight recorder inside every Windows PC. It quietly logs thousands of events per second: app launches, disk reads, network calls, and CPU spikes. When something goes wrong, that recording holds the answer.
The problem has always been reading the recording. A single trace file can contain millions of events, and making sense of them required dedicated software plus the kind of expertise that mostly lives inside Microsoft and large engineering teams. That is why 'my laptop is slow' has stayed an unsolved mystery for most people, even though the evidence was sitting right there on the machine.
ETW MCP acts as a translator between that raw recording and an AI assistant. Importantly, Microsoft says the tool does not stream raw trace events to the AI model. Instead, the server processes the trace locally and returns summarized answers, which matters for privacy since traces can reveal a lot about what runs on your machine.
What questions can the AI actually answer?
Based on Microsoft's announcement, the preview handles questions like: which processes consumed the most CPU time, what a specific thread was doing, where the critical path of a slowdown was, and how two traces compare. That last one is useful for before-and-after checks, such as comparing your PC before and after installing new software.
💡 Why It Matters Even If You Never Write Code
If you are a solopreneur or knowledge worker, you will probably never install ETW MCP yourself. So why care? Because this is a preview of how your computer problems get solved from now on.
First, the direct effect: the developers who build the apps you rely on can now diagnose performance problems dramatically faster. When a small SaaS team can ask an AI 'why does our app freeze on startup?' and get an answer in minutes instead of days, bugs get fixed faster and the software you pay for gets smoother.
Second, the pattern: Microsoft is wiring its deepest system internals into AI assistants through MCP, the same open protocol used by Anthropic's Claude models (such as Claude Sonnet 4.6) and OpenAI-powered tools. In 2026, MCP has become the USB port of the AI world: one standard plug that lets any assistant use any tool. ETW MCP is Microsoft betting that even something as gnarly as kernel-level tracing belongs behind that plug.
Third, the trajectory: today this is a developer preview in a terminal. The obvious next step is consumer-facing. Imagine telling Copilot on Windows 11 'my laptop has been slow since Tuesday, figure out why' and getting a real diagnosis instead of generic advice to restart. ETW MCP is the plumbing that makes that future plausible.
⚖️ Old Way vs. ETW MCP Way: What Actually Changes
The clearest way to see the shift is to compare how a Windows performance investigation worked before this release with how it works now. The task itself has not changed; the skill required to do it has collapsed.
Note what stays the same, too: you still need to capture a trace first, the tool is still a preview, and complex investigations still benefit from human expertise. ETW MCP lowers the floor; it does not remove the ceiling.
| Step | Before (traditional) | Now (with ETW MCP) |
|---|---|---|
| Open a trace | Load ETL file in Windows Performance Analyzer | Point your AI assistant at the file |
| Find the problem | Manually dig through charts and stacks | Ask 'what caused the slowdown?' in English |
| Compare two traces | Side-by-side manual analysis, often hours | Ask the assistant to compare them |
| Skill required | Deep ETW expertise, rare and expensive | Ability to ask a clear question |
| Where it runs | Dedicated GUI tools | Headless, in any terminal, via MCP |
🛠️ How to Try ETW MCP Today
The preview is aimed at developers, but if you are comfortable following instructions, you can try it now. Fair warning: this involves a terminal. If that is not your thing, the practical action is simply to know this exists and watch for it to surface inside Copilot on Windows.
Start with Microsoft's official announcement on the Performance and Diagnostics blog at devblogs.microsoft.com, which walks through setup. The short version: you install the Microsoft.Windows.EventTracing.MCP package from NuGet, register it as an MCP server with your AI assistant of choice (GitHub Copilot in VS Code is the most common pairing), capture or grab an existing ETL trace, and start asking questions.
If you are non-technical, here is your lighter-weight action plan for today instead: bookmark the announcement, and next time an app you depend on feels slow, mention ETW traces when you file a support ticket. Vendors who adopt this tooling can now act on that evidence far faster than before.
- ✔Read Microsoft's announcement post on the Performance and Diagnostics dev blog
- ✔Confirm you have an MCP-compatible assistant (GitHub Copilot, Claude, or similar)
- ✔Install the Microsoft.Windows.EventTracing.MCP preview package from NuGet
- ✔Register ETW MCP as a server in your assistant's MCP configuration
- ✔Capture a trace (Windows Performance Recorder works) or use an existing ETL file
- ✔Ask a first question, for example: 'Which process used the most CPU in this trace?'
🔒 Privacy, Limits, and What Microsoft Has Not Said
A system trace is sensitive. It can reveal every program you ran, files you touched, and network activity. So the design choice Microsoft highlighted matters: ETW MCP analyzes traces locally and does not hand raw trace events to the AI model. The assistant receives processed answers, not your machine's full diary.
That said, keep expectations calibrated. This is a preview, and previews change. Microsoft has not announced consumer integration into the Copilot app on Windows 11, has not published pricing (the preview package is a free download), and has not committed to a general-availability date. Treat any claim beyond that as speculation, including my own guess above about future consumer features.
Also remember that the answers are only as good as the model reading them. AI assistants can misread ambiguous data, so for high-stakes decisions, a human expert reviewing the trace remains the gold standard. The honest framing: ETW MCP makes the first 80 percent of a performance investigation fast and cheap, and leaves the hardest 20 percent to people who know what they are doing.
❓ Frequently Asked Questions
What is ETW MCP in simple terms?
It is a preview tool from Microsoft that lets AI assistants like GitHub Copilot read Windows performance recordings (ETW traces) and answer plain-English questions about them, such as which app was slowing down your PC. It uses MCP, the Model Context Protocol, an open standard for connecting AI assistants to tools.
Do I need to be a developer to use ETW MCP?
For now, mostly yes. The preview ships as a NuGet package and runs in a terminal, so setup assumes developer comfort. Non-technical users benefit indirectly: the software vendors and IT people you rely on can diagnose problems faster. A consumer-friendly version inside Copilot on Windows has not been announced.
Does ETW MCP send my computer's data to the cloud?
Microsoft says the tool does not send raw trace events directly to the AI model. The trace is processed locally and the assistant receives summarized results. Still, the assistant itself may be cloud-based, so treat the answers it receives as data leaving your machine and review your organization's policies before using it on sensitive systems.
Which AI assistants work with ETW MCP?
Any assistant that supports the Model Context Protocol. GitHub Copilot is the pairing Microsoft demonstrates, but MCP is an open standard also supported by Anthropic's Claude models (like Claude Sonnet 4.6) and many other AI tools, so the server is not locked to one assistant.
🏁 Final Thoughts
The headline sounds niche, but the story is big: Microsoft just connected the deepest diagnostic layer of Windows to AI assistants through an open standard. Today that means developers can ask 'why is this slow?' and get real answers from real trace data. Tomorrow it likely means Copilot diagnosing your sluggish laptop the way a Microsoft engineer would. The takeaway for non-developers: expect faster fixes from the software you use, and expect 'ask the AI to read the logs' to become the default first step in troubleshooting everything. If you want news explainers like this that skip the jargon, subscribe to Agents at Work, and drop a comment with the next headline you want decoded.
Last updated: August 06, 2026 · Keyword: Microsoft ETW MCP · Agents at Work
Comments
Post a Comment