Skip to content
SPECIFICTION
Get listed

OpenProcMon

github.com

Free plan Windows
Visit github.com
Spec score 7.9 #9 of 26 in Process Monitoring Software

What it is

OpenProcMon is a free, open-source process monitor for 64-bit Windows. It tracks process, file system, registry, and network activity in real time, with filters for process name, PID, operation, path, result, or category. Its interface includes a process tree, activity summaries, and call-stack views with per-frame module resolution. The tool reads and writes Sysinternals Process Monitor .PML logs, including logs made with the original Process Monitor. Developers can use its Rust SDK to connect to the driver, choose monitored activity, set filters, and consume parsed events programmatically. For AI-assisted capture and analysis, the procmon-cli MCP server operates over stdio and has setup instructions for clients including Claude Code, Claude Desktop, Codex, and Cursor. Capture tools can export filtered results as PML, CSV, or XML. The v0.5.0 release offers a Windows x64 ZIP with the GUI, CLI/MCP server, console example, skill, and guides. Live capture needs Administrator privileges to load the kernel driver; analyzing an existing .PML file does not. The project is MIT-licensed and its Rust rewrite is described as under active development.

Spec sheet

Purpose
OpenProcMon is an open-source Process Monitor implementation for Windows.Read 9 Oct 2026 · github.com
Intended users
The project describes its driver as a possible starting point for building EDR-style tooling and provides MCP tools for AI-assisted capture and analysis.Read 9 Oct 2026 · github.com
License
The project is released under the MIT License.Read 9 Oct 2026 · github.com
Activity monitoring
It monitors process, file system, registry, and network activity in real time.Read 9 Oct 2026 · github.com
AI integration
The procmon-cli MCP server exposes capture and analysis operations to AI agents over stdio, and the project also provides a skill.Read 9 Oct 2026 · github.com
AI integrations
Its MCP server supports Claude Code, Claude Desktop, OpenAI Codex CLI, Cursor, Windsurf, Cline, and Continue through stdio configuration.Read 9 Oct 2026 · github.com
Analysis
Its interface includes a process tree, activity summaries, and call stack views with per-frame module resolution.Read 9 Oct 2026 · github.com
Capture and analysis privileges
Live capture requires Administrator privileges and the kernel driver, while analyzing an existing .PML file requires neither.Read 9 Oct 2026 · github.com
Download
The v0.5.0 release provides a Windows x64 ZIP containing the GUI, CLI/MCP server, console example, skill, and MCP guides.Read 9 Oct 2026 · github.com
Exports
The MCP capture tools can export filtered captures as PML, CSV, or XML.Read 9 Oct 2026 · github.com
Filtering
Users can filter and highlight events by process name, PID, operation, path, result, or category.Read 9 Oct 2026 · github.com
License and development
The project is released under the MIT License, and its Rust rewrite is described as under active development.Read 9 Oct 2026 · github.com
Limitations
OpenProcMon targets 64-bit Windows and does not support 32-bit Windows or 32-bit .PML files.Read 9 Oct 2026 · github.com
Limits
OpenProcMon targets 64-bit Windows only and does not support 32-bit .PML files.Read 9 Oct 2026 · github.com
Permissions
Live capture requires running as Administrator because it loads the kernel driver; analyzing an existing .PML file does not require elevation.Read 9 Oct 2026 · github.com
PML compatibility
OpenProcMon reads and writes Sysinternals Process Monitor .PML logs.Read 9 Oct 2026 · github.com
PML support
OpenProcMon reads and writes Sysinternals Process Monitor .PML logs, including logs created by the original Process Monitor.Read 9 Oct 2026 · github.com
Process analysis
The GUI includes a process tree, activity summaries, and call-stack views with per-frame module resolution.Read 9 Oct 2026 · github.com
SDK
Its Rust SDK can connect to the driver, select monitored activity, set filters, and consume parsed events programmatically.Read 9 Oct 2026 · github.com
Supported MCP clients
The MCP guide gives setup instructions for Claude Code, Claude Desktop, Codex, and Cursor.Read 9 Oct 2026 · github.com

Plans and prices

OpenProcMon Free MIT-licensed open source · 64-bit Windows only · live capture requires Administrator privileges Read 9 Oct 2026 · github.com

Every OpenProcMon plan and price →

Strong points and limits

Strong points

  • Real-time monitoring across four activity categories
  • Reads and writes Sysinternals .PML logs
  • Exports filtered captures as PML, CSV, or XML
  • Free and MIT-licensed

Limits

  • Supports 64-bit Windows only
  • Live capture requires Administrator privileges
  • Does not support 32-bit .PML files

Who it suits

OpenProcMon suits Windows users who need detailed process, file, registry, or network activity logs, and developers building on its SDK or MCP tools. Its existing-log analysis does not require elevation.

Verdict

OpenProcMon combines live monitoring, .PML compatibility, and programmatic or MCP-based analysis. Its 64-bit Windows scope and administrator requirement for live capture are important constraints.

Where Specifiction places it

Alternatives to OpenProcMonAll alternatives →

PM2 From $79/mo · Free plan 9.0 Visit