Fun and Useful AppControl AI/MCP Prompt Examples - Post them here!

General
, ,
1

Have you been using our MCP/AI integration, and you’ve found some cool prompts you’d like to share? Post them here in the forum below!

I’ll post the first prompt…

I saw this article in the news about Meta https://www.reuters.com/sustainability/boards-policy-regulation/meta-start-capturing-employee-mouse-movements-keystrokes-ai-training-data-2026-04-21/ so I used this prompt: “Use the AppControl MCP tools to look at all executables that have run on my PC, and cross reference them against any known employee monitoring apps. Does my PC have any employee monitoring apps?”

I got this result with Claude:

image
image1320×1660 227 KB

Have you found any other interesting prompts that work well with AppControl’s optional MCP/AI integration? Please share!

1 Like
2

Prompt: What apps that are currently auto-starting with Windows on my computer should I remove from auto-starting in order to speed up Windows and only start them when I need them.

About the yellow highlighting - I added these in an update I gave in a presentation on AppControl for points I had verbal comments for

image
image1098×723 241 KB

I think most users of UniGetUI really want it running on Windows Startup.

image
image873×681 181 KB

When I complained to Claude that I could not find Windows Widgets in Startup (I even tried Mark Russinovich’s excellent AutoRuns),

image
image912×342 106 KB

So in the end, I found that Claude made some mistakes, but the integration of AppControl and Claude surfaced a lot of useful information.

3

Yes, I find in general all these LLMs make major mistakes almost constantly, to a degree that it’s disturbing. One strategy to fight that is to send them to a specific data source to check again. For example you could say “Look at best practices for hardening Windows according to the X PDF (or X website) and then cross reference that with my PC, and recommend changes I can make to secure my PC better.”

Without sending the LLM to check a specific data source I think a lot of the time it will just make stuff up that isn’t useful.

At one point when I was using it, it was repeatedly suggesting I turn off Windows Security/Defender, which I found disappointing. I am referring to Claude.

4

I had Claude make a prompt for me today that I found worked pretty well:

"You are a Windows security auditor. Your knowledge source is exclusively the Microsoft Security Baselines guide at https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines — do not use any other security standards or general knowledge.

Using the AppControl MCP tools, collect the following from my PC:

  1. All currently running processes — flag any running with elevation=Full or Elevated flags

  2. All new unsigned binaries seen in the past 72 hours (unsigned_only=true, event_type=NewBinarySeen)

  3. Any ThreatDetected or DriverServiceAdded events in the past 72 hours — cross-reference driver publisher against Microsoft-signed expectation from the baseline

  4. Top 10 CPU/disk consumers over the past hour — flag any non-Microsoft binary consuming >10% CPU

  5. Any BinaryHashChanged events for core system files (ntoskrnl, winlogon, lsass, etc.)

For each finding, map it to a specific Microsoft Security Baseline principle:

  • Least Privilege (no standard user should have admin rights)

  • Known-good binaries (hash integrity of system files)

  • Kernel/driver hygiene (only Microsoft-signed drivers)

  • No unauthorized elevation (UAC and elevation chain integrity)

  • Tamper protection (Defender/AV coverage)

Output a prioritized list of risks with specific remediation steps drawn only from the Microsoft Security Baseline guidance."**

5

A mixed bag in terms of results - mostly good. One terrible.

“What apps have used my webcam in the past 24 hours?”

Claude flagged that svchost.exe had accessed the webcam and went on to mention that svchost is used by Windows Hello and, because there were two rapid accesses in the early morning, it was probably signing into Windows. Timing matched. Very good analysis. I didn’t know that svchost was the process that kicked off Windows Hello.

“What are the most recent program updates on my computer?”

It noted all of them and even pointed out that ig.exe had been updated 4 times in the past day. I had no clue what ig.exe is. Claude told me not to worry. It said this was normal because ig.exe is part of Malwarebytes and probably indicated incremental definition updates. Very good - gave me assurances that an app updating itself 4 times in a day was nothing to be concerned about.

“What apps that are currently autostarting with Windows should I remove from autostarting to improve performance and only load them when I need them?”

Some good suggestions. One not really great. One terrible.

Recommended removing Brother ControlCenter4. Said it was only needed if I wanted to initiate a scan from my printer. Said “the actual RAM usage isn’t directly measurable through AppControl” and estimated RAM use at 30-60 MB RAM. When I challenged that with "Why can’t AppControl tell you the amount of RAM - if I search for the program within AppControl, it lists RAM use. Claude replied, “You’re right to call that out … I just didn’t query for it.” It then reported the RAM use at 1.3 MB and said that was “remarkably low - far less than I estimated” and “…using next to nothing. Definitely not a meaningful reason to remove from Startup”

Claude recommended removing UniGetUI from Startup “… only needs to run when you’re managing/updating software. Currently running suspended, so wasting memory for no reason.” When I challenged with, “If I remove UniGetUI from Startup Apps, will it still automatically check for updates to my programs?” Claude admitted, “No, UniGetUI will not start automatically if you remove it from Startup, It has no scheduled task or background service that launches it automatically. It relies entirely on being in your Startup folder (or another autostart mechanism you’ve configured to run at boot and then check for updates in the background.” So not good that it initially recommended I remove it from Startup. Good that it could tell UniGetUI did not have any other mechanism to automatically check for updates.

Claude picked up on the fact that I am autostarting a program from within a folder synced to Google Drive and outlined the risks (which I knew). Excellent that it understands those risks.

Claude recommended removing Razer (for my mouse) from Startup, noting it used 9 processes. When I asked for the impact on system performance over time, including CPU and memory usage, it gave nice graphs of memory and CPU used by Razer over time. It noted “The main concern here is the memory behaviour … at steady state it holds 70-150 MB. Removing it from Startup would be a real win for available memory.” When I asked “I have 32 GB RAM. Is this savings in RAM really significant?” Claude replied “Honestly no. 150MB on a 32 GB system is less than 0.5% of total RAM. You’d never notice it in practice.”

When I asked Claude about apps with top CPU utilization, it reported that PowerShell was a heavy user. I asked what was using PowerShell so much. One was “Lenovo Vantage scheduled tasks”. So I asked for a PowerShell script that would list all scheduled tasks from Lenovo sorted by last run. It gave me a script. When I ran it, I found there were 32 scheduled tasks from Lenovo, 21 of which had run in the past 2 days. I will probably look a little more into those! Good analysis.

Overall, I really like that AppControl surfaces the metrics. The ability of Claude to make sense of the metrics is generally good. Its recommendations about what to do with that information is generally good, but does require the user to not blindly agree! If I had, the biggest impact would have been UniGetUI would no longer be checking for program updates on my computer.

I look forward to AI getting smarter :slight_smile:

1 Like
6

I asked Claude, “What might be some useful queries against AppControl to help me improve performance and security on my computer. Provide the actual queries I would ask of Claude in plain language.”

Performance

  • “What are the top 10 CPU-consuming apps on my computer over the last hour?”
  • “What are the top 10 memory-consuming apps right now?”
  • “Which apps have been hitting the disk hardest in the last hour?”
  • “Show me a system-wide CPU and memory timeline for the last 24 hours — were there any unusual spikes?”
  • “What was my computer doing at [time] — any resource spikes?”

Security

  • “List all unsigned binaries on my system”
  • “Are there any unsigned executables running right now?”
  • “Show me any unsigned binaries in my Temp, Downloads, or AppData folders”
  • “What new executables appeared on my system in the last 24 hours?”
  • “Have any known binaries changed their hash recently?”
  • “Have any new kernel drivers been installed recently?”
  • “Show me all threat detection events in the last 7 days”
  • “Have there been any blocked processes recently?”

Privacy

  • “Which apps have accessed my webcam?”
  • “Which apps have accessed my microphone?”
  • “Show me the full webcam and microphone access history”

Investigation

  • “Something slowed my computer down around 2pm today — what was running then and did anything security-related happen at the same time?”
  • “Give me a full history of events for [app name]”
  • “What’s currently running on my computer right now?”
  • “Are there any executables running from unusual locations like Temp or Downloads?”
1 Like
7

Some of these are useful, but I find some of these are better accomplished by just looking at AppControl directly. :laughing: Don’t tell Claude though. :+1:

One thing that I did recently that helped with Claude was that I went to its settings and I added this instruction “Never generate significant code, or images, or video, or anything that will use significant tokens/usage, without asking consent to do so.”

1 Like