trace_stop_etw_capture

[external]

Stops an owned ETW capture and optionally binds its evidence to one verified live IIS worker.

From GliderTrace 1.2.0. Requires the local Windows stdio server that owns the capture.

Before you use this tool

Stops only the owned ETW capture. The tool leaves the IIS worker running. Stateless HTTP cannot stop this capture.

Try it locally in the GliderTrace playground

Parameters

Name	Type	Required	Description
captureId	string	Yes	Copy captureId from trace_start_etw_capture.
processId	number	No	Optional live IIS worker PID from a fresh trace_list_processes result. Supply with targetId.
targetId	string	No	Optional target identity from the same inventory result as processId. Supply both or neither.

Examples

Replace sample paths and symbol keys with values from your workspace.

Stop capture and bind the selected live worker

Arguments 
{
  "captureId": "COPY_FROM_START_RESULT",
  "processId": 12345,
  "targetId": "COPY_FROM_FRESH_INVENTORY"
}

Full MCP request

Full MCP request 
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "trace_stop_etw_capture",
    "arguments": {
      "captureId": "COPY_FROM_START_RESULT",
      "processId": 12345,
      "targetId": "COPY_FROM_FRESH_INVENTORY"
    }
  }
}

Response Notes

Returns captureId, sessionId, status, targetId, candidate workers, artifacts, warnings, and coverage. Without a verified target, the sensitive ETL remains unbound. Candidate starts remain unverified and include ETW start times. If the worker exits, stop without a target and import the artifact with verified PID and start-time evidence. A repeated stop returns the stored result. Read identity, provider, clock, stack, and loss coverage before attribution.

GliderTrace 1.0.0 returns compact JSON for every tool. Result fields appear beside success; there is no response-format parameter. success describes the tool call. Check the process or session status and exitCode separately. Scalar results and fields that conflict with reserved names appear under result.

To migrate an envelope consumer, read response.sessionId instead of response.data.sessionId. Stored sessions and exported files keep their formats. --max-response-chars limits response text to 60,000 UTF-16 characters by default. Use 0 to disable it, or at least 1,000. This limit counts text characters, not transport bytes or tokens.

outputLimit.truncated marks omitted response detail. It does not change capture completeness. Use the returned next tool and arguments when available. Do not repeat a command or feedback submission to recover omitted output. For event pages, keep the filters and cursor while reducing limit.

For session details, set includeArtifacts and includeTopFindings to false to reduce output. Check error, actionable meta, warnings, and coverage before drawing conclusions. Internal diagnostics stay in local server logs.