How to increase query limit in Netwrix Auditor

[acappozzo (Andrea)]

Hello everyone,

We are currently facing a configuration issue with our Netwrix Auditor environment that utilizes an MCP (Model Context Protocol) server to query a SQL database.

When Claude Desktop runs a query through the MCP server, the results are consistently truncated to a maximum of 100 records, regardless of the actual number of rows present in the database.

We would like to know if this 100-record limit is a hardcoded default value within the source code or if it is a configurable parameter.

Specifically, we are looking for guidance on:

1. Which configuration file (e.g., a .config file, .json file, or .env variable) we need to modify to increase or remove this limit? The Netwrix GitHub documentation mentions settings are often provided via the Claude Desktop config, but we need the specific parameter name.

2. What is the exact name of the parameter (e.g., maxRows, pageSize, LimitRecords) that controls this behavior within the Netwrix Auditor MCP server implementation?

We need to load larger datasets to allow the AI to properly analyze the audit logs for our investigations.

Thank you in advance for your support.

Best regards,

[TheCat (Evgeniy Panarin)]

Hi Andrea,

The limit of 100 records is the default value used to minimize load on the API and ensure stable performance during queries executed through the MCP server.

At the moment, this limit is not controlled by any external configuration file (such as .config, .json, or environment variables). Instead, it is defined directly in the MCP server’s command schema, where the parameter:

count — Maximum number of records to retrieve (default: 100, max value: 1000)

controls how many records the API returns.

If you need to retrieve a larger dataset (1000 records), you can try passing this explicitly in your MCP query: “count”: 1000

This should override the default value and allow the API to return more records, assuming the backend supports the requested size.

Could you please give it a try? This should resolve the issue.

Best regards,
Evgenii Panarin