A Model Context Protocol server that bridges AI models with WinDbg for crash dump analysis, user-mode remote debugging, and kernel debugging.
How to install mcp-windbg?
svnscha/mcp-windbg
$git clone https://github.com/svnscha/mcp-windbgInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install mcp-windbg by running `git clone https://github.com/svnscha/mcp-windbg`, then use it for the current task and follow its documentation at https://github.com/svnscha/mcp-windbg.
README.md
| 1 | # MCP Server for WinDbg Crash Analysis |
| 2 | |
| 3 | [](https://github.com/svnscha/mcp-windbg/actions/workflows/ci.yml) |
| 4 | [](https://svnscha.github.io/mcp-windbg/) |
| 5 | [](https://pypi.org/project/mcp-windbg/) |
| 6 | [](LICENSE) |
| 7 |  |
| 8 |  |
| 9 | |
| 10 | A Model Context Protocol server that bridges AI models with WinDbg for crash dump analysis, user-mode remote debugging, and kernel debugging. |
| 11 | |
| 12 | <!-- mcp-name: io.github.svnscha/mcp-windbg --> |
| 13 | |
| 14 | ## Overview |
| 15 | |
| 16 | This server drives the Windows debuggers - [CDB](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/opening-a-crash-dump-file-using-cdb) for user mode (dumps and `-remote`) and **KD** for kernel targets (`-k`) - so you can debug in natural language: *"Show me the call stack and explain this access violation"* or *"Open a kernel session and tell me which driver bugchecked."* |
| 17 | |
| 18 | It is not a magical auto-fix. It is a Python wrapper around `cdb.exe` / `kd.exe` that lets an LLM run real debugger commands and reason about the output. |
| 19 | |
| 20 | ## Features |
| 21 | |
| 22 | - **Crash dump analysis** - open a `.dmp`/`.mdmp`/`.hdmp` and get automated triage (`!analyze -v`, stacks, modules, threads) in a single call. |
| 23 | - **User-mode remote debugging** - attach to a live `cdb`/WinDbg debug server (`-remote`) over TCP, a named pipe, or COM, and break in on demand. |
| 24 | - **Kernel debugging** - attach to a kernel target (`-k`, driven by `kd.exe`) over KDNET, a named pipe, or serial; the server waits for the target and breaks in for you. |
| 25 | - **Run any WinDbg/KD command** - drive an open session with arbitrary commands (`kb`, `!process 0 0`, `!heap`, `lm`, ...) described in natural language. |
| 26 | - **Session ids** - every open returns a session id; several sessions (dumps, remote, kernel) can be open at once and are addressed independently. |
| 27 | - **Resilient live sessions** - per-call timeouts, and a slow live command that outruns its timeout is broken into with CTRL+BREAK and the session resynchronized instead of wedging. |
| 28 | - **Multi-dump triage** - discover and compare many dumps across a directory. |
| 29 | - **Text filter hooks** - a `--filter-script` can redact PII/secrets from tool arguments and output before they leave the machine. |
| 30 | - **stdio or HTTP** - run locally over stdio, or as a streamable-HTTP service you drive from another machine. |
| 31 | |
| 32 | ## Use cases |
| 33 | |
| 34 | | You have | You want to | Guide | |
| 35 | | --- | --- | --- | |
| 36 | | A `.dmp` from a crash | Root-cause it: exception, faulting frame, why it happened | [Analyze a crash dump](https://svnscha.github.io/mcp-windbg/scenarios/crash-dump/) | |
| 37 | | A live user-mode process (via `cdb -server`) | Break in and inspect a hang or live state | [Debug a remote target](https://svnscha.github.io/mcp-windbg/scenarios/remote-debugging/) | |
| 38 | | A KD-enabled machine or VM | Debug drivers, bugchecks, and boot-time issues | [Debug a kernel target](https://svnscha.github.io/mcp-windbg/scenarios/kernel-debugging/) | |
| 39 | | A folder full of dumps | Triage the batch and find the common signature | [Triage multiple dumps](https://svnscha.github.io/mcp-windbg/scenarios/triage/) | |
| 40 | | A debugging host, but you work elsewhere | Drive it over HTTP from another machine | [Debug from another machine](https://svnscha.github.io/mcp-windbg/scenarios/http-service/) | |
| 41 | | Dumps with secrets or PII | Scrub tool output before it leaves the box | [Redact sensitive data](https://svnscha.github.io/mcp-windbg/scenarios/redaction/) | |
| 42 | |
| 43 | ## Tools |
| 44 | |
| 45 | Every `open_*` tool returns an opaque **`session_id`** (e.g. `cdb-1a2b3c4d`); pass it to the matching `run_*`, `close_*`, and `send_ctrl_break` calls. User-mode targets (dumps and `-remote`) run under `cdb.exe`; kernel targets run under `kd |
Related
6 picksType
- chrome-devtools-mcpMCP server for Chrome DevToolsJul 2026
- lean-lsp-mcpLean Theorem Prover MCPJul 2026
- desktopcommandermcpMCP server for terminal commands, file operations, and process managementJul 2026
- langfuse-mcpLangfuse MCP server for accessing and analyzing telemetry data via natural languageJun 2026
- mcp_debugPostman for your MCP server with a Claude chat that calls your toolsJun 2025
- tauri-plugin-mcpAllows AI agents (e.g., Cursor, Claude Code) to debug within Tauri apps via screenshot capture, window management, DOM access, and simulated user inputs.Jul 2026
