MCP Windbg logo

MCP Windbg

Windows MCP server for analyzing crash dumps and controlling user-mode or kernel WinDbg sessions.

Install MCP Windbg

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-windbg": {
      "command": "uvx",
      "args": [
        "plugin"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

The mcp-windbg MCP server connects AI clients to Windows CDB and KD for crash dump analysis, remote user-mode debugging, and kernel debugging. It opens sessions, returns session IDs, runs debugger commands, and supports live-session controls such as breaking, waiting, and closing. Use it when an agent needs to inspect Windows dumps, compare multiple dumps, or operate a remote or kernel debugging target. It runs locally over stdio or as a streamable HTTP service.

Use cases

  • Analyze a user-mode crash dump
  • Triage multiple dumps in a directory
  • Inspect a remote user-mode process
  • Debug a kernel target or bugcheck
  • Redact sensitive debugger output

Key features

  • User-mode CDB dump triage
  • Kernel KD dump and live-session support
  • Remote debugging over supported transports
  • Arbitrary debugger command execution
  • Independent session IDs
  • Stdio and streamable HTTP modes

Tools11

What MCP Windbg lets your agent do. Expand a tool for its parameters.

Self-reported~156 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

13/13 checks healthy over the last 45d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · plugin (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1.6kStargazers on the source repository.
Last commit3d agoMost recent push to the default branch.
Tools exposed11Callable tools this server registers over MCP.

How MCP Windbg works

What mcp-windbg does

The mcp-windbg MCP server lets an MCP-compatible client drive the Windows CDB and KD debuggers. CDB handles user-mode crash dumps and user-mode remote sessions, while KD handles kernel targets and kernel crash dumps. The server exposes debugger operations as MCP tools so an agent can request triage, inspect output, and issue additional commands.

It supports .dmp, .mdmp, and .hdmp files for user-mode analysis, as well as kernel dumps such as MEMORY.DMP and minidumps. Opening a dump performs built-in triage that includes analysis, stacks, modules, and threads. A directory can also be scanned to find multiple dump files for batch comparison.

How it works

Each opening operation creates an opaque session ID. Later calls use that ID to address the corresponding CDB or KD process, allowing dump, remote, and kernel sessions to remain open independently. User-mode sessions use cdb.exe; kernel sessions use kd.exe.

The mcp-windbg MCP server can attach to a user-mode debug server with -remote, or connect to a kernel target with -k over KDNET, a named pipe, or serial communication. For live targets, an agent can send a break request, run commands, resume execution, and wait for the target to stop again. Closing a kernel session resumes the target machine.

Commands are passed to the underlying debugger rather than interpreted as a separate abstraction. This allows standard debugger commands such as stack, module, process, and heap inspection commands to be used through the MCP interface. Live commands have per-call timeouts; if a command exceeds its timeout, the server uses CTRL+BREAK and resynchronizes the session.

Setup and configuration

The host must run Windows and have Microsoft Debugging Tools for Windows or WinDbg from the Microsoft Store installed. These packages provide cdb.exe and kd.exe, which the server auto-detects. Python 3.10 or newer is needed when installing and launching the package directly; the uvx route provides its own package-launch path.

Install the package with pip install mcp-windbg, then register the module with an MCP client. A symbol path can be supplied through _NT_SYMBOL_PATH, for example a local symbol cache backed by Microsoft’s symbol server. The material does not identify any environment variable as mandatory for every configuration.

The mcp-windbg MCP server can run over stdio for a local client or as a streamable HTTP service when the debugging host and client are on different machines. A filter script can be configured to redact secrets or personally identifiable information from tool arguments and output before that data leaves the host.

Tools and capabilities

  • list_dumps finds crash dump files in a directory.
  • open_cdb_dump opens and triages a user-mode dump.
  • open_cdb_remote connects to a user-mode remote debug server.
  • open_kd_session attaches to a live kernel target.
  • open_kd_dump opens and triages a kernel crash dump.
  • run_cdb_command and run_kd_command execute commands in their matching sessions.
  • send_ctrl_break interrupts a running live session.
  • wait_for_break waits for a target resumed with g to stop.
  • close_cdb_session and close_kd_session close their respective sessions.

Limitations and notes

The server is a Python wrapper around real Windows debugger executables; it does not automatically repair the cause of a crash. Correct debugger installation, target connectivity, symbols, and permissions remain necessary for useful results. Kernel debugging can affect a live target, and closing a kernel session resumes that machine. Enterprise Claude Code installations may also restrict MCP servers through managed settings and organizational MCP policy.

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Windbg

mcp-windbg is an MCP server that connects AI clients to Windows CDB and KD for user-mode crash dumps, remote debugging, and kernel debugging. Its main tools list dumps, open and triage CDB or KD sessions, run debugger commands, send breaks, wait for targets, and close sessions.

Install it with `pip install mcp-windbg` and register `python -m mcp_windbg` with your MCP client. Direct installation requires Python 3.10 or newer. On Claude Code, the documented alternative uses the `mcp-windbg-uvx` plugin and requires uv with `uvx` available.

Yes, mcp-windbg works with Cursor because the project lists Cursor among its MCP-compatible clients. It can be registered as a local stdio server, or accessed through a streamable HTTP service when the debugging host is separate from the client.

mcp-windbg uses `cdb.exe` for user-mode dump and remote sessions and `kd.exe` for kernel sessions and kernel dumps. These executables come from Microsoft Debugging Tools for Windows or WinDbg from the Microsoft Store, and the server auto-detects them.

Yes, mcp-windbg can list dump files in a directory and supports multi-dump triage. Use `list_dumps` to discover files, then open the relevant dumps and compare their debugger output and crash signatures through separate session IDs.

Related MCP servers

Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Windbg AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/mcp-windbg?style=directory)](https://allmcps.com/mcp/mcp-windbg)
HTML Embed
<a href="https://allmcps.com/mcp/mcp-windbg"><img src="https://allmcps.com/api/badge/mcp-windbg?style=directory" alt="MCP Windbg on AllMCPs" /></a>