MCP Server for WinDbg Crash Analysis

A Model Context Protocol server that bridges AI models with WinDbg for crash dump analysis, user-mode remote debugging, and kernel debugging.

Overview

This server drives the Windows debuggers - CDB for user mode (dumps and -remote) and KD for kernel targets (-k) - so you can debug in natural language: "Show me the call stack and explain this access violation" or "Open a kernel session and tell me which driver bugchecked."

It is not a magical auto-fix. It is a Python wrapper around cdb.exe / kd.exe that lets an LLM run real debugger commands and reason about the output.

Features

• Crash dump analysis - open a .dmp/.mdmp/.hdmp and get automated triage (!analyze -v, stacks, modules, threads) in a single call.
• User-mode remote debugging - attach to a live cdb/WinDbg debug server (-remote) over TCP, a named pipe, or COM, and break in on demand.
• Kernel debugging - attach to a kernel target (-k, driven by kd.exe) over KDNET, a named pipe, or serial; the server waits for the target and breaks in for you.
• Run any WinDbg/KD command - drive an open session with arbitrary commands (kb, !process 0 0, !heap, lm, ...) described in natural language.
• Session ids - every open returns a session id; several sessions (dumps, remote, kernel) can be open at once and are addressed independently.
• Resilient live sessions - per-call timeouts, and a slow live command that outruns its timeout is broken into with CTRL+BREAK and the session resynchronized instead of wedging.
• Multi-dump triage - discover and compare many dumps across a directory.
• Text filter hooks - a --filter-script can redact PII/secrets from tool arguments and output before they leave the machine.
• stdio or HTTP - run locally over stdio, or as a streamable-HTTP service you drive from another machine.

Use cases

Tools

Every open_* tool returns an opaque session_id (e.g. cdb-1a2b3c4d); pass it to the matching run_*, close_*, send_ctrl_break, and wait_for_break calls. User-mode targets (dumps and -remote) run under cdb.exe; kernel targets run under kd.exe.

Parameters, timeouts, and the built-in triage prompts are in the tools reference.

Quick start

[!TIP] In enterprise environments, MCP server usage might be restricted by organizational policies. Check with your IT team about AI tool usage and ensure you have the necessary permissions before proceeding.

Prerequisites

• Windows with Debugging Tools for Windows or WinDbg from the Microsoft Store, which ship cdb.exe and kd.exe (auto-detected).
• Any MCP-compatible client (Claude Code, GitHub Copilot, Claude Desktop, Cursor, Windsurf, Cline, ...).

Python is not a prerequisite in itself. Each route below states what it needs.

Install in Claude Code

The plugin

The shortest path: two lines, no pip install, no MCP configuration to edit. Adds four skills and a crash-analyst agent on top of the ten tools, with symbols preconfigured.

/plugin marketplace add svnscha/mcp-windbg
/plugin install mcp-windbg-uvx@mcp-windbg

Needs uv, which supplies uvx: winget install astral-sh.uv. The plugin uses it to fetch the pinned server from PyPI on first use, so there is nothing else to install. See the plugin README for symbols and options.

Registering the server yourself

If you would rather not use the plugin, or you already run the package:

pip install mcp-windbg
claude mcp add mcp-windbg -s user -e _NT_SYMBOL_PATH="SRV*C:\Symbols*https://msdl.microsoft.com/download/symbols" -- python -m mcp_windbg

Needs Python 3.10 or higher. The tools are identical; the skills and the agent are not included.

Install in another client

pip install mcp-windbg

Needs Python 3.10 or higher. Then point the client at python -m mcp_windbg. For VS Code (GitHub Copilot), press F1 and select MCP: Open User Configuration to enable it in every workspace:

{
    "servers": {
        "mcp_windbg": {
            "type": "stdio",
            "command": "python",
            "args": ["-m", "mcp_windbg"],
            "env": {
                "_NT_SYMBOL_PATH": "SRV*C:\\Symbols*https://msdl.microsoft.com/download/symbols"
            }
        }
    }
}

See the client configuration guide for Claude Desktop, Copilot CLI, Autohand Code, HTTP, and from-source setups.

Start debugging

Restart your client, then ask for what you want:

Analyze the crash dump at C:\dumps\app.dmp
Connect to tcp:Port=5005,Server=192.168.0.100 and show me the current thread state
Open a kernel session on net:port=50000,key=1.2.3.4, run !analyze -v, and tell me which driver bugchecked

Server options (--cdb-path, --kd-path, --symbols-path, --filter-script, --transport, ...) are documented in the command-line reference.

Documentation

svnscha.github.io/mcp-windbg

Blog

Read about the development journey: The Future of Crash Analysis: AI Meets WinDbg

• Reddit: I taught Copilot to analyze Windows Crash Dumps
• Hackernews: AI Meets WinDbg

License

MIT