Repolode
Submit
svnscha

svnscha/mcp-windbg

An MCP server that lets AI assistants drive WinDbg/CDB/KD to analyze Windows crash dumps and debug user-mode and kernel targets.

View on GitHubWebsite
Stars
1,660
Forks
168
Open issues
2
Last commit
10 days ago

What is it?

mcp-windbg is a Python Model Context Protocol server that wraps the Windows debuggers, cdb.exe for user-mode dumps and remote targets and kd.exe for kernel targets. An MCP-compatible client can open a crash dump, get automated triage output such as !analyze -v, stacks, modules and threads, and then run further debugger commands while reasoning about the results.

Beyond dump analysis, the server can attach to a live user-mode debug server over TCP, a named pipe or COM, and to kernel targets over KDNET, a named pipe or serial. Several sessions can be open at once and are addressed by session id. Per-call timeouts let a slow live command be interrupted with CTRL+BREAK and the session resynchronized.

It runs over stdio for local use or as a streamable-HTTP service for driving a debugging host from another machine. A filter script can redact sensitive data from tool arguments and output. It requires Windows with Debugging Tools for Windows or WinDbg from the Microsoft Store.

Key features

  • 01Opens .dmp, .mdmp and .hdmp crash dumps and returns automated triage output in one call.
  • 02Attaches to user-mode cdb remote debug servers over TCP, named pipe or COM.
  • 03Attaches to kernel targets over KDNET, named pipe or serial via kd.exe.
  • 04Runs arbitrary WinDbg/KD commands on open sessions from the MCP client.
  • 05Supports multiple concurrent sessions addressed by session id.
  • 06Offers stdio or streamable-HTTP transport and a filter script for redaction.

Use cases

  • Root-causing an access violation or hang from a crash dump with an AI assistant.
  • Investigating which driver caused a kernel bugcheck on a KD-enabled machine.
  • Triaging a folder of crash dumps to find a common failure signature.
  • Debugging a Windows host from another machine over HTTP.

In collections

MCP servers

Topics

#windbg#crash-dump#debugging#mcp#mcp-server#windows#kernel-debugging#copilot#copilot-chat#crash-reports

FAQ

What is mcp-windbg?
An MCP server that lets AI assistants drive WinDbg/CDB/KD to analyze Windows crash dumps and debug user-mode and kernel targets. mcp-windbg is a Python Model Context Protocol server that wraps the Windows debuggers, cdb.exe for user-mode dumps and remote targets and kd.exe for kernel targets. An MCP-compatible client can open a crash dump, get automated triage output such as !analyze -v, stacks, modules and threads, and then run further debugger commands while reasoning about the results.
Is mcp-windbg free to use? What license does it have?
mcp-windbg is open source under the MIT license. Check the license terms before using it in commercial products.
Is mcp-windbg still maintained?
Actively maintained. The last commit to mcp-windbg was on Oct 28, 2026.
What can I use mcp-windbg for?
Root-causing an access violation or hang from a crash dump with an AI assistant. Investigating which driver caused a kernel bugcheck on a KD-enabled machine. Triaging a folder of crash dumps to find a common failure signature. Debugging a Windows host from another machine over HTTP.
Where can I get mcp-windbg?
The source code and installation instructions are on GitHub: https://github.com/svnscha/mcp-windbg

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects