svnscha/mcp-windbg

What it solves

It enables AI models to perform Windows crash dump analysis, user-mode remote debugging, and kernel debugging using natural language. Instead of manually running complex debugger commands, users can ask an LLM to investigate access violations, identify bugchecked drivers, or triage multiple crash dumps.

How it works

The project is a Python-based Model Context Protocol (MCP) server that acts as a wrapper around the Windows debugging tools cdb.exe (for user-mode) and kd.exe (for kernel-mode). It exposes a set of tools that allow an LLM to open sessions, run arbitrary debugger commands, and reason about the resulting output. It supports multiple concurrent sessions via session IDs and can operate over stdio or HTTP.

Who it’s for

Windows developers and system engineers who need to root-cause crashes, debug drivers, or inspect live process states but want to leverage AI to automate the triage and analysis process.

Highlights

• Comprehensive Debugging Support: Handles crash dumps (.dmp, .mdmp, .hdmp), live user-mode remote debugging, and kernel debugging via KDNET, named pipes, or serial.
• Natural Language Interface: Allows LLMs to execute commands like !analyze -v or kb based on user prompts.
• Session Management: Supports multiple independent debugging sessions simultaneously.
• Data Privacy: Includes text filter hooks via --filter-script to redact PII or secrets before data is sent to the AI model.
• Resilient Live Sessions: Implements per-call timeouts and uses CTRL+BREAK to resynchronize sessions that hang.