svnscha/mcp-windbg

What it solves

This project provides a bridge between AI models and Windows debugging tools, allowing developers to perform crash dump analysis, user-mode remote debugging, and kernel debugging using natural language. It eliminates the need to manually run complex debugger commands by letting an LLM drive the debugger and reason about the output.

How it works

It is a Python wrapper around cdb.exe and kd.exe (the command-line versions of WinDbg). It implements the Model Context Protocol (MCP), which allows AI clients (like Claude Code, GitHub Copilot, and Cursor) to call specific tools to open sessions, run arbitrary debugger commands, and manage sessions via unique session IDs. It can operate locally via stdio or as a remote service over HTTP.

Who it’s for

Windows developers and system engineers who need to root-cause crashes, debug drivers, or triage multiple crash dumps without manually executing every debugger command.

Highlights

• Comprehensive Debugging Support: Supports crash dumps (.dmp, .mdmp, .hdmp), live user-mode remote debugging, and kernel debugging via KDNET, named pipes, or serial.
• CDB/KD Integration: Directly drives cdb.exe and kd.exe to run any valid WinDbg/KD command.
• Session Management: Supports multiple independent sessions simultaneously using session IDs.
• Resilient Live Sessions: Uses CTRL+BREAK to resynchronize sessions that exceed timeouts instead of wedging.
• Privacy Controls: Includes text filter hooks via --filter-script to redact PII or secrets before data leaves the machine.
• Flexible Deployment: Can be run locally via stdio or as a streamable HTTP service.