MCP Server for WinDbg Crash Analysis
The Mcp Windbg server integrates AI models with WinDbg/CDB to enable crash dump analysis and remote debugging on Windows systems, allowing users to execute debugger commands through natural language queries. It provides tools for examining Windows crash dumps, connecting to live debugging sessions, and processing multiple dumps to identify patterns. The server supports multiple transport protocols (stdio and streamable HTTP) and works with MCP-compatible clients like Claude Desktop, VS Code, and Cursor, serving as a Python wrapper around CDB that leverages LLM knowledge to assist with Windows debugging tasks.
- GitHub stars
- 1.7K
- tools
- 11
- transport
- STDIO, HTTP
- env vars
- 2
- last updated
- Oct 23, 2026
Tools
11 toolsPublic tool metadata for what this MCP can expose to an agent.
list_dumpsList crash dump files in a directory
List crash dump files in a directory
No parameter schema in public metadata yet.
open_cdb_dumpOpen and triage a crash dump
Open and triage a crash dump
No parameter schema in public metadata yet.
open_cdb_remoteAttach to a user-mode remote debug server (-remote)
Attach to a user-mode remote debug server (-remote)
No parameter schema in public metadata yet.
open_kd_sessionAttach to a kernel target (-k, KDNET / named pipe / serial)
Attach to a kernel target (-k, KDNET / named pipe / serial)
No parameter schema in public metadata yet.
open_kd_dumpOpen and triage a kernel crash dump (MEMORY.DMP, minidump)
Open and triage a kernel crash dump (MEMORY.DMP, minidump)
No parameter schema in public metadata yet.
run_cdb_commandRun a command on a user-mode session
Run a command on a user-mode session
No parameter schema in public metadata yet.
run_kd_commandRun a command on a kernel session
Run a command on a kernel session
No parameter schema in public metadata yet.
close_cdb_sessionClose a user-mode session
Close a user-mode session
No parameter schema in public metadata yet.
close_kd_sessionClose a kernel session (resumes the target machine)
Close a kernel session (resumes the target machine)
No parameter schema in public metadata yet.
send_ctrl_breakBreak into a running live session
Break into a running live session
No parameter schema in public metadata yet.
wait_for_breakWait for a target you resumed with g to stop again
Wait for a target you resumed with g to stop again
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
CDB_PATHCustom path to cdb.exe (optional)
_NT_SYMBOL_PATHSymbol path for Windows debugging (optional, defaults to Microsoft symbol server)
Readme
MCP Server for WinDbg Crash Analysis
A Model Context Protocol server that bridges AI models with WinDbg for crash dump analysis, user-mode remote debugging, and kernel debugging.
Details
- Repository
- github.com/svnscha/mcp-windbg
- Category
- Reverse Engineering
- Package
mcp-windbg- Transport
- STDIO, HTTP
- Registry
- MCP registry, active
Related Reverse Engineering MCP servers
View all
Binary Ninjafosdickio/binary_ninja_mcpA Binary Ninja plugin containing an MCP server that enables seamless integration with your favorite LLM/MCP client.351stars
Groupdocs Assembly Mcpgroupdocs-assembly/groupdocs.assembly.mcpMCP server for GroupDocs.Assembly — generate documents from templates and data with AI agents.0stars
QuReDecadvanced-binary-operations/quredec_mcpEvidence-backed decision briefs with citations — recommendation, confidence, risks, sources.0stars
Pyghidra Litejohnzfitch/pyghidra-liteToken-efficient Ghidra RE: decompile, xrefs, Swift/ObjC, ELF/Mach-O, async analysis36stars
Mcp Pwntoolsdaedalus/mcp-pwntoolsMCP server exposing pwntools 4.15.0 functionality for binary exploitation0stars
Compiler Explorercompiler-explorer/compiler-explorerCompile code with thousands of compilers, inspect the assembly, and share godbolt.org links19.2Kstars