MCP server for WinDbg · v1.1.0 · 1.6k stars · 3k downloads / month

mcp-windbg

Crash-dump analysis, driven by AI.

Ask "why the access violation?" and your assistant runs the right CDB commands, reads the dump and explains the root cause. Crash dumps, live sessions and the Windows kernel, from Claude, Copilot, Cursor or any MCP client.

Quick start with Claude → GitHub Documentation PyPI

Explore

Starred by engineers at

Microsoft
Google
Intel
AMD
NVIDIA
Citrix
Tencent
ByteDance
Red Hat
Palo Alto Networks
Sophos
BeyondTrust
Sentry
Thales
ZEISS
Philips
Mistral AI
and many more

What it does

WinDbg, with a conversation on top.

mcp-windbg wraps the Debugging Tools for Windows in a Model Context Protocol server. The model decides which commands to run. The debugger does the work.

01
Crash dump analysis

Open .dmp, .mdmp and .hdmp files or triage a whole directory. The model runs the CDB commands, reads the output and explains the root cause.
02
User-mode remote debugging

Attach to a remote debug server, break in, inspect, resume. Sessions carry timeouts, so a hung target never hangs your assistant.
03
Kernel debugging

Attach to a kernel target over KD. Drivers, bugchecks and a live kernel, through the same conversation.
04
Redaction and transport

Text filter hooks scrub PII and secrets before output reaches the model. Runs over stdio or streamable HTTP.

In action

From "it crashed" to "here is why".

crash-dump-analysis.webm

Quick start

Two commands, then ask.

Install the plugin from inside Claude Code and point it at a dump. Symbols resolve from the Microsoft symbol server on first use. Other clients take the same Python command.

Windows with Debugging Tools or WinDbg
Python 3.10+
uv for the plugin route

/plugin marketplace add svnscha/mcp-windbg
/plugin install mcp-windbg-uvx@mcp-windbg

pip install mcp-windbg
claude mcp add mcp-windbg -s user \
  -e _NT_SYMBOL_PATH="SRV*C:\Symbols*https://msdl.microsoft.com/download/symbols" \
  -- python -m mcp_windbg

{
  "servers": {
    "mcp_windbg": {
      "type": "stdio",
      "command": "python",
      "args": ["-m", "mcp_windbg"],
      "env": {
        "_NT_SYMBOL_PATH": "SRV*C:\\Symbols*https://msdl.microsoft.com/download/symbols"
      }
    }
  }
}

claude

> Analyze C:\dumps\app.dmp and tell me why it crashed.

open_cdb_dump  C:\dumps\app.dmp
run_cdb_command !analyze -v
run_cdb_command kb

The crash is a null dereference in Renderer::Flush ...

The VS Code snippet goes into .vscode/mcp.json. Claude Desktop and Cursor use the same command and arguments.

Tool surface

Ten tools, one debugger.

Every tool maps to something you would do by hand in WinDbg. Sessions carry ids, so several dumps or targets can be open at once.

list_dumps List crash dump files in a directory
open_cdb_dump Open and triage a crash dump
open_cdb_remote Attach to a user-mode remote debug server
open_kd_session Attach to a kernel target
run_cdb_command Run a command on a user-mode session
run_kd_command Run a command on a kernel session
send_ctrl_break Break into a running live session
wait_for_break Wait for the target to stop after a resume
close_cdb_session Close a user-mode session
close_kd_session Close a kernel session

From the blog

Articles.

Release notes, the story behind the project, and what AI-assisted crash analysis looks like in practice.

Open source · MIT

Built in the open.

mcp-windbg is maintained on GitHub and supported by Liasoft. Stars, issues and pull requests keep it moving.

GitHub stars: 1.6k
Downloads / month: 3k
License: MIT

Star on GitHub Contribute Report a bug

mcp-windbg

WinDbg, with a conversation on top.

Crash dump analysis

User-mode remote debugging

Kernel debugging

Redaction and transport

From "it crashed" to "here is why".

Two commands, then ask.

Ten tools, one debugger.

Articles.

Built in the open.