MCP server for WinDbg · v1.5.1 · 1.6k stars · 2.3k downloads / month

mcp-windbg

Crash-dump analysis, driven by AI.

Ask "why the access violation?" and your assistant runs the right CDB commands, reads the dump and explains the root cause. Crash dumps, live sessions and the Windows kernel, from Claude, Copilot, Cursor or any MCP client.

Quick start with Claude → Download for Windows

GitHub Documentation PyPI

Explore

Starred by engineers at

Microsoft
Google
Intel
AMD
NVIDIA
Citrix
Tencent
ByteDance
Red Hat
Palo Alto Networks
Sophos
BeyondTrust
Sentry
Thales
ZEISS
Philips
Mistral AI
and many more

What it does

WinDbg, with a conversation on top.

mcp-windbg wraps the Debugging Tools for Windows in a Model Context Protocol server. The model decides which commands to run. The debugger does the work.

01
Crash dump analysis

Open .dmp, .mdmp and .hdmp files or triage a whole directory. The model runs the CDB commands, reads the output and explains the root cause.
02
User-mode remote debugging

Attach to a remote debug server, break in, inspect, resume. Sessions carry timeouts, so a hung target never hangs your assistant.
03
Kernel debugging

Attach to a kernel target over KD. Drivers, bugchecks and a live kernel, through the same conversation.
04
Redaction and transport

Text filter hooks scrub PII and secrets before output reaches the model. Runs over stdio or streamable HTTP.

In action

From "it crashed" to "here is why".

crash-dump-analysis.webm

Quick start

Install the tools, then ask.

Install WinDbg, download the signed mcp-windbg.exe and point your client at it. No Python, no package manager. Symbols resolve from the Microsoft symbol server on first use.

Windows with WinDbg or Debugging Tools for Windows

1. Install WinDbg · PowerShell

winget install "9PGJGD53TN86" `
  --accept-source-agreements --accept-package-agreements

WinDbg supplies cdb.exe and kd.exe, which mcp-windbg finds automatically. Alternatively, install the Windows SDK or WDK with Debugging Tools for Windows selected. If you already have the debugging tools, skip the WinDbg install.

2. Download mcp-windbg · PowerShell

New-Item -ItemType Directory -Force "C:\tools" | Out-Null
Invoke-WebRequest `
  "https://github.com/svnscha/mcp-windbg/releases/latest/download/mcp-windbg.exe" `
  -OutFile "C:\tools\mcp-windbg.exe"

The executable carries its own Python interpreter and is code signed; Get-AuthenticodeSignature C:\tools\mcp-windbg.exe should report Valid, and every release publishes a SHA256SUMS file. Prefer pip, uvx or the Claude Code plugin? Those routes are in the setup guide.

claude mcp add mcp-windbg -s user `
  -e "_NT_SYMBOL_PATH=SRV*C:\Symbols*https://msdl.microsoft.com/download/symbols" `
  -- "C:\tools\mcp-windbg.exe"

{
  "servers": {
    "mcp_windbg": {
      "type": "stdio",
      "command": "C:\\tools\\mcp-windbg.exe",
      "env": {
        "_NT_SYMBOL_PATH": "SRV*C:\\Symbols*https://msdl.microsoft.com/download/symbols"
      }
    }
  }
}

claude

> Analyze C:\dumps\app.dmp and tell me why it crashed.

open_cdb_dump  C:\dumps\app.dmp
run_cdb_command !analyze -v
run_cdb_command kb

The crash is a null dereference in Renderer::Flush ...

For VS Code, put the snippet in .vscode/mcp.json. Claude Desktop and Cursor take the same command with no arguments.

Tool surface

Ten tools, one debugger.

Every tool maps to something you would do by hand in WinDbg. Sessions carry ids, so several dumps or targets can be open at once.

list_dumps List crash dump files in a directory
open_cdb_dump Open and triage a crash dump
open_cdb_remote Attach to a user-mode remote debug server
open_kd_session Attach to a kernel target
run_cdb_command Run a command on a user-mode session
run_kd_command Run a command on a kernel session
send_ctrl_break Break into a running live session
wait_for_break Wait for the target to stop after a resume
close_cdb_session Close a user-mode session
close_kd_session Close a kernel session

From the blog

Articles.

Release notes, the story behind the project, and what AI-assisted crash analysis looks like in practice.

Open source · MIT

Built in the open.

mcp-windbg is maintained on GitHub, with the release executable signed by my company, Liasoft. Stars, issues and pull requests keep it moving.

GitHub stars: 1.6k
Downloads / month: 2.3k
License: MIT

Star on GitHub Contribute Report a bug

mcp-windbg

WinDbg, with a conversation on top.

Crash dump analysis

User-mode remote debugging

Kernel debugging

Redaction and transport

From "it crashed" to "here is why".

Install the tools, then ask.

Ten tools, one debugger.

Articles.

Built in the open.