# 🚀 New Release: mcp-windbg 1.0.0

> Kernel debugging, session IDs, and a redesigned tool surface. The first stable release.

- Published: 2026-07-16
- Author: Sven Scharmentke
- Canonical: https://svnscha.de/posts/mcp-windbg-1-0-0-release/
- Tags: ai, debugging, mcp-windbg, copilot, crash-analysis, kernel, release

---

I've just released version 1.0.0 of **mcp-windbg**. Yes, one-point-zero. The headline: **your AI assistant can now debug the Windows kernel.** The fine print: every tool has a new name, so bring your prompts. Both below.

## Kernel Debugging

Three new tools, `open_kd_session`, `run_kd_command`, and `close_kd_session`, drive `kd.exe` against a live kernel target over the connections you would actually use:

- **KDNET** (`net:port=...,key=...`)
- **Named pipes** (`com:pipe,port=\\.\pipe\...`) - the classic VM setup
- **Serial** - because sometimes it is 2003 in your lab and that is fine

Point your assistant at a VM, ask what that driver is up to, and let it run `!process`, `!irql`, `lm`, and friends while you have your coffee.

A kernel target is not a dump file: break in at the wrong moment and you have halted an entire machine. The tools are built around that reality:

- **Sessions arrive already stopped.** `open_kd_session` waits for the connect banner and breaks in for you.
- **Closing resumes the target.** `close_kd_session` sends `g` by default; pass `resume: false` only if you want the machine frozen on purpose.
- **`--kd-path`** points the server at a specific `kd.exe`, the counterpart to `--cdb-path`.

There are also two new guided prompts to go with it: **`kernel-triage`** investigates a kernel target (including telling a real bugcheck apart from a plain break-in, and releasing the machine at the end), and **`remote-triage`** does the same for a live user-mode process.

## Session IDs

The other big change: sessions are now first-class. Every `open_*` tool returns an opaque **session ID** (`cdb-…` or `kd-…`), and `run_*`, `close_*`, and `send_ctrl_break` address a session by that ID. No more implicit sessions, no more addressing by dump path: open first, then talk. Opening the same dump twice gives you two independent sessions.

The kind is enforced, too: pass a `cdb` ID to `run_kd_command` and you get an error naming the right tool. That matters more than it sounds when the caller is a model that occasionally guesses.

## The Breaking Changes

The old names conflated the product (WinDbg) with the engines doing the work (`cdb.exe` for user mode, `kd.exe` for kernel). That distinction is now load-bearing, so everything got renamed:

| 0.x | 1.0.0 |
|---|---|
| `list_windbg_dumps` | `list_dumps` |
| `open_windbg_dump` | `open_cdb_dump` |
| `open_windbg_remote` | `open_cdb_remote` |
| `run_windbg_cmd` | `run_cdb_command` / `run_kd_command` |
| `close_windbg_dump`, `close_windbg_remote` | `close_cdb_session` |

Also: `send_ctrl_break` takes a `session_id`, and the `connection_type` parameter is gone because the tool name now says which engine you mean. If you have prompts or agent instructions written against the 0.x names, they need updating - that is exactly why this is 1.0.0 and not 0.16.0. The [docs](https://svnscha.github.io/mcp-windbg/) are rewritten around the new flow, including a "Debug a kernel target" guide.

## Smaller, But You Will Notice

- **Per-call timeouts**: `timeout_seconds` on any `open_*` / `run_*` overrides that tool's default. Useful when that one `!analyze -v` against a 30 GB dump needs its time.
- **A slow command no longer wedges the session.** On timeout the server breaks in with CTRL+BREAK and resynchronizes, so the session is usable for the next command instead of stranded.
- **Output goes to the right command.** Every command waits on its own unique completion marker, so late output from a slow command can never be mistaken for the next one's result.
- **No more orphaned debuggers.** `cdb.exe` launched via the Microsoft Store aliases spawns a child that a plain terminate left behind, still holding the target. Shutdown now kills the whole process tree.

## Getting Started

Still a one-liner:

```bash
pip install mcp-windbg
```

Full release notes are on the [v1.0.0 release page](https://github.com/svnscha/mcp-windbg/releases/tag/v1.0.0), and the project lives at [github.com/svnscha/mcp-windbg](https://github.com/svnscha/mcp-windbg). A star is always appreciated.

## One-Point-Zero

Fourteen months ago this was a [weekend experiment](/posts/ai-meets-windbg/). Today it sits at 1.4k stars and debugs kernels. Calling it 1.0 is a promise more than a milestone: the names are stable now, and breaking changes from here on will be rare and loud.

Here is to stable.

---

*If mcp-windbg has helped you, I would love to hear about it. Reach out, open an issue, or just star the [repository](https://github.com/svnscha/mcp-windbg). Thank you all.*