svnscha - debugging

🚀 New Release: mcp-windbg 1.3.0

2026-09-10T00:00:00+00:00

Version 1.3.0 of mcp-windbg separates the Claude Code integration into three plugins. If you've already installed mcp-windbg yourself, you can now add the debugging skills and crash-analysis agent to that connection.

Three Separate Plugins

The 1.2.0 release bundled the server, skills, and agent together. I split them so you can choose the parts you need:

Plugin	What it provides
`mcp-windbg-uvx`	The MCP server, launched with uvx, and default symbol settings
`mcp-windbg-skills`	Four debugging skills
`mcp-windbg-agents`	The `crash-analyst` agent

The uvx plugin now ships only the server configuration. Skills and agents are independent: install either, both, or neither.

Skills and Agents for Your Existing Server

If mcp-windbg is already registered in Claude Code, add the marketplace and install the workflows you want:

/plugin marketplace add svnscha/mcp-windbg
/plugin install mcp-windbg-skills@mcp-windbg
/plugin install mcp-windbg-agents@mcp-windbg

The skills cover the same four tasks:

analyze-dump for crash dump analysis.
debug-remote for live user-mode debugging.
kernel-debug for live kernel debugging.
windbg-doctor for checking the debugging setup.

They use your configured MCP connection, whether it runs a native executable, a Python installation, or an HTTP service. Setup diagnosis checks that server's actual launcher and host. It no longer assumes every installation needs uv.

For example:

/mcp-windbg-skills:analyze-dump C:\dumps\app.dmp

The agent is available as mcp-windbg-agents:crash-analyst. It investigates a dump and reports its likely cause, debugger evidence, and next steps. It uses the MCP tools directly and does not need the skills plugin.

If you want the plugin to start the server through uvx, install it as well:

/plugin install mcp-windbg-uvx@mcp-windbg

Windows and CDB/KD are still required on the debugging host. The server's built-in MCP prompts are available independently of these plugins.

Enterprise environments: Managed allowedMcpServers settings can cause Claude Code to silently skip plugin-bundled MCP servers (issue #32882). I recommend manual installation and registration plus the skills plugin, with the agents plugin if needed. The server must still be permitted by your organization's MCP policy.

Upgrading from the Bundled Plugin

Update the marketplace and server plugin:

/plugin marketplace update mcp-windbg
/plugin update mcp-windbg-uvx@mcp-windbg

Then install the skills and agents plugins using the commands above if you want to keep those workflows.

Skill commands now start with /mcp-windbg-skills: instead of /mcp-windbg:. For example, /mcp-windbg:analyze-dump becomes /mcp-windbg-skills:analyze-dump. References to the agent should use mcp-windbg-agents:crash-analyst. Restart Claude Code if the new components do not appear.

See the full v1.3.0 release notes and the plugin guide for installation, switching servers, and updating each plugin.

🚀 New Release: mcp-windbg 1.2.2

2026-09-05T00:00:00+00:00

Version 1.2.2 of mcp-windbg is out. This release fixes missing Unicode output on Windows systems that use a multibyte code page, including Chinese, Japanese, and Korean systems.

The bug was reported by a community member in issue #102. Thanks for taking the time to provide a clear report and help track it down.

The Problem

The du command, which displays a Unicode string, sometimes returned an empty result through mcp-windbg. Running the same command directly in CDB worked as expected. Other commands such as db and dw also worked against the same address.

The important detail was the reporter's Chinese Windows system locale.

What Caused It

mcp-windbg communicates with cdb.exe through a pipe. It sends a command and reads the debugger's response from that pipe.

On multibyte system code pages, such as Chinese 936, Japanese 932, Korean 949, or the "Use Unicode UTF-8" setting, CDB can truncate text while writing it to a pipe. The end of a line may be missing, including the closing quote and newline.

For du, this could remove the entire string. If the output was cut in the middle of a character, later commands could also time out because the session could no longer parse the incomplete output correctly.

This only affects redirected output, which is why the command still looks correct when run in a normal debugger window. There is no CDB option that fixes the pipe output; interactive mode, batch mode, and ANSI log files all show the same problem.

The Fix

CDB can write complete UTF-16 log files using .logopen /u, so mcp-windbg now uses one on affected systems. The pipe is still used to manage command timing, but the command output itself is read from the UTF-16 log.

This is not a special case for du. It also fixes Unicode text in module paths, !analyze output, string dumps, and other debugger commands. Systems with a single-byte code page continue to use the existing pipe-based output.

I tested the fix with real crash dumps, a live kernel target, and remote sessions using the 1252, 936, and 65001 code pages.

Getting Started

Upgrade with:

pip install -U mcp-windbg

If you use the Claude Code plugin, update the plugin to pick up the new version.

The project is available on GitHub. If you notice any other commands behaving differently on a non-English Windows system, please open an issue.

🚀 New Release: mcp-windbg 1.2.0

2026-08-27T00:00:00+00:00

Version 1.2.0 of mcp-windbg adds a Claude Code plugin. It packages the MCP server together with the instructions and workflows needed for common debugging tasks, so Claude Code can install and use it without a separate Python setup or a hand-written MCP configuration.

Installing the Plugin

Add the mcp-windbg marketplace and install the plugin from Claude Code:

/plugin marketplace add svnscha/mcp-windbg
/plugin install mcp-windbg-uvx@mcp-windbg

The plugin starts mcp-windbg with uvx, which downloads the pinned version from PyPI the first time it runs. You still need Windows, CDB, and uv, but you do not need to install the Python package yourself.

The existing pip install mcp-windbg setup remains available for other MCP clients and for anyone who prefers a manual configuration.

Skills for Common Debugging Tasks

The plugin includes four skills:

analyze-dump guides the analysis of a Windows crash dump.
debug-remote works with a live user-mode target through CDB.
kernel-debug handles live kernel debugging with KD.
windbg-doctor checks the local setup when CDB, KD, symbols, or the MCP server are not working as expected.

These skills only load when they are needed, which keeps the plugin's normal context use small. The underlying MCP tools are still available directly when you want to run a specific command or control a session yourself.

The Crash Analyst Agent

The plugin also includes a read-only crash-analyst agent. It can investigate a dump independently and return:

its likely cause
the debugger evidence supporting that conclusion
alternative causes it checked
practical next steps

The agent is kept away from mutating tools. It can inspect a debugging session, but it cannot resume a target or perform another action that would change its state.

Symbols by Default

Readable stack traces depend on symbols, and missing symbol configuration is a common source of poor results. The plugin now provides the Microsoft symbol server as the default value for _NT_SYMBOL_PATH.

If you already have _NT_SYMBOL_PATH configured, the plugin leaves it unchanged. Existing private symbol servers and custom cache paths therefore continue to work.

A Small 1.2.1 Follow-up

Version 1.2.1 followed later the same day. It reorganized the README installation guide by client and fixed a corrupted C:\dumps\app.dmp example that contained a hidden control character. There were no runtime changes, so it does not need a separate post.

Getting Started

Use the two plugin commands above for Claude Code, or upgrade the Python package for another MCP client:

pip install -U mcp-windbg

See the full release notes for v1.2.0 and v1.2.1. The source and plugin marketplace are available in the mcp-windbg repository.

🚀 New Release: mcp-windbg 1.1.0

2026-08-26T00:00:00+00:00

Version 1.1.0 of mcp-windbg is out. It's the first release since 1.0.0, which was broken on fresh installs for some time.

What Happened: 1.0.1

The dependency was mcp>=1.28.1 with no upper bound. When the MCP Python SDK shipped 2.0.0 - renaming McpError to MCPError and dropping the @server.list_tools() decorator - every fresh install broke at import:

ImportError: cannot import name 'McpError' from 'mcp.shared.exceptions'

Existing installs worked fine; only new ones broke. That's the worst kind of bug: invisible to anyone who could report it. 1.0.1 capped the requirement at <2.0.0. Thanks to @aphroteus for the fix and @arjunarjun07 for finding the cause.

If you're still on 1.0.0, run pip install --upgrade mcp-windbg. Any pip install "mcp<2" workaround can go.

Support for the 2.x SDK

A cap is a stopgap, not a fix. 1.1.0 runs on mcp>=2.0.0: handlers are passed straight to Server(...) instead of registered via decorators, and they return the SDK's result types (ListToolsResult, CallToolResult).

Nothing changes for clients - same tools, same schemas, stdio and streamable-http both work as before. Python support is unchanged (the 2.x SDK wants 3.10+, like this project already did).

Two changes so the next SDK release is boring instead of another five silent weeks:

All runtime dependencies are capped at the next major version. Without a ceiling, moving to 2.x would have left the same trap for 3.0.0. Since mcp-windbg is an application, not a library, upper bounds can't conflict with anything downstream - a breaking SDK release just becomes a failing CI run.
A weekly canary tests what users actually get. CI installed from uv.lock, so it only tested pinned versions, while real installs resolve whatever the ranges allow. The canary ignores the lock, installs the newest allowed versions, and runs the test suite every Monday. It's scheduled rather than tied to pull requests on purpose: an upstream break should page me, not block someone's unrelated PR.

`wait_for_break`

The one new tool. Resume a target with g, go do something else, then call wait_for_break to block until it stops again - breakpoint, bugcheck, or CTRL+BREAK. It returns everything the debugger printed along the way.

If the wait expires, the target keeps running. Waiting never halts your machine behind your back.

Fixing `g` Freezing the Target

This was bad and hid for a while, so let me be honest about it.

Go-class commands (g, gh, gn, gN, gc, gu) hand control back to the target, after which the debugger stops reading stdin. The server queued an .echo marker behind the g, which never got answered - so the command sat until timeout, and the timeout's CTRL+BREAK halted the target again. Ask the machine to run, get it frozen a minute later. The opposite of what you asked for.

Go-class commands are now sent bare and return immediately. Step commands (p, t, pa, ta, ...) are unaffected.

Fixing that exposed several related problems:

A command right after g breaks in cleanly. No manual send_ctrl_break, and the target's output isn't thrown away.
A break-in sent immediately after g no longer gets lost. Resuming used to return before the debugger read the g, leaving a window where a CTRL+BREAK hit the prompt instead of the target. Against a live KDNET target, a break sent with no gap was lost every single time. The resume is now confirmed consumed before reporting success.
Break-in checks before signaling. A CTRL+BREAK aimed at an already-stopped target would queue and re-halt it later. The session now probes for a prompt first and only signals if there's no answer, making speculative send_ctrl_break calls safe.
bp nt!X; g reports whether the breakpoint was set. A typo'd symbol now shows up as Couldn't resolve error instead of an endless wait.
One operation per session at a time. wait_for_break parks on a worker thread while the server keeps answering other requests; a second call on the same session is refused immediately. Closing a session also ends any wait parked on it.
Kernel sessions over named pipe or serial connect. kd announces those links with a different message than KDNET, and only the latter was matched - so sessions that were actually attached timed out.

Getting Started

Still one line:

pip install mcp-windbg

Release notes: v1.1.0 - Docs: svnscha.github.io/mcp-windbg - Source: github.com/svnscha/mcp-windbg

Summary

No headline features here. Just a dependency cap, a canary, one new tool, and a long list of places where the debugger and the server disagreed about who was talking. That's what a .1 release should be - especially after a 1.0.0 nobody could install.

If mcp-windbg has helped you, I'd love to hear about it. Open an issue, reach out, or star the repository. Thank you.

🚀 New Release: mcp-windbg 1.0.0

2026-07-16T00:00:00+00:00

I've just released version 1.0.0 of mcp-windbg. Yes, one-point-zero. The headline: your AI assistant can now debug the Windows kernel. The fine print: every tool has a new name, so bring your prompts. Both below.

Kernel Debugging

Three new tools, open_kd_session, run_kd_command, and close_kd_session, drive kd.exe against a live kernel target over the connections you would actually use:

KDNET (net:port=...,key=...)
Named pipes (com:pipe,port=\\.\pipe\...) - the classic VM setup
Serial - because sometimes it is 2003 in your lab and that is fine

Point your assistant at a VM, ask what that driver is up to, and let it run !process, !irql, lm, and friends while you have your coffee.

A kernel target is not a dump file: break in at the wrong moment and you have halted an entire machine. The tools are built around that reality:

Sessions arrive already stopped. open_kd_session waits for the connect banner and breaks in for you.
Closing resumes the target. close_kd_session sends g by default; pass resume: false only if you want the machine frozen on purpose.
--kd-path points the server at a specific kd.exe, the counterpart to --cdb-path.

There are also two new guided prompts to go with it: kernel-triage investigates a kernel target (including telling a real bugcheck apart from a plain break-in, and releasing the machine at the end), and remote-triage does the same for a live user-mode process.

Session IDs

The other big change: sessions are now first-class. Every open_* tool returns an opaque session ID (cdb-… or kd-…), and run_*, close_*, and send_ctrl_break address a session by that ID. No more implicit sessions, no more addressing by dump path: open first, then talk. Opening the same dump twice gives you two independent sessions.

The kind is enforced, too: pass a cdb ID to run_kd_command and you get an error naming the right tool. That matters more than it sounds when the caller is a model that occasionally guesses.

The Breaking Changes

The old names conflated the product (WinDbg) with the engines doing the work (cdb.exe for user mode, kd.exe for kernel). That distinction is now load-bearing, so everything got renamed:

0.x	1.0.0
`list_windbg_dumps`	`list_dumps`
`open_windbg_dump`	`open_cdb_dump`
`open_windbg_remote`	`open_cdb_remote`
`run_windbg_cmd`	`run_cdb_command` / `run_kd_command`
`close_windbg_dump`, `close_windbg_remote`	`close_cdb_session`

Also: send_ctrl_break takes a session_id, and the connection_type parameter is gone because the tool name now says which engine you mean. If you have prompts or agent instructions written against the 0.x names, they need updating - that is exactly why this is 1.0.0 and not 0.16.0. The docs are rewritten around the new flow, including a "Debug a kernel target" guide.

Smaller, But You Will Notice

Per-call timeouts: timeout_seconds on any open_* / run_* overrides that tool's default. Useful when that one !analyze -v against a 30 GB dump needs its time.
A slow command no longer wedges the session. On timeout the server breaks in with CTRL+BREAK and resynchronizes, so the session is usable for the next command instead of stranded.
Output goes to the right command. Every command waits on its own unique completion marker, so late output from a slow command can never be mistaken for the next one's result.
No more orphaned debuggers. cdb.exe launched via the Microsoft Store aliases spawns a child that a plain terminate left behind, still holding the target. Shutdown now kills the whole process tree.

Getting Started

Still a one-liner:

pip install mcp-windbg

Full release notes are on the v1.0.0 release page, and the project lives at github.com/svnscha/mcp-windbg. A star is always appreciated.

One-Point-Zero

Fourteen months ago this was a weekend experiment. Today it sits at 1.4k stars and debugs kernels. Calling it 1.0 is a promise more than a milestone: the names are stable now, and breaking changes from here on will be rare and loud.

Here is to stable.

If mcp-windbg has helped you, I would love to hear about it. Reach out, open an issue, or just star the repository. Thank you all.

🚀 New Release: mcp-windbg 0.15.0

2026-06-09T00:00:00+00:00

I've just released version 0.15.0 of mcp-windbg. It has been a while since the 0.12.2 post, and three releases have landed since then. Rather than a single feature, this is a round-up of everything that has shipped: a way to break into a running session, a hook to scrub sensitive data before it ever reaches the model, and a proper documentation site to tie it all together.

What's New

Break into a live session

If you have used a real debugger, you know the moment: the process is spinning, you want to know what it is doing right now, and you reach for CTRL+BREAK. That now works through the MCP interface too.

The new send_ctrl_break tool, contributed by @GeoYS, interrupts an active CDB/WinDbg session, for both dump and remote debugging workflows. So when you are driving a live target and it wanders off into a tight loop or a long wait, the model can break in, inspect the state, and carry on, the same way you would at the keyboard. This closes a real gap: before, a live session that was busy was a session you could only wait on.

Redact sensitive data before it leaves the machine

Crash dumps are full of things you might not want to hand to a model: file paths with usernames, machine names, environment variables, command lines, sometimes worse. The new --filter-script option lets you point the server at a trusted Python helper that can rewrite string-valued tool arguments and tool text output on the way through.

The important part is the boundary. Your script only sees the string values, not the full MCP protocol messages, so you can do focused PII redaction (mask a username, strip a token, normalize a path) without writing a protocol-aware proxy. If you run a centralized analysis service, this is the piece that lets you control what actually crosses the wire.

A real documentation site

The project has outgrown a README and a wiki. There is now a proper documentation site built with MkDocs Material and deployed to GitHub Pages. It covers getting started, the individual use cases, and a reference for the command-line options, the tools, and client configuration.

A few highlights worth calling out:

Use-case guides for the things people kept asking about: running the server over HTTP to debug from another machine, and scrubbing tool output to redact sensitive data.
The built-in dump-triage prompt is now documented, including its dump_path argument, so you can trigger a full structured triage without hand-writing the workflow.
Honest limitations are written down rather than discovered the hard way: the HTTP transport has no authentication, attach-by-PID is not supported, and sessions run concurrently.

Quieter, sturdier foundations

This release also includes several smaller changes that matter in daily use:

The stdio transport no longer crashes on a malformed input line. A single unparseable line used to tear down the whole process; now it is logged and the server keeps running.
The test suite was rebuilt as a declarative end-to-end harness. Every scenario runs against a really-hosted python -m mcp_windbg server driven by a real MCP client, with only the LLM faked. Coverage now sits above 90 percent, measured in the subprocess where tool dispatch actually runs.
Package metadata is complete, so pip show and the PyPI page now carry the author, project URLs, and proper classifiers.
Symbols resolve more often out of the box: the dump's own directory is now auto-included in the symbol search path, so PDBs sitting next to a dump are found without extra configuration.

Community Contributions

This stretch of releases leaned on the community, and two contributions stand out:

@GeoYS added the live break-in feature in #40, which became the send_ctrl_break tool above. It is the headline of the 0.13.0 release.
@SSyl made symbols just work in more cases by auto-including the dump directory in the symbol search path (#41).

This is exactly the kind of contribution that makes a tool better for everyone, not just the person who filed it. Thank you both.

Getting Started

Installation is unchanged and still a one-liner:

pip install mcp-windbg

The project is open source and available on GitHub at https://github.com/svnscha/mcp-windbg. If you find it useful, a star on the repository is always appreciated.

A Year and a Month In

It is hard to believe, but mcp-windbg is now a year and a month old. When I first wrote about it in May 2025, it was a weekend experiment to scratch my own itch: I was tired of typing the same WinDbg commands over and over, and I wanted to see whether a model could drive the debugger for me. I genuinely did not expect it to go anywhere.

It went somewhere. The repository now sits at 1.4k stars, the original article reached tens of thousands of readers in its first days, and the project has shown up in conversations, talks, and threads far beyond anything I planned. People have used it to triage real production crashes, wired it into team workflows, and sent screenshots of it cracking bugs that had been open for weeks. Every one of those still makes my day.

What has meant the most, though, is not the numbers. It is the people. Contributors who saw a gap and just fixed it. Folks who filed thoughtful issues, asked sharp questions, or pushed back when something did not work the way they needed. The many of you who reached out directly, by email, on LinkedIn, in DMs, to say the tool saved you an afternoon, or to suggest where it should go next. A project like this is only as good as the community around it, and this one has been generous well beyond what I could have hoped for.

So this is mostly a thank-you note. Thank you for the stars, the pull requests, the issues, the messages, and for trusting a small open-source tool with your hardest crashes. You are the reason it keeps getting better, and the reason I keep shipping.

Here is to the next year.

If mcp-windbg has helped you, I would love to hear about it. Reach out, open an issue, or just star the repository. Thank you all.

Introducing Native Windows Debugging for VS Code: Kernel & Remote Debugging

2026-06-07T00:00:00+00:00

Remember the Cliffhanger?

A while back I wrote about the joy of writing a debugger adapter for Visual Studio Code. It started with a simple wish - I just wanted a faster way to remote-debug a service running in a VM - and ended with a working proof of concept: VS Code driving WinDbg through a custom Debug Adapter Protocol implementation.

But that post ended on an honest note:

I have not implemented remote debugging or kernel debugging yet, but I now feel ready to take a real shot at both without getting lost in the basics again.

Well. I took the shot.

Remote debugging works. Kernel debugging works. And the whole thing is now a real, installable VS Code extension: Native Windows Debugging (dbgeng).

Debug native Windows code - C and C++ programs, services, and even the Windows kernel - straight from Visual Studio Code, using the same engine that powers WinDbg.

That's the whole pitch in under two minutes. Now let me show you what's behind it.

Get It Right Now

No waiting, no building from source:

Marketplace: Native Windows Debugging (dbgeng)
Source: github.com/svnscha/dap-dbgeng (MIT licensed)
Docs: svnscha.github.io/dap-dbgeng

The adapter is bundled inside the extension, so there's nothing separate to build, download, or point at. Install it, write a launch.json, press F5. That's it.

Four Ways to Debug - Two of Them Were Never Possible Before

VS Code has always had great local debugging for plenty of languages. But the moment you wanted native Windows remote or kernel debugging, you hit a wall. That stack lives in Visual Studio and WinDbg, not in VS Code - because of course it does.

This extension closes exactly that gap. One adapter, four scenarios:

Local - the debugger starts your program and debugs it from launch.
Attach - connect to a process that's already running, by its PID.
Remote - debug a user-mode process on another machine via dbgsrv.
Kernel - debug kernel-mode drivers and the OS around them.

The first two are the comfortable ones. The last two are the gap I set out to close. Let's walk through them.

Local: The Comfortable Starting Point

Start simple. The debugger launches your program and you step through it like any other debugger in VS Code. It's just a launch.json:

{
  "name": "Debug myapp",
  "type": "dbgeng",
  "request": "launch",
  "program": "${workspaceFolder}/build/Debug/myapp.exe",
  "stopAtEntry": true
}

program is the only thing you really have to provide. dbgeng.dll is found automatically from your installed Windows SDK, so you usually don't even set a path. Set a breakpoint, press F5, and you get the full loop: continue, step over, step into, step out, call stack, locals, watch expressions, and a Debug Console that evaluates expressions through the real engine.

If you use the CMake Tools extension, you can even drop the program line entirely - the adapter defaults to your selected CMake launch target. Point CMake's debug command at the dbgeng type and CMake: Debug just works.

Attach: Already Running? Just Connect

Sometimes the process is already alive and you don't want to restart it. Attach to it by its process ID:

{
  "name": "Attach to myapp",
  "type": "dbgeng",
  "request": "attach",
  "processId": 12345
}

Don't know the PID off the top of your head? Set "processId": "${command:dap-dbgeng.pickProcess}" and you get a process picker at debug time. Same familiar VS Code interface, with the real Windows debug engine underneath.

Remote: My Favorite Part

This was the first scenario I implemented: debugging a user-mode process on another machine while keeping the debug engine and symbols on the local system.

The trick is the Windows process server, dbgsrv. You run it on the target, and your machine connects to it over TCP (or a named pipe).

On the target, start the process server:

dbgsrv -t tcp:port=5005

On your machine, point a launch.json at it:

{
  "name": "Attach on TARGETPC",
  "type": "dbgeng",
  "request": "attach",
  "processId": "${command:dap-dbgeng.pickProcess}",
  "connectionString": "tcp:port=5005,server=TARGETPC"
}

Press F5, pick the remote process from the list (the picker now shows processes on the dbgsrv host), and you're debugging it remotely. The engine and symbols never leave your machine - only the debuggee lives on the other side.

This is precisely the workflow I wanted at the very beginning: compile locally, deploy to the VM, attach, get back to work. Now it's a one-keystroke thing.

Kernel: Yes, Really

And then there's the big one. Kernel-mode debugging from VS Code.

Kernel debugging is whole-machine, so you need two boxes: a host (VS Code + the adapter) and a target being debugged - almost always a throwaway VM, because kernel debugging halts the entire target at breakpoints.

On the target, enable kernel debugging and reboot:

bcdedit /debug on
bcdedit /dbgsettings net hostip:<HOST-IP> port:50005 key:1.2.3.4

On the host, point a kernel config at it:

{
  "name": "Debug driver (KDNET)",
  "type": "dbgeng",
  "request": "attach",
  "kernel": true,
  "connectionString": "net:port=50005,key=1.2.3.4"
}

kernel: true flips the adapter into kernel mode and turns connectionString into a kernel transport. There's no processId here - the session is the whole machine. Press F5, it connects over KDNET, and breaks at DriverEntry. From the same editor people keep telling me is "just a text editor."

Kernel debugging. Just another breakpoint. That still feels a little unreal to type.

KDNET isn't the only option, either - the same connectionString field speaks serial (named pipe), 1394, and USB transports too. Whatever your VM or test box gives you.

How It Works

A few things changed since the proof of concept, and they're worth a mention.

It talks to the engine natively. The adapter uses the real DbgEng APIs throughout - IDebugClient, IDebugControl, IDebugSymbols, IDebugSystemObjects, with IDebugEventCallbacks and IDebugOutputCallbacks for events. No fragile text-scraping of WinDbg console output. When the engine knows something, the adapter asks it directly.

The protocol layer is still generated. That code-generation step I was so happy about last time paid off again. src/protocol/ is generated from the official DAP schema, so every request, response, and event stays in lockstep with the spec instead of drifting from hand-written DTOs.

The POC grew up - and changed language. The original proof of concept was C#. Hardening it into something I'd actually ship meant rebuilding the adapter in C++20 (CMake + Ninja, vcpkg manifest mode), sitting much closer to the engine it wraps. That was part of the "harden the rough edges" plan, and it made the kernel and remote work far less painful.

It records itself. There's a built-in session-trace recorder that doubles as the project's replay-test format. Recorded sessions get replayed against real test debuggees in CI, so the behaviors you see in those videos are the same behaviors the test suite asserts on.

An Honest Word on Scope

I'm keeping the same promise I made in the first post: the adapter advertises only what it implements correctly, rather than dangling buttons that misbehave.

What works today: line and conditional breakpoints, step over/into/out, continue, pause, instruction-level stepping in the disassembly view, call stack with delayed frame loading, variables and scopes (including registers), set-variable, expression evaluation in the Watch pane and Debug Console, disassembly view, and clean terminate/disconnect.

What's planned but not advertised yet: function breakpoints, data breakpoints (watchpoints), hit-conditional breakpoints, logpoints, read/write memory, a modules view, evaluate-on-hover, and hex formatting toggles. The engine can do all of these - the adapter just doesn't expose them yet. The features reference keeps the full, deliberately conservative list.

And here's the escape hatch: anything the UI doesn't surface, you can usually still do by typing native debugger commands straight into the Debug Console. It's the real engine - it'll answer.

Getting Started

If you want to try it, the whole loop is about ten minutes:

Install Native Windows Debugging (dbgeng) from the Marketplace.
Make sure you have Debugging Tools for Windows (it ships dbgeng.dll, via the Windows SDK or WDK installer). The adapter finds it automatically.
Drop a dbgeng configuration into .vscode/launch.json - pick the scenario from above.
Set a breakpoint, press F5.

The Getting Started guide walks through it in detail, and each scenario has its own page in the docs.

Your Turn

This is open source, and it's at the stage where real-world usage is the most valuable thing it can get. So:

⭐ Star it on GitHub if it's useful to you.
🐛 Report a bug through the issue tracker - the templates tell you what to include.
🔧 Contribute if you're into native Windows debugging internals; see CONTRIBUTING.md.

Summary

Last time I closed with "I just want to remote debug a service on a VM." That was the entire ambition.

It turned into DAP, a code generator, a dbgeng wrapper, a pile of state-machine bugs - and now remote debugging, kernel debugging, a published extension, and a documentation site.

The gap between "VS Code can't do native Windows kernel and remote debugging" and "actually, now it can" is closed. With the same engine that powers WinDbg, sitting quietly behind the editor you already use every day.

And yes - it still started with "I just want to remote debug a service on a VM."

P.S. - One More Thing About Those Videos

While you're here: how did you actually like the videos? Be honest.

Because here's the fun part - this is the first time I generated end-to-end videos, all the way from Claude to YouTube. No editing suite, no timeline scrubbing, no manual voiceover takes. Just prompting and vibing until it looked right.

The stack, if you're curious:

Remotion for the video itself - everything you see is React, rendered to MP4. Code as video turns out to be a really nice fit for the "iterate fast" loop.
My DGX Spark doing the heavy lifting locally.
MOSS-TTS for the voice. And here's a little detour: I first deep-cloned my own voice. The result was genuinely impressive - but not quite perfect, and the "almost me" uncanny gap bugged me more than I expected. So I switched to a fully synthesized voice instead, and I was happier with that than with a not-quite-right clone of myself.

I think that's pretty cool. A little surreal, honestly. The same "describe what you want, iterate, ship" loop that built the debugger also produced the launch video for it.

So let me know what you think - of the extension and of the videos. What worked, what felt off, what you'd want next. There's no comment box here, so just hit me up (LinkedIn or GitHub) or open an issue. I'm genuinely curious.

The Joy of Writing a Debugger Adapter for Visual Studio Code

2026-04-15T00:00:00+00:00

Current State

Before I get into the story, here is the current result: Visual Studio Code debugging a C++ application with WinDbg under the hood through my first proof of concept integration.

Right now this is still an early POC, not a finished debugger experience. It proves the architecture works and that VS Code can drive WinDbg through a custom adapter, but it still needs a lot more iteration before I would call it really useful.

One detail I already like is that the debugger command window is not a fake simplified console. I can type regular WinDbg commands straight into it.

Why

Because I do what I always do when a workflow annoys me: I build a tool until the annoyance goes away.

This time the pain point was remote debugging a service application running inside a VM. My ideal flow was simple:

Compile locally
Deploy to the VM
Start or restart the service
Attach a debugger
Get back to work without ten minutes of clicking around

That sounded perfectly reasonable: a small helper extension for Visual Studio Code, a bit of automation, some launch configuration glue, and done.

That was the plan.

It did not stay the plan.

Removing Friction

I started with the pragmatic part first: automate the annoying steps.

I wired up a helper extension that could compile the service, copy the binaries to the VM, and prepare the remote machine for debugging. This is my favorite kind of productivity work, because the payoff is immediate. Every bit of friction you remove saves time again and again.

Once the plumbing was in place, I expected the final step to be easy: tell VS Code to remote debug the service and call it a day.

Instead, I hit a wall.

VS Code Is Not Visual Studio

At first glance, this feels like something that should already exist. Visual Studio has mature debugging capabilities. VS Code has debugging. Microsoft builds both. Surely there must be a supported path to do classic remote Windows debugging from VS Code, right?

Not really.

The more I dug into it, the clearer it became that the debugging stack in VS Code is a different world. VS Code speaks the Debug Adapter Protocol, or DAP. It expects debugger extensions to implement that protocol and sit between the editor and the actual debugger engine.

That part is good. DAP is a clean idea.

The frustrating bit was this: the specific native Windows remote-debugging flow I wanted was not available through a supported public route in VS Code. The Visual Studio native debugger stack is not something you can just plug into from your own VS Code extension and say, "Thanks, I will take remote debugging from here." And the VS Code side does not magically inherit Visual Studio's remote debugging capabilities just because both products come from Microsoft.

So after spending time exploring options, the conclusion was simple:

There was no supported way to get the workflow I wanted with the existing pieces.

Building It Anyway

Once I accepted that I would not be wiring together existing public APIs, the problem changed shape.

The question was no longer, "How do I enable remote debugging in VS Code?"

It became:

"What debugger engine can I control myself, and how do I make VS Code talk to it properly?"

That is where WinDbg entered the story.

WinDbg already knows how to do the important parts. User-mode debugging. Remote debugging. Kernel debugging. Crash dump analysis. It is a serious tool with decades of capability behind it.

But again, my tool of choice did not give me the VS Code experience I wanted out of the box.

So the next step was clear:

Build a debugger adapter for WinDbg.

Learning DAP

If you want to integrate a debugger with VS Code, DAP is the contract. Once I sat down and read it properly, a lot of things clicked.

The official home for it is the Debug Adapter Protocol website, and that site is worth bookmarking because it has both the overview and the actual specification. At the time I was working through this, the important mental model was simple: VS Code and the adapter exchange JSON messages with a very predictable shape, and the protocol defines what those messages are supposed to mean.

The protocol is straightforward. VS Code sends requests like initialize, launch, attach, setBreakpoints, stackTrace, variables, continue, next, and so on, and your adapter answers them while emitting events like initialized, stopped, continued, and terminated.

That sounds simple enough until you remember that a debugger is mostly state, timing, and edge cases.

Still, the protocol gave me exactly what I needed: a structured way to make VS Code think in terms of debugging, while I figured out how to translate that into WinDbg behavior.

This was the moment where the project stopped being a helper extension and became a real debugger adapter.

To make that a bit more concrete, a minimal launch payload for the current POC looks roughly like this:

The adapter currently points at the debugging engine directly, so the windbg setting names the WinDbg stack even though the configured path is dbgeng.dll rather than windbg.exe.

{
	"type": "dapwdbg",
	"request": "launch",
	"name": "Launch through WinDbg",
	"windbg": "C:/Program Files (x86)/Windows Kits/10/Debuggers/x64/dbgeng.dll",
	"program": "${workspaceFolder}/build/Debug/testapp.exe",
	"stopAtEntry": true
}

That stopAtEntry flag is a small but useful quality-of-life feature. I added it because it is a familiar debugger option and useful to have. By default it is false, so the adapter continues after configurationDone. If you set it to true, VS Code stays paused at entry and waits for the next command.

And on the wire, the messages are simple, which is exactly what you want from a protocol. A stop event coming back from the adapter looks roughly like this:

{
	"seq": 17,
	"type": "event",
	"event": "stopped",
	"body": {
		"reason": "entry",
		"description": "Paused at process entry.",
		"threadId": 1,
		"allThreadsStopped": true
	}
}

That might not look exciting, but it is the important part: once VS Code receives something in that shape at the right time, it knows how to show the stack, scopes, variables, and stepping UI around it.

Step 1: Parse the Schemas Instead of Hand-Writing Everything

One thing became obvious very quickly: I did not want to manually model the entire protocol by hand in C#.

That is the kind of task that feels fine for the first ten message types and becomes a waste of time by the next fifty.

DAP is defined by schemas. Machines should read schemas. Machines should generate code. Humans should not write all of that by hand.

So one of the first pieces I built was a small toolchain around the protocol definitions.

The idea was straightforward:

Parse the protocol schemas
Convert them into C# types
Use generated models for requests, responses, events, and payloads
Stop wasting time on repetitive plumbing

This bought me two things immediately:

Better consistency with the protocol
Faster iteration whenever I needed to expand coverage

It also reduced a whole category of annoying bugs where hand-written DTOs silently drift away from the spec.

That generator phase was not glamorous, but it kept paying off. Every time I added another request handler later, I was very happy not to be hand-authoring another stack of protocol classes.

The nice part is that the generated code stays very literal. For example, the generated LaunchRequest model is basically just a strongly typed wrapper around the DAP shape, with Command = "launch" baked in and a typed Arguments property. A generated event model like StoppedEvent then points at a generated StoppedEventBody class with fields such as Reason, Description, ThreadId, and AllThreadsStopped.

That is exactly the level of abstraction I wanted. The protocol layer should be boring and explicit so the interesting work can happen one layer above it.

Step 2: A Python Generator That Produces C#

Yes, the adapter is in C#.

Yes, I used Python to generate part of it.

That combination made sense for the job. Python is still one of the fastest ways to build a transformation tool, especially when the task is basically: read structured input, normalize it, and generate source code.

So I built a Python tool that parsed the protocol definitions and generated the corresponding C# code.

That generator handled the boring but important parts:

Request and response classes
Event payloads
Shared protocol types
Optional fields and enum-like shapes
Enough structure to keep serialization predictable

This turned out to be one of the highest leverage steps in the whole project. Instead of spending my time on protocol plumbing, I could focus on the parts that actually matter: session management, command execution, state transitions, and debugger behavior.

In other words, I automated the boring part so I could focus on the interesting part.

Step 3: Wrap WinDbg Through dbgeng

Once the protocol layer was under control, the next question was how to talk to the debugger engine itself.

For that I went with dbgeng, the Windows debugging engine behind the debugger family. That is where the real power is. It is also where some of the complexity is.

On the package side, the current codebase still reflects some iteration. The wrapper layer currently leans on the public DbgEng interop exposed through the ClrMD packages Microsoft.Diagnostics.Runtime and Microsoft.Diagnostics.Runtime.Utilities. Separately, the broader adapter codebase also references Microsoft.Debugging.Platform.DbgEng and Microsoft.Debugging.Platform.DbgX, which are part of the newer Microsoft debugging platform stack. That split is real in the code today, but I do not want to pretend it is already the final architecture.

In the wrapper itself, the core interfaces in use right now are IDebugClient, IDebugControl, IDebugSymbols, and IDebugSystemObjects. For callbacks, I register IDebugEventCallbacks and IDebugOutputCallbacks. That gives me the essential surface area I need to launch or attach, execute commands, inspect symbols, enumerate threads, and react to breakpoints, exceptions, exits, and debugger output.

This wrapper layer became the core of the adapter. Its job was to expose the debugger in a way that fit the expectations of DAP rather than the expectations of a human typing commands into a debugger console.

That means translating concepts like:

Launching or attaching to a target
Resuming and breaking execution
Enumerating threads
Building stack traces
Reading locals and variables
Handling modules and symbols
Surfacing exceptions, exits, and other stop reasons

If you have ever worked with debugger APIs, you know they do not hide much complexity. You need to be explicit. You need to think about ownership, state, timing, callbacks, and edge cases that often show up only once things are already going wrong.

One small example was line stepping. I had already enabled source line support and saw source locations show up, so for a moment I thought step over was working.

It did not.

What I had actually proven was that WinDbg could show me line information. That is not the same thing as telling it to do source-based stepping. I had forgotten to enable that part as well. The fix was one extra command:

public void EnableSourceLineSupport()
{
	ThrowIfDisposed();
	ExecuteDebuggerCommand(".lines -e", "Could not enable source line support");
	ExecuteDebuggerCommand("l+t", "Could not enable source-based stepping");
}

That was a very debugger-adapter kind of bug. Everything looked correct for just long enough to be misleading.

Step 4: Implement the Real Requests and Iterate

With the generated protocol types on one side and the WinDbg wrapper on the other, I could finally work on the adapter loop itself.

At this point, the adapter was useful for actual debugging.

I began with the core requests: initialize, launch, attach, setBreakpoints, configurationDone, threads, stackTrace, scopes, variables, continue, pause, next, stepIn, stepOut, disconnect, ...

On paper that looks like a clean checklist. In reality, each of those requests is a conversation between at least three parties:

VS Code and its expectations
The adapter and its internal state machine
The debugger engine and its current state

So the implementation loop looked roughly like this:

Add one request
Run it in VS Code
Watch it fail in an interesting way
Fix the translation layer
Hit the next state mismatch
Repeat until the experience works the way it should

This is also where you learn that "technically works" and "feels right to use" are not the same thing.

It is not enough to answer the request. You have to answer it in the right order, at the right time, and with enough fidelity that the editor can build a coherent UI around it.

That was one of the more interesting parts of the project.

Here is a tiny slice of what that translation layer looks like today. After launch, the adapter records whether it should remain paused at entry or continue once VS Code finishes sending its setup messages:

_launchAwaitingConfigurationDone = true;
_launchStopAtEntry = DapArgumentReader.TryGetBoolean(arguments, "stopAtEntry")
	?? DapArgumentReader.TryGetBoolean(arguments, "stopOnEntry")
	?? false;

This is the kind of code that looks harmless until you realize it decides whether the whole session feels smooth or broken.

When It Worked

At some point the pieces clicked together.

I could launch a debugging session from VS Code, talk to WinDbg through the adapter, and use the editor as if this had always been a normal supported workflow.

It also stopped being just about the original VM service scenario. Because the adapter sits on top of WinDbg, it opened the door to more than the first use case:

Local launch and local attach already work in the adapter
Dump-file attach is wired in
Remote attach and kernel scenarios are the next serious end-to-end targets
Crash dump debugging is now a realistic extension of the same architecture

That was the point where the project started to feel solid.

Why This Was Fun

This was fun for the same reason good tooling work is always fun: it changes how you work.

You remove friction once, then benefit from it every day after that. And along the way, you learn where the real product boundaries are. Visual Studio and VS Code may look adjacent from the outside, but their debugging plumbing is very different. Once that became clear, the path forward became clear too.

What I Learned

This project taught me a few things very clearly:

If a workflow matters enough, it is often worth productizing it for yourself
DAP is a really good abstraction for debugger integration
Code generation is the right answer when a protocol brings lots of repetitive structure
Debugger adapters are mostly about state, timing, and translation
WinDbg becomes much more approachable when you put a good UX in front of it

Also: if you think you fixed stepping, make sure you actually fixed it and did not just make the debugger show line numbers.

Most importantly, I was reminded again that some of the best side projects start as practical attempts to make tomorrow less annoying than today.

Summary

I only wanted a better remote debugging workflow for a service running in a VM.

That turned into DAP, schema parsing, code generation, dbgeng, and a long series of state-machine bugs.

The result so far is a working first proof of concept: a WinDbg-backed debugger adapter for Visual Studio Code with local launch, local attach, dump-file attach, stack traces, scopes, variables, breakpoints, and step commands working well enough to prove the architecture.

That matters because it means I finally have a base I can build on. I have not implemented remote debugging or kernel debugging yet, but I now feel ready to take a real shot at both without getting lost in the basics again.

Next Steps

The next step is to use this base for the work I actually set out to do:

Harden the current adapter and clean up rough edges in the state machine
Start implementing the actual remote debugging flow for the VM scenario
Take a first real implementation shot at kernel debugging too
Keep the scope under control so the project does not drift again like it did at the start
Open source the project once the foundation is stable enough
Keep turning WinDbg power into something that feels normal inside VS Code

And yes, this all started with "I just want to remote debug a service on a VM."

That is usually how the best tools start.

🚀 New Release: mcp-windbg 0.12.2

2025-12-15T00:00:00+00:00

I've just released version 0.12.2 of mcp-windbg, bringing some significant enhancements that expand how and where you can perform crash dump analysis.

What's New

This release introduces two major features that address the flexibility and deployment needs many of you have been asking about.

First up is support for the Prompts API, which fundamentally changes how you can interact with crash dump analysis. Rather than being tied to a local setup, you can now trigger triage analysis from anywhere in your environment. The server can be deployed on any machine in your network, whether that's a dedicated analysis box, a build server, or even directly on a file server hosting your crash dumps. This means you can centralize your debugging infrastructure and access it from wherever you're working.

Second, this release adds streamable-http as an alternative transport backend. This gives you more options for how the server communicates, particularly useful in containerized or networked environments where different transport mechanisms might be preferable.

The combination of these features means you can now set up a centralized crash analysis service that developers across your team can leverage without needing to install WinDbg or configure everything locally. Want to analyze dumps directly on the file server where they're stored? Now you can.

Getting Started

If you want to try out the latest version, installation is straightforward:

pip install mcp-windbg

The project is open source and available on GitHub at https://github.com/svnscha/mcp-windbg. If you find it useful, a star on the repository is always appreciated.

A Real-World Example

No release post would be complete without putting the tool to work on an actual crash dump. Here's an example of the analysis in action:

Even Copilot needs a debugger sometimes.

🚀 New Release: mcp-windbg 0.10.0

2025-10-11T00:00:00+00:00

mcp-windbg 0.10.0: Now Available on PyPI

Five months after the initial release of mcp-windbg, I'm releasing version 0.10.0 with significant improvements and simplified deployment.

mcp-windbg is now officially available on PyPI. Installation no longer requires cloning repositories or setting up development environments:

pip install mcp-windbg

This represents a significant simplification from the original setup process described in my first article.

Additionally, mcp-windbg is now listed on the official Model Context Protocol registry, which should improve discoverability and enable integrations with various MCP-compatible tools.

Release 0.10.0: Key Features and Improvements

Version 0.10.0 incorporates community feedback and focuses on improving usability across different experience levels with debugging tools.

New Features

Live Debugging Sessions

Added open_windbg_remote and close_windbg_remote functions
Support for connecting to live processes beyond crash dump analysis
Real-time debugging through conversational AI interface

Extended Dump File Support

Full compatibility with .mdmp and .hdmp formats
Microsoft Store WinDbg CDB compatibility
Improved automatic discovery of crash dump files

Development Infrastructure

Migrated to uv package manager for improved build performance
Significantly reduced development setup and build times
Streamlined dependency management

Community Contributions

@sooknarine contributed several key improvements that made this release possible:

#6: Find local dumps with other common extensions - Enhanced automatic discovery of crash dump files
#10: Add support for remote debugging - Implemented live debugging session support

These contributions demonstrate the value of community involvement in open source development.

Infrastructure Improvements

Several behind-the-scenes improvements enhance reliability and maintainability:

Continuous Integration: Automated testing across Python versions 3.10 through 3.14
Dependency Management: Automated security updates and dependency maintenance
Release Process: Streamlined deployment for faster delivery of updates

Documentation Updates

The documentation has been restructured for better usability:

AGENTS.md: Comprehensive debugging instructions specifically for AI assistants
Structured Templates: .github/prompts/dump-triage.prompt.md for consistent crash analysis (inspired by my prompt engineering article)
Repository Wiki: All documentation now lives in an easily searchable wiki
Simplified README: Focused on getting you started in minutes, not hours
This Changelog: So you know what's changing and why

Installation: From Tedious to Trivial

Remember the old installation process? Clone, setup virtual environment, install dependencies, configure paths... ugh.

Here's the new process:

# Install mcp-windbg
pip install mcp-windbg

# That's it. Seriously.

Then add this to your .vscode/mcp.json:

{
	"servers": {
		"mcp_windbg": {
			"type": "stdio",
			"command": "python",
			"args": [
				"-m",
				"mcp_windbg"
			],
			"env": {
				"_NT_SYMBOL_PATH": "SRV*C:\\Symbols*https://msdl.microsoft.com/download/symbols"
			}
		}
	}
}

The installation process is now considerably simplified compared to the previous manual setup requirements.

Next Steps

With 0.10.0 released, these are the next areas I plan to work on:

More AI integrations beyond VS Code
Enhanced live debugging capabilities
Performance optimizations for large dump files
Community-requested features (keep them coming!)

The development roadmap will continue to incorporate community feedback and feature requests.

Getting Started

To begin using mcp-windbg 0.10.0:

Install: pip install mcp-windbg
Configure: Add the MCP server to your VS Code configuration
Use: Load crash dumps and interact through natural language queries
Contribute: Report issues, suggest features, or contribute code improvements

Links:

Community Response and Impact

Since the initial release in May, the project has received significant community engagement. The original article generated over 40,000 page views within the first two days, along with thousands of LinkedIn impressions and direct messages from developers worldwide.

The feedback has been constructive and encouraging. Developers have shared how the tool helped reduce time spent on crash analysis, and several teams have integrated it into their debugging workflows. I've had opportunities to present this work both internally and externally, leading to valuable discussions about AI-assisted development tools.

The open source community response has been particularly gratifying. Contributors like @sooknarine have stepped in to add functionality that benefits all users. The GitHub repository has gained considerable attention, and the project's inclusion in the official MCP registry should further improve its discoverability.

Building something that genuinely helps other developers solve real problems has been rewarding beyond what I expected when I first started working on this as a way to improve my own debugging workflow.

Thanks to everyone who has contributed, shared feedback, or simply tried the tool. The community response has made this project much better than it would have been otherwise.

AI Meets WinDBG: A Different Way to Analyze Crashes

2025-05-04T00:00:00+00:00

Old Meets New: Bringing Crash Analysis into 2025

Let's face it - while the rest of software development has evolved at warp speed, crash dump analysis feels like it's been preserved in digital amber for decades. We've got self-driving cars and pocket-sized supercomputers, yet here we are, still pecking away at command prompts like it's the dawn of the internet. Why is debugging the only area where we cling to tools that look like they belong in a computer history museum?

Picture this: You, a professional software engineer in 2025, hunched over a terminal, manually typing arcane commands like !analyze -v and .ecxr, squinting at hexadecimal memory addresses, and mentally translating stack traces. All while your friends in other industries are delegating their work to AI assistants that can write entire documents, create art, or automate complex workflows.

Something's wrong with this picture, right?

I wanted a simpler workflow: ask questions in plain language and let an AI assistant run the relevant debugger commands. This is more than a new interface for WinDBG; it changes how you interact with the debugger.

When Inspiration Strikes

During a debugging session at work, I had one of those lightning bolt moments. What if - and stick with me here - we could apply the same AI-assisted "vibe coding" approach to crash dump analysis?

Picture this: instead of manually slogging through memory dumps and command outputs, you simply ask, "Hey, why did this application crash?" and get an intelligent, contextual answer that actually helps you solve the problem.

The idea was too compelling not to pursue. So I built it.

See It In Action: AI-Powered Crash Analysis

Before diving into the technical details, let me show you what this looks like in practice. I have prepared a demo application to showcase two different use cases:

Video 1: Crash Analysis and Automated Bugfix

In this video, I show how Copilot can analyze a crash dump, identify the bug and auto-fix the issue.

Your browser does not support the video tag.

As you can see in the video, instead of manually running WinDBG commands and interpreting the cryptic output, I'm having a natural conversation with GitHub Copilot. The AI quickly identifies that the application crashed, explains which specific conditions led to the crash, and suggests a fix.

Video 2: Automated Crash Dump Analysis of multiple crash dump files

This video demonstrates a different capability: analyzing multiple crash dump files at once. It shows how the tool can quickly identify which dumps belong to your application and which don't.

Your browser does not support the video tag.

Worth noting, it takes just a few seconds until you get your first useful answer. I've played around with this for many hours and let me tell you one thing: You can really go deep. If you ask the right questions, the AI runs WinDBG/CDB commands that I haven't seen in all these years of debugging, and that is simply amazing.

How can this help the industry?

I believe this is one of the really good examples of how AI can boost productivity. Analyzing crash dumps is a very tedious task. It begins with quickly checking and identifying whether crashes are the same or different, and often requires very advanced knowledge when a crash is challenging - really challenging.

Copilot can help here tremendously; it knows how to:

Interpret assembly code (without you having to remember what EAX stands for)
Check memory contents (so you don't have to count hex bytes on your fingers)
Traverse structures with symbols (goodbye to manual pointer arithmetic!)
And so much more

This can help engineers, support teams, and QA staff work with crash dumps without memorizing every debugger command.

How did I build this?

If you've ever worked with WinDBG, you know the drill: cryptic commands, obscure syntax, and endless scrolling through memory addresses and stack traces that make your eyes glaze over. It's the kind of specialized knowledge that takes years to master and feels like speaking an alien language even when you do.

The trick here is connecting WinDBG with AI. To do that, you first need to programmatically control a debugging session, right? There are plenty of options on how to do this. I prefer to keep things simple, so I have chosen CDB, which is Microsoft's Console Debugger. It operates on standard input and output, and that's so much more fun to deal with than setting up COM APIs or similar approaches.

The second part is "connecting with AI." That's where Model Context Protocol Servers come into the game.

Understanding Model Context Protocol Servers

MCP is an open standard developed by Anthropic, released in November 2024. This protocol allows AI models to interact with external tools and data sources - think of it as giving AI assistants "hands" to work with other software. It defines a way for AI assistants to discover, access, and use tools through a consistent interface. In essence, it's what allows GitHub Copilot to "talk" to external programs like WinDBG.

An MCP server acts as the intermediary between the AI model and the tool. It:

Registers available tools with the client
Handles requests from AI models to use these tools
Executes the tool operations and returns results
Maintains context across interactions

Any tool can be made available to an AI model through an MCP server. I built one for WinDBG's CDB debugger.

Why MCP Instead of LanguageModelTool API?

The LanguageModelTool API might eventually be a better fit for this specific use-case. Creating a Visual Studio Extension that "just works" out of the box would potentially simplify the integration process significantly.

However, using MCP directly offers several notable advantages. It works with any AI model, not just limiting itself to Copilot. The server can be used outside VS Code, functioning with various other tools. New features can be easily added without necessitating changes to the core integration. Moreover, it remains platform-independent, avoiding lock-in to any single company's implementation.

The MCP-WinDBG Project

I've implemented a Model Context Protocol server that wraps WinDBG/CDB and exposes its capabilities to AI models within VS Code. Better yet, I've made it open source so everyone can experience this new workflow.

The project, mcp-windbg, connects VS Code and GitHub Copilot to WinDBG's analysis commands.

The actual "hard part" was implementing the CDB (Command-Line WinDBG) interaction layer. And by "hard", I mean vibe-coding with two coffees on a Saturday morning, where I spent more time being annoyed by pyTest failures than actual coding difficulties. The core implementation came together surprisingly quickly!

The rest is primarily wrapper code that implements the Model Context Protocol specifications. Now that I've established and defined the core WinDBG interaction logic, I'm considering refactoring the project to TypeScript. This would enable me to create both an MCP Server in TypeScript and a dedicated Visual Studio Extension, with both implementations leveraging the same underlying CDB interaction layer.

What Does This Mean In Practice?

Let me walk you through what this enables:

Natural language crash analysis: "Why is this application crashing with an access violation at this address?" (Instead of: "What the $%#@ is this heap corruption!?")
Contextual debugging: "Show me the stack trace for thread 5 and explain what each function is doing based on the symbols." (Instead of staring at call stacks like they're ancient hieroglyphics)
Root cause identification: "What's causing this null pointer dereference and where should I look in the code to fix it?" (Instead of playing detective with memory addresses)

Instead of typing obscure commands like !analyze -v followed by a series of manual investigations, you simply ask questions in plain language, and the AI interprets the crash data for you. It's like having a WinDBG expert whispering in your ear, except it doesn't get annoyed when you ask the same question five times.

How It Works

The MCP server connects GitHub Copilot to WinDBG:

It provides a set of tools that Copilot can use to interact with crash dumps
It translates natural language questions into appropriate WinDBG commands
It parses and interprets the often cryptic WinDBG output into more useful information
It maintains context throughout a debugging session, enabling follow-up questions to work naturally

The technical implementation uses Python to spawn and communicate with CDB (the command-line version of WinDBG), parses the output, and exposes the functionality through the Model Context Protocol to VS Code.

Getting Started With mcp-windbg

Ready to try it yourself? Here's how to get started:

First, make sure you have the Windows SDK installed with Debugging Tools for Windows
Clone the repository: git clone https://github.com/svnscha/mcp-windbg.git
Set up a Python virtual environment and install the package
Configure VS Code to use the MCP server

For complete details, check out the repository README.

Once configured, create a .vscode/mcp.json file in your project that points to the server:

{
    "servers": {
        "mcp_server_windbg": {
            "type": "stdio",
            "command": "python",
            "args": [
                "-m",
                "mcp_server_windbg"
            ],
            "env": {
                "_NT_SYMBOL_PATH": "SRV*C:\\Symbols*https://msdl.microsoft.com/download/symbols"
            }
        },
    }
}

You might need to update the command, depending on where and how you have installed the mcp_server_windbg to.

The Human Touch Still Matters

Just like with code refactoring, the AI assistance isn't perfect. The human element - your experience, intuition, and domain knowledge - remains crucial. Sometimes you'll need to guide the analysis, ask follow-up questions, or provide additional context.

The useful part is the combination: AI can process a large amount of debugger output quickly, while you provide the context needed to judge the result. It still needs supervision and can follow the wrong lead, so treat its findings as a starting point rather than a final answer.

Join The Experience

I'd love for you to try this out, contribute to the project, and share your experiences. If you're interested:

Star the GitHub repository
Try it on your own crash dumps
Report issues, suggest improvements, or contribute code
Share your success stories (or even failures - we learn from those too!)

The Magic Is In The Flow

Just like with my code refactoring experience, the real magic isn't about any single capability - it's about the flow. When debugging stops being a tedious chore and becomes a fluid conversation, something fundamentally changes in how you approach problem-solving.

Gone are the days of dreading crash analysis. Instead, each debugging session becomes an opportunity for collaboration with an AI partner that helps you understand what's happening at a deeper level.

Summary

Crash dump analysis has traditionally been one of the most technically demanding and least enjoyable parts of software development. It's like archaeology with a keyboard - painstakingly excavating through layers of memory and CPU state to unearth what went wrong. With AI assistance through tools like mcp-windbg, it becomes another area where we can experience that perfect "vibe state" of frictionless problem-solving.

If you're still manually typing WinDBG commands and squinting at memory dumps in 2025, you're not just missing out on productivity - you're missing out on a fundamentally more enjoyable way to work.

Try it. Debug it. Vibe it.

svnscha - debugging

🚀 New Release: mcp-windbg 1.3.0

Three Separate Plugins

Skills and Agents for Your Existing Server

Upgrading from the Bundled Plugin

🚀 New Release: mcp-windbg 1.2.2

The Problem

What Caused It

The Fix

Getting Started

🚀 New Release: mcp-windbg 1.2.0

Installing the Plugin

Skills for Common Debugging Tasks

The Crash Analyst Agent

Symbols by Default

A Small 1.2.1 Follow-up

Getting Started

🚀 New Release: mcp-windbg 1.1.0

What Happened: 1.0.1

Support for the 2.x SDK

wait_for_break

Fixing g Freezing the Target

Getting Started

Summary

🚀 New Release: mcp-windbg 1.0.0

Kernel Debugging

Session IDs

The Breaking Changes

Smaller, But You Will Notice

Getting Started

One-Point-Zero

🚀 New Release: mcp-windbg 0.15.0

What's New

Break into a live session

Redact sensitive data before it leaves the machine

A real documentation site

Quieter, sturdier foundations

Community Contributions

Getting Started

A Year and a Month In

Introducing Native Windows Debugging for VS Code: Kernel & Remote Debugging

Remember the Cliffhanger?

Get It Right Now

Four Ways to Debug - Two of Them Were Never Possible Before

Local: The Comfortable Starting Point

Attach: Already Running? Just Connect

Remote: My Favorite Part

Kernel: Yes, Really

How It Works

An Honest Word on Scope

Getting Started

Your Turn

Summary

P.S. - One More Thing About Those Videos

The Joy of Writing a Debugger Adapter for Visual Studio Code

Current State

Why

Removing Friction

VS Code Is Not Visual Studio

Building It Anyway

Learning DAP

Step 1: Parse the Schemas Instead of Hand-Writing Everything

Step 2: A Python Generator That Produces C#

Step 3: Wrap WinDbg Through dbgeng

Step 4: Implement the Real Requests and Iterate

When It Worked

Why This Was Fun

What I Learned

Summary

Next Steps

🚀 New Release: mcp-windbg 0.12.2

What's New

Getting Started

A Real-World Example

🚀 New Release: mcp-windbg 0.10.0

mcp-windbg 0.10.0: Now Available on PyPI

Release 0.10.0: Key Features and Improvements

New Features

Community Contributions

Infrastructure Improvements

`wait_for_break`

Fixing `g` Freezing the Target