MCP Server for WinDbg Crash Analysis

A Model Context Protocol server that bridges AI models with WinDbg for crash dump analysis, user-mode remote debugging, and kernel debugging.

Overview

This server drives the Windows debuggers - CDB for user mode (dumps and -remote) and KD for kernel targets (-k) - so you can debug in natural language: "Show me the call stack and explain this access violation" or "Open a kernel session and tell me which driver bugchecked."

It is not a magical auto-fix. It is a Python wrapper around cdb.exe / kd.exe that lets an LLM run real debugger commands and reason about the output.

Features

• Crash dump analysis - open a .dmp/.mdmp/.hdmp and get automated triage (!analyze -v, stacks, modules, threads) in a single call.
• User-mode remote debugging - attach to a live cdb/WinDbg debug server (-remote) over TCP, a named pipe, or COM, and break in on demand.
• Kernel debugging - attach to a kernel target (-k, driven by kd.exe) over KDNET, a named pipe, or serial; the server waits for the target and breaks in for you.
• Run any WinDbg/KD command - drive an open session with arbitrary commands (kb, !process 0 0, !heap, lm, ...) described in natural language.
• Session ids - every open returns a session id; several sessions (dumps, remote, kernel) can be open at once and are addressed independently.
• Resilient live sessions - per-call timeouts, and a slow live command that outruns its timeout is broken into with CTRL+BREAK and the session resynchronized instead of wedging.
• Multi-dump triage - discover and compare many dumps across a directory.
• Text filter hooks - a --filter-script can redact PII/secrets from tool arguments and output before they leave the machine.
• stdio or HTTP - run locally over stdio, or as a streamable-HTTP service you drive from another machine.

Use cases

You have	You want to	Guide
A .dmp from a crash or a blue screen	Root-cause it: exception or bugcheck, faulting frame, why it happened	Analyze a crash dump
A live user-mode process (via cdb -server)	Break in and inspect a hang or live state	Debug a remote target
A KD-enabled machine or VM	Debug drivers, bugchecks, and boot-time issues	Debug a kernel target
A folder full of dumps	Triage the batch and find the common signature	Triage multiple dumps
A debugging host, but you work elsewhere	Drive it over HTTP from another machine	Debug from another machine
Dumps with secrets or PII	Scrub tool output before it leaves the box	Redact sensitive data

Tools

Every open_* tool returns an opaque session_id (e.g. cdb-1a2b3c4d); pass it to the matching run_*, close_*, send_ctrl_break, and wait_for_break calls. User-mode targets (dumps and -remote) run under cdb.exe; kernel targets and kernel dumps run under kd.exe.

Tool	Purpose
list_dumps	List crash dump files in a directory
open_cdb_dump	Open and triage a crash dump
open_cdb_remote	Attach to a user-mode remote debug server (-remote)
open_kd_session	Attach to a kernel target (-k, KDNET / named pipe / serial)
open_kd_dump	Open and triage a kernel crash dump (MEMORY.DMP, minidump)
run_cdb_command	Run a command on a user-mode session
run_kd_command	Run a command on a kernel session
close_cdb_session	Close a user-mode session
close_kd_session	Close a kernel session (resumes the target machine)
send_ctrl_break	Break into a running live session
wait_for_break	Wait for a target you resumed with g to stop again

Parameters, timeouts, and the built-in triage prompts are in the tools reference.

Quick start

[!NOTE] Claude Code in enterprise environments: when managed settings define allowedMcpServers, plugin-bundled MCP servers may be silently skipped (Claude Code issue #32882). I recommend installing and registering the server manually, then optionally adding the skills or agents plugin. The server must still be permitted by your organization's MCP policy.

Prerequisites

• Windows with Debugging Tools for Windows or WinDbg from the Microsoft Store, which ship cdb.exe and kd.exe (auto-detected).
• Any MCP-compatible client (Claude Code, GitHub Copilot, Claude Desktop, Cursor, Windsurf, Cline, ...).

Python is not a prerequisite in itself. Each route below states what it needs.

Install in Claude Code

Install the server plugin if needed, then optionally add skills, agents, or both:

Plugin	Server	Included workflows
mcp-windbg-uvx	Launched by the plugin with uvx	MCP tools only
mcp-windbg-skills	Uses the uvx plugin or your own MCP connection	Four optional skills
mcp-windbg-agents	Uses the uvx plugin or your own MCP connection	Optional crash-analyst agent

Server with uvx

The shortest path: two lines, no pip install, no MCP configuration to edit. Adds the eleven tools, with symbols preconfigured. Skills and agents are installed separatel