Happy slice of mcp pizzaMCP.pizza

mcp-windbg

MCP.Pizza Chef: svnscha

Windows crash files normally mean opening a debugger and typing commands most people never learn. This drives those Microsoft debugging tools for you, so a plain question gets a real answer: which frame faulted, what the call stack looked like, which driver caused a blue screen. It can also attach to a running program that has hung, attach to a kernel target over a network or serial link, and sift through a whole folder of dumps to find the shared pattern. Windows only.

Coding

Use This MCP server To

Explain why this crash file reports an access violation Find which driver caused the blue screen Show me the call stack from a crash dump Triage a folder of dumps for the common cause Break into a hung program and see what it awaits Strip private details out of debugger output first

README

MCP Server for WinDbg Crash Analysis

CI Docs PyPI License: MIT Platform: Windows Python 3.10+

A Model Context Protocol server that bridges AI models with WinDbg for crash dump analysis, user-mode remote debugging, and kernel debugging.

Overview

This server drives the Windows debuggers - CDB for user mode (dumps and -remote) and KD for kernel targets (-k) - so you can debug in natural language: "Show me the call stack and explain this access violation" or "Open a kernel session and tell me which driver bugchecked."

It is not a magical auto-fix. It is a Python wrapper around cdb.exe / kd.exe that lets an LLM run real debugger commands and reason about the output.

Features

  • Crash dump analysis - open a .dmp/.mdmp/.hdmp and get automated triage (!analyze -v, stacks, modules, threads) in a single call.
  • User-mode remote debugging - attach to a live cdb/WinDbg debug server (-remote) over TCP, a named pipe, or COM, and break in on demand.
  • Kernel debugging - attach to a kernel target (-k, driven by kd.exe) over KDNET, a named pipe, or serial; the server waits for the target and breaks in for you.
  • Run any WinDbg/KD command - drive an open session with arbitrary commands (kb, !process 0 0, !heap, lm, ...) described in natural language.
  • Session ids - every open returns a session id; several sessions (dumps, remote, kernel) can be open at once and are addressed independently.
  • Resilient live sessions - per-call timeouts, and a slow live command that outruns its timeout is broken into with CTRL+BREAK and the session resynchronized instead of wedging.
  • Multi-dump triage - discover and compare many dumps across a directory.
  • Text filter hooks - a --filter-script can redact PII/secrets from tool arguments and output before they leave the machine.
  • stdio or HTTP - run locally over stdio, or as a streamable-HTTP service you drive from another machine.

mcp-windbg FAQ

Does this work on a Mac?
No. It needs Windows, plus Microsoft's Debugging Tools for Windows and Python 3.10 or newer.
Which apps does it work in?
Claude Code, Claude Desktop, GitHub Copilot in VS Code, Cursor, Windsurf, and Cline are all listed.
Do I need a paid key?
No. It drives debugger programs already installed on your machine.
Can I use this to find out why my app crashed?
Yes — point it at the crash file and it runs the standard analysis, then explains the result in plain language.
Will it fix the bug for me?
No. The author is explicit that it runs real debugger commands and reasons about the output, nothing more.
How hard is the setup?
One install command, then a few lines in your app's settings telling it where to find symbol files.
Can it handle dumps containing sensitive information?
Yes, you can supply a filter script that removes private details before anything leaves the machine.