# MCP Server for WinDbg Crash Analysis

Bridges Claude Code with CDB and KD debuggers for crash dump triage, kernel inspection, and remote debugging without opening the WinDbg UI.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 1632
- Author: svnscha
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/svnscha/mcp-windbg
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/mcp-server-for-windbg-crash-analysis

## What it does

The server functions as a Python wrapper around console utilities `cdb.exe` and `kd.exe`. It supplies MCP tools to inspect user-mode dumps (`.dmp`, `.mdmp`), kernel dumps (`MEMORY.DMP`), or live targets. An assistant can inspect stack frames, list loaded modules, and run debugger diagnostics through commands like `!analyze -v`.

Every target receives an isolated session identifier. This architecture permits side-by-side triage across multiple dump files. To prevent hanging live sessions, per-call timeouts trigger a CTRL+BREAK interruption to resynchronize the connection, and an optional filter script strips sensitive data before output leaves the host.

Without Debugging Tools for Windows or WinDbg installed to provide `cdb.exe` and `kd.exe`, the server cannot execute. Unlike Microsoft's official GUI-integrated WinDbg MCP, this project operates completely headless over stdio or HTTP.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `CDB_PATH`, `_NT_SYMBOL_PATH` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env CDB_PATH=<CDB_PATH> --env _NT_SYMBOL_PATH=<_NT_SYMBOL_PATH> --transport stdio mcp-server-for-windbg-crash-analysis -- uvx mcp-windbg
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-windbg <command>

### Codex

**Platform CLI**
```bash
codex mcp add mcp-server-for-windbg-crash-analysis --env CDB_PATH=<CDB_PATH> --env _NT_SYMBOL_PATH=<_NT_SYMBOL_PATH> -- uvx mcp-windbg
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-windbg <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mcp-server-for-windbg-crash-analysis": {
            "command": "uvx",
            "args": [
                "mcp-windbg"
            ],
            "env": {
                "CDB_PATH": "<CDB_PATH>",
                "_NT_SYMBOL_PATH": "<_NT_SYMBOL_PATH>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-windbg <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mcp-server-for-windbg-crash-analysis": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "mcp-windbg"
            ],
            "env": {
                "CDB_PATH": "<CDB_PATH>",
                "_NT_SYMBOL_PATH": "<_NT_SYMBOL_PATH>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-windbg <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e CDB_PATH=<CDB_PATH> -e _NT_SYMBOL_PATH=<_NT_SYMBOL_PATH> mcp-server-for-windbg-crash-analysis uvx mcp-windbg
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-windbg <command>

## When to use it
- Triage crash dump files after application crashes or kernel bugchecks.
- Execute arbitrary WinDbg and KD commands from natural language requests.
- Inspect multiple crash dumps across a directory to compare failures.
- Attach to remote user-mode debug servers or live Windows kernel sessions.

## Example prompts
- Open crash.dmp in the current folder and explain the failure using !analyze -v
- Run kb on the open cdb session and inspect the faulting call stack
- Scan C:\Dumps for crash files and summarize the common fault signatures

## Similar
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74559
- [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18727
- [SeleniumBase MCP](https://affpapa.org/en/nevibecode/mcp/seleniumbase-mcp.md) — MCP server · ★ 13169
- [mobile-mcp](https://affpapa.org/en/nevibecode/mcp/mobile-mcp.md) — MCP server · ★ 9946
- [XcodeBuildMCP](https://affpapa.org/en/nevibecode/mcp/xcodebuildmcp.md) — MCP server · ★ 6505
- [agent-device](https://affpapa.org/en/nevibecode/mcp/agent-device.md) — MCP server · ★ 5149

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md