windbg-mcp — Claude Code MCP server: WinDbg debugging for AI agents
Brings WinDbg engine to AI agents: crash dumps, live user and kernel sessions, Time Travel Debugging, driver IOCTLs.
Open on GitHubWhat windbg-mcp does
The server runs a DbgEng instance and exposes debugging commands over MCP. Agents get user-mode and kernel-mode sessions, can analyze dumps, record TTD traces and step through them. It serves over stdio or listens on HTTP with --listen to reach clients on other machines.
Inside: a supervisor and one engine worker per session. Supports Secure Kernel (VTL1) reads from Hyper-V checkpoints, driver IOCTL exploration, and Microsoft hypervisor attach via KDNET. Kernel attach and TTD recording need Administrator rights.
Runs on Windows x64 only. TTD covers user-mode; kernel debugging requires a stopped target for certain memory operations.
What it helps with
- analyze a crash dump and locate the faulting instruction
- record a Time Travel Debugging trace and replay a failure
- attach to the kernel over KDNET
- map a driver's IOCTL surface
- read VTL1 memory from a Hyper-V checkpoint
Example prompts for the agent
- Attach to dump
service_crash.dmpand show the call stack of the crashing thread - Start a TTD recording of
app.exeand find where it opens the registry key - Connect to kernel debug profile
test-machineand list loaded drivers
How to install windbg-mcp
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about windbg-mcp
How do I install windbg-mcp in Claude Code?
Run /plugin marketplace add glslang/windbg-mcp in the Claude Code chat. The server will appear in the plugin list.
What does windbg-mcp do?
It gives agents WinDbg debugger commands: dump analysis, kernel attach, Time Travel Debugging, process and kernel memory reads. The DbgEng engine runs on your Windows machine; the agent sends requests to it.
What does windbg-mcp require?
Windows x64 and DbgEng from WinDbg Preview. Kernel attach and TTD recording need Administrator; you can run it as a service with --install-service.