# mcp-windbg

A Model Context Protocol server for Windows crash dump analysis using WinDbg/CDB

- **Kind:** MCP server
- **Owner:** svnscha
- **Source:** https://github.com/svnscha/mcp-windbg
- **Version:** 1.2.2
- **Runtime:** python
- **License:** MIT
- **Transports:** stdio, streamable-http
- **Pinned commit:** `0b38a2848dddc8f7db2a179a1d6161af43875c51`
- **Page:** https://forefy.com/mcps/9348f661-f256-536c-968d-0a39fe9b456a
- **API (JSON):** https://forefy.com/api/asr/mcps/9348f661-f256-536c-968d-0a39fe9b456a

## Install

Ask your agent: `Install the mcp-windbg MCP server securely from: https://forefy.com/mcps/9348f661-f256-536c-968d-0a39fe9b456a and register it with my agent`

## Tools (10)

- `list_dumps`: List Windows crash dump files in a directory. Helps discover dumps to analyze with open_cdb_dump.
- `open_cdb_dump`: Open and triage a Windows crash dump with cdb.exe (user mode). Runs .lastevent and !analyze -v (optionally kb/lm/~) and returns a session_id. Use that session_…
- `open_cdb_remote`: Attach to a user-mode remote debug server (-remote) with cdb.exe, e.g. one started with 'cdb -server tcp:port=5005 <program>'. Returns a session_id for run_cdb…
- `open_kd_session`: Attach to a kernel target with kd.exe (-k). Waits for the target to connect, breaks in, and returns a session_id for run_kd_command / send_ctrl_break / close_k…
- `run_cdb_command`: Run a WinDbg/CDB command on a user-mode session (from open_cdb_dump or open_cdb_remote), addressed by session_id. Optional timeout_seconds overrides the defaul…
- `run_kd_command`: Run a command on a kernel session (from open_kd_session), addressed by session_id. Optional timeout_seconds overrides the default (kernel memory reads can be s…
- `close_cdb_session`: Close a user-mode (cdb) session and release its resources, addressed by session_id.
- `close_kd_session`: Close a kernel (kd) session and release its resources, addressed by session_id.
- `send_ctrl_break`: Break into a running live session (cdb remote or kd), addressed by session_id. Useful to interrupt a running target so commands work again.
- `wait_for_break`: Block until a resumed target stops, and return everything it printed when it did. Use this after letting the target run with 'g' - to catch the bugcheck, the b…

## Environment

- `LOCALAPPDATA`
- `CDB_PATH`
- `_NT_SYMBOL_PATH`