Windbg MCP

Unclaimed

by gengstah

An MCP (Model Context Protocol) server that turns all pybag Windows debugger functions into native MCP tools. It lets MCP-compatible clients (Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents) control user-mode processes, kernel sessions, and crash dump analysis via structured JSON calls.

Install

$claude mcp add windbg-mcp python C:\path\to\windbg-mcp\windbg_mcp.py

Unclaimed listing

Is this your MCP server?

This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.

Claim this server

Tools (40)

access

"e" execute, "w" write (default), "r" read/write

action

"go" (default) continues execution after capture; "break" halts

addr

hex address to watch

attach

pid or name (not both), initialbreak

bp

expr (required), capture, action, oneshot, passcount

capture

when true (default), automatically saves full state — registers, stack, memory — to the capture buffer each time this breakpoint fires

capture_state

—

clear_captures

—

connect

options (required)

context_memory.code_at_rip

32 bytes at RIP as hex and formatted

context_memory.stack_at_rsp

64 bytes at RSP as hex, formatted, and ASCII

create

path (required), args, initialbreak

detach

—

disable_bp

id (required)

enable_bp

id (required)

expr

symbol ("ntdll!NtCreateFile") or hex address ("0x7ff800001234")

get_captures

—

go

timeout (ms, default 30000)

goto

expr (required)

hw_bp

addr (required), size, access, capture, action, oneshot

instruction

disassembly of the instruction at RIP

kernel_attach

connectstring (required), initialbreak

list_bps

—

list_processes

—

load_dump

path (required)

oneshot

removes the breakpoint after it fires once

passcount

fires only after N passes through the location

read_mem

addr (required), size (default 16)

registers

all register values as {name: "0x..."} hex strings

remove_bp

id (required)

rip

instruction pointer at the moment of capture

size

watch width in bytes — 1, 2, 4, or 8 (default 4)

stack

top 10 call stack frames with addresses and return addresses

status

—

step_into

count (default 1)

step_out

—

step_over

count (default 1)

symbol_at_rip

nearest symbol to RIP

terminate

—

trace

count (default 10)