expr

MCP tool from Windbg MCP by gengstah

symbol ("ntdll!NtCreateFile") or hex address ("0x7ff800001234")

How to use it

expr is exposed by the Windbg MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the expr tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.

Install Windbg MCP

$claude mcp add windbg-mcp python C:\path\to\windbg-mcp\windbg_mcp.py

FULL WINDBG MCP LISTING

Other tools in Windbg MCP (39)

"e" execute, "w" write (default), "r" read/write

"go" (default) continues execution after capture; "break" halts

hex address to watch

pid or name (not both), initialbreak

expr (required), capture, action, oneshot, passcount

when true (default), automatically saves full state — registers, stack, memory — to the capture buffer each time this breakpoint fires

—

—

options (required)

context_memory.code_at_rip

32 bytes at RIP as hex and formatted

context_memory.stack_at_rsp

64 bytes at RSP as hex, formatted, and ASCII

path (required), args, initialbreak

—

id (required)

id (required)

—

timeout (ms, default 30000)

expr (required)

addr (required), size, access, capture, action, oneshot

disassembly of the instruction at RIP

connectstring (required), initialbreak

—

—

path (required)

removes the breakpoint after it fires once

fires only after N passes through the location

addr (required), size (default 16)

all register values as {name: "0x..."} hex strings

id (required)

instruction pointer at the moment of capture

watch width in bytes — 1, 2, 4, or 8 (default 4)

top 10 call stack frames with addresses and return addresses

—

count (default 1)

—

count (default 1)

nearest symbol to RIP

—

count (default 10)