kernel_attach

MCP tool from Windbg MCP by gengstah

connectstring (required), initialbreak

How to use it

kernel_attach is exposed by the Windbg MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the kernel_attach tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.

Install Windbg MCP

$claude mcp add windbg-mcp python C:\path\to\windbg-mcp\windbg_mcp.py

FULL WINDBG MCP LISTING

Other tools in Windbg MCP (39)

"e" execute, "w" write (default), "r" read/write

"go" (default) continues execution after capture; "break" halts

hex address to watch

pid or name (not both), initialbreak

expr (required), capture, action, oneshot, passcount

when true (default), automatically saves full state — registers, stack, memory — to the capture buffer each time this breakpoint fires

—

—

options (required)

context_memory.code_at_rip

32 bytes at RIP as hex and formatted

context_memory.stack_at_rsp

64 bytes at RSP as hex, formatted, and ASCII

path (required), args, initialbreak

—

id (required)

id (required)

symbol ("ntdll!NtCreateFile") or hex address ("0x7ff800001234")

—

timeout (ms, default 30000)

expr (required)

addr (required), size, access, capture, action, oneshot

disassembly of the instruction at RIP

—

—

path (required)

removes the breakpoint after it fires once

fires only after N passes through the location

addr (required), size (default 16)

all register values as {name: "0x..."} hex strings

id (required)

instruction pointer at the moment of capture

watch width in bytes — 1, 2, 4, or 8 (default 4)

top 10 call stack frames with addresses and return addresses

—

count (default 1)

—

count (default 1)

nearest symbol to RIP

—

count (default 10)