get_system_state

MCP tool from Windbg MCP by memoryforensics1

Full state overview — VM power, KD, guest ops, UMD. Always allowed.

How to use it

Project documentation lists get_system_state for the Windbg MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install Windbg MCP

$pip install frida-tools
FULL WINDBG MCP LISTING

Other tools in Windbg MCP (28)

guest_kill_process

Kill a process by PID

guest_list_processes

List running processes with PIDs

guest_run_command

Execute command in guest OS, capture stdout/stderr

guest_transfer_from_vm

Copy file from guest to host

guest_transfer_to_vm

Copy file from host to guest

kd_break

Halt running target (Ctrl+Break)

kd_connect

Attach to kernel via KDNET. Target breaks on connect.

kd_continue

Resume target execution

kd_disconnect

Detach from kernel. Resumes target so VM keeps running.

kd_execute

Run any WinDbg command (k, r, lm, !process 0 0, !analyze -v, etc.)

kd_step

Step one instruction (into or over)

kd_wait_for_event

Wait for breakpoint/exception with timeout. Always returns.

umd_dbgsrv_connect

Connect to remote dbgsrv in guest

umd_dbgsrv_execute

Attach to PID, run WinDbg commands, detach

umd_dbgsrv_skill

dbgsrv best practices and WinDbg command reference for LLMs

umd_frida

Inject JS, eval expressions, list processes, detach

umd_frida_attach

Attach Frida to a guest process

umd_frida_skill

Frida best practices and API reference for LLMs

umd_ttd

Time Travel Debugging — record, stop, retrieve, list traces

umd_ttd_query

Query TTD traces (not yet implemented)

vm_pause

Freeze entire VM

vm_resume

Unpause a paused VM

vm_screenshot

Capture VM display as PNG

vm_set_target

Switch the active VM target at runtime (VMX path + credentials)

vm_snapshot_list

List available snapshots

vm_snapshot_restore

Restore a named snapshot (debug sessions are cleanly torn down and can reconnect after)

vm_start

Power on the VM

vm_stop

Shut down (graceful or hard)