Windbg MCP
未认领An MCP (Model Context Protocol) server that turns all pybag Windows debugger functions into native MCP tools. It lets MCP-compatible clients (Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents) control user-mode processes, kernel sessions, and crash dump analysis via structured JSON calls.
安装
claude mcp add windbg-mcp python C:\path\to\windbg-mcp\windbg_mcp.py工具（40 个）
access
"e" execute, "w" write (default), "r" read/write
action
"go" (default) continues execution after capture; "break" halts
addr
hex address to watch
attach
pid or name (not both), initialbreak
bp
expr (required), capture, action, oneshot, passcount
capture
when true (default), automatically saves full state — registers, stack, memory — to the capture buffer each time this breakpoint fires
capture_state
—
clear_captures
—
connect
options (required)
context_memory.code_at_rip
32 bytes at RIP as hex and formatted
context_memory.stack_at_rsp
64 bytes at RSP as hex, formatted, and ASCII
create
path (required), args, initialbreak
detach
—
disable_bp
id (required)
enable_bp
id (required)
expr
symbol ("ntdll!NtCreateFile") or hex address ("0x7ff800001234")
get_captures
—
go
timeout (ms, default 30000)
goto
expr (required)
hw_bp
addr (required), size, access, capture, action, oneshot
instruction
disassembly of the instruction at RIP
kernel_attach
connectstring (required), initialbreak
list_bps
—
list_processes
—
load_dump
path (required)
oneshot
removes the breakpoint after it fires once
passcount
fires only after N passes through the location
read_mem
addr (required), size (default 16)
registers
all register values as {name: "0x..."} hex strings
remove_bp
id (required)
rip
instruction pointer at the moment of capture
size
watch width in bytes — 1, 2, 4, or 8 (default 4)
stack
top 10 call stack frames with addresses and return addresses
status
—
step_into
count (default 1)
step_out
—
step_over
count (default 1)
symbol_at_rip
nearest symbol to RIP
terminate
—
trace
count (default 10)