Windbg MCP Server

Windows debugger automation for crash analysis, user-mode, and kernel sessions.

Data last scanned today · Reviewed today

53 3 dangerous tools9 tools★ 1,500PythonMIT

Overview

This Python-based MCP server functions as a wrapper for cdb.exe and kd.exe, allowing AI models to execute native Windows debugging commands. It supports analyzing crash dumps, performing live user-mode remote debugging via TCP or named pipes, and connecting to kernel targets using KDNET or serial connections. Designed for sophisticated troubleshooting, it enables natural language queries to interpret call stacks, thread states, and bugchecks. The server provides session management for multiple concurrent debugging targets and includes resiliency features like command timeouts and automated session resynchronization.

Our verdict

This server carries a high risk level with a security score of 53/100. It is a community-maintained project that has not undergone editorial review, meaning its security properties—including potential risks associated with executing arbitrary debugger commands—lack external verification. Users should exercise caution and review the provided filter-script capabilities to redact sensitive information before deploying this tool in sensitive environments.

Supports direct kernel debugging and user-mode crash analysis
Provides multi-session management with individual session IDs
Includes a configurable filter script for PII redaction
Zero direct dependencies minimize supply-chain surface area

Community-maintained project lacking official vendor support
Requires high-trust environments due to arbitrary command execution
Security implementation and OAuth have not been reviewed

Tools

Tool	Description	Risk
list_dumps	List crash dump files in a directory	low
open_cdb_dump	Open and triage a crash dump	medium
open_cdb_remote	Attach to a user-mode remote debug server (-remote)	medium
open_kd_session	Attach to a kernel target (-k, KDNET / named pipe / serial)	medium
run_cdb_command	Run a command on a user-mode session	high
run_kd_command	Run a command on a kernel session	high
close_cdb_session	Close a user-mode session	medium
close_kd_session	Close a kernel session (resumes the target machine)	medium
send_ctrl_break	Break into a running live session	high

Compatibility

Client	Local	Docker	Remote	Read-only
Claude Desktop
Cursor
VS Code
Windsurf
ChatGPT

Frequently asked questions

›What software prerequisites are required to run this server?

You need a Windows environment with Python 3.10 or higher and the Debugging Tools for Windows, which includes cdb.exe and kd.exe.

›How does the server handle sensitive data in tool output?

You can provide a --filter-script to redact PII or secrets from both tool arguments and debugger output before they leave the machine.

›Can I connect to the server from a different machine?

Yes, you can run the server as a streamable HTTP service to drive it remotely from another machine instead of running it locally via stdio.

›How are multiple debugging sessions managed?

Every open session returns a unique session_id that you use to address that specific session, allowing you to manage several dump, remote, or kernel sessions simultaneously.

›What happens if a live debugging command exceeds its timeout?

The server is designed to be resilient; it will send a CTRL+BREAK to the process and resynchronize the session to prevent the tool from wedging.