MCP Server for WinDbg Crash Analysis

A Model Context Protocol server that bridges AI models with WinDbg for crash dump analysis, user-mode remote debugging, and kernel debugging.

[!TIP] Looking for AI debugging built into WinDbg itself? Microsoft now ships an official WinDbg MCP, starting with WinDbg 1.2610.1001.0. You enable it in WinDbg's MCP service settings, and chat with your active debugging session from VS Code with GitHub Copilot or from the GitHub Copilot CLI. If that is what you want, start there:

• Introducing WinDbg MCP (announcement)
• Set up WinDbg MCP and the overview
• Get the latest WinDbg

This project is an independent, community-built alternative. It runs cdb.exe / kd.exe headless, so it fits when you want to use another MCP client, drive a debugger from another machine over HTTP, or script triage across many dumps without opening the WinDbg UI.

Overview

This server drives the Windows debuggers - CDB for user mode (dumps and -remote) and KD for kernel targets (-k) - so you can debug in natural language: "Show me the call stack and explain this access violation" or "Open a kernel session and tell me which driver bugchecked."

It is not a magical auto-fix. It is a Python wrapper around cdb.exe / kd.exe that lets an LLM run real debugger commands and reason about the output.

Features

• Crash dump analysis - open a .dmp/.mdmp/.hdmp and get automated triage (!analyze -v, stacks, modules, threads) in a single call.
• User-mode remote debugging - attach to a live cdb/WinDbg debug server (-remote) over TCP, a named pipe, or COM, and break in on demand.
• Kernel debugging - attach to a kernel target (-k, driven by kd.exe) over KDNET, a named pipe, or serial; the server waits for the target and breaks in for you.
• Run any WinDbg/KD command - drive an open session with arbitrary commands (kb, !process 0 0, !heap, lm, ...) described in natural language.
• Session ids - every open returns a session id; several sessions (dumps, remote, kernel) can be open at once and are addressed independently.
• Resilient live sessions - per-call timeouts, and a slow live command that outruns its timeout is broken into with CTRL+BREAK and the session resynchronized instead of wedging.
• Multi-dump triage - discover and compare many dumps across a directory.
• Text filter hooks - a --filter-script can redact PII/secrets from tool arguments and output before they leave the machine.
• stdio or HTTP - run locally over stdio, or as a streamable-HTTP service you drive from another machine.

Use cases