WinDbg MCP

An MCP (Model Context Protocol) server that exposes every pybag Windows debugger function as a native MCP tool. It gives any MCP-compatible client (Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents) full control over user-mode processes, kernel sessions, and crash dump analysis — all through typed tool calls with structured JSON responses.

---

Requirements

• Windows only — pybag requires Microsoft Debugging Tools for Windows
• Python 3.10+
• Microsoft Debugging Tools for Windows (part of the Windows SDK)

---

Installation

1. Clone the repository

git clone https://github.com/your-username/windbg-mcp.git
cd windbg-mcp

2. Install Python dependencies

pip install pybag mcp

3. Install Microsoft Debugging Tools

Download the Windows SDK and select Debugging Tools for Windows during setup: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/

---

Connecting to LLM IDEs and Clients

The server runs as a local stdio process. All clients below launch it the same way — python <path-to>/windbg_mcp.py — but each has its own config format.

---

Claude Desktop

Edit the Claude Desktop configuration file and add the windbg-mcp entry:

Config file location:

• Windows: %APPDATA%\Claude\claude_desktop_config.json
• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "windbg-mcp": {
      "command": "python",
      "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
    }
  }
}

Restart Claude Desktop. All 55 debugger tools will appear automatically.

---

Claude Code (CLI)

Run the following command once to register the server. Claude Code stores the entry in its own MCP config and makes the tools available in every subsequent session.

claude mcp add windbg-mcp python C:\path\to\windbg-mcp\windbg_mcp.py

To verify the server was registered:

claude mcp list

To remove it later:

claude mcp remove windbg-mcp

---

Claude Cowork

There are two ways to add WinDbg MCP to Cowork: via JSON configuration (quick) or by installing it as a .mcpb plugin bundle (portable, shareable).

Option A — JSON Configuration

1. Open the Claude desktop app and go to Settings → MCP Servers.
2. Click Add Server and paste the following:

{
  "windbg-mcp": {
    "command": "python",
    "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
  }
}

3. Save and restart Cowork. The tools will be available in your next session.

Option B — Install as a .mcpb Plugin Bundle

A .mcpb file is a zip archive of the plugin directory that Cowork can install directly. This is the recommended approach when sharing the server with a team or across machines.

Step 1 — Build the .mcpb file

From the root of the cloned repository, run:

powershell -Command "Compress-Archive -Path '.\*' -DestinationPath 'windbg-mcp.zip'; Rename-Item 'windbg-mcp.zip' 'windbg-mcp.mcpb'"

This creates windbg-mcp.mcpb in the current directory, bundling windbg_mcp.py, manifest.json, and any other project files.

Step 2 — Install in Cowork

1. Open the Claude desktop app.
2. Go to Settings → Plugins (or Extensions).
3. Click Install Plugin and select windbg-mcp.mcpb.
4. Cowork reads manifest.json from the bundle, registers the MCP server, and makes all tools available immediately — no manual path configuration required.

The manifest.json bundled in this repo is already configured correctly:

{
  "manifest_version": "0.2",
  "name": "windbg-mcp",
  "version": "1.0.0",
  "description": "WinDbg MCP — full Windows debugger control via MCP tools",
  "server": {
    "type": "python",
    "entry_point": "windbg_mcp.py",
    "mcp_config": {
      "command": "python",
      "args": ["${__dirname}/windbg_mcp.py"]
    }
  }
}

${__dirname} is resolved at install time to the directory where Cowork unpacked the bundle, so you do not need to hard-code any paths.

---

OpenAI Codex CLI

Add the server to your Codex CLI configuration file. The file is typically located at ~/.codex/config.json (Linux/macOS) or %USERPROFILE%\.codex\config.json (Windows).

{
  "mcpServers": {
    "windbg-mcp": {
      "command": "python",
      "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
    }
  }
}

Once saved, start a new Codex session. The WinDbg tools will be available for the model to call.

---

Cursor

1. Open Cursor → Preferences → Cursor Settings.
2. Navigate to the MCP tab.
3. Click Add new global MCP server and use this configuration:

{
  "windbg-mcp": {
    "command": "python",
    "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
  }
}

4. Save. Cursor will connect to the server on its next Composer session.

---

Continue.dev

Add the following to your ~/.continue/config.json (or the workspace-level .continue/config.json):

{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "python",
          "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
        }
      }
    ]
  }
}

Reload the Continue extension. The 55 debugger tools will appear in the tool list.

---

Custom Agents and the MCP SDK

If you are building your own agent or automation pipeline, connect to WinDbg MCP over the standard MCP stdio transport. The server speaks JSON-RPC 2.0 over stdin/stdout.

Python (using the mcp SDK)

import asyncio
from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client

server_params = StdioServerParameters(
    command="python",
    args=[r"C:\path\to\windbg-mcp\windbg_mcp.py"],
)

async def main():
    async with stdio_client(server_params) as (read, write):
        async with ClientSession(read, write) as session:
            await session.initialize()

            # List all available tools
            tools = await session.list_tools()
            print([t.name for t in tools.tools])

            # Load a crash dump
            result = await session.call_tool(
                "load_dump",
                arguments={"path": r"C:\crashes\crash.dmp"},
            )
            print(result.content)

            # Read 64 bytes at RSP
            result = await session.call_tool(
                "read_mem",
                arguments={"addr": "0x00000000001FF000", "size": 64},
            )
            print(result.content)

asyncio.run(main())

TypeScript / Node.js (using the @modelcontextprotocol/sdk package)

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const transport = new StdioClientTransport({
  command: "python",
  args: ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"],
});

const client = new Client({ name: "my-agent", version: "1.0.0" }, {});
await client.connect(transport);

// Call a tool
const result = await client.callTool({
  name: "load_dump",
  arguments: { path: "C:\\crashes\\crash.dmp" },
});
console.log(result.content);

await client.close();

LangChain / LangGraph

from langchain_mcp_adapters.tools import load_mcp_tools
from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client

server_params = StdioServerParameters(
    command="python",
    args=[r"C:\path\to\windbg-mcp\windbg_mcp.py"],
)

async def get_tools():
    async with stdio_client(server_params) as (read, write):
        async with ClientSession(read, write) as session:
            await session.initialize()
            return await load_mcp_tools(session)

Direct JSON-RPC over stdio (language-agnostic)

The server communicates via newline-delimited JSON-RPC 2.0 messages. You can drive it from any language by writing to the process's stdin and reading from stdout:

→ {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"my-client","version":"1.0"}}}
← {"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{...},"serverInfo":{"name":"WinDbg MCP","version":"1.0.0"}}}

→ {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"load_dump","arguments":{"path":"C:\\crashes\\crash.dmp"}}}
← {"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"{\"status\": \"ok\", ...}"}]}}

---

Available Tools (55 total)

Session Management

| Tool | Parameters | Returns | |------|-----------|---------| | status | — | {connected, type, pid, bitness} | | list_processes | — | [{pid, name, description}] | | create | path (required), args, initial_break | {status, pid, bitness} | | attach | pid or name (not both), initial_break | {status, pid, bitness} | | kernel_attach | connect_string (required), initial_break | {status, type, connect_string} | | load_dump | path (required) | {status, bitness, rip, symbol_at_rip} | | connect | options (required) | {status, options} | | detach | — | {status} | | terminate | — | {status} |

create — Launches a new process under the debugger. Set initial_break=True (default) to break at the process entry point.

attach — Attaches to a running process. Provide either pid (integer) or name (process filename). Do not provide both.

kernel_attach — Connects to a remote kernel debugger. connect_string uses KD syntax, e.g. "net:port=55000,key=1.2.3.4".

load_dump — Opens a .dmp file for post-mortem analysis. Returns the crash address and nearest symbol immediately.

connect — Connects to a process server for remote user-mode debugging. options uses DbgEng connection syntax, e.g. "tcp:server=192.168.1.10,port=5555".

---

Execution Control

| Tool | Parameters | Returns