WinDbg

You run a dedicated MCP server that connects AI models to WinDbg for Windows crash dump analysis and remote debugging. It lets you analyze dumps, inspect live targets, and batch-process multiple dumps with natural-language queries and scripted commands, all through the Model Context Protocol.

How to use

You use an MCP-enabled client to interact with the WinDbg MCP Server. Start the server using your preferred transport, then connect from your MCP client. You can analyze crash dumps, attach to remote debugging sessions, or process several dumps in a directory to identify patterns and root causes.

Practical usage patterns include: inserting natural-language requests like examining the call stack for a crash, listing available dumps, opening a specific dump, connecting to a remote debugging session, and running WinDbg commands to investigate the root cause. The server exposes a set of tools you can invoke from your MCP client to manage dumps and sessions, and to execute custom WinDbg commands.

How to install

Prerequisites you need to prepare before installing the WinDbg MCP Server:

• Windows with Debugging Tools for Windows or WinDbg from the Microsoft Store • Python 3.10 or higher • Any MCP-compatible client (for example, GitHub Copilot, Claude Desktop, Cline, Cursor, Windsurf, etc.) • The server must be configured in your chosen client before usage

Install the MCP Windbg package from Python’s package index:

pip install mcp-windbg

Starting and configuring the server for different transports

The server supports multiple transport options. You can run it locally with standard input/output or expose it over HTTP for remote access.

Standard I/O (default) starts the server in a way that is compatible with local MCP clients like VS Code.

Streamable HTTP enables bidirectional streaming for modern HTTP clients.

Start with the default Standard I/O transport:

mcp-windbg

Or explicitly request the stdio transport:

mcp-windbg --transport stdio

Start with the HTTP transport and bind to a host/port for remote clients:

mcp-windbg --transport streamable-http --host 127.0.0.1 --port 8000

Configuration details for client connections

Use the following connection configurations in your MCP client to reach the server. The HTTP transport uses a remote URL, while the stdio transport runs locally.

# HTTP transport (remote access)
{
  "type": "http",
  "name": "windbg_http",
  "url": "http://127.0.0.1:8000/mcp",
  "args": []
}

# Standard I/O transport (local)
{
  "type": "stdio",
  "name": "windbg_stdio",
  "command": "mcp-windbg",
  "args": ["--transport", "stdio"],
  "env": null
}

VS Code and HTTP transport configuration

To make the WindDbg MCP Server available in all workspaces, you can add a global user configuration. This enables seamless access from any workspace without duplicating settings.

{
  "servers": {
    "mcp_windbg": {
      "type": "stdio",
      "command": "python",
      "args": ["-m", "mcp_windbg"],
      "env": {
        "_NT_SYMBOL_PATH": "SRV*C:\\Symbols*https://msdl.microsoft.com/download/symbols"
      }
    }
  }
}

Examples of typical workflows

Crash Dump Analysis and Live Debugging are core use cases. Examples include analyzing a heap crash, inspecting environment variables, and examining thread states during a live debugging session.

Example workflow: open a crash dump and run a sequence of WinDbg commands via natural language prompts to extract root cause information.

Analyze the crash dump at C:\dumps\app.dmp

MCP compatibility and tools

This server implements the Model Context Protocol (MCP), making it compatible with any MCP-enabled client. You can rely on a consistent interface across clients.

Security and best practices

In enterprise environments, permissions and policies govern the use of AI tools. Ensure you have authorization to use the MCP server for debugging tasks and that access to crash dumps is compliant with your security posture.

Notes and troubleshooting

If you run into issues starting the HTTP transport, verify that the chosen host and port are available and not blocked by a firewall. Check that the debugging tools for Windows are installed and accessible by the server process.

Tools and capabilities

The server exposes a set of tools to manage dumps and debugging sessions. These tools enable you to list available dumps, open and close dump sessions, connect to remote targets, and run custom WinDbg commands.

Available tools

list_windbg_dumps

List crash dump files for discovery and batch analysis

open_windbg_dump

Analyze and open a specific crash dump for investigation

close_windbg_dump

Cleanup dump sessions to free resources

open_windbg_remote

Connect to a remote debugging target for live analysis

close_windbg_remote

Cleanup remote sessions to release resources

run_windbg_cmd

Execute WinDbg commands for custom analysis and investigation