windbg-mcp

An MCP server that exposes WinDbg/DbgEng to AI agents (Claude Code, Cursor, …) over stdio. It drives a live debugger engine for user-mode, kernel, crash-dump, and Time Travel Debugging.

Rust Windows x64 MIT · v0.1.3 MCP TTD

Architecture

AI agent — JSON-RPC / stdio → server.rs
rmcp tool router — mpsc + oneshot → engine.rs
DebugEngine, one OS thread → DbgEng / target
live · kernel · dump · TTD

engine.rs — DbgEng needs serialized, single-thread access, so the engine is confined to one OS worker thread. Async handlers marshal closures onto it via mpsc with oneshot replies; a catch_unwind guard turns a panic into a failed call, not a dead thread.

main.rs — tokio + stdio transport. Logs go to stderr, since stdout is the JSON-RPC channel. ttd.rs locates TTD.exe and launches trace recording.

Tool surface

Roughly thirty tools grouped by debugger concern. Forward and reverse control tools mirror a debugger UI's F9/F8/F7 — so an agent can drive a trace in both directions.

Sessionopen_dump · open_trace · attach_kernel · attach_process · launch · end_session

Stateregisters · read_memory · backtrace · modules · threads · disassemble · dx

Controlgo · step_over · step_into · set_breakpoint

TTD navstep_back · step_over_back · reverse_go · goto_position

TTD analysisttd_calls · ttd_memory · ttd_events · index_trace · record_trace

Driver IOCTLdecode_ioctl · driver_object · device_object · irp_stack · ioctl_trace

Rawexecute — run any debugger command, returns full text output

Install

Ships as a single-plugin Claude Code marketplace — installing registers the windbg MCP server and a debugging skill that knows how to drive it.

> /plugin marketplace add glslang/windbg-mcp

> /plugin install windbg-mcp@windbg-mcp

Prefer a binary? Prebuilt Windows x64 releases are attached to each GitHub release with SHA256 checksums. Or cargo build --release from source.

Walkthroughs

Crash-dump triage

A real kernel minidump: a 0x9F DRIVER_POWER_STATE_FAILURE traced to nvlddmkm.sys via !ext.analyze -v and a manual device-stack walk.

Time Travel Debugging

Opening a .run trace, surveying events and threads, forward/reverse navigation, and counting printf calls with symbols.

Driver IOCTL reachability

Enumerating a driver's IOCTL surface on a live KDNET kernel and deciding user-mode reachability — ending with a reachability report.

← all projects github.com/glslang/windbg-mcp ↗