WinDbg MCP Server by svnscha: Crash Dump Analysis with Claude

• Finds crash dump files in a folder

  Looks through a folder and lists the crash dump files in it, so you can pick one to analyze. It is the starting point when you have a folder of dumps and no file name.

  Try: “List the crash dumps in C:\CrashDumps.”

  Files · list_dumps

• Opens a crash dump and runs a first analysis

  Starts the Windows debugger on a user-mode crash dump and runs the standard first analysis. You get back a session id that the other tools use. Kernel dumps use a different tool.

  Try: “Open C:\CrashDumps\app.dmp and tell me why it crashed.”

  Runs code · open_cdb_dump

• Attaches to a running program through a debug server

  Connects to a program that already runs under a cdb debug server, on this or another machine. A running program stays running unless you ask it to break in. Its description warns that one cdb version can freeze Windows if the server is started with no console input.

  Try: “Attach to the debug server at tcp:Port=5005,Server=192.168.0.100 and show me the call stack.”

  Runs code · open_cdb_remote

• Connects to a Windows kernel target such as a VM

  Waits for a kernel target to connect over network debugging, a named pipe or a serial port, then breaks into it. This pauses the target machine while you look at it.

  Try: “Connect to the VM over KDNET on port 50000 and show me the bugcheck.”

  Runs code · open_kd_session

• Opens a kernel crash dump and runs a first analysis

  Opens a full, kernel, bitmap or small memory dump written by a blue screen and runs the standard first analysis. Use it for MEMORY.DMP and the Minidump folder, not for app crashes.

  Try: “Open C:\Windows\MEMORY.DMP and tell me which driver caused the bugcheck.”

  Runs code · open_kd_dump

• Runs any debugger command on an open app session

  Sends a debugger command you or the assistant chose to an open user-mode session and returns the output. It can run any command the debugger accepts, including ones that change a live program.

  Try: “In that session, show the stack of every thread.”

  Runs code · run_cdb_command

• Runs any debugger command on an open kernel session

  Sends a debugger command to an open kernel session and returns the output. Kernel memory reads can be slow, so you can set a longer timeout. It can run any command the debugger accepts.

  Try: “Run !process 0 0 on the kernel session and list the running processes.”

  Runs code · run_kd_command

• Closes an app debugging session

  Ends a user-mode session and frees its resources. For a remote session it closes only this server's connection, not the debug server, and by default leaves the program as it found it.

  Try: “Close the debugging session for the crash dump.”

  Runs code · close_cdb_session

• Closes a kernel debugging session

  Ends a kernel session and frees its resources. The README notes that this resumes the target machine.

  Try: “Close the kernel session and let the VM run again.”

  Runs code · close_kd_session

• Interrupts a running live target so you can inspect it

  Stops a running target so commands work again. Use it when a live session is running and not responding to commands.

  Try: “Break into the running process so I can look at its threads.”

  Runs code · send_ctrl_break

• Waits for a resumed target to stop again

  After you let a target run, this waits until it hits a breakpoint or bugcheck and returns what it printed. If time runs out the target keeps running.

  Try: “Resume the target and tell me when it crashes.”

  Runs code · wait_for_break

• Reads the recent output a debug session printed

  Returns the latest lines a session printed, including output no earlier call returned, such as kernel debug prints. It works only when the server was started with a log folder, and it still works after the session is closed.

  Try: “Show lines mentioning "driver" from the kernel session log.”

  Files · read_debugger_log

Watch out for

• It can run any debugger command

  The two run tools pass the command to the debugger unchanged, so on a live or kernel target they can change program or system state. Use dumps or test machines, and read each command before it runs. github.com

• Dumps can contain secrets

  Crash dumps hold memory, which can include passwords and personal data, and debugger output goes to your assistant. The --filter-script option can redact tool input and output before it leaves the machine. github.com

• A cdb server started wrong can freeze Windows

  The tool text for remote attach warns that one cdb version, started in server mode with no console input, can exhaust memory and freeze the host. Follow the warning in that tool description. github.com

• HTTP mode is for a debugging host

  The server runs over stdio by default. The streamable-HTTP option binds 127.0.0.1 unless you pass --host, so do not bind it to a public address. github.com

• Optional log folder keeps unfiltered output

  With --log-dir the server writes every line a session prints to a file, unfiltered. Leave it off unless you need the log tool. github.com

Security advisories