Windbg Ext MCP — AI skill for Claude Code

WinDbg‑ext‑MCP

WinDbg extension + Python MCP server. Lets MCP‑compatible clients (Cursor, Claude, VS Code + Cline/Roo) drive WinDbg with clean, validated commands. Kernel‑first; user‑mode works too.

Contents

• Quick Start
• Architecture
• Usage Examples
• What’s Here
• Sanity Check
• Troubleshooting
• Configuration
• Tested With
• Notes

Quick Start

Prereqs

• Windows 10/11
• WinDbg (Windows SDK "Debugging Tools for Windows")
• Visual Studio Build Tools (C++)
• Python 3.11+ and uv

Build the extension (Developer PowerShell for VS):

msbuild extension\windbgmcpExt.sln /p:Configuration=Release /p:Platform=x64

Load in WinDbg:

.load C:\path\to\windbgmcpExt.dll

Install and run the MCP server (in root directory):

uv sync
uv run selftest
uv run mcp --list-tools

# Run with stdio (default)
uv run mcp

# Run with HTTP/SSE transport
uv run mcp --transport http://127.0.0.1:5312

Architecture

MCP Client  <—>  Python MCP Server  <—>  WinDbg Extension (named pipe)  <—>  WinDbg/Target
  (stdio or        zeromcp                 \\.\pipe\windbgmcp                   Kernel/User
   HTTP/SSE)

• The extension hosts a named‑pipe server and executes WinDbg commands safely.
• The Python server validates inputs, resolves timeouts, and exposes tools to MCP clients.
• Supports both stdio (default) and HTTP/SSE (--transport http://127.0.0.1:5312) transports.

Usage Examples

General (natural language prompts)

• "Show me all running processes in the kernel"
• "What's the current thread's stack trace?"
• "Analyze the memory at address 0x1000"
• "Help me understand this crash dump"
• "Set a breakpoint on nt!NtCreateFile and continue execution"
• "Step through the next 3 instructions and show me the registers"

Rootkit behavior (research‑only)

• "Hide explorer.exe using EPROCESS unlink and PspCidTable Unlink"
• "Make OneDrive.exe appear to have no open handles"
• "Make notepad.exe resistance to termination and kill atte