Skip to content
KitploitKITPLOIT
ToolsBlog
Log in
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
windbg-mcp — An MCP (Model Context Protocol) server that turns all pybag Windows debugger functions into native MCP tools. It lets MCP-compatible clients (Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents) control user-mode processes, kernel sessions, and crash dump analysis via structured JSON calls. | Kitploit
Tools/GitHubGitHub/gengstah/windbg-mcp
Dynamic Analysis (Sandboxing)Memory ForensicsVulnerability AnalysisExploitationReverse EngineeringDebuggersForensicsUtilities & FrameworksBinary AnalysisIncident Response
GitHub
868145 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
gengstah/windbg-mcp

windbg-mcp

View Repository

About

An MCP (Model Context Protocol) server that turns all pybag Windows debugger functions into native MCP tools. It lets MCP-compatible clients (Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents) control user-mode processes, kernel sessions, and crash dump analysis via structured JSON calls.

Share

WinDbg MCP

An MCP (Model Context Protocol) server that exposes every pybag Windows debugger function as a native MCP tool. It gives any MCP-compatible client (Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents) full control over user-mode processes, kernel sessions, and crash dump analysis — all through typed tool calls with structured JSON responses.


Requirements

  • Windows only — pybag requires Microsoft Debugging Tools for Windows
  • Python 3.10+
  • Microsoft Debugging Tools for Windows (part of the Windows SDK)

Installation

1. Clone the repository

git clone https://github.com/your-username/windbg-mcp.git
cd windbg-mcp

2. Install Python dependencies

pip install pybag mcp

3. Install Microsoft Debugging Tools

Download the Windows SDK and select Debugging Tools for Windows during setup: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/


Connecting to LLM IDEs and Clients

The server runs as a local stdio process. All clients below launch it the same way — python <path-to>/windbg_mcp.py — but each has its own config format.


Claude Desktop

Edit the Claude Desktop configuration file and add the windbg-mcp entry:

Config file location:

  • Windows: %APPDATA%\Claude\claude_desktop_config.json
  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "windbg-mcp": {
      "command": "python",
      "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
    }
  }
}

Restart Claude Desktop. All 55 debugger tools will appear automatically.


Claude Code (CLI)

Run the following command once to register the server. Claude Code stores the entry in its own MCP config and makes the tools available in every subsequent session.

claude mcp add windbg-mcp python C:\path\to\windbg-mcp\windbg_mcp.py

To verify the server was registered:

claude mcp list

To remove it later:

claude mcp remove windbg-mcp

Claude Cowork

There are two ways to add WinDbg MCP to Cowork: via JSON configuration (quick) or by installing it as a .mcpb plugin bundle (portable, shareable).

Option A — JSON Configuration

  1. Open the Claude desktop app and go to Settings → MCP Servers.
  2. Click Add Server and paste the following:
{
  "windbg-mcp": {
    "command": "python",
    "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
  }
}
  1. Save and restart Cowork. The tools will be available in your next session.

Option B — Install as a .mcpb Plugin Bundle

A .mcpb file is a zip archive of the plugin directory that Cowork can install directly. This is the recommended approach when sharing the server with a team or across machines.

Step 1 — Build the .mcpb file

From the root of the cloned repository, run:

powershell -Command "Compress-Archive -Path '.\*' -DestinationPath 'windbg-mcp.zip'; Rename-Item 'windbg-mcp.zip' 'windbg-mcp.mcpb'"

This creates windbg-mcp.mcpb in the current directory, bundling windbg_mcp.py, manifest.json, and any other project files.

Step 2 — Install in Cowork

  1. Open the Claude desktop app.
  2. Go to Settings → Plugins (or Extensions).
  3. Click Install Plugin and select windbg-mcp.mcpb.
  4. Cowork reads manifest.json from the bundle, registers the MCP server, and makes all tools available immediately — no manual path configuration required.

The manifest.json bundled in this repo is already configured correctly:

{
  "manifest_version": "0.2",
  "name": "windbg-mcp",
  "version": "1.0.0",
  "description": "WinDbg MCP — full Windows debugger control via MCP tools",
  "server": {
    "type": "python",
    "entry_point": "windbg_mcp.py",
    "mcp_config": {
      "command": "python",
      "args": ["${__dirname}/windbg_mcp.py"]
    }
  }
}

${__dirname} is resolved at install time to the directory where Cowork unpacked the bundle, so you do not need to hard-code any paths.


OpenAI Codex CLI

Add the server to your Codex CLI configuration file. The file is typically located at ~/.codex/config.json (Linux/macOS) or %USERPROFILE%\.codex\config.json (Windows).

{
  "mcpServers": {
    "windbg-mcp": {
      "command": "python",
      "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
    }
  }
}

Once saved, start a new Codex session. The WinDbg tools will be available for the model to call.


Cursor

  1. Open Cursor → Preferences → Cursor Settings.
  2. Navigate to the MCP tab.
  3. Click Add new global MCP server and use this configuration:
{
  "windbg-mcp": {
    "command": "python",
    "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
  }
}
  1. Save. Cursor will connect to the server on its next Composer session.

Continue.dev

Add the following to your ~/.continue/config.json (or the workspace-level .continue/config.json):

{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "python",
          "args": ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"]
        }
      }
    ]
  }
}

Reload the Continue extension. The 55 debugger tools will appear in the tool list.


Custom Agents and the MCP SDK

If you are building your own agent or automation pipeline, connect to WinDbg MCP over the standard MCP stdio transport. The server speaks JSON-RPC 2.0 over stdin/stdout.

Python (using the mcp SDK)

import asyncio
from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client

server_params = StdioServerParameters(
    command="python",
    args=[r"C:\path\to\windbg-mcp\windbg_mcp.py"],
)

async def main():
    async with stdio_client(server_params) as (read, write):
        async with ClientSession(read, write) as session:
            await session.initialize()

            # List all available tools
            tools = await session.list_tools()
            print([t.name for t in tools.tools])

            # Load a crash dump
            result = await session.call_tool(
                "load_dump",
                arguments={"path": r"C:\crashes\crash.dmp"},
            )
            print(result.content)

            # Read 64 bytes at RSP
            result = await session.call_tool(
                "read_mem",
                arguments={"addr": "0x00000000001FF000", "size": 64},
            )
            print(result.content)

asyncio.run(main())

TypeScript / Node.js (using the @modelcontextprotocol/sdk package)

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const transport = new StdioClientTransport({
  command: "python",
  args: ["C:\\path\\to\\windbg-mcp\\windbg_mcp.py"],
});

const client = new Client({ name: "my-agent", version: "1.0.0" }, {});
await client.connect(transport);

// Call a tool
const result = await client.callTool({
  name: "load_dump",
  arguments: { path: "C:\\crashes\\crash.dmp" },
});
console.log(result.content);

await client.close();

LangChain / LangGraph

from langchain_mcp_adapters.tools import load_mcp_tools
from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client

server_params = StdioServerParameters(
    command="python",
    args=[r"C:\path\to\windbg-mcp\windbg_mcp.py"],
)

async def get_tools():
    async with stdio_client(server_params) as (read, write):
        async with ClientSession(read, write) as session:
            await session.initialize()
            return await load_mcp_tools(session)

Direct JSON-RPC over stdio (language-agnostic)

Download Tool