NadavLor/windbg-ext-mcp

WinDbg extension + Python MCP server. Lets MCP‑compatible clients (Cursor, Claude, VS Code + Cline/Roo) drive WinDbg with clean, validated commands. Kernel‑first; user‑mode works too.
## Contents
Quick Start
Architecture
Usage Examples
What’s Here
Sanity Check
Troubleshooting
Configuration
Tested With
Notes
## Quick Start
Prereqs
Windows 10/11
WinDbg (Windows SDK “Debugging Tools for Windows”)
Visual Studio Build Tools (C++)
Python 3.10+ and Poetry 2.x
Build the extension (Developer PowerShell for VS):
powershell
msbuild extension\windbgmcpExt.sln /p:Configuration=Release /p:Platform=x64
Load in WinDbg:
text
.load C:\path\to\windbgmcpExt.dll
Install and run the MCP server (in root directory):
powershell
poetry install
poetry run selftest
poetry run mcp --list-tools
poetry run mcp
## Architecture
text
MCP Client (stdio) Python MCP Server (stdio) WinDbg Extension (named pipe) WinDbg/Target
FastMCP \\.\pipe\windbgmcp Kernel/User
The extension hosts a named‑pipe server and executes WinDbg commands safely.
The Python server validates inputs, resolves timeouts, and exposes tools to MCP clients.
## Usage Examples
General (natural language prompts)
"Show me all running processes in the kernel"
"What's the current thread's stack trace?"
"Analyze the memory at address 0x1000"
"Help me understand this crash dump"
"Set a breakpoint on nt!NtCreateFile and continue execution"
"Step through the next 3 instructions and show me the registers"
Rootkit behavior (research‑only)
"Hide explorer.exe using EPROCESS unlink and PspCidTable Unlink"
"Make OneDrive.exe appear to have no open handles"
"Make notepad.exe resistance to termination and kill attempts"
"Install invisible system call hooks that dont modify SSDT"
"Hide network connections from netstat while keeping them active"
"Make files invisible to directory enumeration but accessible by direct path"
Note: These are for lawful, defensive research in controlled test labs only.
## Available Tools
debug_session: session status and metadata
connection_manager: connection health and resilience controls
session_manager: capture/restore debugging context
run_command: execute a WinDbg command with validation/timeout handling
run_sequence: execute multiple commands in order
breakpoint_and_continue: set a breakpoint and continue execution
analyze_process: process enumeration, info, and context switching
analyze_thread: thread info and stack traces
analyze_memory: memory display, typed structures, searches
analyze_kernel: kernel objects and system analysis
performance_manager: optimization controls and performance report
async_manager: parallel execution and async task stats
troubleshoot: quick diagnostics and guidance
get_help: list tools and usage tips
test_windbg_communication: pipe connectivity test
network_debugging_troubleshoot: network debugging issue checks
## What’s Here
extension/: C++ WinDbg extension. Named pipe \\.\pipe\windbgmcp. Exports: help, objecttypes, hello, mcpstart, mcpstop, mcpstatus.
mcp_server/: Python MCP server using FastMCP with modular tools (session, execution, analysis, performance, support).