{"repo":"memoryforensics1/windbg-mcp","free":true,"listed":false,"github":"https://github.com/memoryforensics1/windbg-mcp","clone":"git clone https://github.com/memoryforensics1/windbg-mcp.git","description":"C# MCP server for kernel & user-mode Windows debugging — DbgEng COM, KDNET, Frida, dbgsrv, TTD, and integrated VM control. 29 tools for LLM agents.","language":"C#","stars":39,"topics":["ai-agent","claude","csharp","dbgeng","debugger","dotnet","exploit-development","frida","kernel-debugging","llm"],"license":"MIT","category":"ai-agents","readme_excerpt":"WinDbg MCP Server A Model Context Protocol (MCP) server that gives AI agents complete control over a Windows VM for kernel debugging, reverse engineering, malware analysis, and vulnerability research. Built in C# (.NET 8), it wraps the Windows Debugger Engine (DbgEng COM), VMware Workstation, Frida, and dbgsrv into 29 MCP tools that any MCP-compatible LLM client can call. Why this project? Other WinDbg MCP servers exist — most are Python wrappers that launch cdb.exe or windbg.exe as a subprocess and drive it over stdin/stdout. That's easy to prototype but fragile in practice: the child debugger crashes, hangs on modal dialogs, deadlocks its own pipes, or dies mid-session and takes the agent's context with it. This project takes a different approach: - Direct DbgEng COM — calls the Windows Debugger Engine natively through its COM interface. No subprocess to babysit, no stdout parsing, no hung pipes. Commands execute inside the server process on a dedicated MTA COM thread with an event pump — so the debugger can't drag the whole MCP server down with it. - Kernel debugging is the primary use case, not an afterthought — full KDNET integration: attach to a running kernel, set breakpoints, step, run any WinDbg command while the target is halted, wait for events with hard timeouts, detect BSODs, and pass first-chance exceptions through so Windows keeps running normally. Execution-control commands ( g / t / p ) are blocked in kd execute so the LLM can't accidentally run away from a b","default_branch":null,"files":null,"tree":[],"storefront":"/r/memoryforensics1","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/memoryforensics1/windbg-mcp/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}