memoryforensics1/windbg-mcp

View on GitHub ↗

C# MCP server for kernel & user-mode Windows debugging — DbgEng COM, KDNET, Frida, dbgsrv, TTD, and integrated VM control. 29 tools for LLM agents.

39 ★6 forksC#Updated 2mo ago

What you need to know

MCP server (C#/.NET 8) that gives AI agents complete control of a Windows VM for kernel debugging, reverse engineering, malware analysis, and vulnerability research. 29 tools wrap the Windows Debugger Engine (DbgEng COM), VMware Workstation, Frida, dbgsrv, and TTD.

Install

git clone https://github.com/memoryforensics1/windbg-mcp.git
dotnet build src/WinDbgMCP.Server/WinDbgMCP.Server.csproj

Usage

  • •Configure the server in .mcp.json, add to Claude Code/Claude Desktop, and let the agent control the VM, kernel debug, and user-mode sessions.

Key features

  • ✓Kernel debugging via KDNET
  • ✓VM lifecycle control (start/stop/snapshot/screenshot)
  • ✓Guest command execution and file transfer
  • ✓Frida user-mode hooks
  • ✓dbgsrv remote debugging
  • ✓Time Travel Debugging

Best for

Kernel debugging, malware analysis, and vulnerability research on Windows VMs

Caveats

  • ⚠Requires .NET 8 SDK, VMware Workstation Pro, and a Windows guest VM
  • ⚠Windows only
Platforms: WindowsClients: Claude Code · Claude Desktop

Reviewed 2026-08-11

Topics

ai-agentclaudecsharpdbgengdebuggerdotnetexploit-developmentfridakernel-debuggingllmmalware-analysismcpmodel-context-protocolreverse-engineeringtime-travel-debuggingttdvmwarevulnerability-researchwindbgwindows
Stars
39★
Forks
6
Language
C#
License
MIT
Created
2026-04-15
Last push
2026-07-05