MCP100 Assessment

Editorial verdict

Shortlist retained after reviewed Batch 1 re-audit: broad_debugger_authority_without_server_side_least_privilege.

Reviewed September 23, 2026

Task Fit

Mapped

Specialized workflows

Trust

Status warning

broad_debugger_authority_without_server_side_least_privilege

Maintenance

Activity observed

A dated repository or package update is available; editorial maintenance review is still pending.

Popularity

Signals available

Visible usage signals are shown for discovery only, not as proof of safety.

Best for

Opening crash dumps and querying debugger analysis, stacks, modules, and symbols through WinDbg/CDB

Not ideal for

Cross-platform debugging, live application observability, or root-cause conclusions without symbol and source validation

Avoid if

Crash dumps may contain secrets or memory content that cannot be exposed to the connected AI client

Trade-offs

It speeds repetitive debugger queries, but depends on Windows debugging tools and symbol quality and AI summaries can misinterpret low-level evidence.

Evidence scope

Evidence

Current source snapshot

Popularity

1.6k MCP repository stars

3.1k package downloads / 30 days

Repository identity: svnscha/mcp-windbg

Package identity: mcp-windbg · version 1.3.0

Stars observed September 24, 2026 · Downloads observed August 14, 2026

Exact reviewed repository metric.

existing reviewed numeric value preserved pending package refresh

Maintenance

Publisher activity observed July 20, 2026

Current source snapshot

Trust review

Source relationship: Community implementation

Reviewed September 23, 2026

Sources

GitHub repository ↗Publisher README ↗

Supporting evidence (2)

Source file: pyproject.toml ↗Source file: CHANGELOG.md ↗

Evidence-backed setup

Install & Agents

Choose your MCP client. A client connects to the MCP server; the language model is selected inside that client. Only stored, source-backed configurations are shown.

Claude Code

Local stdio

MCP100 logic checked

claude mcp add mcp-windbg -e _NT_SYMBOL_PATH="SRV*/absolute/path/to/symbol-cache*https://msdl.microsoft.com/download/symbols" -- python "-m" "mcp_windbg"

The publisher connection details were combined with this client's official MCP transport configuration; installation was not executed by MCP100.

Verify safely: Restart Claude Code, confirm mcp-windbg tools are listed, and perform one read-only test with non-sensitive data.

Uninstall and revoke

Remove mcp-windbg from Claude Code, restart the client, remove any separately installed package, and revoke dedicated credentials if used.

Evidence & methodology

Publisher-documented setup is not the same as MCP100 execution testing. “MCP100 logic checked” means the stored configuration shape was reviewed, not that third-party MCP software was run.

Evidence checked 2026-08-12

Evidence 1 ↗Evidence 2 ↗

Capability

What it does

A Model Context Protocol server for Windows crash dump analysis using WinDbg/CDB

Security & TestingCybersecurity

Representative uses

Opening crash dumps and querying debugger analysis, stacks, modules, and symbols through WinDbg/CDB

Important limits

Cross-platform debugging, live application observability, or root-cause conclusions without symbol and source validation

Tools10 toolsView tools

list_dumps
List crash-dump files available for debugging.
open_cdb_dump
Open a crash dump in CDB for postmortem debugging.
open_cdb_remote
Connect CDB to a remote debugging target.
open_kd_session
Open a kernel-debugging session with KD.
run_cdb_command
Run a debugger command in the active CDB session.
run_kd_command
Run a debugger command in the active KD session.
close_cdb_session
Close the active CDB debugging session.
close_kd_session
Close the active KD debugging session.
send_ctrl_break
Interrupt the active debugger session with a Ctrl+Break signal.
wait_for_break
Wait for a resumed live debugger target to stop again, then return the debugger output produced at the break.

Context Footprint

~2K estimated schema tokens

Context impact: Low

Estimated token footprint of the MCP tool schemas exposed to the agent.

Approx. estimate

Current v1.1.0 ten-tool debugger surface.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Stdio has no separate authentication. The documented HTTP transport has no authentication; the publisher recommends localhost, SSH tunneling, or an authenticating reverse proxy.
Permissions: Launches CDB or KD, reads crash dumps, attaches to user-mode remote and kernel targets, runs arbitrary WinDbg or KD commands, and can interrupt live sessions.
Data handling: Dump contents, symbol paths, commands, and outputs can be returned to the client or model. Filter scripts can redact text before it leaves the host; symbol retrieval may use Microsoft symbol services. Retention is not documented.
Cost: The MIT-licensed server lists no MCP fee. Windows Debugging Tools and symbol-network use are external requirements.
Risk and cautions: Crash dumps can contain secrets or PII, and arbitrary debugger or kernel commands can affect live systems. Keep HTTP loopback-only or behind authentication, use redaction filters, and supervise remote and kernel sessions.

Related reviewed MCPs

Other options

sonarqube

MCP100 Recommended

Inspect SonarQube and SonarCloud projects, issues, quality gates, and security findings.

Choose this instead if

Choose sonarqube instead if code-quality and application-security investigation with optional controlled project operations.

Inspect SonarQube and SonarCloud projects, issues, quality gates, and security findings.

Compare with MCP Server for WinDbg Crash Analysis View sonarqube details

semgrep

MCP100 Recommended

Run Semgrep security scans and inspect local or authorized Semgrep AppSec findings.

Choose this instead if

Choose semgrep instead if static-analysis and secure-coding investigation within the maintained Semgrep CLI.

Run Semgrep security scans and inspect local or authorized Semgrep AppSec findings.

Compare with MCP Server for WinDbg Crash Analysis View semgrep details

Sentry MCP

MCP100 Recommended

Investigate Sentry errors, issues, projects, and telemetry.

Choose this instead if

Choose Sentry MCP instead if human-in-the-loop issue, event, trace, and performance investigation.

Investigate Sentry errors, issues, projects, and telemetry.

Compare with MCP Server for WinDbg Crash Analysis View Sentry MCP details

Read publisher documentation

Publisher documentation

MCP100 source-backed summary

A concise MCP100 summary built from the reviewed publisher sources. It is not a publisher README; use the original link for the latest full documentation.

View original documentation ↗

MCP Server for WinDbg Crash Analysis

A Model Context Protocol server for Windows crash dump analysis using WinDbg/CDB

What it can help with

Opening crash dumps and querying debugger analysis, stacks, modules, and symbols through WinDbg/CDB

Important limits

Cross-platform debugging, live application observability, or root-cause conclusions without symbol and source validation

Loading optional publisher documentation…

FAQ

What can MCP Server for WinDbg Crash Analysis do?

A Model Context Protocol server for Windows crash dump analysis using WinDbg/CDB

Can it open crash dumps and run CDB or KD debugger commands?

Yes. The reviewed surface includes opening CDB dumps or remote sessions, opening KD sessions, running CDB or KD commands, and controlling or closing those debugger sessions.

Does MCP Server for WinDbg Crash Analysis work with Codex?

Yes. MCP100 reviewed an evidence-backed setup for Codex, but has not independently verified it with a live runtime test.

How does it connect to a debugger?

Stdio has no separate authentication. The documented HTTP transport has no authentication; the publisher recommends localhost, SSH tunneling, or an authenticating reverse proxy.

What are the risks of using it for live or sensitive crash analysis?

Crash dumps can contain secrets or PII, and arbitrary debugger or kernel commands can affect live systems. Keep HTTP loopback-only or behind authentication, use redaction filters, and supervise remote and kernel sessions.

Is this an official MCP?

svnscha is listed as Community implementation in MCP100’s current evidence.

Current implementation resources: