x64dbg MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track debugger-version and analysis-tool changes because debugging capabilities are specialized

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Authorized Windows debugging and reverse-engineering workflows.

What we know

A native MCP plugin exposing x64dbg breakpoints, stepping, memory/register access and PE analysis over HTTP.

Maintenance / activity evidence

Observed Sep 30, 2026 (UTC)v1.5: Win7/8 compat — runtime DPI resolution, unit tests + CI

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Debugger/process authority. Writes: Breakpoints; Memory writes; Allocation; Stepping.
Mandatory bearer token
Sensitive access: Process memory, Registers, Binaries

Remote debugger control can alter process execution and memory; use only on authorized targets and keep the endpoint private.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

2,309 repository stars

Stars observed Oct 6, 2026.

All limitations / Review context

Which x64dbg operations and Windows versions remain supported?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Remote debugger control can alter process execution and memory; use only on authorized targets and keep the endpoint private.
Debugger/process authority.
Mandatory bearer token
Target process memory and binary state are exposed.
Reviewed write actions: Breakpoints; Memory writes; Allocation; Stepping
Sensitive access: Process memory, Registers, Binaries
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Windows/x64dbg-specific.
Full debugger and process-memory access is high impact.

Original activity observations

2026-09-30T07:13:46Z: v1.5: Win7/8 compat — runtime DPI resolution, unit tests + CI

Technical identity

github.com/duty1g/x64dbg-mcp-server

Exact implementation source: https://github.com/duty1g/x64dbg-mcp-server ↗
Reviewed resource type: Testing / Debugging
Repository identity: duty1g/x64dbg-mcp-server
Service endpoint: http://localhost:9094/

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
duty1g/x64dbg-mcp-server
Recorded repository material and project history.

Setup · Watchlist

Testing / Debugging setup

Publisher instructions.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher-specific setup path. Follow prerequisites, then register or connect to your MCP host.
Connection / UI instruction · Publisher instructions
Download x64dbg MCP plugin from https://github.com/duty1g/x64dbg-mcp-server/releases and copy dist/ contents to x64dbg root.
Configure / authenticate
Publisher instructions
Start x64dbg. Streamable HTTP at http://localhost:9094/ (x64) or 9095 (x32), with generated Bearer token in request header. Prefer 127.0.0.1 binding.
Advanced configuration · Generic JSON MCP client · Publisher instructions
Generic JSON MCP client · Publisher instructions
{ "mcpServers": { "x64dbg": { "headers": { "Authorization": "Bearer REPLACE_WITH_GENERATED_TOKEN" }, "type": "http", "url": "http://localhost:9094/" } } }
Check connection
Suggested check
Check client MCP tool discovery using the generated token; unauthorized requests get 401. Do not write process memory in verification.
Remove / uninstall / revoke
MCP100 setup guide
Disconnect the HTTP MCP entry; close x64dbg or disable/remove plugin from its plugin directory to stop the local server.
MCP100 client-scope guidance: each CLI removal example targets only its named client and exact registered entry. Package names, Desktop/Cursor configuration keys and Codex/Claude registration names may differ; use the entry you actually registered. Client removal does not revoke provider credentials.
claude mcp remove x64dbg

Official Documentation & Sources

What it does

A native MCP plugin exposing x64dbg breakpoints, stepping, memory/register access and PE analysis over HTTP.

Capability: Security & Testing
Resource type: Testing / Debugging
Industry: Cybersecurity
Best fit: Authorized Windows debugging and reverse-engineering workflows.

Representative uses

Set breakpoints and step execution
Read/write process memory
Inspect modules/symbols/PE structures
Dump debugging artifacts

Limitations

Windows/x64dbg-specific.
Full debugger and process-memory access is high impact.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Mandatory bearer token
Permissions: Debugger/process authority.
Data handling: Target process memory and binary state are exposed.
Cost: free
Risk and cautions: Remote debugger control can alter process execution and memory; use only on authorized targets and keep the endpoint private.

Access scope and cautions

Write actions: Breakpoints Memory writes Allocation Stepping
Sensitive access: Process memory Registers Binaries
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Set breakpoints and step execution; Read/write process memory; Inspect modules/symbols/PE structures; Dump debugging artifacts.

What setup and authentication are documented?

A complete connection procedure is not verified. Recorded endpoint: http://localhost:9094/. Recorded transport: streamable_http. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Mandatory generated bearer token.

Can it modify data or perform write operations?

Documented write actions include: Breakpoints; Memory writes; Allocation; Stepping. Recorded permission boundary: Debugger/process authority.

What data-handling boundary should I consider?

Target process memory and binary state are exposed. Recorded sensitive-access context: Process memory; Registers; Binaries.

What limitations and risks should I check before use?

Remote debugger control can alter process execution and memory; use only on authorized targets and keep the endpoint private. Windows/x64dbg-specific. Full debugger and process-memory access is high impact. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

duty1g is listed as Community implementation in MCP100’s current evidence.