> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# WinDbg MCP

> Connect Claude Code to WinDbg/CDB on Windows VM4 via SSH tunnel for crash dump and kernel analysis.

`mcp-windbg` wraps the Windows CDB/WinDbg debugger over HTTP on port 8000. Use it for crash dump analysis, kernel debugging, and post-mortem investigation of Windows malware.

## Prerequisites

* `mcp-windbg` installed on VM4 via `pip install mcp-windbg`
* The `C:\lab\startup.ps1` autostart task running (starts mcp-windbg on login)
* SSH tunnel active from VM1 to VM4

## Register with Claude Code

The SSH tunnel for WinDbg shares the same connection as x64dbg (started by the `lab` function). Register the MCP after the tunnel is up:

```bash theme={null}
claude mcp add windbg \
  --scope user \
  --transport http \
  -- http://127.0.0.1:8000/mcp

claude mcp list | grep windbg
```

## Test the Connection

```bash theme={null}
curl -s http://127.0.0.1:8000/health
```

## Typical Usage

Ask Claude to analyze a crash dump:

```
Use windbg MCP to open C:\dumps\crash.dmp and:
1. Get the exception record and faulting address
2. Get the call stack at time of crash
3. List loaded modules and check for suspicious ones
4. Summarize: crash cause, faulting module, any indicators of compromise
```

## Troubleshooting

| Issue | Fix |
| - | - |
| Port 8000 "connection refused" | Check that `startup.ps1` ran on VM4. Run manually: `mcp-windbg --transport streamable-http --host 127.0.0.1 --port 8000` |
| Tunnel not forwarding | Re-establish: `ssh -i ~/.ssh/windows_key -N -L 8000:127.0.0.1:8000 analyst@192.168.56.40 &` |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.