An MCP (Model Context Protocol) server that turns all pybag Windows debugger functions into native MCP tools. It lets MCP-compatible clients (Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents) control user-mode processes, kernel sessions, and crash dump analysis via structured JSON calls.
☆85May 3, 2026Updated 2 months ago
Alternatives and similar repositories for windbg-mcp
Users that are interested in windbg-mcp are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- C# MCP server for kernel & user-mode Windows debugging — DbgEng COM, KDNET, Frida, dbgsrv, TTD, and integrated VM control. 29 tools for L…☆36Jul 5, 2026Updated last week
- A lightweight Windows Prefetch file parser to extract programs' execution history☆70Jan 12, 2026Updated 6 months ago
- IFL - Interactive Functions List (plugin for Binary Ninja)☆24Jul 9, 2024Updated 2 years ago
- Static analysis & exploitation-triage toolkit for Windows kernel drivers. Discover IOCTLs, Symbolic Links, and check cert , and Downlaods…☆191Apr 27, 2026Updated 2 months ago
- .NET CLR-Stomping☆146May 20, 2026Updated last month
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification s…☆40Jun 4, 2026Updated last month
- An IDA Pro / Hex-Rays plugin that turns noisy pseudocode into reviewable, kernel-aware cleanup artifacts☆157Jul 7, 2026Updated last week
- PoC for generating bthprops.cpl module designed to be loaded by Fsquirt.exe LOLBin☆121Jan 4, 2026Updated 6 months ago
- A PoC Cobalt Strike UDRL written in Rust☆31Jun 20, 2026Updated 3 weeks ago
- An MCP server for procmon☆45Jun 23, 2026Updated 3 weeks ago
- WinDbg x64 extension that disassembles live functions and uses an LLM to produce verified pseudocode.☆111Jun 22, 2026Updated 3 weeks ago
- ☆49Oct 14, 2025Updated 9 months ago
- Windows rootkit designed to work with BYOVD exploits☆223Jan 18, 2025Updated last year
- Impersonate Tokens using only NTAPI functions☆85Apr 4, 2025Updated last year
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques☆130Dec 28, 2025Updated 6 months ago
- ☆150Jan 25, 2024Updated 2 years ago
- COM Windows Persistence Technique☆89Apr 27, 2026Updated 2 months ago
- Headless IDA Pro MCP Server☆621Updated this week
- IronPE is a Windows PE manual loader written in Rust for both x86 and x64 PE files.☆123Mar 10, 2026Updated 4 months ago
- Windows security research toolkit for LPE, persistence, COM hijacking, and attack surface enumeration.☆204Jun 13, 2026Updated last month
- EDRUnChoker - fileless WMI defense that removes EDRChoker QoS throttling policies☆43Jun 8, 2026Updated last month
- Hijacks code execution via overwriting Control Flow Guard pointers in combase.dll☆155Apr 18, 2025Updated last year
- A local tool for ingesting Windows Patch Tuesday CVEs, diffing patched binaries with Ghidriff and surfacing LLM-generated security analys…☆55May 19, 2026Updated last month
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Some V8 n-day exploits that I've written☆63Jun 7, 2026Updated last month
- ☆24Updated this week
- Windows kernel research tool. Looks like a debugger, but it is not a debugger. It uses a kernel driver to provide a WinDbg-like live kern…☆69Jul 7, 2026Updated last week
- KslDump — Why bring your own knife when Defender already left one in the kitchen?☆392Apr 13, 2026Updated 3 months ago
- Polymorphic PE rewriter for Windows x64 , rewrites binaries into semantically identical but byte-different variants☆192Jun 6, 2026Updated last month
- Minimalistic HTTP(S) client for the NT kernel☆60Dec 1, 2025Updated 7 months ago
- Havoc C2 BOF port of the KslD.sys BYOVD technique. Credential extraction from lsass via physical memory — no OpenProcess, no auditable AP…☆142Apr 22, 2026Updated 2 months ago
- An IDA Pro plugin to assist with malware reverse engineering with AI and useful utilities☆47Jun 10, 2026Updated last month
- ☆19May 1, 2025Updated last year
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Toolkit for Windows internals, vulnerability analysis, and reproducible security research workflows.☆66Jun 23, 2026Updated 3 weeks ago
- ☆18May 22, 2024Updated 2 years ago
- The PoC for CVE-2025-70795 / CVE-2026-0828 and updated driver☆49Mar 13, 2026Updated 4 months ago
- Assisting Go Analysis and Reversing☆101Nov 13, 2025Updated 8 months ago
- AI-powered malware traffic analysis and network forensics via the Model Context Protocol☆18May 27, 2026Updated last month
- This repo contains PoCs for vulnerable Windows drivers.☆152Dec 20, 2025Updated 6 months ago
- A Windows tool that converts LDIF files to BloodHound CE☆30Dec 20, 2025Updated 6 months ago