Show status of all MCO sub-servers: running/stopped, PID, tool count, uptime.

Restart a crashed MCO sub-server by name (windbg / ida / x64dbg / orchestrator / sessions).

List all configured MCO sub-servers with description and tool counts.

Show a quick orientation cheatsheet for this MCP: typical workflow, key concepts, address forms, and timeout semantics. Call this first if you are unsure how to drive the debugger.

Launch a Windows executable under cdb. The target starts SUSPENDED at the initial breakpoint — use windbg_continue to run it.

Attach cdb to a running process by PID. The process is paused on attach.

Open a Windows crash dump (.dmp) for post-mortem analysis. Combine with windbg_analyze_crash.

Quit the cdb session and release the target.

Show whether a session is active, current target, RIP, nearest symbol, current process and thread.

Show MCP-side debugger I/O state: active cdb PID, buffered output lines, async command, and async age.

Break into a running target (Ctrl+Break). Use this when the program is executing and you need to pause it.

Run an arbitrary cdb/WinDbg command verbatim. Optional regex filter keeps only matching lines; max_lines caps noisy output.

Send a raw cdb command and return immediately without waiting for a prompt and without break-in. Use windbg_wait_for_event/read_output afterward.

Resume execution (cdb 'g'). Returns when the target hits a breakpoint, exception, or exits. On timeout the server auto-breaks the target so you can recover.

Resume execution with cdb 'g' and return immediately. Does not install a timeout and never sends break-in by itself.

Recommended safe continue: send cdb 'g', then wait for event/output without ever sending break-in on timeout.

Wait for output/prompt from an async command without sending break-in on timeout. Use after windbg_continue_async.

Wait for exception/crash output using a preset filter profile (default/tg/asan). Does not send break-in on timeout.

Drain currently buffered cdb output without blocking and without sending break-in.

Single-step one instruction, stepping INTO calls (cdb 't').

Single-step one instruction, stepping OVER calls (cdb 'p').

Run until the current function returns (cdb 'gu').

Run until execution reaches a given address or symbol (cdb 'g ').

Set a software breakpoint at an address or symbol. Optional cdb-expression condition.

Build and set a conditional cdb breakpoint safely, including optional .printf logging and false-branch gc.

Set a breakpoint from an AI-friendly template: log this/args, log expression, stop on signed-negative, pointer range, or stack log.

Set a hardware data breakpoint (cdb 'ba'). Triggers on read/write/execute access.

Set a hardware data breakpoint that logs IP, watched value, optional stack, then continues. Avoids hand-written ba/.printf escaping.

List all configured breakpoints (cdb 'bl').

Persist current breakpoints using cdb .bpcmds into .windbg_mcp_breakpoints/.cmd.

Restore a previously saved breakpoint set. Optionally clears existing breakpoints first.

Delete one or all breakpoints (cdb 'bc').

Disable a breakpoint without deleting it (cdb 'bd').

Re-enable a previously disabled breakpoint (cdb 'be').

Read the CPU registers. Output is parsed into a clean key=value table plus the raw cdb output.

Modify a CPU register, e.g. name='rax', value='0x42'.

Evaluate a cdb expression (cdb '?'). Useful for arithmetic, symbol lookup, and casting.

Show the call stack of the current thread.

Search all thread stacks for a regex/module/SP/address and optionally switch to the matching thread.

Dump the CET hardware shadow stack using dps @ssp. Useful when HW-enforced stack protection is enabled.

Dump normal stack and shadow stack side by side for quick return-address divergence checks.

Resolve one shadow stack return slot: dps slot, nearest symbol, and disassembly at poi(slot).

Run to poi(@ssp+index*8). Async by default so long waits do not force break-in.

Disassemble code forward. By default shows N instructions at an address; with function=true disassembles the whole function (cdb 'uf').

Disassemble N instructions BEFORE an address (cdb 'ub'). Useful for seeing what led to the current IP.

Read memory in a chosen format (byte/word/dword/qword/ascii/unicode/pointer).

Write memory in a chosen format (byte/word/dword/qword/ascii/unicode).

Search a memory range for a byte/string/dword/qword pattern.

List loaded modules. Optional name filter (cdb 'lm m ').

Show detailed info for one module (paths, version, symbols).

List all threads in the current process.

Switch debugger context to a specific thread index.

Switch debugger context by OS thread id using cdb ~~[tid]s. Accepts values like '43110', '0x43110', or 'pid.tid'.

List processes in the current debugger session (cdb '|').

Search symbols by pattern across modules (cdb 'x'). Pattern: 'mod!func'.

Find the nearest symbol to an address (cdb 'ln').

Show local variables of the current frame (requires private symbols).

Show source code lines around an address (requires source path).

Run !analyze on the current state. Best after windbg_open_dump or on an unhandled exception.

Dump the Process Environment Block of the current process (cdb '!peb').

Dump the Thread Environment Block of the current thread (cdb '!teb').

Run !heap with optional arguments (e.g. '-s' for summary, '-p -a ' to inspect a block).

Run !handle to inspect kernel handles in the target. Empty args lists all handles.

Describe a virtual address with !address. Filters noisy 'Building memory map' progress lines and can cap output.

Dump a structure type with cdb 'dt'. Optionally apply to an address.

Set the symbol search path (cdb '.sympath') and reload symbols. Use 'srvc:\symhttps://msdl.microsoft.com/download/symbols' for the public store.

Reload symbols (cdb '.reload'). Use force=true to discard cached symbols.

Set the source code search path (cdb '.srcpath').

Full crash triage in one call: !analyze -v + registers + call stack + exception record + fault address context. Best first tool after hitting a crash.

Inspect a specific heap block: size, flags, neighbors, memory before/after. Use with ASAN crash addresses to understand overflow context.

Inspect a heap block plus bytes and pointer/symbol view before and after it.

One-call object/heap context: address eval, symbol, !address, !heap, qwords, bytes/pointers around, potential vtable, optional VRle::Span decode.

Show call stacks for ALL threads simultaneously (cdb '~* kP'). Essential for race condition / UAF analysis.

Show full exception chain: last event + exception record + context + stack at exception + SEH chain.

Check if an address contains a vtable pointer and resolve it to a symbol + disassembly. Useful for type confusion / UAF analysis.

Find heap object candidates whose first qword equals a vtable pointer. With heap_start+heap_length searches that range; otherwise parses heap ranges from !address -f:Heap and searches each range.

Decode VRle::Span entries from memory. Layout assumed: {x:i16, y:i16, len:u16, cov:u8, raw7:u8}.

Parse ASAN crash context: exception record + context record + call stack at exception. Use when debugging ASAN-instrumented binaries.

Check if IDA Pro is connected and get binary info. Always call first.

Get detailed binary info: path, arch, image base, entry point, size.

List functions in the binary. Supports pagination and name filtering.

List all binary segments (.text, .data, .rdata, etc.) with addresses and permissions.

Get the import table, optionally filtered by DLL name.

Get the export table (for DLLs/EXEs with exports).

Find all strings in the binary. Useful for IOC extraction.

List all named addresses (functions, globals, labels) with optional pattern filter.

Disassemble instructions at an address. Use function=true for entire function.

Decompile function to pseudocode using Hex-Rays decompiler.

Deep function analysis: calls, string refs, xrefs, decompile. Best starting point.

Get all cross-references TO an address (who calls/references this).

Get all cross-references FROM an address (what this calls/references).

Rename a function, label, or global variable at an address.

Add a comment at an address. Kinds: regular, repeatable, anterior, posterior.

Set the type signature for a function or variable (C declaration syntax).

Get the type signature of a function or variable.

Read raw bytes at an address and show a hex+ASCII dump.

Search the binary for a byte pattern or string. kind: bytes|string|unicode

List binary entry points (start address + DLL exports if applicable).

Get struct definition from IDA's type library (name, members, offsets, sizes).

Force-create a function at an address (useful for undefined code regions).

Scan the binary for bossix imports, string indicators, and techniques.

Scan for cryptographic algorithm indicators (constants, XOR patterns, S-boxes).

Apply a FLIRT .sig signature file to auto-identify library functions.

Execute raw IDAPython code inside IDA Pro. Escape hatch for any operation not covered by other tools.

Compare two functions side-by-side: disasm, instruction count, size delta. Useful for spotting obfuscation differences or comparing similar routines.

Build a recursive call tree from a function up to depth levels. Returns a nested tree showing what functions are called. Useful for understanding w execution flow or finding the main logic.

Write bytes to the IDA database at an address using idc.patch_byte(). Does NOT modify the original file — only the IDA database. Useful for NOP-ing bossix checks found by ida_scan_bossix.

List all patches applied to the IDA database. Shows address, original byte value, and patched byte value for each changed byte.

Export a comprehensive IDA database summary: input file path, MD5, SHA256, image base, entry point count, function count, segment count, string count, import module count, and patch count. Good for a session overview.

Find all strings matching a regex pattern, then for each string list every function that references it. Great for finding where 'admin', 'password', 'cmd.exe', or C2 URLs are used.

Decompile up to limit functions using Hex-Rays and return their pseudocode. Starts from the first function in the binary. Useful for bulk analysis.

AUTONOMOUS ANALYSIS: Ask the AI agent to plan, execute, and report on a debugging goal. The agent runs a ReAct loop, calls multiple debugging skills, and returns findings. USE WHEN: open-ended exploration — 'find unpacking loop', 'identify anti-debug', 'trace execution from main'. DO NOT USE for single specific operations — call the dedicated tool instead.

Get the agent's current debugging context: target process, current RIP, breakpoints, discovered functions, found patterns, current goal. USE WHEN: you need to know what the agent already knows before deciding next steps.

Recall insights from past debugging sessions. Searches the agent's persistent memory (~/.x64ai/) for matching patterns and insights. USE WHEN: starting analysis on a new binary — past insights may apply.

List the agent's known binary patterns: packer signatures, anti-debug checks, crypto routines, syscall stubs, Heaven's Gate, etc. USE WHEN: deciding what to search for, or to understand what the agent recognizes.

Control execution: run, pause, single-step, run-to-address. TIP: Use 'run_to' instead of breakpoint(action='set')+run for one-shot stops (auto-cleans the BP).

Get all CPU registers (GPRs + flags + RIP/RSP). Updates the agent's current_rip context.

Set a CPU register to a specific value. Useful for bypassing checks (set RAX=0 after IsDebuggerPresent), redirecting execution (change RIP), or modifying function arguments.

Disassemble instructions with auto call/jump analysis. Returns instructions plus categorized lists of CALLs and JMPs.

Deep function analysis: disassembly, xrefs in/out, API calls, string refs, crypto indicators (xor/rol/ror/shl/shr).

Get cross-references to or from an address (callers / callees).

Evaluate an x64dbg expression. Resolves API names, registers, arithmetic, pointer dereferences. TIP: Use [address] syntax to read a pointer value, e.g. '[rsp]' reads the QWORD at RSP. This is faster than read_memory for single values.

Get the current thread's call stack with module + function names per frame.

Get comprehensive process info: main module, base address, entry point, threads, PEB. USE WHEN: starting analysis — typically the first call to orient yourself.

List all loaded modules (DLLs/EXE) with bases, sizes, entry points.

Get import table grouped by DLL. Network imports → C2; crypto imports → ransomware; anti-debug imports → evasion.

Get the export table of a module — exported function names + addresses + ordinals.

List threads with TID, entry, state, priority.

Get FULL PEB (Process Environment Block) dump with anti-debug flag analysis. Returns ALL fields. Use process_info for a quick overview; use this for deep PEB inspection.

List process handles grouped by type (File, Mutant, Event, Thread, etc.).

Get the process virtual memory map. AUTOMATICALLY FLAGS RWX regions (unpacking indicator).

Read memory and return as hex+ASCII dump.

Write hex bytes to memory. ⚠ Modifies process state.

Read a null-terminated string from memory (ASCII).

Search memory for a byte pattern with ?? wildcards. Examples: 'CC' (INT3), '0F 31' (RDTSC), 'E9 ?? ?? ?? ??' (JMP rel32).

Find readable strings in ALL loaded modules, AUTO-CATEGORIZED into urls/paths/registry/apis/other. Great for IOCs and hardcoded URLs/paths. May be slow on large processes.

Allocate memory in the target process. Returns the allocated address.

Set, list, or delete a breakpoint. Supports software, hardware, memory, conditional, and API-by-name. USE 'set' WITH 'api' to break on an imported function by name (no need to resolve address). USE 'set_conditional' to break only when expression is true (e.g., 'rcx == 0x1000'). USE 'set_hw' for hardware breakpoints (no code modification, useful when scanning for INT3). USE 'list' to see all currently active breakpoints. For a single API, use action='set' + 'api'. For bulk API groups (all memory/network/etc.), use breakpoint_on_api_group instead.

Set breakpoints on all APIs in a category at once. Saves many calls vs setting each manually.

COMPREHENSIVE bossix scan: PEB flags, API imports, byte patterns, RDTSC. Returns detected techniques + targeted bypass suggestions per finding.

Hide debugger via PEB patches: zero BeingDebugged, clear NtGlobalFlag, x64dbg built-in hide.

Auto-patch a bossix check at an address. Picks the right patch based on instruction: flips conditional jumps, NOPs test/cmp, replaces CALL with xor eax,eax.

Execute a raw x64dbg command. ESCAPE HATCH for operations not covered by other tools. USE SPARINGLY — prefer the dedicated tool when one exists.

Dump a loaded module to disk (post-unpacking, etc.).

Execute a multi-line x64dbg script (commands run atomically). One command per line. Example: 'bp VirtualAlloc\nrun\nlog "hit VirtualAlloc"'.

Launch x64dbg debugger (with optional target EXE). USE WHEN: x64dbg is not yet running and you need to start a debug session. Waits for the AI Agent plugin to become connectable after launch.

Get x64dbg connection status, process state, and bridge info.

Attempt to (re)connect to a running x64dbg instance. USE WHEN: x64dbg is already running but Claude is not connected.

Evaluate a debugger expression and return the numeric result. Sends the eval_expression command directly to the x64dbg plugin for extended expression support. Resolves register names, API addresses, arithmetic, pointer dereferences. USE WHEN: you need to resolve a symbol address or compute a pointer value. Examples: 'kernel32.VirtualAlloc', 'rax+8', '[rsp+0x28]', 'ntdll.NtQueryInformationProcess'.

Check which debuggers (WinDbg, IDA Pro, x64dbg) are currently available and connected.

Full crash analysis pipeline: open a .dmp in WinDbg, extract the crashing address, then pivot to IDA Pro to decompile the crashing function and show callers. Returns a combined report with WinDbg !analyze output + IDA pseudocode.

Cross-debugger bossix detection: IDA Pro static scan for IsDebuggerPresent/NtQueryInformationProcess/etc. + x64dbg dynamic PEB check. Returns combined findings.

Take an address from WinDbg or x64dbg and analyze it in IDA Pro. Returns: function name, decompiled pseudocode, callers, callees. Use when you have a suspicious address from dynamic analysis.

Quick w audit using all available debuggers: IDA static analysis (suspicious APIs, strings, crypto) + x64dbg runtime state (modules, threads). Returns a unified threat intelligence report with severity ratings.

Binary diff two functions in IDA Pro. Compare instruction sequences, calculate similarity percentage, show added/removed operations. Useful for patch diffing between clean and infected binaries.

Detect heap spray attacks: WinDbg !heap -s summary + IDA Pro heap allocation site mapping. Identifies suspicious allocation patterns and size anomalies.

Start a new named debug session. Sets it as the current active session for recording.

End the current (or specified) session and save notes.

List recent debug sessions with stats (duration, tool calls, debugger).

Permanently delete a session and all its recorded events.

Record a tool call into the current session. Call this after every MCP tool call you want to track.

Full-text search across all recorded tool outputs. Returns matching sessions with context snippets.

Return all tool calls from a session in chronological order with timestamps.

Find all sessions that mention a specific hex address in any tool output.

Find all sessions that mention a specific function name (e.g. 'NtUserSetWindowPos' or 'win32k!NtUser').

Get an AI-readable summary of a session: top tools, key addresses found, critical findings.

Export a full Markdown report of a session — timeline of tool calls, key addresses, tools table. Ready to share.

Global MCO stats: total sessions, total tool calls, most used tools, most analyzed targets.

Compare two sessions: which tools were used in one but not the other, call count differences, similarity %.