ctxdebug

▎ Overview

ctxdebug is an MCP server platform that connects WinDbg, IDA Pro 9.x, and x64dbg to AI coding assistants for reverse engineering and Windows security research.

One stdio interface. 160+ tools. Three debuggers, one mission control.

The idea. MCO turns your debuggers into MCP (Model Context Protocol) tool servers. You talk to Claude, Kiro, or any MCP-compatible client — it talks to your debuggers. No copy-pasting output. No switching windows. No manual data correlation between tools.

One round trip. You say "analyze this crash dump and find the root cause." MCO opens the dump in WinDbg, runs !analyze -v, extracts the faulting address, pivots to IDA Pro to decompile the crashing function, and returns a combined report with pseudocode and caller chain.

Related MCP server: procmon-mcp

▎ Demo

▎ Launch Sequence

T-2 — Requirements

• Python 3.11+

• OS Windows 10 / 11

• At least one debugger — WinDbg (Windows SDK) · IDA Pro 9.x · x64dbg

T-1 — Install

git clone https://github.com/DdUdle/ctxdebug.git
cd ctxdebug
pip install -e .

T-0 — Register servers

Individual servers:

claude mcp add windbg       -- python windbg_mcp.py
claude mcp add ida          -- python ida_mcp.py
claude mcp add x64dbg       -- python -m agent --mcp
claude mcp add mco          -- python mco_orchestrator.py
claude mcp add mco-sessions -- python mco_sessions.py

Or use the unified gateway — one server, every tool:

claude mcp add mco-gateway -- python mco_gateway.py

See mcp_config_example.json for full JSON configuration with environment variables.

LIFTOFF — Test it

Once a server is registered, ask your AI client:

Open C:\dumps\crash.dmp, run a full crash analysis,
and decompile the function at the fault address.

MCO chains windbg_open_dump → windbg_analyze_crash → mco_pivot_to_ida automatically and returns pseudocode with the caller chain.

▎ Features

▎ Architecture

• Transport — stdio JSON-RPC (MCP 2024-11-05 spec)

• IDA communication — HTTP REST to localhost:2022, auto-discovers endpoint from 6 candidates

• x64dbg communication — binary framing over named pipe (X64A magic + uint32 length + 8-byte padding + JSON)

• Agent reasoning — ReAct loop with pluggable LLM backends (Claude, Groq, OpenRouter, local Ollama, or heuristics-only)

• Sessions — SQLite with FTS5 full-text search, WAL mode, thread-safe

• Gateway — spawns sub-servers as child processes, proxies all tool calls through one stdio connection

▎ Fleet — Servers

▎ Ground Setup — Debuggers

Needs cdb.exe from the Windows SDK. Default path:

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe

Set WINDBG_MCP_CDB if your path differs. No pre-launch needed — tools open dumps or attach on demand.

1. Open IDA Pro 9.x with a binary loaded.

2. In the Python console, run:

   exec(open(r'path\to\mco\ida_server_plugin.py').read())

3. HTTP server starts on port 2022.

1. Build the C++ plugin:

   cd agent\plugins
   build_plugin.bat

2. Copy mco_agent.dp64 to x64dbg's plugin directory.

3. Restart x64dbg — the plugin exposes named pipe \\.\pipe\x64dbg_ai_agent.

▎ Key Workflows

Crash → source code (one command)

mco_crash_to_source(dump_path="C:\\dumps\\crash.dmp")

Opens the dump, runs !analyze -v, extracts the faulting address, decompiles the crashing function in IDA, and returns pseudocode with callers.

Anti-debug detection & bypass

mco_bossix_report()
bossix_hide()            # PEB patch
bossix_patch(address)    # NOP / flip JCC at check

Pivot any address to pseudocode

mco_pivot_to_ida(address="0x7FF712340000")

Autonomous, goal-driven analysis

agent_analyze(goal="Find the unpacking loop and identify the OEP")

The agent plans a sequence of tool calls, executes them, and reports findings — with or without an LLM backend.

Session recording

session_start(name="chrome uaf analysis")
# ... do your work ...
session_end(notes="UAF at CRenderObject::Destroy")
session_export_markdown(session_id=1)

▎ x64dbg Server Modes

▎ Environment Variables

▎ Project Structure

mco/
├── windbg_mcp.py           # WinDbg MCP server (production, 3000+ lines)
├── ida_mcp.py              # IDA Pro MCP server
├── ida_server_plugin.py    # IDA Python plugin (starts HTTP server)
├── mco_orchestrator.py     # Cross-debugger meta-tools
├── mco_sessions.py         # Session recording (SQLite + FTS5)
├── mco_gateway.py          # Unified gateway proxy
├── agent/
│   ├── __main__.py         # x64dbg MCP entry point + LLM backend selection
│   ├── core.py             # ReAct agent (Observe → Think → Act)
│   ├── memory.py           # Persistent memory store (~/.x64ai/)
│   ├── bridge.py           # Named-pipe IPC to x64dbg plugin
│   ├── mcp_server.py       # Tool definitions (38+)
│   ├── skills/             # Modular skill implementations
│   └── plugins/
│       ├── x64dbg_plugin.cpp
│       └── build_plugin.bat
├── mcp_config_example.json # Ready-to-use MCP client config
└── pyproject.toml

▎ Development

git clone https://github.com/DdUdle/ctxdebug.git
cd ctxdebug
pip install -e ".[dev]"
pytest

▎ Contributing

Contributions are welcome. Please open an issue before starting large changes so the approach can be discussed first.

▎ License

MIT — see LICENSE.