re-winedbg — headless Windows-binary debugging from a Linux/macOS host

re-winedbg is the 10th MCP server in the RE-AI plugin. It drives the winedbg debugger shim (a gdbserver-compatible debugger that ships with Wine) plus a GDB client subprocess, so a Linux or macOS host can attach to a Windows .exe and step through it under the control of an AI agent. The server exposes 19 vendor-neutral tools covering the full debug lifecycle: launch, attach, breakpoints (symbol / RVA / absolute address), single-step, register and memory read/write, module / thread / backtrace enumeration, and a server-side trace-breakpoint helper that the v2.4 re-vm-reverse skill uses for dynamic dispatcher sampling.

The server reuses the persistent GDB subprocess plumbing from the re-gdb server (re_gdb.gdb_mi.GDBSession) for the gdb-client side, then layers Wine-specific launch, WINEPREFIX lifecycle, and gdbserver orchestration on top. Each session gets its own WINEPREFIX under ~/.cache/re-ai-wine/<session-id>/; the global ~/.wine is never touched.

Tools

Related MCP server: Pwno MCP

Environment variables

Install

install.sh (POSIX) installs wine + winedbg via apt / dnf / brew on a best-effort basis. Set RE_AI_SKIP_WINE=1 to opt out. On Windows, re-winedbg is not useful (the user has the native Windows debuggers; winedbg is a Linux/macOS compatibility shim) and the check_winedbg tool returns a structured {status: "ERROR", error: "host_not_supported"}.

# Linux (Debian / Ubuntu)
sudo apt-get install -y wine wine64 winedbg

# Linux (Fedora / RHEL)
sudo dnf install -y wine winedbg

# macOS
brew install --cask wine-stable

Per-session WINEPREFIX

Every start_winedbg_gdbserver / launch_under_wine call creates a fresh random WINEPREFIX under ~/.cache/re-ai-wine/<session-id>/ (overridable via the wine_prefix arg). The global ~/.wine is never touched, and end_session will refuse to wineserver -k any prefix that does not start with ~/.cache/re-ai-wine/. This guarantees we don't kill another Wine session the user has running.