Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/memoryforensics1/windbg-mcp/claude-mdgit clone --depth 1 https://github.com/memoryforensics1/windbg-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/memoryforensics1/windbg-mcp/claude-md)<a href="https://agentmods.dev/instructions/memoryforensics1/windbg-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/memoryforensics1/windbg-mcp/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01657 | $0.01657 |
| Opus 5 | $0.00829 | $0.00829 |
| Sonnet 5 | $0.00331 | $0.00331 |
| Haiku 4.5 | $0.00166 | $0.00166 |
Grade A, and why
windbg-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WinDbgMCP — C# MCP Server for Windows VM Control & Kernel Debugging
What This Is
A single C# (.NET 8) MCP server that gives an LLM agent complete control over a Windows VM: VM lifecycle, kernel debugging (DbgEng COM), guest execution (vmrun), and user-mode debugging (Frida/dbgsrv/TTD).
Build & Run
# Build
dotnet build src/WinDbgMCP.Server/WinDbgMCP.Server.csproj
# Run (stdio mode — used by MCP clients)
dotnet run --project src/WinDbgMCP.Server/WinDbgMCP.Server.csproj
# Run tests
dotnet test src/WinDbgMCP.Tests/WinDbgMCP.Tests.csproj
dotnet is at: C:\Program Files\dotnet\dotnet.exe
If not in PATH, use: "/c/Program Files/dotnet/dotnet.exe" from bash.
Project Structure
src/WinDbgMCP.Server/
├── Program.cs # Entry point, MCP server setup, DI
├── appsettings.json # VM creds, KDNET config, timeouts
├── Configuration/
│ └── ServerConfig.cs # Configuration model classes
├── State/
│ ├── SystemState.cs # State model + enums
│ ├── StateCoordinator.cs # Precondition gate (heart of system)
│ ├── ErrorMessages.cs # LLM-friendly error catalog
│ └── ToolResult.cs # Result type
├── Vmware/
│ ├── VmwareManager.cs # vmrun wrapper (all VM operations)
│ └── ProcessResult.cs # vmrun result types
├── KernelDebug/
│ ├── DbgEngThread.cs # Dedicated MTA thread for COM
│ ├── DbgEngManager.cs # Kernel debug session manager
│ ├── DebugEventCallbacks.cs # Debug event capture
│ ├── OutputCapture.cs # Command output capture
│ ├── Interop/
│ │ ├── Constants.cs # Blocked commands, HRESULT values
│ │ └── NativeMethods.cs # P/Invoke for dbgeng.dll
│ └── Models/
│ └── DebugEvent.cs # Debug event model
├── Guest/
│ ├── GuestExecManager.cs # Guest command execution + file transfer
│ └── Models/
│ └── GuestCommandResult.cs # Command result model
├── UserModeDebug/
│ ├── FridaManager.cs # Frida CLI wrapper
│ ├── DbgsrvManager.cs # Remote user-mode debugging
│ └── TtdManager.cs # Time Travel Debugging
└── Tools/
├── VmTools.cs # vm_* tools (7)
├── VmScreenshotTool.cs # vm_screenshot
├── KernelDebugTools.cs # kd_* tools (7)
├── GuestTools.cs # guest_* tools (5)
├── UserModeDebugTools.cs # umd_* tools (8)
└── MetaTools.cs # get_system_state (1)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 147 lines · 1,657 tokens per session scan A beb86a5ce0ea
windbg-mcp CLAUDE.md is an instructions file published in the GitHub repository memoryforensics1/windbg-mcp (40 stars, last pushed 2mo ago), licensed MIT. It adds 1,657 tokens to every session, about $0.0083 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
debug-mcp CLAUDE.md
Claude Code instructions for jkolo/debug-mcp, covering claude.md, what this is, build & test commands, run a single test class and run a single test method.
maui ci-copilot-pipeline-security.instructions.md
Security rules for the Copilot PR-review pipeline. Read before editing.
maui performance-hotpaths.instructions.md
Instructions for dotnet/maui, covering performance-critical path rules, hot paths in maui, allocation avoidance, caching and invalidation and collection iteration.
maui collectionview-windows.instructions.md
Instructions for dotnet/maui, covering collectionview — windows (items/ handler), winui listview/itemsrepeater patterns, data source and change notifications, layout configuration and cross-platform consistency.
codex-provider-sync AGENTS.md
Instructions for Dailin521/codex-provider-sync, covering ai / agent operator guide, vnext architecture baseline, goal, choose the interface and safe operating flow.
Grace AGENTS.md
AGENTS.md instructions for ScottArbeit/Grace, covering agent instructions, agent quickstart (local), issue tracking, development process and markdown guidelines.