用于Windows内核调试的 MCP(模式上下文协议)服务器包 kd.exe. Spawns kd.exe作为子进程并暴露其作为22个MCP工具的功能. 处理 KDNET 连接、 断点、 内存读取、 注册检查和符号 解析不包含 DbgEng COM 包装的线程限制。

设计为与高频相配, 通过 PowerShell 管理超V VM 并在来宾内部配置 KDNET 直接的。 使用 [[T1] 来抓取 VM 并设置 KDNET, 然后通过 结果[T2]到[T3]的[T4] 内核调试会话.

– – . . .

□ 要求

• Windows 10/11,安装了Windows调试工具
• 第3.10号线+
• 在KDNET上连接的目标内核

– – . . .

□ 安装

从 GitHub 直接安装 :

这可以安装 kd-mcp 控制台脚本并自动拉入 [[T6] 依赖。

安装特定修改(立方或承诺):

Kd.exe 地点

服务器默认为:

如果安装在别处, 则覆盖 [T7] 环境变量:

– – . . .

□ 连接 MCP 客户端

克洛德代码(CLI)

·麦克平·杰森

如果您需要针入 [[T8] 每个配置 :

kd-mcp

An MCP (Model Context Protocol) server wrapping kd.exe for Windows kernel debugging. Spawns kd.exe as a subprocess and exposes its functionality as 22 MCP tools. Handles KDNET connections, breakpoints, memory reads, register inspection, and symbol resolution without the threading limitations of DbgEng COM wrappers.

Designed to pair with hyperv-mcp, which manages Hyper-V VMs and configures KDNET inside guests via PowerShell Direct. Use hyperv-mcp to snapshot a VM and set up KDNET, then pass the resulting kernel_attach_string to kd-mcp’s kernel_attach to drop into a kernel debug session.

---

Requirements

• Windows 10/11 with Windows Debugging Tools installed
• Python 3.10+
• A target kernel connected over KDNET

---

Installation

Install directly from GitHub:

pip install git+https://github.com/originsec/kd-mcp.git

This installs the kd-mcp console script and pulls in the mcp dependency automatically.

To install a specific revision (tag or commit):

pip install git+https://github.com/originsec/[email protected]

kd.exe location

The server defaults to:

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\kd.exe

Override with the KD_EXE environment variable if installed elsewhere:

$env:KD_EXE = "C:\path\to\kd.exe"

---

Connecting to MCP clients

Claude Code (CLI)

claude mcp add kd -- kd-mcp

.mcp.json

{
  "mcpServers": {
    "kd": {
      "command": "kd-mcp"
    }
  }
}

If you need to pin KD_EXE per-config:

{
  "mcpServers": {
    "kd": {
      "command": "kd-mcp",
      "env": { "KD_EXE": "C:\\path\\to\\kd.exe" }
    }
  }
}

You can also invoke the module directly without the console script:

python -m kd_mcp

---

Development install

git clone https://github.com/originsec/kd-mcp.git
cd kd-mcp
pip install -e .

---

Available Tools (21 total)

Session

kernel_attach — Launches kd.exe and connects via KDNET. Auto-respawns kd.exe on connection failures until timeout expires, so it can catch the KDNET hello packet whenever the target becomes ready (e.g. after a VM reboot). Pass reset_vm with a Hyper-V VM name to hard-reset the VM 2 seconds after kd.exe starts.

connect_string format: "net:port=50000,key=a1b2.c3d4.e5f6.a7b8.c9d0"

Execution Control