x64dbg MCP Server

x64dbg is the open-source Windows debugger that most reverse-engineering and crash-analysis work on Windows runs through. This plugin puts a Model Context Protocol server inside it, so an AI assistant can drive a live debugging session rather than being handed pasted output.

The surface is broad: 84 MCP tools covering breakpoints, memory reads, disassembly, register access and the rest of the debugger's functionality, plus 22 event callbacks so the agent is notified when the debuggee hits a breakpoint, throws an exception or exits — the difference between an assistant that polls and one that reacts. Both x32 and x64 targets are supported, on ports 9095 and 9094 respectively.

It is a native plugin written in Zig with zero dependencies, which matters for a debugger: there is no Python runtime or Node process to install alongside x64dbg, and no bridge to keep in sync. Installation is copying the contents of dist/ into the x64dbg root directory — the server then starts automatically when x64dbg launches, with an auto-start toggle and settings in a configuration dialog under the Plugins menu. Transport is dual, streamable HTTP plus SSE, and requests are authenticated with a bearer token rather than left open on localhost.

Useful for malware analysis, crash triage, vulnerability research and any workflow where stepping through a binary is faster than reading it, and where handing the stepping to an agent saves the analyst the round trips. MIT licensed, cross-compilable, and under active development — v1.4 fixed agent recovery after a debuggee crash.