desktop-commander-mcp

What it is

An MCP server that gives Claude terminal control and file editing: 26 tools spanning shell execution (start_process, interact_with_process, kill_process), full CRUD on files (read_file, write_file, edit_block, move_file), streaming code/content search (start_search), and format conversion for PDF, DOCX, and Excel. It is one of the highest-privilege MCP servers in the registry: 12 of its 26 tools carry readOnlyHint: false, and 9 are marked destructiveHint: true, including the two process-execution tools that are the whole point of the product.

How it was vetted

Cloned at commit 1eccc8b (2026-07-28) from the public GitHub repo and read end to end: server.ts (the full 26-tool definition array), config-manager.ts (defaults), capture.ts and track-installation.js (telemetry), and the src/remote-device/ package. This is a source audit, not a boot: npm install and npx were both denied by this session’s permission harness (an unattended-run guard against pulling and executing arbitrary third-party dependencies, not something specific to this tool), so the tool was never actually run. The findings below come from the shipped source and its own comments, not from observed runtime behavior.

• The default is not the safe one. config-manager.ts sets allowedDirectories: [] in getDefaultConfig(), and the set_config_value tool’s own description spells out the consequence: an empty array means full filesystem access. There is no install-time flag to scope it, the way postgres-mcp pins --access-mode restricted. You have to know to call set_config_value yourself after setup.
• Shell access is denylisted, not sandboxed. blockedCommands in the default config blocks disk/partition tools (mkfs, dd, fdisk), system admin (sudo, su, passwd), and system control (shutdown, reboot), on top of a Windows-only list (sfc, bcdedit, reg). Nothing on the list stops an arbitrary script, curl, or kill. start_process and interact_with_process run any command your shell user can run.
• Telemetry is on by default at install and on every later tool call. track-installation.js posts an install event through a postinstall npm hook. Separately, capture.ts’s capture() fires on tool calls (with a UI-origin exemption for the bundled file-preview widget), reading telemetryEnabled from config, which defaults to true with the comment // Default to opt-out approach (telemetry on by default). The payload strips path-shaped properties and sanitizes error messages before it goes out, but it still carries a persistent per-machine client ID, platform, client name/version, and event names. Opt out with DESKTOP_COMMANDER_DISABLE_TELEMETRY=1 or telemetryEnabled: false in config.
• The maintainers’ own comment discloses an open security gap. capture.ts carries // TODO(security): bearer token was removed, so this endpoint is now unauthenticated. Confirm the proxy enforces rate limiting / payload validation server-side, otherwise anyone can POST arbitrary events straight into BigQuery ingestion. That is a gap in the vendor’s own telemetry pipeline. It is a live, self-disclosed hole in the exact code path every install talks to by default.
• A separate, opt-in remote-control bridge exists in the same repo. src/remote-device/ is a standalone binary (desktop-commander-device) that authenticates via OAuth device flow and opens a WebSocket to a hosted relay (mcp.desktopcommander.app), letting a ChatGPT or Claude cloud connector run commands on this machine remotely. It is not loaded by the base MCP server and needs its own install step, but it is part of the same trust boundary and worth knowing about before recommending the project.
• Always-on cost is heavy. The ListToolsRequestSchema handler in server.ts is 53,403 characters of tool names, descriptions, and annotations across the 26 tools, roughly 13,000 tokens by a chars/4 estimate, and that excludes the JSON Schema each zodToJsonSchema() call generates for every tool’s input shape, which a live tools/list dump would add on top. That puts it at or above posthog-mcp’s measured ~16k, among the heaviest listings in the registry.

The fix, if you use it: run the standard install, then immediately call set_config_value to set allowedDirectories to the one or two paths you actually want it touching, and set DESKTOP_COMMANDER_DISABLE_TELEMETRY=1 before your first session. Neither is the default, so skipping this step means an agent with terminal access to your entire disk, phoning home on every call.