Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

Desktop Commander MCP server

by wonderwhy-er/desktopcommandermcpMIT licenceAudited 20 Sep 2026 · source d7ae9c4abb15

npm @wonderwhy-er/desktop-commander 0.2.51stdio★ 9,662
✕BLOCKGrade F · 49/100 · 20 Sep 2026 · d7ae9c4
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (49/100). It exposes 12 tools: 7 read, 3 write and 2 destructive. The audit recorded 32 findings (0 critical, 6 high, 4 medium, 21 low). Maintainer's description: This is MCP server for Claude that gives it terminal control, file system search and diff file editing capabilities

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Desktop Commander MCP server (wonderwhy-er/desktopcommandermcp)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/wonderwhy-er/desktop-commander-1

Why this is BLOCK. The audit found 0 critical and 6 high findings; the most severe is Inventory / provenance at src/ui/file-preview/src/payload-utils.ts. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score49/100✕BLOCK F
0 critical6 high4 medium21 low1 info

32 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared16 observations
  • NetworkDeclared5 observations
  • ShellDeclared10 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

Findings (32)

Sorted by severity · the 25 most severe of 32 are listed

HIGHInventory / provenanceinv.suspicious_name · src/ui/file-preview/src/payload-utils.ts
F-13 Inventory / provenanceCWE-1104Layer L0
payload-utils.ts
Why
member named after an attack tool
Fix
remove or justify
HIGHCode injectioncode.eval_exec · scripts/publish-release.cjs:70
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return exec(command, { silent: true, ...options });
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · scripts/publish-release.cjs:291
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(command);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · scripts/publish-release.cjs:329
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(`git tag -f ${tag}`);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · scripts/publish-release.cjs:330
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(`git push -f origin ${tag}`);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · scripts/publish-release.cjs:413
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(options.skipTests ? 'npm run build' : 'npm test');
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
MEDIUMInformation disclosuredisclose.log_secret · scripts/count-tokens.js:104
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`${colors.cyan}🔢 Desktop Commander MCP — Token Counter${colors.reset}`);
Why
No further detail recorded for this rule.
Fix
—
MEDIUMSupply chainprompt.pipe_to_shell · plugins/claude/skills/terminal/SKILL.md:112
F-08 Supply chainCWE-829 · CWE-1357Layer L2
(`curl ... | sh`) — that's untrusted code execution; show it and confirm first.
Why
No further detail recorded for this rule.
Fix
—
MEDIUMSupply chainprompt.pipe_to_shell · plugins/claude/skills/terminal/SKILL.md:166
F-08 Supply chainCWE-829 · CWE-1357Layer L2
- Anything piping remote content into a shell (`curl ... | sh`).
Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
force_terminate, kill_process
Why
2 tool(s) can delete or overwrite
Fix
prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenanceinv.hidden_file · .codespellrc
F-13 Inventory / provenanceCWE-1104Layer L0
.codespellrc
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInformation disclosuredisclose.log_secret · test/test-remote-token-rotation-persisted.js:284
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`\n${failures ? '🔴' : '✅'} remote token rotation persistence: ${failures} failing test(s).`);
Why
No further detail recorded for this rule.
Fix
—
LOWInformation disclosuredisclose.log_secret · test/test-symlink-security.js:63
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`  Symlink (file): ${SYMLINK_TO_RESTRICTED_FILE} → ${RESTRICTED_DIR}/secret.txt`);
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/remote-device/desktop-commander-integration.ts:170
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const devPath = path.resolve(__dirname, '../../dist/index.js');
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/tools/pdf/markdown.ts:7
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { CONFIG_FILE } from '../../config.js';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/ui/config-editor/src/app.ts:2
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { createToolBridge } from '../../shared/tool-bridge.js';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/ui/config-editor/src/app.ts:3
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { createCompactRowShellController, type ToolShellController } from '../../shared/tool-shell.js';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/ui/config-editor/src/app.ts:4
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { renderCompactRow } from '../../shared/compact-row.js';
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · plugins/claude/skills/ai-tools-setup/references/openclaw.md:26
F-04 Network egressCWE-200 · CWE-319Layer L1
The Control UI default is `http://127.0.0.1:18789/`. (Some versions/setups use a
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · plugins/cursor/skills/ai-tools-setup/references/openclaw.md:26
F-04 Network egressCWE-200 · CWE-319Layer L1
The Control UI default is `http://127.0.0.1:18789/`. (Some versions/setups use a
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · skills/ai-tools-setup/references/openclaw.md:26
F-04 Network egressCWE-200 · CWE-319Layer L1
The Control UI default is `http://127.0.0.1:18789/`. (Some versions/setups use a
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · test/test-feature-flags-timeout.js:139
F-04 Network egressCWE-200 · CWE-319Layer L1
await fetch(`http://127.0.0.1:${port}/test`, {
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · test/test-feature-flags-timeout.js:186
F-04 Network egressCWE-200 · CWE-319Layer L1
await currentFetchPattern(`http://127.0.0.1:${port}/flags.json`);
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.base64_blob · test/large_test_file.txt:1
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@modelcontextprotocol/sdk, @opendocsg/pdf2md, @supabase/supabase-js, @tiptap/core, @tiptap/extension-image, @tiptap/extension-table, @tiptap/extension-table-cell, @tiptap/extension-table-header
Why
49 dependency range(s) float
Fix
pin exact versions or ship a lockfile

Tools it exposes

12 declared in source · 2 destructive

7 read3 write2 destructive

2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

ToolWhat it doesRisk
force_terminateForce terminate a running terminal session. ${CMD_PREFIX_DESCRIPTION}destructive
kill_processTerminate a running process by PID. Use with caution as this will forcefully terminate the specified process. ${CMD_PREFIX_DESCRIPTION}destructive
stop_searchStop an active search. Stops the background search process gracefully. Use this when youwrite
write_fileWrite or append to file contents. IMPORTANT: DO NOT use this tool to create PDF files. Usewrite
write_pdfCreate a new PDF file or modify an existing one. THIS IS THE ONLY TOOL FOR CREATING AND MODIFYING PDF FILES. RULES ABOUT FILENAMES: - When creating a new PDF,write
get_more_search_resultsGet more results from an active search with offset-based pagination. Supports partial result reading with: -read
get_usage_statsGet usage statistics for debugging and analysis. Returns summary of tool usage, success/failure rates, and performance metrics. ${CMD_PREFIX_DESCRIPTION}read
list_directoryGet a detailed listing of all files and directories in a specified path. Use this instead ofread
list_processesList all running processes. Returns process information including PID, command name, CPU usage, and memory usage. ${CMD_PREFIX_DESCRIPTION}read
read_fileRead contents from files and URLs. Read PDF files and extract content as markdown and images. Prefer this overread
read_multiple_filesRead the contents of multiple files simultaneously. Each fileread
read_process_outputRead output from a running process with file-like pagination support. Supports partial output reading with offset and length parameters (like read_file): -read

Safer alternatives

All code intelligence servers →
Deep Code Reasoning✓SAFE

evalops/deep-code-reasoning-mcp

A Model Context Protocol (MCP) server that provides advanced code analysis and reasoning capabilities powered by Google's Gemini AI

2 writeGrade B
Axon✓SAFE

harshkedia177/axon

Graph-powered code intelligence engine — indexes codebases into a knowledge graph, exposed via MCP tools for AI agents and a CLI for developers.

2 writeGrade B
Lucidity✓SAFE

hyperb1iss/lucidity-mcp

AI-powered code quality analysis using MCP to help AI assistants review code more effectively. Analyze git changes for complexity, security issues, and more through structured prompts.

1 readGrade B

Audit history

  1. ✕BLOCK F 49 / 100

    Source changed, verdict held · d7ae9c4abb15

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Desktop Commander MCP server

What is the Desktop Commander MCP server?
This is MCP server for Claude that gives it terminal control, file system search and diff file editing capabilities
What tools does Desktop Commander expose?
12 in total: 7 read-only, 3 that write, and 2 that can delete or overwrite (force_terminate, kill_process). Every one is listed on this page with its risk.
Is Desktop Commander safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (49/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Desktop Commander need?
No credential environment variables were found in its source, so it appears to need none.
How does Desktop Commander run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @wonderwhy-er/desktop-commander at 0.2.51.
How current is this page?
The grade is for one exact copy of the source (d7ae9c4abb15), read on 2026-09-20. The repository is watched and re-audited when it changes.
I already installed Desktop Commander. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.