DesktopCommanderMCP MCP Server

by wonderwhy-er• 10k•• Scanned•Claim this listing•Request removal
Coding Agentsagentaicode analysiscode generationgemini cli extension

This is MCP server for Claude that gives it terminal control, file system search and diff file editing capabilities

DesktopCommanderMCP is an open-source mcp server by wonderwhy-er, written mainly in JavaScript, with 10,187 GitHub stars and the MIT license. Its code was last updated Oct 30, 2026. The latest npm release is @wonderwhy-er/desktop-commander 0.3.3, published Nov 12, 2026, with 1,399,692 downloads last week.

Scan summary: scanned Nov 5, 2026 at commit edfc903. Seen able to run shell commands, read or write files, read environment and secrets, connect to the internet. 2 published advisories for its package. Scan policy

aboutREADMEsecurityreviews

How to install DesktopCommanderMCP

Built from the start command in the project's README: npx -y @wonderwhy-er/desktop-commander@latest. Check the README for required keys or settings.

Claude Code · Terminal
claude mcp add desktopcommandermcp -- npx -y @wonderwhy-er/desktop-commander@latest
Claude Desktop · claude_desktop_config.json
{
  "mcpServers": {
    "desktopcommandermcp": {
      "command": "npx",
      "args": [
        "-y",
        "@wonderwhy-er/desktop-commander@latest"
      ]
    }
  }
}
Cursor · .cursor/mcp.json
{
  "mcpServers": {
    "desktopcommandermcp": {
      "command": "npx",
      "args": [
        "-y",
        "@wonderwhy-er/desktop-commander@latest"
      ]
    }
  }
}
VS Code · Terminal
code --add-mcp '{"name":"desktopcommandermcp","command":"npx","args":["-y","@wonderwhy-er/desktop-commander@latest"]}'

What DesktopCommanderMCP can touch

  • Run shell commandsFound in the code by our scan
  • Run dynamic codeNot seen in this scan
  • Read or write filesListed as a tool: read_file
  • Read environment and secretsFound in the code by our scan
  • Control a web browserNot seen in this scan
  • Connect to databasesNot seen in this scan
  • Read or send messagesNot seen in this scan
  • Touch money or tradingNot seen in this scan
  • Connect to the internetContacted desktopcommander.app, googlechromelabs.github.io, storage.googleapis.com and 1 more

"Not seen" means our checks did not find it, and the tool may still do it. Covers commit edfc903, Nov 5, 2026. See the scan policy.

Before you install DesktopCommanderMCP

AgenticMart scanned DesktopCommanderMCP on Nov 5, 2026 with automated checks for hidden code, known-malicious packages, leaked secrets and vulnerable dependencies. The result covers one commit under our scan policy, so review what access you give it and check any advisories shown here.

What it can access

  • An MCP server is a program your AI app starts and talks to. A local one runs with your user's permissions: it can see the files, environment variables and network your account can.
  • Based on its description and topics, it likely needs to read and write files on your machine.
  • Based on its description and topics, it likely needs to run shell commands.

Before you install

  1. Point it at one project folder, never your home directory.
  2. Keep tool-call approval on, and run it in a container if you can.
  3. Pin the version you reviewed instead of always installing the latest release.
  4. Read the tool list or scripts before the first run, and keep approval prompts on for actions that write, send or delete.
  • Maintained by wonderwhy-er on GitHub, 10,187 stars and 1,272 forks. Popularity is not proof of safety.
  • Last code change: Oct 30, 2026.
  • Open-source license: MIT.
Read the scan reportWhat our scan checks

Published advisories for @wonderwhy-er/desktop-commander

From the OSV database, for this npm package. Check that your installed version is past any fix.

  • CVE-2026-10690DesktopCommanderMCP is vulnerable to SSRF
  • CVE-2026-10691DesktopCommanderMCP is vulnerable to Uncontrolled Resource ConsumptionFixed in 0.2.39.

Tools DesktopCommanderMCP exposes (25)

Listed by the server itself during our scan of commit edfc903.

  • get_config

    Get the complete server configuration as JSON. Config includes fields for: - blockedCommands (array of blocked shell commands) - defaultShell (shell to use for commands) - allowedDirectories (paths the s

  • set_config_value

    Set a specific configuration value by key. Security note: configuration changes affect later file and command behavior. Isolating them from untrusted file or command content reduces the chance that exte

  • read_file

    Read contents from files and URLs. Read PDF files and extract content as markdown and images. Suitable for reading authorized local files directly without starting a shell command.

  • read_multiple_files

    Read the contents of multiple files simultaneously. Each file's content is returned with its path as a reference. Handles text files normally and renders images as viewable content.

  • write_file

    Write or append to file contents. PDF creation is handled by the dedicated write_pdf tool. Existing DOCX content can be edited with edit_block. New DOCX files can be created here; markdown headings (#, ##, ###) are converted t

  • write_pdf

    Create a new PDF file or modify an existing one. Dedicated PDF creation and modification tool. OUTPUT FILES: - Creating a PDF requires 'outputPath' with a new filename (e.g., "result_01.pdf", "analysis

  • create_directory

    Create a new directory or ensure a directory exists. Can create multiple nested directories in one operation. Only works within allowed directories. Abso

  • list_directory

    Get a detailed listing of all files and directories in a specified path. Returns a structured directory listing without starting a shell command. Results distinguish between files and directories with [

  • move_file

    Move or rename files and directories. Can move files between directories and rename them in a single operation. Both source and destination must be within allowed directories.

  • start_search

    Start a streaming search that can return results progressively. SEARCH STRATEGY GUIDE: Choose the right search type based on what the user is looking for:

  • get_more_search_results

    Get more results from an active search with offset-based pagination. Supports partial result reading with: - 'offset' (start result index, default: 0) * Positive: Start from re

  • stop_search

    Stop an active search. Stops the background search process gracefully. Use this when you've found what you need or if a search is taking too long. Similar to force_terminate for

  • list_searches

    List all active searches. Shows search IDs, search types, patterns, status, and runtime. Similar to list_sessions for terminal processes. Useful for managing multiple concurrent

  • get_file_info

    Retrieve detailed metadata about a file or directory including: - size - creation time - last modified time - permissions - type -

  • edit_block

    Apply surgical edits to files. Small, focused edits are easier to verify than large multi-purpose replacements. old_string can include enough surrounding context to uniquely identify the intended text.

  • start_process

    Start a terminal process on the authorized device with intelligent state detection. Suitable for shell commands, interactive REPL sessions, data-processing scripts, programmatic file analysis, and other

  • read_process_output

    Read output from a running process with file-like pagination support. Supports partial output reading with offset and length parameters (like read_file): - 'offset' (start line, default: 0)

  • interact_with_process

    Send input to an existing terminal or REPL process and return newly available output. Useful for interactive shells, Python/Node/R/Julia REPLs, database consoles, and long-running commands started with

  • force_terminate

    Force terminate a running terminal session. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.

  • list_sessions

    List all active terminal sessions. Shows session status including: - PID: Process identifier - Blocked: Whether session is waiting for input - Runtime:

  • list_processes

    List all running processes. Returns process information including PID, command name, CPU usage, and memory usage. This command can be referenced as "DC: ..." or "use Desktop Com

  • kill_process

    Terminate a running process by PID. For a PID that start_process returned, it ends the whole command: the shell and every process the command started, as force_terminate does. Any other PID ends that process only. Sessions started with node:local hav

  • get_usage_stats

    Get usage statistics for debugging and analysis. Returns summary of tool usage, success/failure rates, and performance metrics. This command can be referenced as "DC: ..." or "u

  • get_recent_tool_calls

    Get recent local tool call history with arguments and outputs. Returns a chronological list of recent calls loaded from the local history file. Useful for: - Onboarding new chats

  • give_feedback_to_desktop_commander

    Open feedback form in browser to provide feedback about Desktop Commander. The form itself collects survey answers; this tool does not accept survey responses or pre-fill them. It automatically includes

Hosts it contacted while running

desktopcommander.appgooglechromelabs.github.iostorage.googleapis.comtelemetry.desktopcommander.app

DesktopCommanderMCP is an open-source mcp server by wonderwhy-er, written mainly in JavaScript. This is MCP server for Claude that gives it terminal control, file system search and diff file editing capabilities

At a glance

Stars
10k
Forks
1.3k
Language
JavaScript
License
MIT
Created
Dec 2024
Last update
Oct 30, 2026
Type
MCP Server
Price
Free

Topics

agentaicode-analysiscode-generationgemini-cli-extensionmcpterminal-aiterminal-automationvibe-coding

Questions about DesktopCommanderMCP

What is DesktopCommanderMCP?

This is MCP server for Claude that gives it terminal control, file system search and diff file editing capabilities

Who maintains DesktopCommanderMCP?

DesktopCommanderMCP is maintained by wonderwhy-er on GitHub (wonderwhy-er/DesktopCommanderMCP). AgenticMart lists it from public repository data.

Is DesktopCommanderMCP safe to use?

AgenticMart scanned DesktopCommanderMCP on Nov 5, 2026 with automated checks for hidden code, known-malicious packages, leaked secrets and vulnerable dependencies. The result covers one commit under our scan policy, so review what access you give it and check any advisories shown here.

What license does DesktopCommanderMCP use?

It is published under the MIT license.

DesktopCommanderMCP alternatives

View more →

Similar mcp servers in Coding Agents, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
DesktopCommanderMCP (this page)
wonderwhy-er
10kMITOct 30, 2026Scanned, no flagged issues
Context Mode
mksglu
33kNone foundNov 1, 2026Not scanned yet
Serena
oraios
31kNone foundOct 28, 2026Not scanned yet
Fastmcp
PrefectHQ
28kApache-2.0Nov 1, 2026Scanned, no flagged issues
Nuclear
nukeop
19kAGPL-3.0Nov 1, 2026Scanned, no flagged issues
MCP For Beginners
microsoft
18kMITOct 30, 2026Scanned, no flagged issues