Code Execution MCP Server

DesktopCommanderMCP

Name: DesktopCommanderMCP
Author: wonderwhy-er

A swiss-army-knife that can manage/execute programs and read/write/search/edit code and text files.

Scan flagged something by wonderwhy-er5,705MITTypeScriptBeginnerstdio

Install

Claude Code

claude mcp add desktopcommandermcp -- npx -y desktop-commander

Cursor

{
  "mcpServers": {
    "desktopcommandermcp": {
      "command": "npx",
      "args": [
        "-y",
        "desktop-commander"
      ]
    }
  }
}

VS Code

{
  "mcp": {
    "servers": {
      "desktopcommandermcp": {
        "command": "npx",
        "args": [
          "-y",
          "desktop-commander"
        ]
      }
    }
  }
}

Windsurf

{
  "mcpServers": {
    "desktopcommandermcp": {
      "command": "npx",
      "args": [
        "-y",
        "desktop-commander"
      ]
    }
  }
}

Claude Desktop

{
  "mcpServers": {
    "desktopcommandermcp": {
      "command": "npx",
      "args": [
        "-y",
        "desktop-commander"
      ]
    }
  }
}

Safety Report

67% Scan flagged something

Scanned 5 months ago

4 passed 2 warnings

Security

Authentication

details

No API authentication required; relies on Claude Desktop subscription. No token or key validation for tool access.

Warning

CORS Policy

details

Runs as a local stdio MCP server; no HTTP endpoints exposed, CORS not applicable.

N/A

Rate Limiting

details

No built-in rate limiting on terminal commands or file operations.

Warning

Known CVEs

details

No known CVEs at time of review. Project is actively maintained with regular releases.

Info

Code Quality

Dependency Audit

details

Published on npm as @wonderwhy-er/desktop-commander. Dependency audit status not publicly documented.

Info

Dangerous Patterns

details

No dangerous code patterns detected

Pass

License

details

MIT license.

Pass

Code Source

details

Open source on GitHub. Code is publicly auditable.

Pass

Community

Maintenance Status

details

Actively maintained; regular commits and npm releases. Community-driven with telemetry and audit logging.

Pass

Compatibility

Claude CodeSupported via manual config in claude_desktop_config.json or npx setup.

Not Tested

CursorWorks via standard MCP stdio transport.

Not Tested

VS CodeWorks via standard MCP stdio transport.

Not Tested

WindsurfWorks via standard MCP stdio transport.

Not Tested

Claude DesktopPrimary target; one-line setup via npx @wonderwhy-er/desktop-commander@latest setup.

Not Tested

Tools Provided (25)

get_config

Retrieves complete server configuration including blocked commands and allowed directories.

set_config_value

Updates specific config values such as shell, allowed directories, or limits.

start_process

Initiates programs or terminal commands with ready-state detection.

interact_with_process

Sends input to running processes and receives responses.

read_process_output

Retrieves buffered output from an active terminal session.

force_terminate

Forcefully stops a running terminal session by session ID.

list_sessions

Lists all currently active terminal sessions.

list_processes

Displays all running OS processes with details.

kill_process

Terminates a process by its PID.

read_file

Reads local files, URLs, Excel files, and PDFs with optional pagination.

read_multiple_files

Reads several files simultaneously.

write_file

Creates or modifies files; supports Excel.

write_pdf

Generates or edits PDF documents.

create_directory

Creates new directories on the filesystem.

list_directory

Returns recursive file and folder listings.

move_file

Moves or renames files and directories.

start_search

Begins a streaming file content or filename search.

get_more_search_results

Paginates through results of an ongoing search.

stop_search

Halts an active search session.

list_searches

Shows all currently running search sessions.

get_file_info

Retrieves metadata for a file or directory.

edit_block

Applies targeted text replacements or Excel cell updates to a file.

get_usage_stats

Returns usage statistics for the server.

get_recent_tool_calls

Returns historical tool call data for debugging purposes.

give_feedback_to_desktop_commander

Submits feedback about the tool.

Frequently Asked Questions

What is DesktopCommanderMCP?

A swiss-army-knife that can manage/execute programs and read/write/search/edit code and text files.

What tools does DesktopCommanderMCP provide?

DesktopCommanderMCP provides 25 tools including get_config, set_config_value, start_process, interact_with_process. Each tool can be called by AI agents to perform specific operations.

Is DesktopCommanderMCP safe to use?

We cannot tell you that, and nobody scanning at this scale can. What we did in March 2026 was shallow-clone DesktopCommanderMCP and run five keyword searches over its source: auth identifiers, CORS configuration, rate-limit identifiers, the dependency manifest against a hardcoded list of 18 known-vulnerable packages, and unguarded eval/exec calls. At least one matched — the specific finding is in the scan report on this page. A text search cannot follow a variable, judge intent, or tell you what a server does once it is running, so "nothing matched" is not "safe". What the scan does and does not cover is written out at /mcp/security.

What are alternatives to DesktopCommanderMCP?

Similar MCP servers include Serena, MCP Run Python, Container Use. Each serves a similar purpose but may differ in features, language, and compatibility.

Stay Updated on MCP Servers

New servers, safety alerts, and install guides — weekly.

DesktopCommanderMCP

Install

Safety Report

Compatibility

Tools Provided (25)

Frequently Asked Questions

Similar MCP Servers

Serena

MCP Run Python

Container Use

Free AI writing tools

Stay Updated on MCP Servers