Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
MCPpedia last refreshed this data
app.desktopcommander/remote-desktop-commander is an MCP server that hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer. Its tool list has not been published yet, requires no API key, and scores 51/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"remote-desktop-commander": {
"url": "https://mcp.desktopcommander.app/mcp"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Build, explore, automate on your computer — from anywhere.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@wonderwhy-er/desktop-commander' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption
A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a15
DesktopCommanderMCP is vulnerable to SSRF
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.
>= 0source →Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in ai-ml
MCP client bridge: connects to MCP servers and registers their tools on ctx.tools
An autonomous agent that conducts deep research on any data using any LLM providers
1000+ scientific tools for AI scientists: life science, reserach, literature, and more.
Workspace template + MCP server for Claude Code, Codex CLI, Cursor & Windsurf. Multi-agent knowledge engine (ag-refresh / ag-ask) that turns any codebase into a queryable AI assistant.
MCP Security Weekly
Get CVE alerts and security updates for app.desktopcommander/remote-desktop-commander and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.

Build, explore, automate on your computer — from anywhere.
Reach your computer's filesystem and terminal from any AI app that supports remote MCP connectors. Remote Desktop Commander is a hosted MCP server that relays a secure connection to your real machine, giving your AI assistant the same full file and shell access as the local server — without you needing to be at the keyboard.
https://mcp.desktopcommander.app/mcp (Streamable HTTP, OAuth 2.0)This repository hosts the public manifests, documentation and issue tracker for the hosted service. The service implementation is not open source. For the open-source local (stdio) server, see DesktopCommanderMCP.
On the computer you want to control:
npx @wonderwhy-er/desktop-commander@latest remote
Your browser opens to a verification page showing a pairing code (also printed in the terminal — a standard OAuth device-flow check). Sign in, confirm the codes match, and the terminal reports "Device ready". Keep the agent running: close the terminal, no access.
Each client walks you through OAuth sign-in on first connect.
claude.ai / Claude Desktop — Settings → Connectors → Add custom connector, then enter:
https://mcp.desktopcommander.app/mcp
Claude Code:
claude mcp add --transport http remote-desktop-commander https://mcp.desktopcommander.app/mcp
(If you work inside a checkout of this repo, Claude Code also picks up the included .mcp.json automatically.)
ChatGPT — Settings → Apps & Connectors → Advanced settings → enable Developer mode (requires a plan that includes it), then Create connector and enter:
https://mcp.desktopcommander.app/mcp
Cursor — one click: Add to Cursor. Or add to ~/.cursor/mcp.json manually:
{
"mcpServers": {
"remote-desktop-commander": {
"url": "https://mcp.desktopcommander.app/mcp"
}
}
}
VS Code — install the agent plugin (bundles this server):
copilot plugin install desktop-commander/remote-desktop-commander
Or add the server directly to .vscode/mcp.json in your workspace (or your user-level mcp.json):
{
"servers": {
"remote-desktop-commander": {
"type": "http",
"url": "https://mcp.desktopcommander.app/mcp"
}
}
}
Gemini CLI:
gemini extensions install https://github.com/desktop-commander/remote-desktop-commander
These work against any machine running the agent, no setup needed:
"List the contents of my home directory and tell