Is app.localcmd/local-commander safe to use?

app.localcmd/local-commander has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "local-commander-agent". Review the Security section above for details before installing.

How do I install app.localcmd/local-commander?

app.localcmd/local-commander supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can app.localcmd/local-commander do?

app.localcmd/local-commander provides 6 tools: Requirements, Cursor, Antigravity, Kiro, Links and 1 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with app.localcmd/local-commander?

app.localcmd/local-commander is compatible with claude-desktop, cursor, claude-code. It uses http transport.

Is app.localcmd/local-commander actively maintained?

app.localcmd/local-commander is actively maintained - last commit was 4 days ago. It has 1 GitHub stars.

app.localcmd/local-commander

local-commander-agent

Give your AI hands on every computer you own. One chat, all your machines — even from your phone.

1 1.2k/wk 6 tools GitHub npm

1 open CVE

MIT license

Actively maintained

Last commit 4d ago

Works with most clients

Transport: http

6 tools · ~364 tok

Grade A · 0.2% of 200K ctx

MCPpedia last refreshed this data 1d ago

Edit this pageView history

app.localcmd/local-commander is an MCP server that give your AI hands on every computer you own. One chat, all your machines — even from your phone. Its tool list has not been published yet over http, requires no API key, and scores 91/100 on MCPpedia's security, maintenance and efficiency rubric.

Other

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktophttp · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "app-localcmd-local-commander": {
      "args": [
        "-y",
        "local-commander-agent"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/app-localcmd-local-commander)](https://mcppedia.org/s/app-localcmd-local-commander)

Read me

What app.localcmd/local-commander does

Give your AI hands on every computer you own. One chat, all your machines — even from your phone.

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

91/100across 5 weighted dimensions

How we score →

0255075100

−9

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

1 open

MAL-2026-18425info

Malicious code in local-commander-agent (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (bddef1c4c8e802c4c5b624072b68ff1fea4d66455da428306cd506196e02c6dc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the

source →

Inventory

Tools (6)

Click any tool to inspect its schema.

~364 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is app.localcmd/local-commander safe to use?: app.localcmd/local-commander has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "local-commander-agent". Review the Security section above for details before installing.
How do I install app.localcmd/local-commander?: app.localcmd/local-commander supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can app.localcmd/local-commander do?: app.localcmd/local-commander provides 6 tools: Requirements, Cursor, Antigravity, Kiro, Links and 1 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with app.localcmd/local-commander?: app.localcmd/local-commander is compatible with claude-desktop, cursor, claude-code. It uses http transport.
Is app.localcmd/local-commander actively maintained?: app.localcmd/local-commander is actively maintained - last commit was 4 days ago. It has 1 GitHub stars.

Similar servers

Others in other

View all →

io.github.vshulcz/deja-vu95

deja-vu: local memory over the session histories of forty-three coding agents.

1.5k 6

MCP Wordpress Remote95

MCP WordPress Remote proxy server

188 10

Argo95

专门为 agent 打造的 agent 搜索工具，具备多语言搜索能力，覆盖中文/英文/学术/代码/购物/金融/新闻/百科。

242 1

Football Docs94

Searchable football data provider documentation for AI coding agents. Like Context7 for football data.

226 8

MCP Security Weekly

Get CVE alerts and security updates for app.localcmd/local-commander and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktophttp · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "app-localcmd-local-commander": {
      "args": [
        "-y",
        "local-commander-agent"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/app-localcmd-local-commander)](https://mcppedia.org/s/app-localcmd-local-commander)

Read me

What app.localcmd/local-commander does

Give your AI hands on every computer you own. One chat, all your machines — even from your phone.

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

README

Local Commander for Cursor, DeepSeek Harness, Antigravity, Kiro and LM Studio

Connects Cursor, DeepSeek Harness, Antigravity, Kiro and LM Studio to Local Commander at https://localcmd.app/mcp. Your AI gets hands on every computer you own: it can run commands and scripts, change settings, edit files and check local services on any of them, from one chat. Your workspace at localcmd.app shows which computer ran each request and how it ended.

This repository holds configuration only: a Cursor plugin, a DeepSeek Harness bundle, an Antigravity plugin, a Kiro Power and LM Studio settings. The service runs at localcmd.app.

Requirements

A Local Commander account at localcmd.app.
A Windows 11 x64 computer with Node.js 20 or later and the paired agent: run npx local-commander-agent@latest on it, then choose full access or selected folders.
The computer must be online for work and for reading results.

Once you approve a computer and connect your AI, it can do what your Windows account can do, just like you at the keyboard. You can limit it to certain folders, block commands, stop running work, or switch a computer off from the site at any time. Every run shows which computer did it. Whatever the AI asks for goes back to the AI.

Cursor

Install the plugin, or add this to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "local-commander": { "url": "https://localcmd.app/mcp" }
  }
}

Cursor opens localcmd.app to sign in and approve access (OAuth 2.0). Sign-in happens on localcmd.app; Cursor never sees your password.
Ask the agent to list your computers, then work on an approved project.

Troubleshooting:

The agent reports no computers: start the agent on the Windows computer and check that it shows as online at localcmd.app.
Sign-in loops or fails: open Output, choose "MCP Logs", and check the OAuth error; then remove and re-add the server.
A result is unknown: the computer dropped during the task. The work is not re-run automatically; check the computer and ask again.

DeepSeek Harness

A configuration-only DeepSeek Harness bundle. The tools appear as mcp__local-commander__<tool>.

The harness MCP client sends static headers only, so the bundle starts mcp-remote over stdio. On first use it opens localcmd.app in your browser to sign in and approve access (OAuth 2.0), then keeps the token refreshed. In your localcmd.app workspace these requests show the client name "MCP CLI Proxy", the name mcp-remote registers.

DeepSeek Harness asks for Node.js 22.19 or later on the machine where you chat.

Install: download local-commander-dsh-1.0.0.tgz from the latest release, then run:

dsh plugin --profile web add ./local-commander-dsh-1.0.0.tgz
dsh web

You can also build the tarball from this repository with npm pack.

Remove:

dsh plugin --profile web remove local-commander-dsh

Antigravity

This repository is also an Antigravity plugin (.antigravity-plugin/plugin.json plus mcp_config.json). Like the DeepSeek Harness bundle, it starts mcp-remote over stdio, which opens localcmd.app in your browser to sign in and approve access (OAuth 2.0) and keeps the token refreshed. Requests show the client name "MCP CLI Proxy" in your localcmd.app workspace.

Install:

agy plugin install https://github.com/netbka/local-commander-plugins

Or clone the repository and run agy plugin install <folder>. Remove with agy plugin uninstall local-commander.

Kiro

The kiro-power/ folder is a Kiro Power in the Agent Plugi

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

91/100across 5 weighted dimensions

How we score →

0255075100

−9

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

1 open

MAL-2026-18425info

Malicious code in local-commander-agent (npm)

source →

Inventory

Tools (6)

Click any tool to inspect its schema.

~364 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is app.localcmd/local-commander safe to use?: app.localcmd/local-commander has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "local-commander-agent". Review the Security section above for details before installing.
How do I install app.localcmd/local-commander?: app.localcmd/local-commander supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can app.localcmd/local-commander do?: app.localcmd/local-commander provides 6 tools: Requirements, Cursor, Antigravity, Kiro, Links and 1 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with app.localcmd/local-commander?: app.localcmd/local-commander is compatible with claude-desktop, cursor, claude-code. It uses http transport.
Is app.localcmd/local-commander actively maintained?: app.localcmd/local-commander is actively maintained - last commit was 4 days ago. It has 1 GitHub stars.