Desktop Commander

Name: Desktop Commander
Author: edgarsskore

@wonderwhy-er/desktop-commander · by edgarsskore

MCP server for terminal operations and file editing

npm

1 open CVE

No license

Maintenance unknown

No commit data

Works with most clients

Transport: stdio

0 tools

Grade F

Edit this pageView history

Desktop Commander is an MCP server that MCP server for terminal operations and file editing. Its tool list has not been published yet over stdio, requires no API key, and scores 27/100 on MCPpedia's security, maintenance and efficiency rubric.

Developer Tools

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": [
        "-y",
        "@wonderwhy-er/desktop-commander"
      ]
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/desktop-commander)](https://mcppedia.org/s/desktop-commander)

Read me

What Desktop Commander does

MCP server for terminal operations and file editing

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y '@wonderwhy-er/desktop-commander' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

27/100across 5 weighted dimensions

How we score →

0255075100

−73

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

1 open1 fixed

CVE-2026-10691medium · fixedCVSS 4.3

DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a15

Affected: >= 0Fixed in 0.2.39source →

CVE-2026-10690mediumCVSS 6.3

DesktopCommanderMCP is vulnerable to SSRF

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.

Affected: >= 0source →

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Desktop Commander safe to use?: Desktop Commander has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@wonderwhy-er/desktop-commander". Review the Security section above for details before installing.
How do I install Desktop Commander?: Install Desktop Commander via npm: `npx @wonderwhy-er/desktop-commander`. Then add it to your MCP client config file.
What AI clients work with Desktop Commander?: Desktop Commander is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Similar servers

Others in developer-tools

View all →

Context797

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

61.1k 2

Chrome Devtools Mcp96

Chrome DevTools for coding agents

49.6k 10

Mcp_agent_mail96

Asynchronous coordination layer for AI coding agents: identities, inboxes, searchable threads, and advisory file leases over FastMCP + Git + SQLite

2.1k 6

Mcp Gitlab96

MCP server for using the GitLab API

1.9k 12

MCP Security Weekly

Get CVE alerts and security updates for Desktop Commander and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Frequently Asked Questions

Is Desktop Commander safe to use?

Desktop Commander has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@wonderwhy-er/desktop-commander". Review the Security section above for details before installing.

How do I install Desktop Commander?

Install Desktop Commander via npm: `npx @wonderwhy-er/desktop-commander`. Then add it to your MCP client config file.

What AI clients work with Desktop Commander?

Desktop Commander is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.