DesktopCommanderMCP
@wonderwhy-er/desktop-commander · by wonderwhy-er
This is MCP server for Claude that gives it terminal control, file system search and diff file editing capabilities
1 open CVE
MIT license
Actively maintained
Last commit 2d ago
Works with most clients
Transport: stdio, sse, http
12 tools · ~1.1k tok
Grade B · 0.5% of 200K ctx
MCPpedia last refreshed this data
DesktopCommanderMCP is an MCP server that this is MCP server for Claude that gives it terminal control, file system search and diff file editing capabilities. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 88/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio, sse, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"desktop-commander": {
"args": [
"-y",
"@wonderwhy-er/desktop-commander@latest"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/desktopcommandermcp)
Read me
What DesktopCommanderMCP does
Work with code and text, run processes, and automate tasks, going far beyond other AI editors - while using host client subscriptions instead of API token costs.
Test This Server
This server supports HTTP transport. Be the first to test it — help the community know if it works.
Loading README…
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
88/100across 5 weighted dimensions
0255075100
27
20
16
15
10
−12
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev1 open1 fixed
CVE-2026-10691medium · fixedCVSS 4.3
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption
A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a15
CVE-2026-10690mediumCVSS 6.3
DesktopCommanderMCP is vulnerable to SSRF
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.
Affected:
>= 0source →Inventory
Tools (12)
Click any tool to inspect its schema.
~1.1k tokens total
Community
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is DesktopCommanderMCP safe to use?
- DesktopCommanderMCP has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@wonderwhy-er/desktop-commander". Review the Security section above for details before installing.
- How do I install DesktopCommanderMCP?
- DesktopCommanderMCP supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can DesktopCommanderMCP do?
- DesktopCommanderMCP provides 12 tools: read_file, write_file, search_files, execute_command, list_directory and 7 more. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with DesktopCommanderMCP?
- DesktopCommanderMCP is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
- Is DesktopCommanderMCP actively maintained?
- DesktopCommanderMCP is actively maintained — last commit was 2 days ago. It has 9,381 GitHub stars.
Related
Similar servers
Others in developer-tools / productivity
Context797Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors
61.1k 2
XcodeBuildMCP97A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.
6.3k 2
X
XcodeBuildMCP97XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.
6.3k 1
Browser Tools Mcp96Monitor browser logs directly from Cursor and other MCP compatible IDEs.
7.3k 7
MCP Security Weekly
Get CVE alerts and security updates for DesktopCommanderMCP and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.
