I
io.github.wonderwhy-er/desktop-commander
@wonderwhy-er/desktop-commander
MCP server for terminal commands, file operations, and process management
1 open CVE
MIT license
Actively maintained
Last commit 3d ago
Works with most clients
Transport: stdio, sse, http
14 tools
Grade F
MCPpedia last refreshed this data
This server has been archived and is no longer actively maintained.
io.github.wonderwhy-er/desktop-commander is an MCP server that MCP server for terminal commands, file operations, and process management. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 49/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio, sse, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"desktop-commander": {
"args": [
"-y",
"@wonderwhy-er/desktop-commander@latest"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/io-github-wonderwhy-er-desktop-commander-wonderwhy-er)
Read me
What io.github.wonderwhy-er/desktop-commander does
Work with code and text, run processes, and automate tasks, going far beyond other AI editors - while using host client subscriptions instead of API token costs.
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@wonderwhy-er/desktop-commander' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Loading README…
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
49/100across 5 weighted dimensions
0255075100
15
10
14
10
−51
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev1 open1 fixed
CVE-2026-10690mediumCVSS 6.3
DesktopCommanderMCP is vulnerable to SSRF
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.
Affected:
>= 0source →CVE-2026-10691medium · fixedCVSS 4.3
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption
A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a15
Inventory
Tools (14)
Click any tool to inspect its schema.
Community
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is io.github.wonderwhy-er/desktop-commander safe to use?
- io.github.wonderwhy-er/desktop-commander has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@wonderwhy-er/desktop-commander". Review the Security section above for details before installing.
- How do I install io.github.wonderwhy-er/desktop-commander?
- io.github.wonderwhy-er/desktop-commander supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can io.github.wonderwhy-er/desktop-commander do?
- io.github.wonderwhy-er/desktop-commander provides 14 tools: blockedCommands, Windows, allowedDirectories, Features, Security and 9 more. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with io.github.wonderwhy-er/desktop-commander?
- io.github.wonderwhy-er/desktop-commander is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
- Is io.github.wonderwhy-er/desktop-commander actively maintained?
- io.github.wonderwhy-er/desktop-commander is actively maintained — last commit was 3 days ago. It has 9,388 GitHub stars.
Related
Similar servers
Others in developer-tools
Context797Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors
61.1k 2
Chrome Devtools Mcp96Chrome DevTools for coding agents
49.6k 10
Mcp_agent_mail96Asynchronous coordination layer for AI coding agents: identities, inboxes, searchable threads, and advisory file leases over FastMCP + Git + SQLite
2.1k 6
G
Mcp Gitlab96MCP server for using the GitLab API
1.9k 12
MCP Security Weekly
Get CVE alerts and security updates for io.github.wonderwhy-er/desktop-commander and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.
