registry / @tokor/desktop-commander / 0.2.47

@tokor/desktop-commander@0.2.47

⚠ Under review

MCP server for terminal operations and file editing

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No unconsented install-time agent control hijack was confirmed. The risky surface is explicit user-invoked Claude MCP setup plus telemetry and broad MCP filesystem/shell tools.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall verifies ripgrep; user runs setup/bin or desktop-commander setup for Claude config mutation

Impact

Warn-level agent extension lifecycle risk, not confirmed malware

Mechanism

explicit MCP server setup and telemetry collection

Rationale

Static inspection does not show credential theft, destructive behavior, remote payload execution, or unconsented postinstall mutation of Claude config. Because explicit setup mutates an AI-agent control surface and package identity is inconsistent with the configured upstream package name, warn rather than block.

Evidence

package.jsondist/npm-scripts/verify-ripgrep.jsdist/setup-claude-server.jsdist/track-installation.jsdist/index.jsdist/utils/capture.jsdist/config-manager.jsdist/uninstall-claude-server.js

Network endpoints2

telemetry.desktopcommander.app/mp/collectdc-telemetry-proxy-83847352264.europe-west1.run.app/mp/collect

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/setup-claude-server.js explicit setup command writes Claude Desktop MCP config and restarts Claude.
dist/setup-claude-server.js and dist/track-installation.js send install/setup telemetry to telemetry.desktopcommander.app with environment/install context.
package.json metadata/bin setup references desktop-commander but setup config installs @wonderwhy-er/desktop-commander, not @tokor/desktop-commander.

Evidence against

package.json postinstall only runs dist/npm-scripts/verify-ripgrep.js and ignores failure.
dist/npm-scripts/verify-ripgrep.js only resolves ripgrep path and prints warnings; no config writes or network.
dist/index.js setup/remove/remote actions are argument-gated; normal import starts MCP server.
dist/utils/capture.js supports telemetry opt-out via config and DESKTOP_COMMANDER_DISABLE_TELEMETRY.
Shell/file/process capabilities are MCP server features aligned with package description.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 2.50 MB of source, external domains: calendar.app.google, claude.ai, dc-telemetry-proxy-83847352264.europe-west1.run.app, desktopcommander.app, discord.com, example.com, github.com, json-schema.org, mcp.desktopcommander.app, prosemirror.net, schemas.openxmlformats.org, tally.so, telemetry.desktopcommander.app, www.google.com

Source & flagged code

5 flagged

package.jsonView file

Lines 9-49json

9 "repository": {

10 "type": "git",

11 "url": "git+https://github.com/wonderwhy-er/DesktopCommanderMCP.git"

12 },

13 "bugs": "https://github.com/wonderwhy-er/DesktopCommanderMCP/issues",

14 "type": "module",

15 "engines": {

16 "node": ">=18.0.0"

17 },

18 "bin": {

19 "desktop-commander": "dist/index.js",

20 "setup": "dist/setup-claude-server.js",

21 "remove": "dist/uninstall-claude-server.js"

22 },

23 "files": [

24 "dist",

25 "logo.png",

26 "testemonials"

27 ],

28 "scripts": {

29 "postinstall": "node dist/npm-scripts/verify-ripgrep.js || node -e \"process.exit(0)\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L29

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

30 "open-chat": "open -n /Applications/Claude.app",

31 "device:install": "cd src/remote-device && npm install",

32 "device:start": "tsx src/remote-device/device.ts",

33 "device:start:dev": "nodemon --watch src/remote-device --exec tsx src/remote-device/device.ts",

34 "sync-version": "node scripts/sync-version.js",

35 "bump": "node scripts/sync-version.js --bump",

36 "bump:minor": "node scripts/sync-version.js --bump --minor",

37 "bump:major": "node scripts/sync-version.js --bump --major",

38 "build": "tsc && shx cp setup-claude-server.js uninstall-claude-server.js track-installation.js dist/ && shx chmod +x dist/*.js && shx mkdir -p dist/data && shx cp src/data/onboarding-prompts.json dist/data/ && shx mkdir -p dist/remote-device/scripts && shx cp src/remote-device/scripts/blocking-offline-update.js dist/remote-device/scripts/ && node scripts/build-ui-runtime.cjs",

39 "watch": "tsc --watch",

40 "start": "node dist/index.js",

41 "start:debug": "node --inspect-brk=9229 dist/index.js",

42 "setup": "npm install --include=dev && npm run build && node setup-claude-server.js",

43 "setup:debug": "npm install && npm run build && node setup-claude-server.js --debug",

44 "remove": "npm install && npm run build && node uninstall-claude-server.js",

45 "prepare": "npm run build",

46 "clean": "shx rm -rf dist",

47 "test": "npm run build && node test/run-all-tests.js",

48 "test:integration": "npm run build && node test/integration/run-all-integration-tests.js",

49 "test:debug": "node --inspect test/run-all-tests.js",

dist/ui/config-editor/config-editor-runtime.jsView file

Lines 5-45javascript

5 if (input[${b}] === undefined) {

6 if (${b} in input) {

7 newResult[${b}] = undefined;

8 }

9 } else {

10 payload.issues = payload.issues.concat(

11 ${x}.issues.map((iss) => ({

12 ...iss,

13 path: iss.path ? [${b}, ...iss.path] : [${b}],

14 }))

15 );

16 }

17 } else if (${x}.value === undefined) {

18 if (${b} in input) newResult[${b}] = undefined;

19 } else {

20 newResult[${b}] = ${x}.value;

21 }

22 `)}else{let x=S[$];p.write(`const ${x} = ${k($)};`),p.write(`

23 if (${x}.issues.length) payload.issues = payload.issues.concat(${x}.issues.map(iss => ({

24 ...iss,

25 path: iss.path ? [${Ge($)}, ...iss.path] : [${Ge($)}]

26 })));`),p.write(`newResult[${Ge($)}] = ${x}.value`)}p.write("payload.value = newResult;"),p.write("return payload;");let I=p.compile();return($,x)=>I(m,$,x)},r,o=at,a=!Tr.jitless,u=a&&$i.value,l=t.catchall,c;e._zod.parse=(m,p)=>{c??(c=n.value);let g=m.value;if(!o(g))return m.issues.push({expected:"object",code:"invalid_type",input:g,inst:e}),m;let k=[];if(a&&u&&p?.async===!1&&p.jitless!==!0)r||(r=i(t.shape)),m=r(m,p);else{m.value={};let x=c.shape;for(let b of c.keys){let N=x[b],D=N._zod.run({value:g[b],issues:[]},p),C=N._zod.optin==="optional"&&N._zod.optout==="optional";D instanceof ...

27`)}var ir=e=>(t,n,i,r)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},a=t._zod.run({value:n,issues:[]},o);if(a instanceof Promise)throw new Re;if(a.issues.length){let s=new(r?.Err??e)(a.issues.map(u=>Ze(u,o,pe())));throw Zo(s,r?.callee),s}return a.value},bo=ir($e),or=e=>async(t,n,i,r)=>{let o=i?Object.assign(i,{async:!0}):{async:!0},a=t._zod.run({value:n,issues:[]},o);if(a instanceof Promise&&(a=await a),a.issues.length){let s=new(r?.Err??e)(a.issues.map(u=>Ze(u,o,pe())));throw Zo(s,r?.callee),s}return a.value},xo=or($e),ar=e=>(t,n,i)=>{let r=i?{...i,async:!1}:{async:!1},o=t._zod.run({value: ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ui/config-editor/config-editor-runtime.jsView on unpkg · L25

28`).filter(o=>o),i=Math.min(...n.map(o=>o.length-o.trimStart().length)),r=n.map(o=>o.slice(i)).map(o=>" ".repeat(this.indent*2)+o);for(let o of r)this.content.push(o)}compile(){let t=Function,n=this?.args,i=[...(this?.content??[""]).map(r=>` ${r}`)];return new t(...n,i.join(`

29`))}},Zm={major:4,minor:3,patch:5},U=f("$ZodType",(e,t)=>{var n;e??(e={}),e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=Zm;let i=[...e._zod.def.checks??[]];e._zod.traits.has("$ZodCheck")&&i.unshift(e);for(let r of i)for(let o of r._zod.onattach)o(e);if(i.length===0)(n=e._zod).deferred??(n.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let r=(a,s,u)=>{let l=Qe(a),c;for(let m of s){if(m._zod.def.when){if(!m._zod.def.when(a))continue}else if(l)continue;let p=a.issues.length,g=m._zod.check(a);if(g instanceof Promise&&u?.async===!1)throw new Re;if(c||g instanceof Pro ...

30 if (${x}.issues.length) {

31 if (${b} in input) {

32 payload.issues = payload.issues.concat(${x}.issues.map(iss => ({

33 ...iss,

34 path: iss.path ? [${b}, ...iss.path] : [${b}]

35 })));

36 }

37 }

39 if (${x}.value === undefined) {

40 if (${b} in input) {

41 newResult[${b}] = undefined;

42 }

43 } else {

44 newResult[${b}] = ${x}.value;

45 }

Long lines were clipped for display.

dist/tools/fuzzySearch.jsView file

Lines 1-34javascript

1import { capture } from '../utils/capture.js';

2import { Worker } from 'worker_threads';

3// Re-export so existing callers keep importing from this module.

4export { recursiveFuzzyIndexOf, getSimilarityRatio } from './fuzzySearchCore.js';

5/** Abort fuzzy search in the worker after this many ms to avoid unbounded CPU burn. */

6export const FUZZY_SEARCH_TIMEOUT_MS = 30000;

7/**

8 * Inline worker entry: imports the dependency-free core module (passed as

9 * moduleUrl) and runs the search off the main thread. The core module is

10 * deliberately a leaf — importing this module (or anything app-level) from the

11 * worker would boot the whole server per search. Kept as an eval'd snippet so

12 * the worker needs no separate file to ship alongside the compiled output.

13 */

14const WORKER_CODE = `

15const { workerData, parentPort } = require('worker_threads');

16import(workerData.moduleUrl)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/fuzzySearch.jsView on unpkg · L14

17 .then((m) => {

18 parentPort.postMessage({ ok: true, ...m.runFuzzySearch(workerData.text, workerData.query) });

19 })

20 .catch((err) => {

21 parentPort.postMessage({ ok: false, error: String(err && err.stack || err) });

22 });

23`;

24const CORE_MODULE_URL = new URL('./fuzzySearchCore.js', import.meta.url).href;

25/**

26 * Runs the fuzzy search in a Worker thread so the main MCP event loop stays

27 * responsive to pings and other tool calls during heavy scans. Rejects if the

28 * scan exceeds timeoutMs, terminating the worker so it doesn't linger in the

29 * background. Search metrics come back with the result and are captured here,

30 * on the main thread, where the client identity is initialized.

31 */

32export function runFuzzySearchInWorker(text, query, timeoutMs = FUZZY_SEARCH_TIMEOUT_MS) {

33 return new Promise((resolve, reject) => {

34 const worker = new Worker(WORKER_CODE, { eval: true, workerData: { moduleUrl: CORE_MODULE_URL, text, query } });

dist/track-installation.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * Installation Source Tracking Script

5 * Runs during npm install to detect how Desktop Commander was installed

6 *

7 * Debug logging can be enabled with:

8 * - DEBUG=desktop-commander npm install

9 * - DEBUG=* npm install

10 * - NODE_ENV=development npm install

11 * - DC_DEBUG=true npm install

12 */

14import { randomUUID } from 'crypto';

15import * as https from 'https';

16import { platform } from 'os';

17import path from 'path';

18import { fileURLToPath } from 'url';

20// Get current file directory

21const __filename = fileURLToPath(import.meta.url);

22const __dirname = path.dirname(__filename);

24// Debug logging utility - configurable via environment variables

25const DEBUG_ENABLED = process.env.DEBUG === 'desktop-commander' ||

26 process.env.DEBUG === '*' ||

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/track-installation.jsView on unpkg · L14

27 process.env.NODE_ENV === 'development' ||

28 process.env.DC_DEBUG === 'true';

30const debug = (...args) => {

31 if (DEBUG_ENABLED) {

32 console.log('[Desktop Commander Debug]', ...args);

33 }

34};

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/npm-scripts/verify-ripgrep.js || node -e "process.exit(0)"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node dist/npm-scripts/verify-ripgrep.js || node -e "process.exit(0)"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/ui/config-editor/config-editor-runtime.jsView file

25path: iss.path ? [${Ge($)}, ...iss.path] : [${Ge($)}] L26: })));`),p.write(`newResult[${Ge($)}] = ${x}.value`)}p.write("payload.value = newResult;"),p.write("return payload;");let I=p.compile();return($,x)=>I(m,$,x)},r,o=at,a=!Tr.jitless,u... L27: `)}var ir=e=>(t,n,i,r)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},a=t._zod.run({value:n,issues:[]},o);if(a instanceof Promise)throw new Re;if(a.issues.length){let s=new(r?.Er...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ui/config-editor/config-editor-runtime.jsView on unpkg · L25

dist/tools/fuzzySearch.jsView file

14const WORKER_CODE = ` L15: const { workerData, parentPort } = require('worker_threads'); L16: import(workerData.moduleUrl)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/fuzzySearch.jsView on unpkg · L14

dist/track-installation.jsView file

14import { randomUUID } from 'crypto'; L15: import * as https from 'https'; L16: import { platform } from 'os'; ... L21: const __filename = fileURLToPath(import.meta.url); L22: const __dirname = path.dirname(__filename); L23: L24: // Debug logging utility - configurable via environment variables L25: const DEBUG_ENABLED = process.env.DEBUG === 'desktop-commander' || L26: process.env.DEBUG === '*' || ... L58: const configData = fs.readFileSync(CONFIG_FILE, 'utf8'); L59: const config = JSON.parse(configData); L60: if (config.clientId) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/track-installation.jsView on unpkg · L14

Findings

1 Critical2 High4 Medium7 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/track-installation.js

MediumDynamic Requiredist/tools/fuzzySearch.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/ui/config-editor/config-editor-runtime.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 9-49json

9 "repository": {

10 "type": "git",

11 "url": "git+https://github.com/wonderwhy-er/DesktopCommanderMCP.git"

12 },

13 "bugs": "https://github.com/wonderwhy-er/DesktopCommanderMCP/issues",

14 "type": "module",

15 "engines": {

16 "node": ">=18.0.0"

17 },

18 "bin": {

19 "desktop-commander": "dist/index.js",

20 "setup": "dist/setup-claude-server.js",

21 "remove": "dist/uninstall-claude-server.js"

22 },

23 "files": [

24 "dist",

25 "logo.png",

26 "testemonials"

27 ],

28 "scripts": {

29 "postinstall": "node dist/npm-scripts/verify-ripgrep.js || node -e \"process.exit(0)\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L29

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

30 "open-chat": "open -n /Applications/Claude.app",

31 "device:install": "cd src/remote-device && npm install",

32 "device:start": "tsx src/remote-device/device.ts",

33 "device:start:dev": "nodemon --watch src/remote-device --exec tsx src/remote-device/device.ts",

34 "sync-version": "node scripts/sync-version.js",

35 "bump": "node scripts/sync-version.js --bump",

36 "bump:minor": "node scripts/sync-version.js --bump --minor",

37 "bump:major": "node scripts/sync-version.js --bump --major",

39 "watch": "tsc --watch",

40 "start": "node dist/index.js",

41 "start:debug": "node --inspect-brk=9229 dist/index.js",

42 "setup": "npm install --include=dev && npm run build && node setup-claude-server.js",

43 "setup:debug": "npm install && npm run build && node setup-claude-server.js --debug",

44 "remove": "npm install && npm run build && node uninstall-claude-server.js",

45 "prepare": "npm run build",

46 "clean": "shx rm -rf dist",

47 "test": "npm run build && node test/run-all-tests.js",

48 "test:integration": "npm run build && node test/integration/run-all-integration-tests.js",

49 "test:debug": "node --inspect test/run-all-tests.js",

dist/ui/config-editor/config-editor-runtime.jsView file

Lines 5-45javascript

5 if (input[${b}] === undefined) {

6 if (${b} in input) {

7 newResult[${b}] = undefined;

8 }

9 } else {

10 payload.issues = payload.issues.concat(

11 ${x}.issues.map((iss) => ({

12 ...iss,

13 path: iss.path ? [${b}, ...iss.path] : [${b}],

14 }))

15 );

16 }

17 } else if (${x}.value === undefined) {

18 if (${b} in input) newResult[${b}] = undefined;

19 } else {

20 newResult[${b}] = ${x}.value;

21 }

22 `)}else{let x=S[$];p.write(`const ${x} = ${k($)};`),p.write(`

23 if (${x}.issues.length) payload.issues = payload.issues.concat(${x}.issues.map(iss => ({

24 ...iss,

25 path: iss.path ? [${Ge($)}, ...iss.path] : [${Ge($)}]

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ui/config-editor/config-editor-runtime.jsView on unpkg · L25

30 if (${x}.issues.length) {

31 if (${b} in input) {

32 payload.issues = payload.issues.concat(${x}.issues.map(iss => ({

33 ...iss,

34 path: iss.path ? [${b}, ...iss.path] : [${b}]

35 })));

36 }

37 }

39 if (${x}.value === undefined) {

40 if (${b} in input) {

41 newResult[${b}] = undefined;

42 }

43 } else {

44 newResult[${b}] = ${x}.value;

45 }

Long lines were clipped for display.

dist/tools/fuzzySearch.jsView file

Lines 1-34javascript

1import { capture } from '../utils/capture.js';

2import { Worker } from 'worker_threads';

3// Re-export so existing callers keep importing from this module.

4export { recursiveFuzzyIndexOf, getSimilarityRatio } from './fuzzySearchCore.js';

5/** Abort fuzzy search in the worker after this many ms to avoid unbounded CPU burn. */

6export const FUZZY_SEARCH_TIMEOUT_MS = 30000;

7/**

8 * Inline worker entry: imports the dependency-free core module (passed as

9 * moduleUrl) and runs the search off the main thread. The core module is

10 * deliberately a leaf — importing this module (or anything app-level) from the

11 * worker would boot the whole server per search. Kept as an eval'd snippet so

12 * the worker needs no separate file to ship alongside the compiled output.

13 */

14const WORKER_CODE = `

15const { workerData, parentPort } = require('worker_threads');

16import(workerData.moduleUrl)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/fuzzySearch.jsView on unpkg · L14

17 .then((m) => {

18 parentPort.postMessage({ ok: true, ...m.runFuzzySearch(workerData.text, workerData.query) });

19 })

20 .catch((err) => {

21 parentPort.postMessage({ ok: false, error: String(err && err.stack || err) });

22 });

23`;

24const CORE_MODULE_URL = new URL('./fuzzySearchCore.js', import.meta.url).href;

25/**

26 * Runs the fuzzy search in a Worker thread so the main MCP event loop stays

27 * responsive to pings and other tool calls during heavy scans. Rejects if the

28 * scan exceeds timeoutMs, terminating the worker so it doesn't linger in the

29 * background. Search metrics come back with the result and are captured here,

30 * on the main thread, where the client identity is initialized.

31 */

32export function runFuzzySearchInWorker(text, query, timeoutMs = FUZZY_SEARCH_TIMEOUT_MS) {

33 return new Promise((resolve, reject) => {

34 const worker = new Worker(WORKER_CODE, { eval: true, workerData: { moduleUrl: CORE_MODULE_URL, text, query } });

dist/track-installation.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * Installation Source Tracking Script

5 * Runs during npm install to detect how Desktop Commander was installed

6 *

7 * Debug logging can be enabled with:

8 * - DEBUG=desktop-commander npm install

9 * - DEBUG=* npm install

10 * - NODE_ENV=development npm install

11 * - DC_DEBUG=true npm install

12 */

14import { randomUUID } from 'crypto';

15import * as https from 'https';

16import { platform } from 'os';

17import path from 'path';

18import { fileURLToPath } from 'url';

20// Get current file directory

21const __filename = fileURLToPath(import.meta.url);

22const __dirname = path.dirname(__filename);

24// Debug logging utility - configurable via environment variables

25const DEBUG_ENABLED = process.env.DEBUG === 'desktop-commander' ||

26 process.env.DEBUG === '*' ||

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/track-installation.jsView on unpkg · L14

27 process.env.NODE_ENV === 'development' ||

28 process.env.DC_DEBUG === 'true';

30const debug = (...args) => {

31 if (DEBUG_ENABLED) {

32 console.log('[Desktop Commander Debug]', ...args);

33 }

34};