Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
-
No community reviews yet
Ran this server? Tell others if you would trust it in production. Reviews are separate from our grade.
Write a reviewWhy it got a C
MIT-licensed community project (about 10,000 stars), actively maintained: four people committed in the last 90 days and v0.3.3 shipped on 2026-11-12. Two low advisories (uncontrolled resource use and SSRF) were fixed before they were published. Biggest deduction: by default it lets the model run any terminal command and execute code, with no sign-in and no approval step, so a prompt injection from a file or web page it reads can become code execution. Its own SECURITY.md says the command blocklist and allowed-directories setting are guardrails against accidents, not a sandbox: terminal commands can still reach files outside the allowed folders. For anything untrusted, use its Docker install with only the folders you choose mounted. It also sends limited, pseudonymous telemetry unless you turn it off with telemetryEnabled false.
How to connect
npx @wonderwhy-er/desktop-commander@latest setupIs Desktop Commander MCP safe?
Is Desktop Commander MCP safe to use?
Desktop Commander MCP grades C (usable with care). There is no login: anything that can start or reach it gets its full access. It can run model-controlled code or uses a plaintext remote connection, so run it isolated with no credentials.
Does Desktop Commander MCP have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Desktop Commander MCP support authentication?
No. It has no login of its own, so limit who and what can start it.
Alternatives in Developer Tools
- A Appwrite MCP ServerOfficial Appwrite server that exposes databases, users, functions, teams and storage as tools, hosted with OAuth or run locally with a project API key.
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
Embed this badge
[](https://trustedmcp.io/servers/desktop-commander-mcp)<a href="https://trustedmcp.io/servers/desktop-commander-mcp"><img src="https://trustedmcp.io/badge/desktop-commander-mcp.svg" alt="TrustedMCP grade C" height="80"></a>Community reviews
No published community reviews yet.
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.