Desktop Commander MCP: Terminal, Filesystem, and Surgical Edits for Claude

Desktop Commander MCP is the 7.8k-star open-source server that turns Claude into something closer to a human developer on your machine — terminal sessions, ripgrep search, surgical edit_block patches, Excel/PDF/DOCX, and a file preview UI in Claude Desktop. Latest release: v0.2.45 (July 11, 2026).

Creator @wonderwhy-er (Eduard Ruzga) built it on top of Anthropic's MCP Filesystem Server and extended it far beyond read/write — the README's pitch: "Work with code and text, run processes, and automate tasks… using host client subscriptions instead of API token costs."

TL;DR — Desktop Commander (July 2026)

Why Desktop Commander exists

Before MCP, Claude could only see what you pasted. IDE agents like Cursor and Windsurf added filesystem + terminal — but burn fast-request quotas and chunk large files.

Desktop Commander's differentiation (from the README and community testimonials):

YouTube commenters in the repo describe ditching Cursor + Claude duplicate subscriptions and fixing a Flutter null-safety migration in hours after days stuck in IDE cascades.

Install — all MCP clients

Standard JSON config (from README):

{
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": ["-y", "@wonderwhy-er/desktop-commander@latest"]
    }
  }
}

Where to put it

Install options

Uninstall:

npx @wonderwhy-er/desktop-commander@latest remove

Creates a config backup before removing the desktop-commander entry from Claude's config.

Tool categories (v0.2.45)

Desktop Commander exposes 30+ tools grouped in the README:

Terminal

Long-running commands: execute with timeout → continues in background → read output by PID.

Filesystem

Negative offset: read_file supports tail-style reads from file end (Unix tail semantics).

Code editing

edit_block — SEARCH/REPLACE format:

src/main.js
<<<<<<< SEARCH
console.log("old message");
=======
console.log("new message");
>>>>>>> REPLACE

Enhancements (v0.2.x):

• Fuzzy fallback when exact match fails — similarity %, character diffs {-removed-}{+added+}
• expected_replacements for multi-occurrence edits
• Logs to ~/.claude-server-commander-logs/fuzzy-search.log

Configuration

Default fileWriteLineLimit: 50 lines — intentionally low to force small edits and survive Claude message limits without losing entire rewrites.

Analytics

• get_usage_stats — your own usage insight
• get_recent_tool_calls — debug / context recovery
• Audit log: ~/.claude-server-commander/claude_tool_call.log (10MB rotation)

File Preview UI (Claude Desktop)

Desktop Commander ships a rich preview widget — not just raw tool JSON:

Directory browser: list_directory opens as expandable tree inside the panel — not a wall of paths in chat.

Pair with Claude Code desktop browser when you need web verification; Desktop Commander handles local disk + terminal.

Quick workflows

Data analysis (in-memory)

"Analyze sales.csv and show top customers"

Desktop Commander runs Python in memory — no temp script file on disk.

SSH + ops

"SSH to my server and check disk space"

start_process maintains the SSH session; interact_with_process sends follow-up commands.

Surgical refactor

"Replace deprecated API calls in src/api/.ts"*

start_search → ripgrep hits → multiple small edit_block patches (not one 2,000-line rewrite).

Onboarding

New users (<10 successful commands) get automatic tutorials. Anytime:

• "Help me get started with Desktop Commander"
• "Show me Desktop Commander examples"

Disable: --no-onboarding flag in npx args.

Desktop Commander vs Cursor / Windsurf / Claude Code

explainx.ai read: Desktop Commander is not a Cursor replacement — it's the MCP layer that makes Claude Desktop (or any MCP host) competitive with IDE agents for subscription-priced automation. Many teams run Codex vs Claude Code for repo work and Desktop Commander for OS-wide scripts.

Security — read before allowedDirectories: []

From SECURITY.md and the README warnings:

⚠️ Never change config in the same chat where you're doing real work — Claude may try to widen allowedDirectories when blocked.

For enterprise threat models: MCP security guide · context-mode sandboxing.

Telemetry: Limited pseudonymous data; no file contents or paths. Opt out: telemetryEnabled: false or ask Claude to disable telemetry.

Desktop Commander App (Beta)

Beyond the MCP server, wonderwhy-er ships a Desktop Commander App (macOS & Windows):

• Any model — Claude, GPT-4.5, Gemini 2.5
• Live file change previews as AI edits
• Custom MCPs without config files
• Roadmap: skills, dictation, scheduled background tasks

The MCP server remains the path for Claude Desktop / Cursor / Codex users who want the open-source integration.

Remote MCP

Desktop Commander supports Remote MCP — use from ChatGPT web and Claude web without local Claude Desktop. Same tool surface; latency and sandbox policy depend on the remote host.

v0.2.45 and recent releases

Track: GitHub Releases · MCP directory entry

Setup checklist

1. Add npx config to your MCP host
2. Restart client (auto-pulls latest on npx)
3. Run get_config({}) — verify allowedDirectories
4. Set fileWriteLineLimit if 50 lines is too aggressive for your workflow
5. Ask Claude: "Help me get started with Desktop Commander"
6. Stage git commits before large edit sessions — community best practice from testimonials

How do you verify the setup without granting broad access?

Start with a disposable directory containing one text file. Ask the host to list the directory, read the file, and report its contents without modification. Then request one narrow edit and inspect the diff yourself. This confirms discovery, reading, and writing separately before you let the server work on an important repository.

Use a version-pinned package when repeatability matters, and record the host and server versions alongside the configuration. Installing the latest package on every restart can change behavior between sessions. Review an update before treating the earlier test as evidence for the new version.

Does Docker automatically provide full host isolation?

No. The isolation depends on the container configuration. A container can reach mounted directories, and privileged execution or access to the Docker socket can change the boundary substantially. The Docker security documentation explains these deployment concerns; Desktop Commander's security policy describes its built-in restrictions as guardrails.

Mount only the project material the task requires and avoid handing the container credentials it does not need. Test the intended accessible path and an inaccessible path using harmless files. That verifies the particular setup you are running instead of making a generic security claim from the word “Docker.”

How should you review fuzzy edits?

Read the resulting diff, especially when exact matching failed. Similar-looking sections can occur in generated files, copied examples, or repeated configuration blocks. A high similarity score does not establish that the intended occurrence was changed. Check the surrounding function and the number of replacements before running the application.

After an edit, run the owning check and inspect any unexpected changed paths. Keep the task scope explicit in the host prompt, and preserve unrelated work. Surgical tools make a narrow workflow possible; the prompt and review process still determine whether the workflow actually stays narrow.

Related on explainx.ai

• How to restrict what Claude Desktop can access on your PC — the allowedDirectories bypass this guide flags, explained for non-developers, plus OS-level fixes
• What is MCP? — Model Context Protocol guide
• Claude Code MCP servers — connect any tool
• MCP security guide 2026
• Top 10 MCP server directories
• context-mode MCP sandboxing
• Codex vs Claude Code comparison
• Claude Code desktop in-app browser
• MCP tool descriptions & selection reliability

Official: GitHub — wonderwhy-er/DesktopCommanderMCP · desktopcommander.app · Discord

Desktop Commander runs with your user permissions. Treat it like installing a global npm CLI with full disk and shell access — use Docker or tight allowedDirectories on shared machines.