MCP Observatory
1m ago Tracked 59,457 Last 1m ago 24h 2,463
npm JavaScript analyzed 0.2.41

@wonderwhy-er/desktop-commander

v0.2.41
npm

MCP server for terminal operations and file editing

maintainer
serg33v
licence
MIT
first seen
2026-05-22
last seen
2026-06-01
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.2.41 · analyzer v33 · 4w ago

danger signals6

  • dynamic code execution new Function() package/dist/ui/config-editor/config-editor-runtime.js :26 ludes("Cloudflare"))return!1;try{return new Function(""),!0}catch{return!1}});function et(e){if(ht(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!="function")return!0;let n=t.prototype;r
  • dynamic code execution new Function() package/dist/ui/file-preview/preview-runtime.js :28 ludes("Cloudflare"))return!1;try{return new Function(""),!0}catch{return!1}});function ti(e){if(ro(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!="function")return!0;let n=t.prototype;r
  • suspicious endpoint www.google-analytics.com (telemetry) package/dist/setup-claude-server.js :16 const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
  • suspicious endpoint www.google-analytics.com (telemetry) package/dist/track-installation.js :79 const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
  • suspicious endpoint www.google-analytics.com (telemetry) package/dist/uninstall-claude-server.js :16 const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
  • suspicious endpoint www.google-analytics.com (telemetry) package/dist/utils/capture.js :377 const GA_OLD_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_OLD_ID}&api_secret=${GA_OLD_SECRET}`;
code evidence v0.2.41 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 226

filesystem 25

  • fs package/dist/config-manager.js :1 import fs from 'fs/promises';
  • fs package/dist/remote-device/desktop-commander-integration.js :3 import fs from 'fs/promises';
  • fs package/dist/remote-device/device.js :7 import fs from 'fs/promises';
  • fs package/dist/search-manager.js :3 import fs from 'fs/promises';
  • fs package/dist/setup-claude-server.js :2 import fs from 'fs/promises';
  • fs package/dist/tools/config.js :6 import { access, readFile } from 'node:fs/promises';
  • fs package/dist/tools/filesystem.js :1 import fs from "fs/promises";
  • fs package/dist/tools/improved-process-tools.js :9 import fs from 'fs/promises';
  • fs package/dist/tools/pdf/manipulations.js :1 import fs from 'fs/promises';
  • fs package/dist/tools/pdf/markdown.js :1 import fs from 'fs/promises';
  • fs package/dist/tools/prompts.js :2 import * as fs from 'fs/promises';
  • fs package/dist/ui/resources.js :4 import fs from 'fs/promises';
show 13 more
  • fs package/dist/uninstall-claude-server.js :2 import fs from 'fs/promises';
  • fs package/dist/utils/feature-flags.js :1 import fs from 'fs/promises';
  • fs package/dist/utils/files/binary.js :7 import fs from "fs/promises";
  • fs package/dist/utils/files/docx.js :18 import fs from 'fs/promises';
  • fs package/dist/utils/files/excel.js :6 import fs from 'fs/promises';
  • fs package/dist/utils/files/image.js :5 import fs from "fs/promises";
  • fs package/dist/utils/files/pdf.js :5 import fs from 'fs/promises';
  • fs package/dist/utils/files/text.js :15 import fs from "fs/promises";
  • fs package/dist/utils/fuzzySearchLogger.js :1 import fs from 'fs/promises';
  • fs package/dist/utils/ripgrep-resolver.js :2 import { existsSync, chmodSync } from 'fs';
  • fs package/dist/utils/system-info.js :2 import fs from 'fs';
  • fs package/dist/utils/toolHistory.js :1 import * as fs from 'fs';
  • fs package/dist/utils/trackTools.js :1 import * as fs from 'fs';

shell / exec 13

  • shell package/dist/remote-device/desktop-commander-integration.js :1 import { spawn } from 'child_process';
  • shell package/dist/remote-device/remote-channel.js :364 const { spawnSync } = await import('child_process');
  • shell package/dist/search-manager.js :1 import { spawn } from 'child_process';
  • shell package/dist/setup-claude-server.js :8 import { exec } from "node:child_process";
  • shell package/dist/terminal-manager.js :1 import { spawn } from 'child_process';
  • shell package/dist/tools/feedback.js :4 import { exec } from 'child_process';
  • shell package/dist/tools/improved-process-tools.js :8 import { spawn } from 'child_process';
  • shell package/dist/tools/process.js :1 import { exec } from 'child_process';
  • shell package/dist/track-installation.js :106 const { execSync } = await import('child_process');
  • shell package/dist/uninstall-claude-server.js :8 import { exec } from "node:child_process";
  • shell package/dist/utils/open-browser.js :1 import { execFile, spawn } from 'child_process';
  • shell package/dist/utils/ripgrep-resolver.js :1 import { execSync } from 'child_process';
show 1 more
  • shell package/dist/utils/system-info.js :4 import { execSync } from 'child_process';

network 9

  • net package/dist/remote-device/device-authenticator.js :30 const response = await fetch(`${this.baseServerUrl}/device/start`, {
  • net package/dist/remote-device/device.js :202 const response = await fetch(`${this.baseServerUrl}/api/mcp-info`);
  • net package/dist/setup-claude-server.js :10 import * as https from 'https';
  • net package/dist/tools/filesystem.js :310 const response = await fetch(url, {
  • net package/dist/tools/pdf/markdown.js :163 const response = await fetch(source);
  • net package/dist/track-installation.js :15 import * as https from 'https';
  • net package/dist/uninstall-claude-server.js :10 import * as https from 'https';
  • net package/dist/utils/capture.js :2 import * as https from 'https';
  • net package/dist/utils/feature-flags.js :156 const fetchPromise = fetch(this.flagUrl, {

install hooks 2

  • postinstall (suspicious) package/package.json :25 node dist/track-installation.js && node dist/npm-scripts/verify-ripgrep.js || node -e "process.exit(0)"
  • prepare package/package.json :41 npm run build

declared dependencies 47

  • @modelcontextprotocol/sdk@^1.9.0
  • @modelcontextprotocol/ext-apps@^1.0.1
  • @opendocsg/pdf2md@^0.2.2
  • @supabase/supabase-js@^2.89.0
  • @tiptap/core@^3.22.3
  • @tiptap/extension-image@^3.22.3
  • @tiptap/extension-table@^3.22.4
  • @tiptap/extension-table-cell@^3.22.4
  • @tiptap/extension-table-header@^3.22.4
  • @tiptap/extension-table-row@^3.22.4
  • @tiptap/pm@^3.22.3
  • @tiptap/starter-kit@^3.22.3
show 28 more
  • @vscode/ripgrep@^1.15.9
  • cross-fetch@^4.1.0
  • exceljs@^4.4.0
  • fastest-levenshtein@^1.0.16
  • file-type@^21.1.1
  • glob@^10.3.10
  • highlight.js@^11.11.1
  • isbinaryfile@^5.0.4
  • markdown-it@^14.1.0
  • md-to-pdf@^5.2.5
  • open@^10.2.0
  • pdf-lib@^1.17.1
  • pizzip@^3.2.0
  • remark@^15.0.1
  • remark-gfm@^4.0.1
  • remark-parse@^11.0.0
  • sharp@^0.34.5
  • tiptap-markdown@^0.9.0
  • unified@^11.0.5
  • unpdf@^1.4.0
  • zod@^3.24.1
  • zod-to-json-schema@^3.23.5
  • @anthropic-ai/mcpb@^1.2.0
  • @types/node@^20.17.24
  • commander@^13.1.0
  • esbuild@^0.27.2
  • js-tiktoken@^1.0.21
  • jsdom@^24.1.3

7 more not shown — this panel samples each group; the count above is the real total.