Audit Logging Mechanisms and Log Rotation Strategies in Desktop Commander MCP

Desktop Commander MCP employs three specialized logging subsystems—tool-call auditing with automatic size-based rotation, fuzzy-search interaction tracking, and a central runtime logger—to provide comprehensive observability without unbounded disk growth.

The Desktop Commander MCP server (wonderwhy-er/DesktopCommanderMCP) maintains a detailed audit trail of runtime operations through a multi-layered logging architecture. Understanding these audit logging mechanisms and log rotation strategies is essential for administrators monitoring tool usage, debugging performance issues, and ensuring compliance with forensic analysis requirements.

Tool-Call Audit Logging with Automatic Rotation

The primary audit mechanism resides in src/utils/trackTools.ts, which persists every invocation of built-in tools such as fs, git, and custom commands.

How Tool-Call Tracking Works

The exported trackToolCall function constructs a timestamped entry and appends it to the file defined by the TOOL_CALL_FILE constant. This creates an immutable record of who called which tool and with what parameters.

import { trackToolCall } from './utils/trackTools.js';

// Example: invoking a custom "run-script" tool
await trackToolCall('run-script', { script: 'build.sh', cwd: '/project' });

Size-Based Rotation Strategy

When the audit log exceeds the threshold defined by TOOL_CALL_FILE_MAX_SIZE (approximately 10 MiB), the system automatically renames the current file with a timestamp suffix (<base>_YYYY-MM-DD_HH-MM-SS.<ext>) and starts a fresh log. This size-based rotation prevents unbounded disk growth while preserving recent history for forensic analysis.

Fuzzy-Search Interaction Auditing

For performance tuning and user-behavior analysis, src/utils/fuzzySearchLogger.ts maintains a dedicated audit trail of search operations.

The FuzzySearchLogger.log(entry) method appends JSON-serialized lines to ~/.claude-server-commander-logs/fuzzy-search.log, capturing what queries were made, result counts, and execution timings. Unlike the tool-call logger, this subsystem does not implement automatic rotation—the file remains intentionally small due to single-line JSON entries and can be cleared manually via FuzzySearchLogger.clear().

import { FuzzySearchLogger } from './utils/fuzzySearchLogger.js';

await FuzzySearchLogger.log({
  query: 'open file',
  resultsCount: 12,
  durationMs: 34,
  timestamp: new Date().toISOString(),
});

Central Runtime Logger

The src/utils/logger.ts module provides a unified interface for general runtime events through the logger object and logToStderr helper.

Calls route through a buffered log function that writes to the MCP logger once initialized, with logToStderr(level, msg) mirroring messages to stderr for immediate visibility. This subsystem emits to stdout/stderr rather than files, relying on the host process or external logger for any rotation policies.

import { logger } from './utils/logger.js';

logger.info('Desktop Commander started');
logger.error('Failed to load user configuration', { path: configPath });

Configuration and Constants

Rotation behavior is controlled by constants defined in src/config.ts (or .js). The TOOL_CALL_FILE constant specifies the audit log location, while TOOL_CALL_FILE_MAX_SIZE sets the ~10 MiB threshold that triggers rotation events in src/utils/trackTools.ts.

Summary

• Desktop Commander MCP uses three complementary logging subsystems to capture tool calls, fuzzy searches, and runtime events.
• The tool-call tracker in src/utils/trackTools.ts implements size-based rotation at approximately 10 MiB to prevent disk exhaustion.
• Fuzzy-search logs in ~/.claude-server-commander-logs/fuzzy-search.log maintain JSON audit trails without automatic rotation but support manual clearing via FuzzySearchLogger.clear().
• The central logger routes messages to stderr and stdout without file-based rotation, deferring to host environment policies.

Frequently Asked Questions

How does Desktop Commander MCP prevent audit logs from consuming excessive disk space?

The tool-call audit system in src/utils/trackTools.ts implements automatic size-based rotation when files reach approximately 10 MiB. Once the threshold specified by TOOL_CALL_FILE_MAX_SIZE is exceeded, the current log receives a timestamp suffix and the system creates a fresh file, effectively capping active log size while preserving historical archives.

Where are fuzzy-search audit logs stored, and how can I clear them?

Fuzzy-search interactions are recorded in ~/.claude-server-commander-logs/fuzzy-search.log as single-line JSON entries. While this subsystem lacks automatic rotation, administrators can programmatically clear the file by invoking FuzzySearchLogger.clear() from the src/utils/fuzzySearchLogger.ts module.

What is the difference between trackToolCall and the central logger?

trackToolCall specifically audits tool invocations with automatic file rotation and persistence, capturing structured data about command execution. The central logger in src/utils/logger.ts handles general runtime messaging (info, warning, error levels) and outputs to stderr/stdout without maintaining persistent log files or rotation logic.

Can I configure the rotation threshold for tool-call audit logs?

The rotation threshold is defined by the TOOL_CALL_FILE_MAX_SIZE constant in src/config.ts. Administrators can modify this value before compilation to adjust the approximately 10 MiB default limit that triggers log rotation in the src/utils/trackTools.ts subsystem.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}