Desktop Commander MCP blockedCommands: Security Configuration and Risk Mitigation

Desktop Commander MCP prevents privilege escalation and system compromise by filtering dangerous commands through a configurable blockedCommands array that blocks utilities like sudo, rm, and iptables before execution.

Desktop Commander MCP is a Model Context Protocol (MCP) server that enables remote command execution while maintaining strict security boundaries. The blockedCommands configuration field acts as the primary defense mechanism, intercepting harmful directives before they reach the host operating system.

Default blockedCommands Available in Desktop Commander MCP

The default blockedCommands list targets utilities commonly abused for privilege escalation, data destruction, and network compromise. According to the schema defined in src/config-field-definitions.ts, the system ships with a conservative blocklist including:

• sudo – Grants root privileges that can modify system files and security settings
• rm – Enables recursive deletion (rm -rf) that can destroy user data and critical system files
• iptables – Alters firewall rules, potentially exposing the system to network attacks
• shutdown and reboot – Can terminate the host or remote session abruptly
• kill and pkill – Terminates processes and could disable security-related services
• chmod and chown – Changes file permissions and ownership, possibly granting unauthorized access
• dd – Low-level disk writer capable of overwriting partitions or entire disks
• wget and curl – Enables downloading and executing arbitrary remote code
• ssh and scp – Opens new remote connections that bypass the controlled channel

This default configuration is stored in the configuration schema and loaded at runtime through src/config-manager.ts.

How blockedCommands Improve Security

The security mechanism operates by deep command inspection rather than simple string matching. When a command is submitted, src/command-manager.ts extracts all sub-commands—including those hidden inside command substitution patterns like $(…) or backticks—and validates each component against the blockedCommands array.

The validateCommand function in src/command-manager.ts performs this validation. If any extracted command matches an entry in the blocklist, the entire request is rejected immediately. This prevents:

1. Privilege escalation by blocking root access utilities
2. Data loss by preventing recursive deletion and disk overwriting
3. Network compromise by restricting firewall modifications and unauthorized remote connections
4. Command injection via subshell exploitation

The test suite in test/test-blocklist-bypass.js specifically verifies that the parser correctly identifies blocked commands even when attackers attempt to obscure them using shell substitution syntax.

Configuring the blockedCommands List

While the default list is conservative, administrators can customize restrictions through the configuration manager. The blockedCommands field accepts an array of strings that the system checks against extracted command tokens.

To update the blocklist at runtime:

import { configManager } from './config-manager.js';
import { commandManager } from './command-manager.js';

// Define restricted utilities
const restrictedCommands = ['sudo', 'rm', 'iptables', 'dd'];

// Persist configuration
await configManager.setValue('blockedCommands', restrictedCommands);

// Validate user input
const userInput = "sudo apt-get update && echo done";
const isAllowed = await commandManager.validateCommand(userInput);
console.log(isAllowed); // false (blocked due to "sudo")

Changes persist through the config-manager.ts layer, which handles configuration storage and retrieval. The system validates all future commands against the updated list without requiring a restart.

Validating Commands Against the Blocklist

The validation logic demonstrates robust security by parsing the command structure rather than performing surface-level checks. The validateCommand method extracts the command name from complex shell statements before comparing against blockedCommands.

Example from the test suite in test/test-blocked-commands.js:

const blockedCommands = ['sudo', 'rm', 'iptables'];
await configManager.setValue('blockedCommands', blockedCommands);

// Test blocking of recursive delete
const result = await commandManager.validateCommand('rm -rf /tmp');
assert.strictEqual(result, false); // "rm" is correctly blocked

The parser handles edge cases where commands might be obfuscated through environment variables or subshells, ensuring that $(which sudo) or backtick substitutions are still caught by the validation logic in src/command-manager.ts.

Summary

• Desktop Commander MCP maintains a configurable blockedCommands array defined in src/config-field-definitions.ts that blocks dangerous utilities like sudo, rm, and iptables by default.
• The validateCommand function in src/command-manager.ts performs deep inspection of command strings, including sub-commands hidden in shell substitutions, to prevent bypass attempts.
• Administrators can customize security restrictions at runtime via config-manager.ts without restarting the service.
• Comprehensive test coverage in test/test-blocked-commands.js and test/test-blocklist-bypass.js ensures the blocking logic remains effective against command injection techniques.

Frequently Asked Questions

How does Desktop Commander MCP detect blocked commands in complex shell scripts?

The validateCommand implementation in src/command-manager.ts parses the command string to extract all sub-commands, including those embedded within $(…) substitution patterns or backticks. It validates each extracted component against the blockedCommands array, preventing attackers from bypassing restrictions using shell obfuscation techniques.

Can I customize the blockedCommands list after installation?

Yes, the blockedCommands list is fully configurable through the config-manager.ts module. You can update the array at runtime using configManager.setValue('blockedCommands', ['sudo', 'rm', ...]), and the system will immediately apply the new restrictions to subsequent command validation requests without requiring a service restart.

Where are the default blockedCommands defined in the source code?

The default blocklist schema is defined in src/config-field-definitions.ts, which specifies the configuration structure and default values. The actual validation logic that enforces these restrictions resides in src/command-manager.ts, specifically within the validateCommand function that checks extracted command tokens against the configured array.

What happens if a blocked command is detected?

When validateCommand identifies a command matching the blockedCommands list, it returns false and prevents the entire command string from executing. This rejection occurs before any system interaction, ensuring that potentially dangerous operations like sudo privilege escalation or rm -rf deletions never reach the host operating system.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}