# How Desktop Commander MCP Rotates Audit Logs and What claude_tool_call.log Records

> Discover how Desktop Commander MCP rotates audit logs at 10 MiB and what detailed information, including ISO timestamp and tool arguments, is logged in claude_tool_call.log.

- Repository: [Eduard Ruzga/DesktopCommanderMCP](https://github.com/wonderwhy-er/DesktopCommanderMCP)
- Tags: internals
- Published: 2026-07-29

---

**Desktop Commander MCP rotates its audit log when the file reaches 10 MiB by renaming it with a timestamp, while each entry records the ISO timestamp, tool name, and JSON arguments.**

Desktop Commander MCP maintains a comprehensive audit trail of every internal tool invocation in a dedicated log file. Understanding how these logs are rotated and what specific data they capture is essential for monitoring server activity and debugging tool usage. This article examines the implementation details found in the `wonderwhy-er/DesktopCommanderMCP` repository, specifically within the [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts) file.

## What Information Is Recorded in claude_tool_call.log

### Log Entry Format

The `trackToolCall()` function in [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts) constructs each audit entry using a strict formatting pattern defined at **lines 19‑21**. The implementation creates a pipe‑delimited line containing three distinct fields to ensure consistent parsing and human readability.

### Captured Data Fields

Every entry written to `claudetoolcall.log` (the file path defined by the `TOOL_CALL_FILE` constant) contains the following components:

- **ISO‑8601 timestamp** – The exact moment the tool was invoked, recorded in UTC.
- **Tool name** – The identifier of the invoked tool, padded to 20 characters for vertical alignment.
- **Arguments** – A JSON‑stringified representation of the parameters passed to the tool, or an empty field if no arguments were provided.

```text
2026-07-29T14:23:07.123Z | list-files           |
2026-07-29T14:24:12.456Z | open-file            | Arguments: {"path":"/home/user/report.pdf","mode":"read"}

```

## How Audit Log Rotation Works in Desktop Commander MCP

### The 10 MiB Size Threshold

Audit log rotation is triggered by file size rather than time. The system checks the current size of `claudetoolcall.log` against the `TOOL_CALL_FILE_MAX_SIZE` constant (set to **10 MiB**) before each write operation. When the log exceeds this threshold, the rotation mechanism activates to prevent unbounded disk usage.

### Timestamped Archive Process

The rotation logic is implemented at **lines 32‑45** of [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts). The process follows three distinct steps:

1. **Generate Archive Name** – The code creates a timestamp suffix using the format `YYYY-MM-DD_HH-MM-SS` (lines 38‑42).
2. **Rename Existing Log** – The current `claudetoolcall.log` file is renamed to `claudetoolcall_YYYYMMDD_HH-MM-SS.log` (lines 44‑45).
3. **Initialize New Log** – A fresh `claudetoolcall.log` file is created, and the new audit entry is appended to it (lines 47‑48).

This size‑based rotation ensures that audit history is preserved in timestamped archives while the active log remains manageable.

## Implementation Details in trackTools.ts

The entire audit system centers on the `trackToolCall()` utility function exported from [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts). This asynchronous function accepts the tool name and an optional arguments object, formats them according to the specification, and handles the file I/O including rotation checks.

```typescript
import { trackToolCall } from './utils/trackTools.js';

// Log a tool call without arguments
await trackToolCall('list-files');

// Log a tool call with parameters
await trackToolCall('open-file', { path: '/home/user/report.pdf', mode: 'read' });

```

When the log file approaches the 10 MiB limit, the rotation code automatically produces archived files such as `claudetoolcall_2026-07-29_14-30-00.log`, allowing administrators to maintain a complete historical record without impacting runtime performance.

## Summary

- **Log Location**: Audit entries are stored in `claudetoolcall.log`, defined by the `TOOL_CALL_FILE` constant.
- **Entry Format**: Each line contains an ISO timestamp, a 20‑character padded tool name, and optional JSON arguments.
- **Rotation Trigger**: Files are rotated when they exceed 10 MiB (`TOOL_CALL_FILE_MAX_SIZE`).
- **Rotation Method**: The current log is renamed with a timestamp suffix, and a new log file is created.
- **Source File**: All logic resides in [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts), specifically in the `trackToolCall()` function.

## Frequently Asked Questions

### What file size triggers audit log rotation in Desktop Commander MCP?

Rotation occurs when `claudetoolcall.log` reaches **10 MiB**. This threshold is defined by the `TOOL_CALL_FILE_MAX_SIZE` constant, which the system checks before appending each new entry in [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts).

### Where does Desktop Commander MCP store its audit log entries?

The audit log is stored in a file named `claudetoolcall.log` (as specified by the `TOOL_CALL_FILE` constant) within the project’s working directory. The specific path is resolved relative to the server’s execution context.

### What specific data does each line in claude_tool_call.log contain?

Each line records three pieces of information: the **ISO‑8601 timestamp** of the invocation, the **tool name** padded to 20 characters, and the **JSON‑stringified arguments** (prefixed with "Arguments: "). If no arguments are provided, the field remains empty.

### How can I programmatically track tool calls in Desktop Commander MCP?

Import the `trackToolCall()` function from [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts) and await it with the tool name as the first argument. Optionally pass a parameters object as the second argument to record the specific inputs provided to the tool.