# How Desktop Commander Telemetry Captures Usage Stats Without Collecting Sensitive Data

> Discover how Desktop Commander telemetry captures usage stats anonymously. Learn about its opt-out architecture, protected PII, and secure data handling.

- Repository: [Eduard Ruzga/DesktopCommanderMCP](https://github.com/wonderwhy-er/DesktopCommanderMCP)
- Tags: best-practices
- Published: 2026-07-25

---

**Desktop Commander telemetry employs an opt-out-by-default architecture that transmits only anonymous UUIDs and generic environment metadata while explicitly excluding personally identifiable information, file contents, and user-entered text.**

The Desktop Commander MCP server implements a privacy-first telemetry pipeline designed to gather installation statistics and usage patterns without compromising user privacy. As implemented in the `wonderwhy-er/DesktopCommanderMCP` repository, the system ensures that sensitive data remains local by architectural design rather than policy alone.

## Anonymous Client Identification

Desktop Commander telemetry uses cryptographically random identifiers rather than personal information to distinguish installations.

### UUID Generation and Storage

The system generates a unique client identifier using `crypto.randomUUID()` during initial setup. This UUID is stored in the local configuration file at `~/.claude-server-commander/config.json` and persists across sessions to enable longitudinal usage analysis without revealing the user's identity.

In [`track-installation.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/track-installation.js) (lines 43-69), the implementation checks for an existing `clientId` in the config file. If none exists, it generates a new UUID and writes it back to disk:

```javascript
// From track-installation.js - Client ID management
const config = await getConfigSettings();
let clientId = config.clientId;

if (!clientId) {
  clientId = crypto.randomUUID();
  config.clientId = clientId;
  await saveConfigSettings(config);
}

```

This opaque `client_id` is the only identifier transmitted in telemetry payloads.

## Non-Personalized Payload Structure

The telemetry system deliberately restricts payload contents to generic, non-identifying data points.

### Explicit Privacy Flags

Each payload includes `non_personalized_ads: false` to signal that the data is unsuitable for advertising personalization. The `events` array contains only event names (such as `package_installed`) and a `params` object limited to:

- **Platform** (operating system)
- **Node.js version**
- **npm version**
- **Installation source** (detected as VS Code, CI environment, or terminal)

As defined in [`track-installation.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/track-installation.js) (lines 76-84), no fields contain file paths, usernames, email addresses, or command contents.

```javascript
// Payload structure from track-installation.js
const payload = {
  client_id: clientId,
  non_personalized_ads: false,
  timestamp_micros: Date.now() * 1000,
  events: [{
    name: 'package_installed',
    params: {
      platform: process.platform,
      node_version: process.version,
      npm_version: await getNpmVersion(),
      installation_source: source
    }
  }]
};

```

## User Consent and Configuration Controls

Desktop Commander telemetry respects user autonomy through multiple opt-out mechanisms.

### Opt-Out by Default Protection

The [`uninstall-claude-server.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/uninstall-claude-server.js) script initializes telemetry as disabled by default. Lines 19-20 explicitly set `telemetryEnabled: false` when creating fresh configuration files, ensuring that new installations do not transmit data without explicit user action.

### Configuration File Management

Users maintain full control through the [`setup-claude-server.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/setup-claude-server.js) script (lines 100-105), which writes the default configuration including the `telemetryEnabled` boolean. While the setup script defaults to `true` for existing users, the uninstall script's opt-out protection takes precedence for new installations.

To manually verify or change telemetry settings:

```javascript
// Check current telemetry status
import { getConfigSettings } from './uninstall-claude-server.js';

async function checkTelemetryStatus() {
  const { telemetryEnabled, clientId } = await getConfigSettings();
  console.log(`Telemetry: ${telemetryEnabled ? 'enabled' : 'disabled'}`);
  console.log(`Anonymous ID: ${clientId || 'not generated'}`);
}
checkTelemetryStatus();

```

## Secure Data Transmission Pipeline

The telemetry pipeline implements strict network controls to prevent data leakage.

### Controlled HTTP Requests

The `postTelemetryPayload` helper function in [`track-installation.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/track-installation.js) (lines 23-33) constructs HTTPS requests with minimal headers and timeout protection:

- **Content-Type**: Strictly set to `application/json`
- **Timeout**: 5-second limit to prevent hanging
- **No additional headers** that could reveal environment details

### Dual-Endpoint Reliability

Data posts to a primary telemetry proxy at `https://telemetry.desktopcommander.app/mp/collect` with automatic fallback to a secondary endpoint if the primary fails. Both endpoints accept only the minimal JSON structure defined in the source code, rejecting any payloads containing unexpected fields.

```javascript
// Network implementation from track-installation.js
async function postTelemetryPayload(payload) {
  const data = JSON.stringify(payload);
  const options = {
    hostname: 'telemetry.desktopcommander.app',
    path: '/mp/collect',
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Content-Length': Buffer.byteLength(data)
    },
    timeout: 5000
  };
  
  // Implementation continues with HTTPS request...
}

```

## Practical Implementation Examples

To programmatically interact with Desktop Commander telemetry:

**Enabling telemetry explicitly:**

```javascript
import { writeFileSync, existsSync, readFileSync } from 'fs';
import { join } from 'path';
import { homedir } from 'os';
import crypto from 'crypto';

const cfgDir = join(homedir(), '.claude-server-commander');
const cfgFile = join(cfgDir, 'config.json');

const config = existsSync(cfgFile)
  ? JSON.parse(readFileSync(cfgFile, 'utf8'))
  : {};

config.telemetryEnabled = true;
config.clientId = config.clientId || crypto.randomUUID();

writeFileSync(cfgFile, JSON.stringify(config, null, 2));

```

**Triggering custom installation tracking:**

```javascript
import { trackInstallation, detectInstallationSource } from './track-installation.js';

async function recordInstallEvent() {
  const source = await detectInstallationSource(); // Returns 'vscode', 'ci', or 'cli'
  await trackInstallation(source); // Transmits anonymous payload
}

recordInstallEvent();

```

## Summary

- **Desktop Commander telemetry** uses randomly generated UUIDs rather than personal identifiers to track installations anonymously.
- The system initializes with **opt-out-by-default protection** in [`uninstall-claude-server.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/uninstall-claude-server.js), ensuring new installations require explicit consent.
- Payloads contain only **generic environment metadata** (platform, Node version, npm version) with explicit `non_personalized_ads` flags.
- **Network requests are strictly controlled** with 5-second timeouts and minimal headers to prevent information leakage.
- Users can toggle telemetry through the local **configuration file** at `~/.claude-server-commander/config.json` without affecting functionality.

## Frequently Asked Questions

### Does Desktop Commander telemetry collect file contents or personal data?

No. According to the source code in [`track-installation.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/track-installation.js) (lines 76-84), the payload explicitly excludes file paths, user-entered text, email addresses, and any content from the file system. Only generic environment data such as Node.js version and operating system platform are transmitted.

### How can I disable telemetry in Desktop Commander?

Set `telemetryEnabled: false` in the configuration file located at `~/.claude-server-commander/config.json`, or delete the configuration file entirely. The [`uninstall-claude-server.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/uninstall-claude-server.js) script also provides utilities to read and modify these settings programmatically.

### What installation sources can Desktop Commander telemetry detect?

The `detectInstallationSource()` function in [`track-installation.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/track-installation.js) identifies whether the installation originated from VS Code, a CI environment, or standard terminal usage by examining environment variables and parent process information.

### Where is the anonymous client ID stored?

The UUID is stored locally in `~/.claude-server-commander/config.json` alongside the `telemetryEnabled` boolean. This file is created during setup by [`setup-claude-server.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/setup-claude-server.js) (lines 100-105) and maintained by the tracking utilities in [`track-installation.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/track-installation.js).