How Desktop Commander MCP Telemetry Collection Works and How to Opt Out

Desktop Commander MCP collects anonymous usage data through a fire-and-forget telemetry subsystem in src/utils/capture.ts, which users can disable via the UI toggle or by setting the DESKTOP_COMMANDER_DISABLE_TELEMETRY=1 environment variable.

Desktop Commander MCP is an open-source Model Context Protocol (MCP) server that implements an opt-out telemetry system to track feature usage while respecting user privacy. The implementation spans three core files—src/utils/capture.ts, src/config-manager.ts, and src/config-field-definitions.ts—and transmits Google Analytics 4-style payloads to a remote telemetry proxy.

Telemetry Architecture Overview

The telemetry flow centers on the capture() API, which acts as a sanitized, non-blocking event pipeline.

The Capture Entry Point

The primary entry point is the capture() function exported from src/utils/capture.ts. Called from tool-call wrappers and UI events throughout the codebase, it first checks if the execution context originated from a widget UI using isInsideUiOriginCall(). If true, the event is dropped immediately to prevent noisy churn.

Events passing the origin check trigger an asynchronous, fire-and-forget process:

// src/utils/capture.ts
export const capture = async (event: string, properties?: any) => {
  if (isInsideUiOriginCall()) return;          // UI churn → no telemetry
  void (async () => {
    const eventProperties = await buildEventProperties(properties);
    await sendToTelemetryProxy(event, eventProperties);
  })();
};

Errors during transmission are silently swallowed, ensuring telemetry never blocks core functionality.

Data Sanitization Pipeline

Before transmission, all data passes through aggressive sanitization in buildEventProperties. The sanitizeError helper strips stack traces and file-system paths from error objects. Additionally, any property key resembling a path—such as path, filePath, or directory—is removed unless explicitly allow-listed (e.g., fileExtension). Remote-device telemetry receives an extra remote: "true" flag for segmentation.

Payload Structure and Client Identification

The final payload conforms to a Google Analytics 4 schema:

{
  "client_id": "<UUID>",
  "timestamp_micros": 1700000000000,
  "events": [{ "name": "event_name", "params": { ... } }]
}

The client_id is a persistent UUID generated via configManager.getOrCreateClientId() in src/config-manager.ts. System metadata—including platform, container detection, and runtime source—is automatically appended to every event.

Data Transmission and Endpoints

Telemetry payloads are POSTed to https://telemetry.desktopcommander.app/mp/collect with a 3-second timeout. If the primary endpoint fails, the system falls back to https://dc-telemetry-proxy-83847352264.europe-west1.run.app/mp/collect.

The transport logic in postTelemetryPayload and sendToTelemetryProxy operates asynchronously; failures do not surface to the user or interrupt tool execution.

Configuration and Kill Switches

Desktop Commander MCP follows an opt-out model where telemetry is enabled by default but can be disabled through multiple mechanisms.

The Default Opt-Out Model

In src/config-manager.ts (line 83), the configuration field telemetryEnabled defaults to true. This flag is read by the capture() function before any network request is initiated. When false, the function returns early without building a payload.

Environment Variable Override

For CI environments or one-off executions, the system checks isTelemetryDisabledByEnv() in src/utils/capture.ts. Setting DESKTOP_COMMANDER_DISABLE_TELEMETRY to 1, true, yes, or on acts as an absolute kill-switch that overrides the persisted configuration:

// src/utils/capture.ts
export function isTelemetryDisabledByEnv(): boolean {
  const raw = process.env.DESKTOP_COMMANDER_DISABLE_TELEMETRY;
  return raw && ['1','true','yes','on'].includes(raw.trim().toLowerCase());
}

How to Disable Telemetry (The Opt-Out Process)

Users can disable telemetry through the UI or programmatically, with the system emitting a final opt-out event before ceasing transmission.

UI-Based Opt-Out

When a user toggles the "Anonymous Telemetry" setting in the UI, the application calls configManager.setValue('telemetryEnabled', false). This method detects the transition from enabled to disabled and fires a final server_telemetry_opt_out event—allowing the team to track opt-out rates while respecting the user's decision:

// src/config-manager.ts – part of setValue()
if (key === 'telemetryEnabled' && isTelemetryDisabledValue(value)) {
  const currentValue = this.config[key];
  if (!isTelemetryDisabledValue(currentValue)) {
    const { capture } = await import('./utils/capture.js');
    await capture('server_telemetry_opt_out', { reason: 'user_disabled', prev_value: currentValue });
  }
}

After this final event, this.saveConfig() persists the change, and subsequent calls to capture() stop generating network requests.

Programmatic and Environment-Based Disabling

Developers can disable telemetry programmatically or via environment variables:

// Programmatic opt-out via config manager
import { configManager } from './config-manager.js';
await configManager.setValue('telemetryEnabled', false);

// Temporary disable for CI runs
process.env.DESKTOP_COMMANDER_DISABLE_TELEMETRY = 'true';

Summary

• Entry Point: The capture() function in src/utils/capture.ts filters UI-origin calls and sanitizes data before transmission.
• Sanitization: Removes file paths, stack traces, and sensitive keys; adds system metadata and a persistent client ID.
• Transport: Fire-and-forget POST requests to telemetry.desktopcommander.app with a Cloud Run fallback; 3-second timeout guarantees non-blocking behavior.
• Defaults: Telemetry is opt-out (telemetryEnabled: true by default in src/config-manager.ts).
• Kill Switches: Set DESKTOP_COMMANDER_DISABLE_TELEMETRY=1 or call configManager.setValue('telemetryEnabled', false).
• Opt-Out Event: Disabling telemetry triggers a single server_telemetry_opt_out event before data collection ceases.

Frequently Asked Questions

What data does Desktop Commander MCP collect?

Desktop Commander MCP collects anonymous feature usage data including tool invocation counts, execution durations, and system metadata (platform, runtime source). According to the source code in src/utils/capture.ts, it explicitly excludes file paths, stack traces, and any property keys resembling paths unless explicitly allow-listed.

How do I completely disable telemetry without using the UI?

Set the environment variable DESKTOP_COMMANDER_DISABLE_TELEMETRY=1 before launching the application. This overrides the persisted configuration and prevents any telemetry initialization for that process instance, as implemented in the isTelemetryDisabledByEnv() function.

Why does telemetry remain enabled by default?

The project uses an opt-out model where telemetryEnabled defaults to true in src/config-manager.ts (line 83). This design choice prioritizes aggregate usage insights while providing clear UI controls and environment-variable overrides for privacy-conscious users.

Will disabling telemetry affect application functionality?

No. The telemetry subsystem is designed to be strictly non-blocking. All network requests are wrapped in fire-and-forget promises with swallowed errors, and the capture() function returns immediately after checking the enabled flag. Disabling telemetry has no impact on tool execution or MCP server performance.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}