# How to Configure Security Settings (blockedCommands and allowedDirectories) in Desktop Commander

> Learn to configure security settings like blockedCommands and allowedDirectories in Desktop Commander by editing the config.json file. Restrict filesystem access and block specific commands.

- Repository: [Eduard Ruzga/DesktopCommanderMCP](https://github.com/wonderwhy-er/DesktopCommanderMCP)
- Tags: how-to-guide
- Published: 2026-07-31

---

**Desktop Commander stores security settings in [`config.json`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/config.json), where `allowedDirectories` restricts filesystem access to whitelisted paths and `blockedCommands` prevents execution of specific shell commands.**

Desktop Commander MCP provides granular security controls to limit filesystem access and block dangerous shell commands. By configuring the `allowedDirectories` and `blockedCommands` arrays in the user configuration file, you can enforce strict boundaries on what the server can access and execute. This guide explains how to set up these security settings using both manual JSON editing and programmatic APIs as implemented in the `wonderwhy-er/DesktopCommanderMCP` repository.

## Understanding the Security Configuration Fields

### allowedDirectories Whitelist

The `allowedDirectories` field defines which filesystem paths Desktop Commander may read from or write to. According to [`src/config-field-definitions.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config-field-definitions.ts) (lines 16-20), this array contains absolute paths that serve as a whitelist. When empty (the default), the application has full filesystem access. Once populated, any file operation targeting paths outside these directories is rejected.

### blockedCommands Blacklist

The `blockedCommands` field, defined in [`src/config-field-definitions.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config-field-definitions.ts) (lines 11-15), contains shell commands that Desktop Commander will refuse to execute. This blacklist prevents destructive operations even if explicitly requested. By default, this array is empty, meaning no commands are blocked.

## How Security Restrictions Are Enforced

Desktop Commander enforces these settings at runtime through specialized managers.

Path validation occurs in [`src/tools/filesystem.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/tools/filesystem.ts) (lines 172-203). Before any file operation, the system calls `getAllowedDirs()` and verifies the target path resides within one of the whitelisted directories. If the check fails, the operation aborts with an error listing the permitted directories.

Command blocking happens in [`src/command-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/command-manager.ts) (lines 233-246). Before spawning a shell process, the CommandManager checks if the command base name appears in `config.blockedCommands`. If matched, the request is rejected immediately.

The default empty arrays for both fields are established in [`src/config-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config-manager.ts) (lines 182-183), where the ConfigManager initializes the configuration object.

## Configuring Security via config.json

You can manually edit the [`config.json`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/config.json) file to set these security boundaries.

### Restricting Filesystem Access

To limit Desktop Commander to specific directories:

```json
{
  "allowedDirectories": [
    "/home/alice/projects",
    "/etc/my-secure-config"
  ],
  "blockedCommands": []
}

```

With this configuration, any filesystem call targeting paths outside `/home/alice/projects` or `/etc/my-secure-config` will fail with an error message indicating the allowed directories.

### Blocking Dangerous Commands

To prevent execution of risky shell commands:

```json
{
  "allowedDirectories": [],
  "blockedCommands": [
    "rm",
    "shutdown",
    "reboot",
    "mkfs"
  ]
}

```

Attempts to execute `rm -rf /` or any variant of the blocked commands will be stopped by the CommandManager, returning an error such as `Command not allowed: rm`.

## Programmatic Configuration Management

For dynamic updates, use the ConfigManager API exposed in [`src/config-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config-manager.ts).

### Updating Settings via Code

To append directories or commands programmatically:

```typescript
import { configManager } from './config-manager';

// Add a new allowed directory
await configManager.setValue('allowedDirectories', [
  ...await configManager.getValue('allowedDirectories'),
  '/var/www'
]);

// Block an additional command
await configManager.setValue('blockedCommands', [
  ...await configManager.getValue('blockedCommands'),
  'chmod'
]);

```

The `setValue` method writes changes immediately to [`config.json`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/config.json), and subsequent operations respect the new restrictions.

### Reading Current Security Settings

To inspect the active configuration:

```typescript
import { getConfig } from './config-manager';

const cfg = await getConfig();
console.log('Allowed directories:', cfg.allowedDirectories);
console.log('Blocked commands:', cfg.blockedCommands);

```

This is useful for debugging or displaying the current security posture in UI components.

## Using the Config Editor UI

Desktop Commander includes a web-based Config Editor located in [`src/ui/config-editor/src/app.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/ui/config-editor/src/app.ts) (lines 310-327). This interface renders the security fields as editable arrays:

- **allowedDirectories**: Displays "All folders allowed (no restriction)" when empty, or "N folder(s) allowed" when configured
- **blockedCommands**: Shows a simple list input where each line represents a blocked command

The UI provides a user-friendly alternative to manual JSON editing while enforcing the same validation rules defined in the configuration schema.

## Summary

- Desktop Commander stores security settings in [`config.json`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/config.json) with two primary fields: `allowedDirectories` (whitelist) and `blockedCommands` (blacklist)
- Filesystem operations validate paths against `allowedDirectories` in [`src/tools/filesystem.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/tools/filesystem.ts) (lines 172-203)
- Shell commands are checked against `blockedCommands` in [`src/command-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/command-manager.ts) (lines 233-246) before execution
- Default empty arrays permit full access; populate arrays to enforce restrictions
- Update settings manually via JSON or programmatically using `configManager.setValue()` and `configManager.getValue()`
- Use the built-in Config Editor UI for visual management of security lists

## Frequently Asked Questions

### What happens if allowedDirectories is empty?

When `allowedDirectories` contains an empty array (the default), Desktop Commander can access any path on the filesystem. The restriction only activates once you add specific directory paths to the array.

### Can I use wildcards or patterns in blockedCommands?

No, the command blocking in [`src/command-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/command-manager.ts) (lines 233-246) performs exact matching against the command base name. You must specify the full command name (e.g., "rm" not "rm *") to block it.

### Do configuration changes require a server restart?

No, changes take effect immediately. When you update [`config.json`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/config.json) manually or via `configManager.setValue()`, the ConfigManager persists the changes and subsequent filesystem or command operations automatically use the updated security settings.

### Where is the config.json file located?

The ConfigManager handles the location of [`config.json`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/config.json) internally. You typically interact with it through the Config Editor UI or the programmatic API rather than direct file system access, ensuring proper validation and persistence.