DesktopCommanderMCP Blocklist: 13 Dangerous Commands Blocked by Default

DesktopCommanderMCP prevents execution of 13 high-risk shell commands—including sudo, dd, mkfs, and useradd—by maintaining a hardcoded blocklist in config.json that is enforced by the CommandManager.validateCommand method.

DesktopCommanderMCP is a Model Context Protocol (MCP) server that enables AI assistants to execute terminal commands on your local desktop. To prevent accidental system damage, data loss, or unauthorized privilege escalation, the server implements a security blocklist defined in the repository’s config.json file that filters dangerous operations before any process execution begins.

The Complete DesktopCommanderMCP Blocklist

The default configuration blocks 13 specific commands across four categories of high-risk system operations. These entries are stored in the blockedCommands array within config.json.

Disk and Filesystem Operations

These commands can destroy data, alter partition tables, or modify filesystem mounts:

• format – Disk formatting utility
• mount – Mount filesystems
• umount – Unmount filesystems
• mkfs – Create filesystems
• fdisk – Partition table manipulator
• dd – Low-level disk copying and writing

Privilege Escalation

Commands that grant elevated privileges or switch user contexts:

• sudo – Execute as superuser
• su – Switch user accounts

User and Password Management

Commands that modify system authentication and account structures:

• passwd – Change user passwords
• adduser – Add user accounts
• useradd – Create user accounts
• usermod – Modify user accounts
• groupadd – Create new groups

Where the Blocklist Is Defined

The blocked commands are stored in config.json at the repository root. The src/config-manager.ts module handles loading and persisting this configuration, while src/command-manager.ts contains the validation logic that enforces restrictions at runtime.

How Command Validation Works

In src/command-manager.ts, the CommandManager.validateCommand method extracts the blockedCommands array from the configuration and rejects any command whose base name appears in this list. This validation occurs before the subprocess is spawned, ensuring blocked commands never reach the operating system.

Programmatically Checking Blocked Commands

You can retrieve the current blocklist and test command validation using the MCP tools exposed by the server.

Retrieve the blocklist configuration:

// Retrieve full config to inspect blockedCommands
await get_config({});
const { blockedCommands } = await get_config({});
if (blockedCommands.includes('sudo')) {
  console.log('⚠️ "sudo" is blocked');
}

Attempting to execute a blocked command returns an error:

// This will fail because "sudo" is on the blocklist
await start_process({ command: 'sudo apt update' });
// Returns: Error - Command "sudo" is blocked

Summary

• DesktopCommanderMCP blocks 13 dangerous commands by default to prevent system damage and unauthorized access
• The blocklist is defined in config.json and includes sudo, dd, mkfs, and user management tools
• Validation occurs in CommandManager.validateCommand within src/command-manager.ts
• Configuration loading and persistence is handled by src/config-manager.ts
• Attempts to execute blocked commands return explicit errors before any process execution begins

Frequently Asked Questions

Can I modify the DesktopCommanderMCP blocklist?

The blocklist is loaded from config.json and processed by src/config-manager.ts. While you can retrieve the current list using get_config, modifying the blocklist requires editing the config.json file directly and restarting the server, as the validation logic in src/command-manager.ts references this configuration at runtime.

Why is dd blocked but not rm?

The dd command can directly overwrite disk blocks and destroy partition tables with a single typo, making it particularly dangerous for automated AI execution. While rm can delete files, the blocklist specifically targets commands that affect system-level structures, partitions, and authentication mechanisms that could render the system unusable.

How does DesktopCommanderMCP detect blocked commands?

The CommandManager.validateCommand method in src/command-manager.ts parses the incoming command string, extracts the base command name, and checks for inclusion in the blockedCommands array loaded from config.json. This validation occurs before any process execution begins, creating a security boundary around the shell environment.

Does the blocklist prevent piped or scripted commands?

The validation checks the base command name of the primary command. If the main command is blocked, the request is rejected immediately. Complex shell constructs that invoke blocked commands as sub-processes are also caught if the parser identifies a blocked command in the command string, though the exact behavior depends on how validateCommand tokenizes compound statements in src/command-manager.ts.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}