# DesktopCommanderMCP Audit Logging Mechanism: How It Works and Where Logs Are Stored

> Discover DesktopCommanderMCP's audit logging mechanism. Learn how it records MCP tool calls and where logs are stored on macOS, Linux, and Windows.

- Repository: [Eduard Ruzga/DesktopCommanderMCP](https://github.com/wonderwhy-er/DesktopCommanderMCP)
- Tags: how-to-guide
- Published: 2026-07-21

---

**DesktopCommanderMCP records every MCP tool call to a rotating JSON audit log stored in `~/.claude-server-commander/` on macOS/Linux and `%USERPROFILE%\.claude-server-commander\` on Windows, automatically archiving files when they exceed 10 MiB.**

The audit logging mechanism in wonderwhy-er/DesktopCommanderMCP provides a comprehensive trail of all tool invocations for debugging, security monitoring, and operational recovery. According to the source code, the system writes sanitized JSON entries to platform-specific user directories while implementing automatic rotation to prevent unbounded disk usage.

## How the Audit Logging Mechanism Works

The implementation spans three coordinated components that handle configuration, file I/O, and tool integration.

### Log Configuration and Destination

The foundation resides in [[`src/config.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config.ts)](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config.ts), which defines the core constants governing audit log behavior:

- `CONFIG_DIR`: Resolves to `.claude-server-commander` within the user's home directory
- `TOOL_CALL_FILE`: Specifies the filename `claude_tool_call.log`
- `TOOL_CALL_FILE_MAX_SIZE`: Set to `10 * 1024 * 1024` bytes (10 MiB) to trigger rotation

On macOS and Linux, the path expands to `~/.claude-server-commander/claude_tool_call.log`. On Windows, the same logic resolves to `%USERPROFILE%\.claude-server-commander\claude_tool_call.log` using `process.env.USERPROFILE`.

### Log Writing and Rotation Logic

The [[`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts)](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts) module manages the actual file operations. When a tool executes, the system appends a JSON line containing the timestamp, tool name, and sanitized arguments to the active log file.

When the file exceeds **10 MiB**, [`trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/trackTools.ts) automatically renames the current file with a timestamp suffix (e.g., `claude_tool_call_2024-07-21_14-30-00.log`) and starts writing to a fresh `claude_tool_call.log`. This rotation ensures continuous auditing without consuming excessive disk space.

### Integration with Tool Implementations

Each tool implementation invokes the audit logger through the `trackToolCall` function. The [[`src/utils/logger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/logger.ts)](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/logger.ts) module provides high-level helpers like `logger.info` and `logger.error` that forward messages to the MCP transport, but the dedicated audit trail is written separately via the tracking utilities to maintain structured, machine-readable records.

## Where Audit Logs Are Stored on Each Platform

The DesktopCommanderMCP audit logging mechanism uses platform-native home directory resolution to determine file placement.

### macOS and Linux

On Unix-like systems, the log resides at:

```bash
~/.claude-server-commander/claude_tool_call.log

```

The path is constructed by concatenating `USER_HOME` with the `CONFIG_DIR` constant defined in [`src/config.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config.ts).

### Windows

On Windows platforms, the log file location resolves to:

```powershell
%USERPROFILE%\.claude-server-commander\claude_tool_call.log

```

The same configuration logic applies, but `USER_HOME` maps to the Windows profile directory via `process.env.USERPROFILE`.

## Accessing and Managing Audit Logs

You can inspect audit entries programmatically through MCP tools or directly via filesystem commands.

### View Raw Log Files

To examine the last 20 entries from the command line:

**macOS/Linux:**

```bash
cat ~/.claude-server-commander/claude_tool_call.log | tail -n 20

```

**Windows PowerShell:**

```powershell
Get-Content "$env:USERPROFILE\.claude-server-commander\claude_tool_call.log" -Tail 20

```

### Programmatic Access via MCP Tools

Retrieve recent audit entries without filesystem access:

```typescript
// Fetch the last 5 tool calls via MCP
await tcpClient.sendRequest('get_recent_tool_calls', { count: 5 });

```

Force log rotation or clear existing logs:

```typescript
// Deletes current audit file and starts fresh
await tcpClient.sendRequest('clear_audit_logs', {});

```

## Summary

- **Audit logging mechanism**: Records every MCP tool call as JSON lines with timestamps and sanitized arguments
- **Storage locations**: `~/.claude-server-commander/claude_tool_call.log` on macOS/Linux; `%USERPROFILE%\.claude-server-commander\claude_tool_call.log` on Windows
- **Rotation policy**: Automatically archives logs when they reach 10 MiB, appending timestamps to archived filenames
- **Key source files**: Configuration in [`src/config.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config.ts), file operations in [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts), integration via `trackToolCall` function
- **Access methods**: Direct file inspection or programmatic retrieval via `get_recent_tool_calls` tool

## Frequently Asked Questions

### What happens when the audit log file reaches 10 MiB?

When the active log file exceeds the `TOOL_CALL_FILE_MAX_SIZE` threshold of 10 MiB, [`trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/trackTools.ts) renames the current file with a timestamp suffix (e.g., `claude_tool_call_2024-07-21_14-30-00.log`) and immediately creates a new `claude_tool_call.log` to continue recording. This rotation happens automatically without interrupting tool execution.

### Can I change the default audit log location?

The log location is hardcoded in [`src/config.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config.ts) using the `CONFIG_DIR` constant appended to the user's home directory. To use a custom location, you would need to modify the `CONFIG_DIR` definition in the source and rebuild the project, as there is no runtime configuration option for log paths in the current implementation.

### How do I retrieve audit logs without accessing the filesystem directly?

DesktopCommanderMCP exposes the `get_recent_tool_calls` tool, which allows MCP clients to request the last N audit entries programmatically. This method reads directly from the log file defined in [`src/config.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config.ts) and returns the entries as structured data, eliminating the need for manual file system navigation.

### Are sensitive arguments sanitized in the audit logs?

According to the implementation in [`trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/trackTools.ts), the audit logging mechanism captures tool names, timestamps, and arguments. While the raw analysis mentions "sanitized arguments," you should verify the specific sanitization logic in your deployed version by inspecting how `trackToolCall` processes parameters before writing to the log file.