DesktopCommanderMCP Audit Logging Mechanism: How It Works and Where Logs Are Stored

DesktopCommanderMCP records every MCP tool call to a rotating JSON audit log stored in ~/.claude-server-commander/ on macOS/Linux and %USERPROFILE%\.claude-server-commander\ on Windows, automatically archiving files when they exceed 10 MiB.

The audit logging mechanism in wonderwhy-er/DesktopCommanderMCP provides a comprehensive trail of all tool invocations for debugging, security monitoring, and operational recovery. According to the source code, the system writes sanitized JSON entries to platform-specific user directories while implementing automatic rotation to prevent unbounded disk usage.

How the Audit Logging Mechanism Works

The implementation spans three coordinated components that handle configuration, file I/O, and tool integration.

Log Configuration and Destination

The foundation resides in [src/config.ts](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config.ts), which defines the core constants governing audit log behavior:

• CONFIG_DIR: Resolves to .claude-server-commander within the user's home directory
• TOOL_CALL_FILE: Specifies the filename claude_tool_call.log
• TOOL_CALL_FILE_MAX_SIZE: Set to 10 * 1024 * 1024 bytes (10 MiB) to trigger rotation

On macOS and Linux, the path expands to ~/.claude-server-commander/claude_tool_call.log. On Windows, the same logic resolves to %USERPROFILE%\.claude-server-commander\claude_tool_call.log using process.env.USERPROFILE.

Log Writing and Rotation Logic

The [src/utils/trackTools.ts](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts) module manages the actual file operations. When a tool executes, the system appends a JSON line containing the timestamp, tool name, and sanitized arguments to the active log file.

When the file exceeds 10 MiB, trackTools.ts automatically renames the current file with a timestamp suffix (e.g., claude_tool_call_2024-07-21_14-30-00.log) and starts writing to a fresh claude_tool_call.log. This rotation ensures continuous auditing without consuming excessive disk space.

Integration with Tool Implementations

Each tool implementation invokes the audit logger through the trackToolCall function. The [src/utils/logger.ts](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/logger.ts) module provides high-level helpers like logger.info and logger.error that forward messages to the MCP transport, but the dedicated audit trail is written separately via the tracking utilities to maintain structured, machine-readable records.

Where Audit Logs Are Stored on Each Platform

The DesktopCommanderMCP audit logging mechanism uses platform-native home directory resolution to determine file placement.

macOS and Linux

On Unix-like systems, the log resides at:

~/.claude-server-commander/claude_tool_call.log

The path is constructed by concatenating USER_HOME with the CONFIG_DIR constant defined in src/config.ts.

Windows

On Windows platforms, the log file location resolves to:

%USERPROFILE%\.claude-server-commander\claude_tool_call.log

The same configuration logic applies, but USER_HOME maps to the Windows profile directory via process.env.USERPROFILE.

Accessing and Managing Audit Logs

You can inspect audit entries programmatically through MCP tools or directly via filesystem commands.

View Raw Log Files

To examine the last 20 entries from the command line:

macOS/Linux:

cat ~/.claude-server-commander/claude_tool_call.log | tail -n 20

Windows PowerShell:

Get-Content "$env:USERPROFILE\.claude-server-commander\claude_tool_call.log" -Tail 20

Programmatic Access via MCP Tools

Retrieve recent audit entries without filesystem access:

// Fetch the last 5 tool calls via MCP
await tcpClient.sendRequest('get_recent_tool_calls', { count: 5 });

Force log rotation or clear existing logs:

// Deletes current audit file and starts fresh
await tcpClient.sendRequest('clear_audit_logs', {});

Summary

• Audit logging mechanism: Records every MCP tool call as JSON lines with timestamps and sanitized arguments
• Storage locations: ~/.claude-server-commander/claude_tool_call.log on macOS/Linux; %USERPROFILE%\.claude-server-commander\claude_tool_call.log on Windows
• Rotation policy: Automatically archives logs when they reach 10 MiB, appending timestamps to archived filenames
• Key source files: Configuration in src/config.ts, file operations in src/utils/trackTools.ts, integration via trackToolCall function
• Access methods: Direct file inspection or programmatic retrieval via get_recent_tool_calls tool

Frequently Asked Questions

What happens when the audit log file reaches 10 MiB?

When the active log file exceeds the TOOL_CALL_FILE_MAX_SIZE threshold of 10 MiB, trackTools.ts renames the current file with a timestamp suffix (e.g., claude_tool_call_2024-07-21_14-30-00.log) and immediately creates a new claude_tool_call.log to continue recording. This rotation happens automatically without interrupting tool execution.

Can I change the default audit log location?

The log location is hardcoded in src/config.ts using the CONFIG_DIR constant appended to the user's home directory. To use a custom location, you would need to modify the CONFIG_DIR definition in the source and rebuild the project, as there is no runtime configuration option for log paths in the current implementation.

How do I retrieve audit logs without accessing the filesystem directly?

DesktopCommanderMCP exposes the get_recent_tool_calls tool, which allows MCP clients to request the last N audit entries programmatically. This method reads directly from the log file defined in src/config.ts and returns the entries as structured data, eliminating the need for manual file system navigation.

Are sensitive arguments sanitized in the audit logs?

According to the implementation in trackTools.ts, the audit logging mechanism captures tool names, timestamps, and arguments. While the raw analysis mentions "sanitized arguments," you should verify the specific sanitization logic in your deployed version by inspecting how trackToolCall processes parameters before writing to the log file.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}