# DesktopCommanderMCP allowedDirectories: Filesystem Operations vs Terminal Commands Explained

> Understand DesktopCommanderMCP's allowedDirectories. Learn how filesystem operations differ from terminal commands and how paths are validated for security.

- Repository: [Eduard Ruzga/DesktopCommanderMCP](https://github.com/wonderwhy-er/DesktopCommanderMCP)
- Tags: deep-dive
- Published: 2026-07-10

---

**In DesktopCommanderMCP, the `allowedDirectories` configuration restricts only filesystem tool operations, while terminal commands are validated against `blockedCommands`; however, any file paths within terminal commands are subsequently checked against `allowedDirectories` when the filesystem layer processes the operation.**

DesktopCommanderMCP is a Model Context Protocol (MCP) server that exposes both filesystem manipulation tools and terminal execution capabilities. The `allowedDirectories` array defined in [`src/config-field-definitions.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config-field-definitions.ts) serves as a path-based access control mechanism, but its application differs fundamentally between native file operations and shell command execution.

## How allowedDirectories Restricts Filesystem Operations

When DesktopCommanderMCP performs filesystem operations through its dedicated tools, the `allowedDirectories` array acts as a mandatory whitelist. According to the source code in [`src/tools/filesystem.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/tools/filesystem.ts) (lines 172-210), every file operation calls `getAllowedDirs()` and validates that the target path resides within one of the permitted directories.

The implementation performs path normalization and enforces two matching conditions:

- **Exact match**: The normalized path equals a listed directory exactly
- **Sub-directory match**: The normalized path starts with a listed directory followed by a trailing slash

If `allowedDirectories` is empty or contains the root path "/", the validation passes and grants unrestricted filesystem access.

```typescript
// src/tools/filesystem.ts
const allowedDirectories = await getAllowedDirs();
if (allowedDirectories.includes('/') || allowedDirectories.length === 0) {
  // unrestricted – allow any path
}
const isAllowed = allowedDirectories.some(dir => {
  const normDir = normalizePath(dir);
  // exact match
  if (normPath === normDir) return true;
  // sub‑directory match
  return normPath.startsWith(normDir + '/');
});
if (!isAllowed) {
  throw new Error(`Path not allowed: ${requestedPath}`);
}

```

## Why Terminal Commands Ignore allowedDirectories

Terminal command execution follows a separate security model implemented in [`src/command-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/command-manager.ts) (lines 29-52). Rather than checking `allowedDirectories`, the command manager validates inputs against the `blockedCommands` array.

When a command is submitted, the system extracts the base command name using `getBaseCommand()` and checks it against the blocklist:

```typescript
// src/command-manager.ts
const blocked = config.blockedCommands || [];
const baseCmd = this.getBaseCommand(command);
if (blocked.includes(baseCmd)) {
  return false; // command blocked
}
return true; // command allowed (file paths will be checked later)

```

This design permits commands like `cp` or `mv` to execute as long as they are not explicitly blocked, regardless of the directories they reference in their arguments.

## The Security Interaction Between Layers

The architecture creates a deliberate separation between **what can execute** and **where it can access**. When a terminal command manipulates files:

1. The [`command-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/command-manager.ts) layer validates that the base command is not in `blockedCommands`
2. If allowed, the command executes
3. Any filesystem operations triggered by the command flow through [`src/tools/filesystem.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/tools/filesystem.ts)
4. The filesystem layer validates all file paths against `allowedDirectories`

This two-layer validation ensures that even permitted commands cannot access data outside the whitelisted directories. For example, `cp /etc/passwd /home/user/docs/` would pass the command check (assuming `cp` is not blocked), but fail when the filesystem layer validates that `/etc/passwd` is not within `allowedDirectories`.

## Configuration Example

The [`src/server.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/server.ts) file documents these configuration fields in the API description. Implement complete access control by defining both arrays:

```json
{
  "allowedDirectories": ["/home/user/documents", "/var/www"],
  "blockedCommands": ["rm", "shutdown", "reboot"]
}

```

This configuration restricts filesystem tools to `/home/user/documents` and `/var/www`, while preventing execution of `rm`, `shutdown`, and `reboot` commands entirely. Other commands like `cp` or `cat` may run, but only if they reference paths within the allowed directories.

## Summary

- **Filesystem operations** in [`src/tools/filesystem.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/tools/filesystem.ts) validate all paths against `allowedDirectories` before reading, writing, or manipulating files
- **Terminal commands** in [`src/command-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/command-manager.ts) validate only against `blockedCommands`, ignoring `allowedDirectories` at the execution layer  
- **Empty `allowedDirectories`** or inclusion of "/" grants unrestricted filesystem access to native tools
- **Path arguments** in terminal commands are still subject to `allowedDirectories` checks when the filesystem layer processes them
- **Separation of concerns** allows administrators to block dangerous commands while restricting file access scope independently

## Frequently Asked Questions

### Does DesktopCommanderMCP check allowedDirectories before running terminal commands?

No. Terminal commands are validated only against `blockedCommands` in [`src/command-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/command-manager.ts). The `allowedDirectories` check occurs later if the command triggers filesystem operations through the MCP tools. Pure shell commands that do not interact with the filesystem layer execute without directory validation.

### What happens if allowedDirectories is empty in the configuration?

When `allowedDirectories` is empty or contains "/", the filesystem validation logic in [`src/tools/filesystem.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/tools/filesystem.ts) passes all paths, granting unrestricted access to the entire file system for filesystem tool operations.

### Can blockedCommands prevent file deletion if allowedDirectories permits the path?

Yes. Even if a target path falls within `allowedDirectories`, adding `rm` to `blockedCommands` prevents the remove command from executing entirely. The command is blocked at the [`command-manager.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/command-manager.ts) layer before any filesystem access occurs.

### How does DesktopCommanderMCP handle path traversal attempts in terminal commands?

Path traversal attempts (e.g., `cat ../../../etc/passwd`) are resolved and normalized during the filesystem layer validation in [`src/tools/filesystem.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/tools/filesystem.ts). After computing the absolute path, the system checks whether the final location falls within the `allowedDirectories` whitelist, rejecting operations that escape the permitted scope.