DesktopCommanderMCP allowedDirectories: Filesystem Operations vs Terminal Commands Explained

In DesktopCommanderMCP, the allowedDirectories configuration restricts only filesystem tool operations, while terminal commands are validated against blockedCommands; however, any file paths within terminal commands are subsequently checked against allowedDirectories when the filesystem layer processes the operation.

DesktopCommanderMCP is a Model Context Protocol (MCP) server that exposes both filesystem manipulation tools and terminal execution capabilities. The allowedDirectories array defined in src/config-field-definitions.ts serves as a path-based access control mechanism, but its application differs fundamentally between native file operations and shell command execution.

How allowedDirectories Restricts Filesystem Operations

When DesktopCommanderMCP performs filesystem operations through its dedicated tools, the allowedDirectories array acts as a mandatory whitelist. According to the source code in src/tools/filesystem.ts (lines 172-210), every file operation calls getAllowedDirs() and validates that the target path resides within one of the permitted directories.

The implementation performs path normalization and enforces two matching conditions:

• Exact match: The normalized path equals a listed directory exactly
• Sub-directory match: The normalized path starts with a listed directory followed by a trailing slash

If allowedDirectories is empty or contains the root path "/", the validation passes and grants unrestricted filesystem access.

// src/tools/filesystem.ts
const allowedDirectories = await getAllowedDirs();
if (allowedDirectories.includes('/') || allowedDirectories.length === 0) {
  // unrestricted – allow any path
}
const isAllowed = allowedDirectories.some(dir => {
  const normDir = normalizePath(dir);
  // exact match
  if (normPath === normDir) return true;
  // sub‑directory match
  return normPath.startsWith(normDir + '/');
});
if (!isAllowed) {
  throw new Error(`Path not allowed: ${requestedPath}`);
}

Why Terminal Commands Ignore allowedDirectories

Terminal command execution follows a separate security model implemented in src/command-manager.ts (lines 29-52). Rather than checking allowedDirectories, the command manager validates inputs against the blockedCommands array.

When a command is submitted, the system extracts the base command name using getBaseCommand() and checks it against the blocklist:

// src/command-manager.ts
const blocked = config.blockedCommands || [];
const baseCmd = this.getBaseCommand(command);
if (blocked.includes(baseCmd)) {
  return false; // command blocked
}
return true; // command allowed (file paths will be checked later)

This design permits commands like cp or mv to execute as long as they are not explicitly blocked, regardless of the directories they reference in their arguments.

The Security Interaction Between Layers

The architecture creates a deliberate separation between what can execute and where it can access. When a terminal command manipulates files:

1. The command-manager.ts layer validates that the base command is not in blockedCommands
2. If allowed, the command executes
3. Any filesystem operations triggered by the command flow through src/tools/filesystem.ts
4. The filesystem layer validates all file paths against allowedDirectories

This two-layer validation ensures that even permitted commands cannot access data outside the whitelisted directories. For example, cp /etc/passwd /home/user/docs/ would pass the command check (assuming cp is not blocked), but fail when the filesystem layer validates that /etc/passwd is not within allowedDirectories.

Configuration Example

The src/server.ts file documents these configuration fields in the API description. Implement complete access control by defining both arrays:

{
  "allowedDirectories": ["/home/user/documents", "/var/www"],
  "blockedCommands": ["rm", "shutdown", "reboot"]
}

This configuration restricts filesystem tools to /home/user/documents and /var/www, while preventing execution of rm, shutdown, and reboot commands entirely. Other commands like cp or cat may run, but only if they reference paths within the allowed directories.

Summary

• Filesystem operations in src/tools/filesystem.ts validate all paths against allowedDirectories before reading, writing, or manipulating files
• Terminal commands in src/command-manager.ts validate only against blockedCommands, ignoring allowedDirectories at the execution layer
• Empty allowedDirectories or inclusion of "/" grants unrestricted filesystem access to native tools
• Path arguments in terminal commands are still subject to allowedDirectories checks when the filesystem layer processes them
• Separation of concerns allows administrators to block dangerous commands while restricting file access scope independently

Frequently Asked Questions

Does DesktopCommanderMCP check allowedDirectories before running terminal commands?

No. Terminal commands are validated only against blockedCommands in src/command-manager.ts. The allowedDirectories check occurs later if the command triggers filesystem operations through the MCP tools. Pure shell commands that do not interact with the filesystem layer execute without directory validation.

What happens if allowedDirectories is empty in the configuration?

When allowedDirectories is empty or contains "/", the filesystem validation logic in src/tools/filesystem.ts passes all paths, granting unrestricted access to the entire file system for filesystem tool operations.

Can blockedCommands prevent file deletion if allowedDirectories permits the path?

Yes. Even if a target path falls within allowedDirectories, adding rm to blockedCommands prevents the remove command from executing entirely. The command is blocked at the command-manager.ts layer before any filesystem access occurs.

How does DesktopCommanderMCP handle path traversal attempts in terminal commands?

Path traversal attempts (e.g., cat ../../../etc/passwd) are resolved and normalized during the filesystem layer validation in src/tools/filesystem.ts. After computing the absolute path, the system checks whether the final location falls within the allowedDirectories whitelist, rejecting operations that escape the permitted scope.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}