# Where Desktop Commander MCP Stores Audit Logs: Complete Path and Implementation Guide

> Find Desktop Commander MCP audit log location at HOME/.claude-server-commander-logs/audit.log. Learn log rotation and implementation in this guide.

- Repository: [Eduard Ruzga/DesktopCommanderMCP](https://github.com/wonderwhy-er/DesktopCommanderMCP)
- Tags: how-to-guide
- Published: 2026-08-02

---

**Desktop Commander MCP stores audit logs in `<HOME>/.claude-server-commander-logs/audit.log`, with fuzzy-search operations logged separately to `fuzzy-search.log` in the same directory, both rotating automatically at 10 MiB.**

Desktop Commander MCP maintains a comprehensive audit trail of every tool call that AI agents execute against your host system. Understanding where these **audit logs are stored** is essential for security compliance, debugging, and forensic analysis. The logging infrastructure writes structured records to persistent local files while simultaneously forwarding them to the MCP client via JSON-RPC notifications.

## How Desktop Commander MCP Captures Audit Logs

### The Central Logging Pipeline

All internal modules invoke the `log()` function exported from [`src/utils/logger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/logger.ts), which forwards entries to the global MCP transport instantiated in [`src/index.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/index.ts). This central logger assigns the namespace `desktop-commander` to every entry, ensuring consistent log formatting across file operations, process executions, and search queries.

### MCP Transport and JSON-RPC Notifications

The `FilteredStdioServerTransport` class implemented in [`src/custom-stdio.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/custom-stdio.ts) provides the `sendLog()` method, which constructs JSON-RPC *notifications/message* payloads and writes them to `process.stdout`. The MCP client—whether Claude Desktop, ChatGPT, or another compatible client—receives these notifications and records them in the client-side audit log, creating a redundant audit trail alongside the local file storage.

## Where Audit Logs Are Stored on Disk

### Primary Audit Log Location

The main audit file resides at:

```

<HOME>/.claude-server-commander-logs/audit.log

```

This path resolves to the user's home directory regardless of operating system. The file contains JSON-structured entries including ISO 8601 timestamps, log levels (debug, info, warn, error), the logger name (`desktop-commander`), and contextual data for every tool invocation.

### Fuzzy-Search Specific Logs

Operations using the fuzzy search functionality maintain a dedicated log at:

```

<HOME>/.claude-server-commander-logs/fuzzy-search.log

```

Managed by [`src/utils/fuzzySearchLogger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/fuzzySearchLogger.ts), this tab-separated file tracks search queries and results independently from the general audit stream. This separation allows specialized analysis of search patterns without noise from unrelated system operations like file reads or process launches.

### Log Rotation and File Management

Both log files implement automatic rotation when they exceed **10 MiB**. The system creates these files on first write, ensuring they survive application crashes and reboots. This 10 MiB limit prevents uncontrolled disk growth while maintaining a bounded, actionable history of recent tool calls.

## Working with Audit Logs Programmatically

### Logging Custom Events

To emit audit entries from custom extensions or modified handlers, import the central logger:

```typescript
import { logger } from './utils/logger';

// Log a file access attempt with structured context
logger.error('Failed to read file', { path: '/etc/passwd', errno: 13 });

```

Alternatively, interact directly with the MCP transport for custom notifications:

```typescript
declare global {
  var mcpTransport: import('./custom-stdio.js').FilteredStdioServerTransport | undefined;
}

if (global.mcpTransport) {
  global.mcpTransport.sendLog(
    'info',
    'User invoked the "search" tool',
    { query: 'TODO', scope: '/src' }
  );
}

```

### Reading Fuzzy-Search Logs

Query the fuzzy-search log programmatically using the dedicated logger:

```typescript
import { fuzzySearchLogger } from '../dist/utils/fuzzySearchLogger.js';

const recent = await fuzzySearchLogger.getRecentLogs(20);
console.log('Last 20 fuzzy-search entries:', recent);

```

This pattern powers the CLI helper available at [`scripts/view-fuzzy-logs.js`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/scripts/view-fuzzy-logs.js).

## Key Implementation Files

- **[`src/utils/logger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/logger.ts)** — Central logging API (`log()` and convenience helpers) used throughout the codebase
- **[`src/custom-stdio.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/custom-stdio.ts)** — Implements `FilteredStdioServerTransport` with `sendLog()` method that writes to both stdout and the audit file
- **[`src/utils/fuzzySearchLogger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/fuzzySearchLogger.ts)** — Dedicated logger for search operations with independent rotation and retrieval methods
- **[`src/index.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/index.ts)** — Initializes the global MCP transport instance that receives log entries from the logger

## Summary

- **Primary location**: Audit logs write to `<HOME>/.claude-server-commander-logs/audit.log`
- **Secondary location**: Fuzzy-search logs store separately in `fuzzy-search.log` within the same directory
- **Rotation policy**: Both files rotate automatically at 10 MiB to manage disk usage
- **Dual delivery**: Logs stream to MCP clients via JSON-RPC while persisting to local files for crash resilience
- **Implementation**: [`src/custom-stdio.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/custom-stdio.ts) handles the file writing alongside stdout transmission according to the Desktop Commander MCP source code

## Frequently Asked Questions

### What is the exact path where Desktop Commander MCP stores audit logs on macOS and Linux?

Desktop Commander MCP writes audit logs to `~/.claude-server-commander-logs/audit.log` on macOS and Linux, expanding the `<HOME>` variable to the user's home directory. The fuzzy-search specific logs reside in the same directory as `fuzzy-search.log`. Both paths are created automatically on first log write if they do not exist.

### How large can the audit log files grow before rotation?

The implementation enforces a strict 10 MiB size limit per file as defined in the transport layer. When either `audit.log` or `fuzzy-search.log` exceeds this threshold, the system automatically rotates the files to prevent unbounded growth while preserving recent history for debugging purposes.

### Do audit logs persist if Desktop Commander MCP crashes?

Yes. Because [`src/custom-stdio.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/custom-stdio.ts) writes entries directly to disk immediately upon receipt using synchronous operations, audit logs survive application crashes and unexpected terminations. The file-based storage mechanism ensures forensic integrity even if the MCP server process terminates unexpectedly.

### Can I query audit logs programmatically rather than reading the raw files?

While the general audit log in `audit.log` is designed for direct file consumption (JSON Lines format), the fuzzy-search logger in [`src/utils/fuzzySearchLogger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/fuzzySearchLogger.ts) exposes a `getRecentLogs()` method that returns parsed entries as JavaScript objects. For the main audit stream, you would need to parse the JSON lines manually or implement a similar retrieval interface.