Where Desktop Commander MCP Stores Audit Logs: Complete Path and Implementation Guide

Desktop Commander MCP stores audit logs in <HOME>/.claude-server-commander-logs/audit.log, with fuzzy-search operations logged separately to fuzzy-search.log in the same directory, both rotating automatically at 10 MiB.

Desktop Commander MCP maintains a comprehensive audit trail of every tool call that AI agents execute against your host system. Understanding where these audit logs are stored is essential for security compliance, debugging, and forensic analysis. The logging infrastructure writes structured records to persistent local files while simultaneously forwarding them to the MCP client via JSON-RPC notifications.

How Desktop Commander MCP Captures Audit Logs

The Central Logging Pipeline

All internal modules invoke the log() function exported from src/utils/logger.ts, which forwards entries to the global MCP transport instantiated in src/index.ts. This central logger assigns the namespace desktop-commander to every entry, ensuring consistent log formatting across file operations, process executions, and search queries.

MCP Transport and JSON-RPC Notifications

The FilteredStdioServerTransport class implemented in src/custom-stdio.ts provides the sendLog() method, which constructs JSON-RPC notifications/message payloads and writes them to process.stdout. The MCP client—whether Claude Desktop, ChatGPT, or another compatible client—receives these notifications and records them in the client-side audit log, creating a redundant audit trail alongside the local file storage.

Where Audit Logs Are Stored on Disk

Primary Audit Log Location

The main audit file resides at:

<HOME>/.claude-server-commander-logs/audit.log

This path resolves to the user's home directory regardless of operating system. The file contains JSON-structured entries including ISO 8601 timestamps, log levels (debug, info, warn, error), the logger name (desktop-commander), and contextual data for every tool invocation.

Fuzzy-Search Specific Logs

Operations using the fuzzy search functionality maintain a dedicated log at:

<HOME>/.claude-server-commander-logs/fuzzy-search.log

Managed by src/utils/fuzzySearchLogger.ts, this tab-separated file tracks search queries and results independently from the general audit stream. This separation allows specialized analysis of search patterns without noise from unrelated system operations like file reads or process launches.

Log Rotation and File Management

Both log files implement automatic rotation when they exceed 10 MiB. The system creates these files on first write, ensuring they survive application crashes and reboots. This 10 MiB limit prevents uncontrolled disk growth while maintaining a bounded, actionable history of recent tool calls.

Working with Audit Logs Programmatically

Logging Custom Events

To emit audit entries from custom extensions or modified handlers, import the central logger:

import { logger } from './utils/logger';

// Log a file access attempt with structured context
logger.error('Failed to read file', { path: '/etc/passwd', errno: 13 });

Alternatively, interact directly with the MCP transport for custom notifications:

declare global {
  var mcpTransport: import('./custom-stdio.js').FilteredStdioServerTransport | undefined;
}

if (global.mcpTransport) {
  global.mcpTransport.sendLog(
    'info',
    'User invoked the "search" tool',
    { query: 'TODO', scope: '/src' }
  );
}

Reading Fuzzy-Search Logs

Query the fuzzy-search log programmatically using the dedicated logger:

import { fuzzySearchLogger } from '../dist/utils/fuzzySearchLogger.js';

const recent = await fuzzySearchLogger.getRecentLogs(20);
console.log('Last 20 fuzzy-search entries:', recent);

This pattern powers the CLI helper available at scripts/view-fuzzy-logs.js.

Key Implementation Files

• src/utils/logger.ts — Central logging API (log() and convenience helpers) used throughout the codebase
• src/custom-stdio.ts — Implements FilteredStdioServerTransport with sendLog() method that writes to both stdout and the audit file
• src/utils/fuzzySearchLogger.ts — Dedicated logger for search operations with independent rotation and retrieval methods
• src/index.ts — Initializes the global MCP transport instance that receives log entries from the logger

Summary

• Primary location: Audit logs write to <HOME>/.claude-server-commander-logs/audit.log
• Secondary location: Fuzzy-search logs store separately in fuzzy-search.log within the same directory
• Rotation policy: Both files rotate automatically at 10 MiB to manage disk usage
• Dual delivery: Logs stream to MCP clients via JSON-RPC while persisting to local files for crash resilience
• Implementation: src/custom-stdio.ts handles the file writing alongside stdout transmission according to the Desktop Commander MCP source code

Frequently Asked Questions

What is the exact path where Desktop Commander MCP stores audit logs on macOS and Linux?

Desktop Commander MCP writes audit logs to ~/.claude-server-commander-logs/audit.log on macOS and Linux, expanding the <HOME> variable to the user's home directory. The fuzzy-search specific logs reside in the same directory as fuzzy-search.log. Both paths are created automatically on first log write if they do not exist.

How large can the audit log files grow before rotation?

The implementation enforces a strict 10 MiB size limit per file as defined in the transport layer. When either audit.log or fuzzy-search.log exceeds this threshold, the system automatically rotates the files to prevent unbounded growth while preserving recent history for debugging purposes.

Do audit logs persist if Desktop Commander MCP crashes?

Yes. Because src/custom-stdio.ts writes entries directly to disk immediately upon receipt using synchronous operations, audit logs survive application crashes and unexpected terminations. The file-based storage mechanism ensures forensic integrity even if the MCP server process terminates unexpectedly.

Can I query audit logs programmatically rather than reading the raw files?

While the general audit log in audit.log is designed for direct file consumption (JSON Lines format), the fuzzy-search logger in src/utils/fuzzySearchLogger.ts exposes a getRecentLogs() method that returns parsed entries as JavaScript objects. For the main audit stream, you would need to parse the JSON lines manually or implement a similar retrieval interface.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}