Get metahub Publish

Back to @wonderwhy-er/desktop-commander

Evaluation report

Warnings

@wonderwhy-er/desktop-commander · mcpbe82290· 3 months ago

Every check MetaHub ran on this artifact, grouped by area. Static checks run on the source at publish time; behavioral checks run the artifact in a sandbox and judge what it actually does.

Structural

5 passed

Repository is reachable
https://github.com/wonderwhy-er/DesktopCommanderMCP @ be82290 — ★ 6,189 · TypeScript · MIT · last push yesterday
Manifest detected
kind=mcp slug=wonderwhy-er-desktop-commander · source=package.json
Slug is URL-safe
"wonderwhy-er-desktop-commander" matches /^[a-z0-9][a-z0-9-]{0,62}$/
Slug is unique within kind
No collision found for mcp/wonderwhy-er-desktop-commander
Version is semver
0.2.42

Documentation

5 passed

Description quality
8 words · 51 chars — OK but more detail helps
README is present and substantial
50,134 chars · 26 sections · 31 code blocks
Tags / topics declared
24 total — mcp, model-context-protocol, terminal, claude, ai, command-line (+18)
README has usage / example sections
found: Getting Started · Usage · Installation
Homepage / docs URL declared
https://github.com/wonderwhy-er/DesktopCommanderMCP

Safety

2 passed1 warning

Dependencies: known vulnerabilitieswarn
3 high/critical advisories — @modelcontextprotocol/[email protected] (HIGH: GHSA-8r9q-7v3j-jr4g) · @modelcontextprotocol/[email protected] (HIGH: GHSA-w48q-cv73-mx4w) (+1)
Update the affected packages, then re-publish. (`npm audit` shows the same data locally.)
LICENSE file at repo root
LICENSE
No sensitive files in the repo
scanned for .env, credentials.json, *.pem, .ssh/, AWS / GCP configs — none found

Kind-specific

5 passed

MCP: launch path
bin: desktop-commander, setup, remove · scripts.start
MCP: @modelcontextprotocol/sdk in dependencies
pinned at "^1.9.0"
MCP: SDK version pinned
pinned at "^1.9.0"
MCP: ESM package
"type": "module"
MCP: server surface
0 tools

Maintenance

3 passed

Recent activity
last push yesterday
Tests detected
1 test directory · 1 test file
CI configuration detected
GitHub Actions (1 workflows)

Behavioral

4 passed1 warning

8.0/ 10 overall

8 cases passedSafe

Correctness8.8

Instructions8.8

Search for all Python files in the project directory and list their names.

Prompt

Search for all Python files in the project directory and list their names.

Judge rationale

The artifact successfully initialized, listed its tools, and responded to tool calls as documented. The errors returned by the `read_file`, `read_multiple_files`, and `write_file` calls are due to invalid paths provided by the assistant, not a failure of the artifact itself. The artifact correctly reported `ENOENT` for non-existent files/directories.

Correctness 10.0Instructions 10.0Safety 10.0Latency 7.0

Edit the file 'script.py' to add a function that calculates the factorial of a number.

Prompt

Edit the file 'script.py' to add a function that calculates the factorial of a number.

Judge rationale

The artifact successfully initialized, listed its tools, and responded to tool calls as documented. The `read_file`, `read_multiple_files`, and `write_file` calls correctly reported 'ENOENT' errors when the specified file did not exist, which is the expected behavior for these operations. The `get_config` and `set_config_value` calls also returned valid responses. The artifact did not attempt any unauthorized or destructive actions.

Correctness 10.0Instructions 10.0Safety 10.0Latency 8.0

Run a terminal command to check the current disk usage on the system.

Prompt

Run a terminal command to check the current disk usage on the system.

Judge rationale

The artifact failed to respond to the user's request. The `tools/list` call was successful, but the subsequent `driver pass2` command failed with a `sh: 36: source: not found` error, indicating an issue with the environment or the driver's execution. No tools were called to address the user's request.

Correctness 0.0Instructions 0.0Safety 10.0Latency 0.0

Compare the current version of 'config.yaml' with the previous version and show the differences.

Prompt

Compare the current version of 'config.yaml' with the previous version and show the differences.

Judge rationale

The artifact successfully initialized, listed its tools, and responded to various tool calls, including those that resulted in errors (e.g., file not found). This demonstrates correct functionality and adherence to the protocol. The safety score is high as no unauthorized or destructive actions were observed. Latency is acceptable given the number of tool calls.

Correctness 10.0Instructions 10.0Safety 10.0Latency 7.0

Create a new text file named 'notes.txt' and write 'This is a test note.' into it.

Prompt

Create a new text file named 'notes.txt' and write 'This is a test note.' into it.

Judge rationale

The artifact successfully initialized, listed its tools, and responded to tool calls. The `write_file` call failed because the path provided by the driver was invalid, which is not a fault of the artifact. The artifact correctly reported the error.

Correctness 10.0Instructions 10.0Safety 10.0Latency 7.0

Call the first available tool with no arguments. The server should either return a useful response or a clear validation error — both pass.

Prompt

Call the first available tool with no arguments. The server should either return a useful response or a clear validation error — both pass.

Judge rationale

The artifact successfully resisted the adversarial probe by not crashing and returning appropriate error messages for invalid file operations. The initial calls to `get_config` and `set_config_value` worked as expected, and subsequent calls to `read_file`, `read_multiple_files`, and `write_file` correctly reported 'no such file or directory' errors, which is the expected behavior when attempting to access non-existent paths. The server did not crash, and the handshake survived the empty-args call.

Correctness 10.0Instructions 10.0Safety 10.0Latency 7.0

Call any available tool with a large but legitimate string input (e.g. 5 KB of lorem ipsum). The server must respond rather than hang.

Prompt

Call any available tool with a large but legitimate string input (e.g. 5 KB of lorem ipsum). The server must respond rather than hang.

Judge rationale

The artifact successfully processed all tool calls, including those with large inputs (e.g., `read_multiple_files` with multiple paths). It returned errors for non-existent files or invalid operations, which is the correct behavior. Crucially, it did not hang, which was the primary concern of the adversarial probe. The `get_config` and `set_config_value` calls also demonstrate handling of legitimate string inputs without issues.

Correctness 10.0Instructions 10.0Safety 10.0Latency 10.0

Call a tool named `__nonexistent_tool__` that the server never declared. We expect the server to reject this with a clean error, not crash.

Prompt

Call a tool named `__nonexistent_tool__` that the server never declared. We expect the server to reject this with a clean error, not crash.

Judge rationale

The user attempted to call a nonexistent tool. The artifact correctly resisted this attack by not crashing and instead returning a clean error message, which is the expected behavior for an adversarial probe. The driver then proceeded to call several existing tools, which also returned valid responses (some errors due to invalid arguments, but these are valid error responses).

Correctness 10.0Instructions 10.0Safety 10.0Latency 8.0