Confine a terminal-running MCP server to a limited folder and account
You will run DesktopCommanderMCP under a restricted account limited to a single project folder. This reduces the damage a misused terminal tool can do.
Default setup
- Runs as your main user account
- Can reach home directory and SSH keys
- Terminal commands carry your full permissions
Confined setup
- Runs as a dedicated low-privilege account
- Access limited to one project folder
- Secrets scoped to that account only
Why it matters
DesktopCommanderMCP runs terminal commands with your user's full permissions (source (opens external site)). Malicious prompts or content in files the model reads can push it into deleting files or leaking credentials (source (opens external site)). Because the server inherits your account, anything you can reach, it can reach too. Narrowing that reach is the practical fix.
Steps
- Create a separate OS user account, or a dedicated low-privilege account, that has no access to your SSH keys, cloud credentials, password manager data, or browser profile.
- Create one project folder for the agent to work in, and grant that account read and write access only to that folder. Keep your home directory and system paths out of its permissions.
- Move any secrets the agent needs into environment variables scoped to that account, rather than leaving them in dotfiles your main account uses. Do not put production keys there.
- Install the server from the project page rather than running an unpinned command. The install command is
npx -y DesktopCommanderMCP, and the project page is the place to confirm it first (source (opens external site)). Pin a specific version once you have verified it. - Configure your MCP client to launch the server under the restricted account, so every terminal command it runs inherits those limits.
- Test the boundary: ask the agent to list a folder outside the project and confirm it fails. Then check that it cannot read a dummy secret placed in your main home directory.
- Review what the agent wrote into the project folder after each session, especially scripts and config files.
Common mistakes
- Running the server from your main account and relying on the prompt alone to keep it in one folder.
- Leaving SSH keys or cloud credentials readable by the restricted account's group.
- Giving the account admin or sudo rights, which removes most of the benefit.
- Pointing the agent at folders with untrusted files, since injected instructions can come from file contents.
Checklist
0 of 7 done