Claude Desktop MCP and Extensions

Overview

Claude Desktop extends what the assistant can do by launching MCP servers (Model Context Protocol). A server is a program, usually a local process, that exposes tools to the model: reading files, querying databases, calling web APIs, running commands. Servers come from two places: entries the user wrote in a JSON config file, and Desktop Extensions, installable bundles that package an MCP server with a manifest.

For an investigator this configuration answers two questions. What could the assistant reach and do? And is anything here a way to run code on the host or to move data off it? Because the app launches these programs itself, an MCP entry or an extension is a persistence and execution vector in the same way a launch agent is, with the difference that it runs whenever the app starts.

File Locations

MCP Servers in claude_desktop_config.json

The mcpServers object maps a server name to how it is launched.

{
  "mcpServers": {
    "example-files": {
      "command": "/usr/local/bin/node",
      "args": ["/Users/jdoe/tools/example-server/index.js"],
      "env": {
        "EXAMPLE_API_KEY": "REDACTED-EXAMPLE"
      }
    }
  }
}

Things to check for each entry:

• Where the executable lives. Paths in a user-writable location, a temporary directory, or an unusual interpreter (bash -c, python -c, curl | sh) deserve scrutiny.
• Whether the file still exists. A configured command whose file was removed is a sign something was cleaned up.
• Secrets in env. These are credentials for third-party services. Their presence tells you which services the user connected, and equal values across hosts or files can be correlated.
• Modification time. The config file's modified time bounds when the list last changed. It does not say when each entry was added.

Desktop Preferences in the Same File

The same file carries application preferences. Of forensic interest:

Key names are version-dependent. Search for variants rather than assuming one spelling.

Desktop Extensions

Desktop Extensions are installable packages (.dxt, later .mcpb) that bundle an MCP server and a manifest.json. They appeared in mid-2025 builds. The app unpacks each into Claude Extensions/<id>/.

What the Files Show

Compare the registry against the directories. An extension in the registry without a directory, a directory with no registry entry, and a leftover settings file for an uninstalled extension each tell a different story about install and removal. Hash the manifest and compare it to the registry hash to detect modification after install.

Blocklist

extensions-blocklist.json lists extensions the vendor has flagged. If an installed extension matches an entry by ID or by name and version, the extension was considered unsafe at the time the list was fetched. The list's own modified time shows when it was last updated.

Tool Toggles

mcp-user-tool-toggles.json records tools or whole servers the user disabled. The file has been seen in more than one shape: a server mapped to a list of disabled tool names, a server mapped to a tool-to-enabled map, and a server mapped to a single enabled flag. Handle all three.

A disabled tool shows a user decision to limit the assistant. The absence of a toggle means a server's tools were left at defaults.

Where MCP Activity Appears Elsewhere

• Logs. mcp.log and mcp-server-<name>.log record server startup, connection, JSON-RPC messages, and stderr (see Logs).
• Audit log. The init event lists the MCP servers and their status at session start. Tool calls to MCP servers appear as tool_use with the server's tool name.
• Session metadata. enabled_mcp_tools and remote_mcp_servers in a Cowork session show what that session could call.
• HTTP cache. A cached api.anthropic.com/api/directory/servers response shows the connector directory the app fetched.

Investigation Scenarios

Persistence Review

List every mcpServers command and every extension. For each, resolve the executable, hash it, and check its signature and location the same way you would for a launch agent (see Launchd). Look at the matching mcp-server-*.log for evidence the server actually ran and when.

Data Movement

Servers with network or file access are the route by which data can leave via the assistant. Pair the configured servers with egress_allowed_domains from session metadata and the tool calls in the audit log.

Credentials Exposure

env blocks and extension settings often hold live credentials. Note which services are implicated so they can be rotated. Reports should show them redacted.

What macfor Collects

The ai.claudedesktop plugin emits claude_mcp_server, claude_desktop_preferences, claude_extension, claude_extension_blocklist_entry, claude_mcp_tool_toggle, and claude_developer_settings records, plus claude_app_config for config.json. For each MCP server it adds executable_resolved_path, executable_exists, and executable_sha256 where the command is a local file. Environment values and extension setting values are redacted in the records (shown as [REDACTED:sha256:<8>], so equal secrets still correlate).

Files that exist mainly to hold secrets (claude_desktop_config.json, config.json, extension settings) are copied into the evidence only with include_secrets.

{
  "type": "claude_mcp_server",
  "config_file": "desktop",
  "name": "example-files",
  "command": "/usr/local/bin/node",
  "args": ["/Users/jdoe/tools/example-server/index.js"],
  "env_keys": ["EXAMPLE_API_KEY"],
  "env": {"EXAMPLE_API_KEY": "[REDACTED:sha256:1a2b3c4d]"},
  "transport": "stdio",
  "executable_exists": true
}

All values above are illustrative.

References

• Model Context Protocol
• Desktop Extensions (MCPB) specification
• Launchd