Claude Desktop

Why scan Claude Desktop?

Claude Desktop runs MCP servers with filesystem authority outside any project boundary, so a server added for one task keeps that reach for every later conversation.

Usage

CallLint can auto-discover and scan Claude Desktop configurations:

calllint scan --agent claude-desktop

How to start

Install nothing globally — run CallLint straight from npm:

npx calllint scan --auto

Then scan Claude Desktop specifically:

calllint scan --agent claude-desktop

How to verify it worked

Check the filesystem scope on each server that came back REVIEW. A desktop config has no project root to contain it, so a path argument is the whole grant.

What CallLint does to Claude Desktop

Offline by default. Deterministic. Never executes the server it judges. SAFE means no blockers observed, not a proof of runtime safety.

A No blockers observed verdict means exactly that — no blocker under the evidence CallLint could collect. It is not a guarantee, and Insufficient evidence never becomes it on its own. See Coverage Boundary for what this scan does not look at.

Configuration Paths

CallLint looks for Claude Desktop configurations in:

• ~/Library/Application Support/Claude/claude_desktop_config.json
• %APPDATA%/Claude/claude_desktop_config.json

Authority Surfaces

Claude Desktop can grant tools the following authority surfaces:

• mcp
• filesystem

Distribution

CallLint is available for Claude Desktop through:

• mcp-stdio (via officialMcpRegistry) — Available now

Support Status

Auto-detects — CallLint finds this host’s config on its own.

The commands under Usage are the ones CallLint actually supports for Claude Desktop today. Anything not listed there is not claimed.

Official Sources

• https://claude.ai/
• https://modelcontextprotocol.io/quickstart