desktop_launch

What desktop_launch does on Claude Mobile

AI agents invoke desktop_launch to trigger actions in Claude Mobile. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why desktop_launch is rated High

This tool falls into Execute rather than Write because it triggers application launches and initiates automation frameworks whose effects depend on which app is launched and what subsequent automation steps occur. While it doesn't permanently destroy data (not Destructive) or create persistent records (not Write), it actively executes device operations and can trigger arbitrary application behavior.

From the tool's definition Tool enables "Start desktop automation and optionally launch an app" on mobile devices. The description indicates it initiates automated control of device interfaces and can launch applications, which are runtime operations that execute code and trigger…

The rule that runs desktop_launch safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Claude Mobile, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For desktop_launch, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "desktop_launch": {
      "limits": [
        {
          "counter": "desktop_launch_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about desktop_launch