AI-written code interpolated user-supplied MCP command and args into a shell string with a trivially bypassable denylist, enabling OS command injection.

+      for (const [category, categoryCommands] of categories) {+        result += `### ${category}\n`;+        categoryCommands.forEach(cmd => {+          result += `• **${cmd.name}** - ${cmd.description}\n`;+          if (cmd.actions.length > 0) {+            cmd.actions.forEach(action => {+              result += `  - ${action}\n`;+            });+          }+        });+        result += '\n';+      }++      return {+        content: [+          {+            type: "text",+            text: result+          }+        ]+      };+    } catch (error) {+      throw new Error(`Failed to list commands: ${error instanceof Error ? error.message : String(error)}`);+    }+  }++  async getCommandHelp(command: string) {+    try {+      const { stdout } = await execAsync(`php "${this.yiiScript}" help ${command}`, {+        cwd: this.projectPath+      });++      return {+        content: [+          {+            type: "text",+            text: `Help for command: ${command}\n\n${stdout}`+          }+        ]+      };+    } catch (error) {+      throw new Error(`Failed to get help for ${command}: ${error instanceof Error ? error.message : String(error)}`);+    }+  }++  async executeCommand(command: string, args: string[] = [], interactive: boolean = false) {+    try {+      // Safety check - avoid dangerous commands+      const dangerousCommands = [+        'migrate/fresh',+        'migrate/down',+        'cache/flush-all'+      ];+      +      if (dangerousCommands.some(dangerous => command.includes(dangerous))) {+        return {+          content: [+            {+              type: "text",+              text: `Command '${command}' is considered dangerous and blocked for safety. Use interactive mode or run manually if needed.`+            }+          ]+        };+      }++      const fullCommand = `php "${this.yiiScript}" ${command} ${args.join(' ')}`.trim();+      +      if (interactive) {+        return {+          content: [+            {+              type: "text",+              text: `Interactive command detected: ${fullCommand}\n\nPlease run this command manually in your terminal as it requires user input.`+            }+          ]+        };+      }++      const { stdout, stderr } = await execAsync(fullCommand, {+        cwd: this.projectPath,+        timeout: 30000 // 30 second timeout+      });++      let result = `Command executed: ${fullCommand}\n\n`;+      if (stdout) {+        result += `Output:\n${stdout}\n`;