wcgw

The server's core functionality, the 'BashCommand' tool, executes arbitrary shell commands directly via `pexpect.spawn`. While the project explicitly warns users ('do not allow BashCommand tool without reviewing the command'), implements `assert_single_statement` to prevent simple multi-statement injections, and includes file protection mechanisms (e.g., requiring a read before edit, tracking read ranges and file hashes), it still represents a significant security risk. If an attacker or an uncontrolled LLM gains access, they could execute malicious commands, leading to data loss, unauthorized access, or system compromise. The provided 'modes' (e.g., 'architect' for read-only) offer some mitigation, but the 'wcgw' mode has no restrictions.