Stopping MCP Supply-Chain RCE Before It Reaches the Shell

A hostile string in MCP's `command` field is a working RCE on the next sensor restart. 10+ public CVEs already follow this shape. Here is how Imunify for AI agents stops it at three layers — before it reaches the shell.