Run a plugin install command on the server machine (self-hosted deployments).

Body: {"command": "uvx mcp-server-fetch"}

Validates that the command starts with uvx or npx to prevent arbitrary execution. Returns {"ok": bool, "output": str}.

ece2ac0a — refused outright in hosted mode. It used to "still run" there, unauthenticated: npx -y <pkg> --help / uvx <pkg> --help download AND execute the named package's code, so anyone could run arbitrary code on the hosted server. A hosted user's plugins run on their own machine via the tunnel, so there is nothing legitimate to install server-side; the dashboard already shows a copy-to-clipboard fallback for hosted users.