Why I Stopped Letting Claude Shell Out for Security Scans

Claude's default shell tool will happily run cyscan for you. Here's why that's the wrong abstraction, and what an MCP server fixes that bash can't.