SECURITY: disallow execution of cli scripts from webserver context
add a basic stats CLI util