From Quake Wiki

Engine-called QC prototypes:

void(string s) SV_ParseClientCommand;

Builtin definitions:

void(entity e, string s) clientcommand = #440;
float(string s) tokenize = #441;
string(float n) argv = #442;

Provides QC the ability to completely control server interpretation of client commands ("say" and "color" for example, clientcommand is necessary for this and substring (FRIK_FILE) is useful) as well as adding new commands (tokenize, argv, and stof (FRIK_FILE) are useful for this)), whenever a clc_stringcmd is received the QC function is called, and it is up to the QC to decide what (if anything) to do with it.

The server QC implements the function SV_ParseClientCOmmand. This function will then receive all commands sent to the server using the 'cmd' command on the client side. self is the client entity which requested the command. The command itself (excluding the 'cmd' bit) is in the string s.

The tokenize and argv builtins are intended for parsing the command string but their use elsewhere is valid.

The clientcommand builtin passes a command string back to the engine - the string can be modified or unchanged. It can only be called from within SV_ParseClientCommand (or more specifically, only when it is called by the engine, but also including any functions it calls). If clientcommand is never called then SV_ParseClientCommand will effectively block or override the command it received.

IMPORTANT NOTE: All client commands will be redirected through SV_ParseClientCommand and many are required for clients to connect. Therefore all commands that the QC doesn't understand should be allowed to pass through to the engine.