A white listed series of specifically implemented events (like greek2me's post) is the way to do this.
If you allow complete access to any servercmd, then malicious saves could be created that ban players, change the admin password, restart the server, who knows what. There's also unforeseen interactions with future add-ons that implement new servercmds. Stick to implementing specific events, not exposing script access.