diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index 1f5f126..9a47403 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -40,7 +40,8 @@
       "Bash(git commit:*)",
       "Bash(git push:*)",
       "Bash(curl:*)",
-      "WebFetch(domain:github.com)"
+      "WebFetch(domain:github.com)",
+      "mcp__zen__codereview"
     ],
     "deny": []
   }
diff --git a/src/solidlsp/language_servers/csharp_language_server/csharp_language_server.py b/src/solidlsp/language_servers/csharp_language_server/csharp_language_server.py
index 9d3a453..a5cc7a9 100644
--- a/src/solidlsp/language_servers/csharp_language_server/csharp_language_server.py
+++ b/src/solidlsp/language_servers/csharp_language_server/csharp_language_server.py
@@ -1,5 +1,5 @@
 """
-CSharp Language Server using csharp-ls (Roslyn-based LSP server)
+CSharp Language Server using Microsoft.CodeAnalysis.LanguageServer (Official Roslyn-based LSP server)
 """
 
 import logging
@@ -99,13 +99,12 @@ class CSharpLanguageServer(SolidLanguageServer):
         else:
             logger.log("No .sln or .csproj file found, language server will attempt auto-discovery", logging.WARNING)
         
-        cmd = " ".join(cmd_parts)
-        
+        # Pass command parts as array to avoid shell injection vulnerabilities
         super().__init__(
             config,
             logger,
             repository_root_path,
-            ProcessLaunchInfo(cmd=cmd, cwd=repository_root_path),
+            ProcessLaunchInfo(cmd=cmd_parts, cwd=repository_root_path),
             "csharp",
         )