the server calls SV_ParseClientCommand. the qc handles whatever it wants (with tokenize to parse the string), and calls clientcommand for anything it wants the engine to handle instead.
its quite simple in that regard.
obviously it IS a serverside extension, so requires a server that supports it. pretty much every engine that has qc extensions has that one at least.
mg's version is buggy, and would not allow you to even connect if it were not for hacks in the engine to work around such buggy mods. unfortunately this helps hide the bugs...
just make sure that you call clientcommand for ALL commands that you don't recognise, you can only skip it for things that you actually recognise and know are safe for the engine to ignore - like say commands (ignoring those will merely mute all the players!).