Skills/npm/bambu-printer-mcp

bambu-printer-mcp@1.1.79

VERIFIED· startup only

Publisher claims: "MCP server for Bambu Lab 3D printers with STL manipulation, slicing, and print management" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher dmontgomery40 · publishing for 709 daysInstalls 26,188Last detonated 5d ago
$claude mcp add bambu-printer-mcp -- npx -y bambu-printer-mcp
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
BAMBU_PRINTER_ACCESS_TOKENBAMBU_TOKEN or --print-authorized / --command-authorizedConfiguration, not credentials: BAMBU_CLIENT_CERT, BAMBU_CLIENT_KEY, BAMBU_CONFIRMATION_TIMEOUT_MS, BAMBU_CONNECT_APP_PATH, BAMBU_CONTROL_REPLY_MS, BAMBU_DEFAULT_CONNECTION_MODE, BAMBU_DEFAULT_CONNECTION_TYPE, BAMBU_DEV_ID, BAMBU_DISPATCH_CHECK_MS, BAMBU_EMERGENCY_MQTT_TIMEOUT_MS, BAMBU_MODEL, BAMBU_NATIVE_ALLOW_UNPINNED_PLUGIN, BAMBU_NATIVE_CERT_DIR, BAMBU_NATIVE_CERT_FILE, BAMBU_NATIVE_COMMAND_JSON, BAMBU_NATIVE_CONFIG_DIR, BAMBU_NATIVE_HELPER, BAMBU_NATIVE_HOME, BAMBU_NATIVE_PLUGIN, BAMBU_NATIVE_SERIAL, BAMBU_NATIVE_TRY_EMMC_PRINT, BAMBU_NOZZLE_TYPE, BAMBU_NOZZLE_VOLUME_TYPE, BAMBU_PRINTER_HOST, BAMBU_PRINTER_MODEL, BAMBU_PRINTER_SERIAL, BAMBU_PROFILES_ROOT, BAMBU_RESUME_STATE_DIR, BAMBU_SERIAL, BAMBU_SLICER_PROFILE, BAMBU_SLICER_PROFILE_DIRS, BAMBU_STOP_ACK_MS, BAMBU_STUDIO_PATH, BAMBU_TEMPLATE_3MF_PATH, BAMBU_TEMPLATE_DIR, BED_TYPE, BLENDER_HOST, BLENDER_MCP_ARGS
Where it talks to
no vendor host named in the codeAlso bblcdn.com, apple.com, prusa3d.com, fabacademy.org, mit.edu, bambulab.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names bblcdn.com, apple.com, prusa3d.com, fabacademy.org, mit.edu, bambulab.com as well as its own vendor. The guard injects BAMBU_PRINTER_ACCESS_TOKEN, BAMBU_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y bambu-printer-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 31 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessexited 1: Node.js v22.23.4
11sprocessdependency install exit 0
31sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-akwuC6/task/home/work/acme-api/.claude/skills/bambu-printer-mcp/dist/printers/camera-tools.js' } Node.js v22.23.4
31sprocessscript backend runs setup only
31sprocesssecond launch, clock +45 days, CI unset
31sprocessexited 1: Node.js v22.23.4

Static findings

HIGH
Access to sensitive file pathsdist/bambu-native.js:269 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, ...install.env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:362 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** A login agent that gives Fusion the add-in's port however Fusion is opened (a GUI app never reads this .env). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The server's own `.env`, when it has one: a client's env block has no file to update. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:87 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/printers/bambu.js:2064 · Process kill command — agent can terminate processes// 5.x/6.x line; we rely on the outer kill timer instead so we don'tFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/index.js:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// directory, as dotenv's own .env lookup is. Slicer CLIs receive paths underFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:122 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:102 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// directory, as dotenv's own .env lookup is. Slicer CLIs receive paths underFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfunction envFile(system) { return path.resolve(system.cwd, ".env"); }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:3548 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…part/1): the printers this server drives and the settings it reads for each, by .env variable name (first canonical, then aliases): label, hint, whether required, t…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/tool-annotations.ts:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// the Fusion add-in folder, a login item and this server's .env are written. Repeating finds them current.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.d.ts:193 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** A login agent that gives Fusion the add-in's port however Fusion is opened (a GUI app never reads this .env). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** One change at a time per server: overlapping updates would interleave backups, renames and .env writes. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/printers/bambu.ts:2294 · Process kill command — agent can terminate processes// 5.x/6.x line; we rely on the outer kill timer instead so we don'tFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfunction envFile(system: SetupSystem): string { return path.resolve(system.cwd, ".env"); }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.d.ts:220 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The .env this server read at start, when there is one. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/index.ts:3692 · File type combined with upload action — agent may exfiltrate local data files…ame>.stl (export_stl of one body), <name>.f3d (export_f3d) and <name>.parameters.json (its user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh; slice it like any other model. Fusion must run on t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/index.ts:5161 · File type combined with upload action — agent may exfiltrate local data files// The report always says failed (a result.json that says success can still leave no output file).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/bambu-native.ts:371 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, ...install.env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/index.js:65 · Process kill command — agent can terminate processes// below and kill the server before it ever opens the stdio transport.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/index.js:3129 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ue, installs what is missing and adds the missing settings to this server's own .env (after a copy of it), keeping a configured FUSION_MCP_COMMAND and its arguments…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/tool-annotations.js:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Replaces BAMBU_DEFAULT_CONNECTION_MODE/TYPE in .env and in this process.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/counterpart/setup.ts:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* to this server's .env and never needs its own printer or model tables. Pure: no printer traffic, no secrets returned.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The server's own `.env`, when it has one: a client's env block has no file to update. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/counterpart/setup.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* to this server's .env and never needs its own printer or model tables. Pure: no printer traffic, no secrets returned.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/counterpart/remote.ts:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfusion_mcp_setup: { install: "raw" }, // installs into the person's Fusion, a login item and this server's .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/stl/stl-manipulator.ts:2096 · Process kill command — agent can terminate processesprocess.kill(); // Attempt to kill the slicer processFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/index.js:3181 · File type combined with upload action — agent may exfiltrate local data files…ame>.stl (export_stl of one body), <name>.f3d (export_f3d) and <name>.parameters.json (its user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh; slice it like any other model. Fusion must run on t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/index.js:3065 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/slicer/slice-cache.ts:157 · File type combined with upload action — agent may exfiltrate local data filesawait fs.promises.writeFile(path.join(staging, "meta.json"), JSON.stringify({ outputs: run.outputs.length, saved, keptAt: new Date().toISOString() }));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandsrc/index.ts:99 · Process kill command — agent can terminate processes// below and kill the server before it ever opens the stdio transport.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.d.ts:351 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreadonly description: "The .env this server read at start, when there is one.";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.d.ts:267 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Adds the bridge settings this server is missing to its own .env, after a copy of the file. A configuredFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:3640 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ue, installs what is missing and adds the missing settings to this server's own .env (after a copy of it), keeping a configured FUSION_MCP_COMMAND and its arguments…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/slicer/slice-cache.js:162 · File type combined with upload action — agent may exfiltrate local data filesawait fs.promises.writeFile(path.join(staging, "meta.json"), JSON.stringify({ outputs: run.outputs.length, saved, keptAt: new Date().toISOString() }));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The working directory dotenv read `.env` from when the server started. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/index.js:4426 · File type combined with upload action — agent may exfiltrate local data files// The report always says failed (a result.json that says success can still leave no output file).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** One change at a time per server: overlapping updates would interleave backups, renames and .env writes. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/tool-annotations.js:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// the Fusion add-in folder, a login item and this server's .env are written. Repeating finds them current.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/slicer/slice-cache.ts:124 · File type combined with upload action — agent may exfiltrate local data filesconst meta = JSON.parse(await fs.promises.readFile(path.join(entry, "meta.json"), "utf8")) as { outputs?: unknown; saved?: unknown };Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/bambu-native.js:95 · npx invocation of non-well-known package — may execute untrusted codereturn `npx -y -p bambu-printer-mcp${version ? `@${version}` : ""} bambu-printer-mcp-native-setup${homeOption}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/counterpart/remote.js:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfusion_mcp_setup: { install: "raw" }, // installs into the person's Fusion, a login item and this server's .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/bambu-native.ts:179 · npx invocation of non-well-known package — may execute untrusted codereturn `npx -y -p bambu-printer-mcp${version ? `@${version}` : ""} bambu-printer-mcp-native-setup${homeOption}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/index.ts:3576 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:358 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** A login agent that gives Fusion the add-in's port however Fusion is opened (a GUI app never reads this .env). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/tool-annotations.ts:78 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Replaces BAMBU_DEFAULT_CONNECTION_MODE/TYPE in .env and in this process.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:464 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files: "This server has no .env file to add its Fusion settings to: add FUSION_MCP_COMMAND and FUSION_MCP_ARGS to its configuration."] : []),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.d.ts:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The working directory dotenv read `.env` from when the server started. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:3037 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…part/1): the printers this server drives and the settings it reads for each, by .env variable name (first canonical, then aliases): label, hint, whether required, t…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.md:1497 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…he path.** Direct MQTT/FTPS tools require local reachability and compatible LAN/Developer Mode settings. FULU bridge cloud jobs use BambuNetwork and require its runtime, inte…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageREADME.md:48 · Authorization escalation language · informational: not an instruction fileUse direct LAN printing by default. Explain any LAN/Developer Mode settingFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectionREADME.md:963 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…01.08.05+ refuses the command (HMS 0500-0500-0001-0007, needs LAN Only Mode and Developer Mode), the call fails and says so; clear that fatal HMS entry with `clear_hms_errors…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectionREADME.md:48 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileUse direct LAN printing by default. Explain any LAN/Developer Mode settingFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File type combined with upload actionsrc/stl/stl-manipulator.ts:1863 · File type combined with upload action — agent may exfiltrate local data files// Example: curaengine slice -v -j cura_settings.json -s layer_height=0.2 -o output.gcode -l input.stlFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandsrc/stl/stl-manipulator.ts:2099 · Process kill command — agent can terminate processesconsole.error("Error attempting to kill slicer process:", killError);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Authorization escalation languageREADME.md:1497 · Authorization escalation language · informational: not an instruction file…he path.** Direct MQTT/FTPS tools require local reachability and compatible LAN/Developer Mode settings. FULU bridge cloud jobs use BambuNetwork and require its runtime, inte…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageREADME.md:963 · Authorization escalation language · informational: not an instruction file…01.08.05+ refuses the command (HMS 0500-0500-0001-0007, needs LAN Only Mode and Developer Mode), the call fails and says so; clear that fatal HMS entry with `clear_hms_errors…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandsrc/stl/stl-manipulator.ts:2100 · Process kill command — agent can terminate processesreject(new Error("Slicing operation cancelled, but failed to kill process."));Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈61 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for bambu-printer-mcp@1.1.79 as of 5d ago. This is the package itself, not its dependencies.