Skills/npm/bambu-printer-mcp

bambu-printer-mcp@1.1.85

VERIFIED· startup only

Publisher claims: "MCP server for Bambu Lab 3D printers with STL manipulation, slicing, and print management" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher dmontgomery40 · publishing for 709 daysInstalls 26,188Last detonated 3d ago
$claude mcp add bambu-printer-mcp -- npx -y bambu-printer-mcp
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
BAMBU_PRINTER_ACCESS_TOKENBAMBU_TOKEN or --print-authorized / --command-authorizedConfiguration, not credentials: BAMBU_CLIENT_CERT, BAMBU_CLIENT_KEY, BAMBU_CONFIRMATION_TIMEOUT_MS, BAMBU_CONNECT_APP_PATH, BAMBU_CONTROL_REPLY_MS, BAMBU_DEFAULT_CONNECTION_MODE, BAMBU_DEFAULT_CONNECTION_TYPE, BAMBU_DEV_ID, BAMBU_DISPATCH_CHECK_MS, BAMBU_EMERGENCY_MQTT_TIMEOUT_MS, BAMBU_MODEL, BAMBU_NATIVE_ALLOW_UNPINNED_PLUGIN, BAMBU_NATIVE_CERT_DIR, BAMBU_NATIVE_CERT_FILE, BAMBU_NATIVE_COMMAND_JSON, BAMBU_NATIVE_CONFIG_DIR, BAMBU_NATIVE_HELPER, BAMBU_NATIVE_HOME, BAMBU_NATIVE_PLUGIN, BAMBU_NATIVE_SERIAL, BAMBU_NATIVE_TRY_EMMC_PRINT, BAMBU_NOZZLE_TYPE, BAMBU_NOZZLE_VOLUME_TYPE, BAMBU_PRINTER_HOST, BAMBU_PRINTER_MODEL, BAMBU_PRINTER_SERIAL, BAMBU_RESUME_STATE_DIR, BAMBU_SERIAL, BAMBU_SLICER_PROFILE, BAMBU_STOP_ACK_MS, BAMBU_STUDIO_PATH, BAMBU_TEMPLATE_3MF_PATH, BAMBU_TEMPLATE_DIR, BED_TYPE, BLENDER_HOST, BLENDER_MCP_ARGS, BLENDER_MCP_BRIDGE_COMMAND, BLENDER_MCP_COMMAND
Where it talks to
no vendor host named in the codeAlso bblcdn.com, apple.com, prusa3d.com, fabacademy.org, mit.edu, bambulab.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names bblcdn.com, apple.com, prusa3d.com, fabacademy.org, mit.edu, bambulab.com as well as its own vendor. The guard injects BAMBU_PRINTER_ACCESS_TOKEN, BAMBU_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y bambu-printer-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 30 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessexited 1: Node.js v22.23.4
9.3sprocessdependency install exit 0
29sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-fqM808/task/home/work/acme-api/.claude/skills/bambu-printer-mcp/dist/printers/camera-tools.js' } Node.js v22.23.4
29sprocessscript backend runs setup only
29sprocesssecond launch, clock +45 days, CI unset
29sprocessexited 1: Node.js v22.23.4

Static findings

HIGH
Access to sensitive file pathssrc/tool-annotations.ts:124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// the Fusion add-in folder, a login item and this server's .env are written. Repeating finds them current.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:3139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ue, installs what is missing and adds the missing settings to this server's own .env (after a copy of it), keeping a configured FUSION_MCP_COMMAND and its arguments…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/bambu-native.js:269 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, ...install.env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:358 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** A login agent that gives Fusion the add-in's port however Fusion is opened (a GUI app never reads this .env). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/bambu-native.js:95 · npx invocation of non-well-known package — may execute untrusted codereturn `npx -y -p bambu-printer-mcp${version ? `@${version}` : ""} bambu-printer-mcp-native-setup${homeOption}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/design-app-setup.js:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The server's own `.env`, when it has one: a client's env block has no file to update. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The working directory dotenv read `.env` from when the server started. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:362 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** A login agent that gives Fusion the add-in's port however Fusion is opened (a GUI app never reads this .env). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:464 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files: "This server has no .env file to add its Fusion settings to: add FUSION_MCP_COMMAND and FUSION_MCP_ARGS to its configuration."] : []),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/bambu-native.ts:371 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, ...install.env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfunction envFile(system: SetupSystem): string { return path.resolve(system.cwd, ".env"); }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:3556 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…part/1): the printers this server drives and the settings it reads for each, by .env variable name (first canonical, then aliases): label, hint, whether required, t…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:3075 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/cad/contracts.js:285 · File type combined with upload action — agent may exfiltrate local data files…t selection and edits: set final: true only on the result you select. cad-result.json in each immediate run folder is protected from script writes and retains final, completed_at, lineage_id (source hash), full checks and artifact paths; c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/counterpart/setup.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* to this server's .env and never needs its own printer or model tables. Pure: no printer traffic, no secrets returned.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// directory, as dotenv's own .env lookup is. Slicer CLIs receive paths underFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/tool-annotations.ts:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Replaces BAMBU_DEFAULT_CONNECTION_MODE/TYPE in .env and in this process.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/counterpart/setup.ts:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* to this server's .env and never needs its own printer or model tables. Pure: no printer traffic, no secrets returned.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/tool-annotations.js:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Replaces BAMBU_DEFAULT_CONNECTION_MODE/TYPE in .env and in this process.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:3648 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ue, installs what is missing and adds the missing settings to this server's own .env (after a copy of it), keeping a configured FUSION_MCP_COMMAND and its arguments…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfunction envFile(system) { return path.resolve(system.cwd, ".env"); }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** One change at a time per server: overlapping updates would interleave backups, renames and .env writes. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/tool-annotations.js:96 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// the Fusion add-in folder, a login item and this server's .env are written. Repeating finds them current.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// directory, as dotenv's own .env lookup is. Slicer CLIs receive paths underFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The server's own `.env`, when it has one: a client's env block has no file to update. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** One change at a time per server: overlapping updates would interleave backups, renames and .env writes. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:3047 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…part/1): the printers this server drives and the settings it reads for each, by .env variable name (first canonical, then aliases): label, hint, whether required, t…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/cad/contracts.js:282 · File type combined with upload action — agent may exfiltrate local data files…th script, output_dir and a plain name. It saves <name>.py and <name>.parameters.json before running, then exports <name>.stl and <name>.step in a fresh subfolder. For an edit, one cad_run with script_path pointing to the earlier .py, para…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/index.ts:3584 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/index.ts:103 · Process kill command — agent can terminate processes// below and kill the server before it ever opens the stdio transport.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/cad/process.ts:20 · Process kill command — agent can terminate processes/** No shell, no inherited printer/provider environment, bounded output, and kill the entire dispatched group. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/index.ts:3700 · File type combined with upload action — agent may exfiltrate local data files…ame>.stl (export_stl of one body), <name>.f3d (export_f3d) and <name>.parameters.json (its user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh; slice it like any other model. Fusion must run on t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Authorization escalation languageREADME.md:1538 · Authorization escalation language · informational: not an instruction file…he path.** Direct MQTT/FTPS tools require local reachability and compatible LAN/Developer Mode settings. FULU bridge cloud jobs use BambuNetwork and require its runtime, inte…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectionREADME.md:963 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…01.08.05+ refuses the command (HMS 0500-0500-0001-0007, needs LAN Only Mode and Developer Mode), the call fails and says so; clear that fatal HMS entry with `clear_hms_errors…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill commandsrc/printers/bambu.ts:2297 · Process kill command — agent can terminate processes// 5.x/6.x line; we rely on the outer kill timer instead so we don'tFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/index.js:69 · Process kill command — agent can terminate processes// below and kill the server before it ever opens the stdio transport.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/cad/contracts.ts:314 · File type combined with upload action — agent may exfiltrate local data files…t selection and edits: set final: true only on the result you select. cad-result.json in each immediate run folder is protected from script writes and retains final, completed_at, lineage_id (source hash), full checks and artifact paths; c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/index.ts:5198 · File type combined with upload action — agent may exfiltrate local data files// The report always says failed (a result.json that says success can still leave no output file).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/cad/process.js:15 · Process kill command — agent can terminate processesconst kill = () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injectionREADME.md:1538 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…he path.** Direct MQTT/FTPS tools require local reachability and compatible LAN/Developer Mode settings. FULU bridge cloud jobs use BambuNetwork and require its runtime, inte…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill commandsrc/cad/process.ts:37 · Process kill command — agent can terminate processesconst kill = () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/cad/process.d.ts:14 · Process kill command — agent can terminate processes/** No shell, no inherited printer/provider environment, bounded output, and kill the entire dispatched group. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/bambu-native.ts:179 · npx invocation of non-well-known package — may execute untrusted codereturn `npx -y -p bambu-printer-mcp${version ? `@${version}` : ""} bambu-printer-mcp-native-setup${homeOption}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/cad/process.js:4 · Process kill command — agent can terminate processes/** No shell, no inherited printer/provider environment, bounded output, and kill the entire dispatched group. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/cad/contracts.ts:311 · File type combined with upload action — agent may exfiltrate local data files…th script, output_dir and a plain name. It saves <name>.py and <name>.parameters.json before running, then exports <name>.stl and <name>.step in a fresh subfolder. For an edit, one cad_run with script_path pointing to the earlier .py, para…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.js:4470 · File type combined with upload action — agent may exfiltrate local data files// The report always says failed (a result.json that says success can still leave no output file).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Authorization escalation languageREADME.md:963 · Authorization escalation language · informational: not an instruction file…01.08.05+ refuses the command (HMS 0500-0500-0001-0007, needs LAN Only Mode and Developer Mode), the call fails and says so; clear that fatal HMS entry with `clear_hms_errors…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commanddist/printers/bambu.js:2067 · Process kill command — agent can terminate processes// 5.x/6.x line; we rely on the outer kill timer instead so we don'tFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injectionREADME.md:48 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileUse direct LAN printing by default. Explain any LAN/Developer Mode settingFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageREADME.md:48 · Authorization escalation language · informational: not an instruction fileUse direct LAN printing by default. Explain any LAN/Developer Mode settingFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actiondist/index.js:3191 · File type combined with upload action — agent may exfiltrate local data files…ame>.stl (export_stl of one body), <name>.f3d (export_f3d) and <name>.parameters.json (its user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh; slice it like any other model. Fusion must run on t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈61 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for bambu-printer-mcp@1.1.85 as of 3d ago. This is the package itself, not its dependencies.