Skills/npm/mcp-3d-printer-server

mcp-3d-printer-server@1.2.60

VERIFIED· startup only

Publisher claims: "MCP server for connecting Claude with 3D printer management systems" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher dmontgomery40 · publishing for 709 daysInstalls 15,897Last detonated 5d ago
$claude mcp add mcp-3d-printer-server -- npx -y mcp-3d-printer-server
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
API_KEYBAMBU_TOKENConfiguration, not credentials: BAMBU_CONTROL_REPLY_MS, BAMBU_DEFAULT_CONNECTION_MODE, BAMBU_DEFAULT_CONNECTION_TYPE, BAMBU_DISPATCH_CHECK_MS, BAMBU_MODEL, BAMBU_NOZZLE_TYPE, BAMBU_RESUME_STATE_DIR, BAMBU_SERIAL, BAMBU_SLICER_PROFILE_DIRS, BAMBU_TEMPLATE_3MF_PATH, BAMBU_TEMPLATE_DIR, BED_TYPE, BLENDER_HOST, BLENDER_MCP_ARGS, BLENDER_MCP_BRIDGE_COMMAND, BLENDER_MCP_COMMAND, BLENDER_MCP_TIMEOUT_MS, BLENDER_PORT, FILAMENT_PROFILE, FULU_BAMBU_BRIDGE_COMMAND, FULU_ORCA_PATH, FULU_ORCA_PLUGIN_DIR, FUSION_MCP_ARGS, FUSION_MCP_COMMAND, FUSION_MCP_HOST, FUSION_MCP_PORT, FUSION_MCP_TIMEOUT_MS, HTTP_PORT, MCP_ALLOW_BRIDGE_COMMAND_ARG, MCP_ALLOW_EXECUTABLE_ARG, MCP_HTTP_ALLOWED_ORIGINS, MCP_HTTP_HOST, MCP_HTTP_JSON_RESPONSE, MCP_HTTP_PATH, MCP_HTTP_PORT, MCP_HTTP_STATEFUL, MCP_TRANSPORT, NOZZLE_DIAMETER
Where it talks to
no vendor host named in the codeAlso bblcdn.com, pi.lan, prusa3d.com, fabacademy.org, mit.edu, repetier-server.com, bambulab.com, apple.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names bblcdn.com, pi.lan, prusa3d.com, fabacademy.org, mit.edu, repetier-server.com, bambulab.com, apple.com as well as its own vendor. The guard injects API_KEY, BAMBU_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y mcp-3d-printer-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 32 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
11sprocessdependency install exit 0
31sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-vPto8U/task/home/work/acme-api/.claude/skills/mcp-3d-printer-server/dist/blender-mcp-bridge.js' } Node.js v22.23.4
31sprocessscript backend runs setup only
31sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actiondist/slicer/bambu-cli.js:509 · File type combined with upload action — agent may exfiltrate local data files* The result.json in the run's fresh output directory, parsed verbatim. BambuFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/design-app-setup.js:464 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files: "This server has no .env file to add its Fusion settings to: add FUSION_MCP_COMMAND and FUSION_MCP_ARGS to its configuration."] : []),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load environment variables from .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.md:200 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…connection_type: "lan"`), which a P1S on authorization firmware accepts without Developer Mode, or Bambu Cloud (`"cloud"`). Every print still passes the same inspection and f…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageREADME.md:55 · Authorization escalation language · informational: not an instruction fileexplain any LAN Only Mode or Developer Mode setting I need to enable.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/design-app-setup.js:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfunction envFile(system) { return path.resolve(system.cwd, ".env"); }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:309 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:143 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load environment variables from .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/counterpart/setup.ts:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The kind this server runs when a .env sets none of these values (no PRINTER_TYPE). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The server's own `.env`, when it has one: a client's env block has no file to update. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:358 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** A login agent that gives Fusion the add-in's port however Fusion is opened (a GUI app never reads this .env). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/counterpart/setup.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* to this server's .env and never needs its own printer or model tables. Pure: no printer traffic, no secrets returned.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/counterpart/setup.js:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdefault: { type: "boolean", description: "The kind this server runs when a .env sets none of its fixed values (no PRINTER_TYPE)." },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/tool-annotations.js:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescounterpart_print_route: write(true, true, false), // with route, replaces the saved connection in .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/fusion-mcp-bridge.ts:373 · File type combined with upload action — agent may exfiltrate local data files* <name>.parameters.json into output_dir. Files are staged, verified andFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/index.ts:63 · File type combined with upload action — agent may exfiltrate local data files// A result.json that says success can still leave no output: the report says failed all the same.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.js:44 · File type combined with upload action — agent may exfiltrate local data files// A result.json that says success can still leave no output: the report says failed all the same.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/index.js:1561 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…s this server drives (each PRINTER_TYPE) and the settings it reads for each, by .env variable name: label, hint, whether required, the fixed values a kind needs (PR…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/tool-annotations.js:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// the Fusion add-in folder, a login item and this server's .env are written. Repeating finds them current.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// dotenv's own .env lookup is: slicer CLIs receive paths under it, and Bambu Studio failsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:1515 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:1754 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…s this server drives (each PRINTER_TYPE) and the settings it reads for each, by .env variable name: label, hint, whether required, the fixed values a kind needs (PR…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/counterpart/setup.ts:146 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdefault: { type: "boolean", description: "The kind this server runs when a .env sets none of its fixed values (no PRINTER_TYPE)." },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:1708 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/counterpart/setup.ts:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* to this server's .env and never needs its own printer or model tables. Pure: no printer traffic, no secrets returned.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/fusion-mcp-bridge.js:390 · File type combined with upload action — agent may exfiltrate local data files* <name>.parameters.json into output_dir. Files are staged, verified andFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Authorization escalation languageREADME.md:200 · Authorization escalation language · informational: not an instruction file…connection_type: "lan"`), which a P1S on authorization firmware accepts without Developer Mode, or Bambu Cloud (`"cloud"`). Every print still passes the same inspection and f…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionsrc/slicer/bambu-cli.ts:619 · File type combined with upload action — agent may exfiltrate local data files* The result.json in the run's fresh output directory, parsed verbatim. BambuFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.js:2475 · File type combined with upload action — agent may exfiltrate local data files…ut_dir as <name>.stl (export_stl), <name>.f3d (export_f3d) and <name>.parameters.json (the design's user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh and its size compared with the Fusion body …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Prompt injectionREADME.md:55 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileexplain any LAN Only Mode or Developer Mode setting I need to enable.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectionREADME.md:634 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…ses the command (HMS 0500-0500-0001-0007 on firmware 01.08.05 and later without Developer Mode), the call fails and says so; the checked file stays on the printer's storage. …Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathsdist/design-app-setup.js:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** One change at a time per server: overlapping updates would interleave backups, renames and .env writes. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:157 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// dotenv's own .env lookup is: slicer CLIs receive paths under it, and Bambu Studio failsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:251 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/index.ts:2677 · File type combined with upload action — agent may exfiltrate local data files…ut_dir as <name>.stl (export_stl), <name>.f3d (export_f3d) and <name>.parameters.json (the design's user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh and its size compared with the Fusion body …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Authorization escalation languageREADME.md:634 · Authorization escalation language · informational: not an instruction file…ses the command (HMS 0500-0500-0001-0007 on firmware 01.08.05 and later without Developer Mode), the call fails and says so; the checked file stays on the printer's storage. …Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈58 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-3d-printer-server@1.2.60 as of 5d ago. This is the package itself, not its dependencies.