Is mcp-3d-printer-server@1.2.76 safe to install?

Skills/npm/mcp-3d-printer-server

mcp-3d-printer-server@1.2.76

CAUTION· startup only

Publisher claims: "MCP server for connecting Claude with 3D printer management systems" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher dmontgomery40 · publishing for 709 daysInstalls 15,897Last detonated 32 h ago

What would fix this Watch Dispute verdict

Coverage

Startup only; authenticated tool behavior not tested.

Tested: server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested: the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: API_KEYBAMBU_TOKENConfiguration, not credentials: BAMBU_CONTROL_REPLY_MS, BAMBU_DEFAULT_CONNECTION_MODE, BAMBU_DEFAULT_CONNECTION_TYPE, BAMBU_DISPATCH_CHECK_MS, BAMBU_MODEL, BAMBU_NOZZLE_TYPE, BAMBU_RESUME_STATE_DIR, BAMBU_SERIAL, BAMBU_SLICER_PROFILE_DIRS, BAMBU_TEMPLATE_3MF_PATH, BAMBU_TEMPLATE_DIR, BED_TYPE, BLENDER_HOST, BLENDER_MCP_ARGS, BLENDER_MCP_BRIDGE_COMMAND, BLENDER_MCP_COMMAND, BLENDER_PORT, CAD_DATA_DIR, CAD_ENABLED, CAD_OUTPUT_DIRS, FILAMENT_PROFILE, FULU_BAMBU_BRIDGE_COMMAND, FULU_ORCA_PATH, FULU_ORCA_PLUGIN_DIR, FUSION_MCP_COMMAND, HTTP_PORT, MCP_ALLOW_BRIDGE_COMMAND_ARG, MCP_ALLOW_EXECUTABLE_ARG, MCP_HTTP_ALLOWED_ORIGINS, MCP_HTTP_HOST, MCP_HTTP_JSON_RESPONSE, MCP_HTTP_PATH, MCP_HTTP_PORT, MCP_HTTP_STATEFUL, MCP_TRANSPORT, NOZZLE_DIAMETER, ORCA_SLICER_BAMBULAB_PATH, ORCASLICER_BAMBULAB_PATH
Where it talks to: no vendor host named in the codeAlso bblcdn.com, prusa3d.com, fabacademy.org, mit.edu, hubs.com, ufl.edu, orcaslicer.com, blogspot.com, hackaday.com, protolabs.com, sv-jme.eu, bambulab.com, apple.com, microsoft.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names bblcdn.com, prusa3d.com, fabacademy.org, mit.edu, hubs.com, ufl.edu, orcaslicer.com, blogspot.com, hackaday.com, protolabs.com, sv-jme.eu, bambulab.com, apple.com, microsoft.com as well as its own vendor. The guard injects API_KEY, BAMBU_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y mcp-3d-printer-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 32 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

12sprocessdependency install exit 0

32sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-mUM6TE/task/home/work/acme-api/.claude/skills/mcp-3d-printer-server/dist/ensure-web-crypto.js' } Node.js v22.23.5

32sprocessscript backend runs setup only

32sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathsdist/design-app-setup.js:358 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** A login agent that gives Fusion the add-in's port however Fusion is opened (a GUI app never reads this .env). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/index.js:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// dotenv's own .env lookup is: slicer CLIs receive paths under it, and Bambu Studio failsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/index.js:1545 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/design-app-setup.js:464 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

: "This server has no .env file to add its Fusion settings to: add FUSION_MCP_COMMAND and FUSION_MCP_ARGS to its configuration."] : []),

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/index.js:113 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load environment variables from .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/index.js:1607 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…s this server drives (each PRINTER_TYPE) and the settings it reads for each, by .env variable name: label, hint, whether required, the fixed values a kind needs (PR…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/design-app-setup.js:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The server's own `.env`, when it has one: a client's env block has no file to update. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/design-app-setup.js:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfunction envFile(system) { return path.resolve(system.cwd, ".env"); }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/index.js:272 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/design-app-setup.js:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** One change at a time per server: overlapping updates would interleave backups, renames and .env writes. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actionsrc/slicer/bambu-cli.ts:619 · File type combined with upload action — agent may exfiltrate local data files* The result.json in the run's fresh output directory, parsed verbatim. BambuFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Auto-update or dynamic fetch configurationpackage.json:9 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"autoUpdate": trueFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Process kill commanddist/cad/process.d.ts:14 · Process kill command — agent can terminate processes/** No shell, no inherited printer/provider environment, bounded output, and kill the entire dispatched group. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File type combined with upload actionsrc/cad/contracts.ts:395 · File type combined with upload action — agent may exfiltrate local data files

…t selection and edits: set final: true only on the result you select. cad-result.json in each immediate run folder is protected from script writes and retains final, completed_at, lineage_id (source hash), full checks and artifact paths; c…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Access to sensitive file pathssrc/index.ts:152 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load environment variables from .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

LOW

Prompt injectionREADME.md:200 · Prompt injection — known jailbreak technique reference · informational: not an instruction file

…connection_type: "lan"`), which a P1S on authorization firmware accepts without Developer Mode, or Bambu Cloud (`"cloud"`). Every print still passes the same inspection and f…

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST01

MEDIUM

File type combined with upload actiondist/index.js:2564 · File type combined with upload action — agent may exfiltrate local data files

…ut_dir as <name>.stl (export_stl), <name>.f3d (export_f3d) and <name>.parameters.json (the design's user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh and its size compared with the Fusion body …

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiondist/index.js:51 · File type combined with upload action — agent may exfiltrate local data files// A result.json that says success can still leave no output: the report says failed all the same.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

LOW

Prompt injectionREADME.md:55 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileexplain any LAN Only Mode or Developer Mode setting I need to enable.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST01

LOW

Prompt injectionREADME.md:702 · Prompt injection — known jailbreak technique reference · informational: not an instruction file

…ses the command (HMS 0500-0500-0001-0007 on firmware 01.08.05 and later without Developer Mode), the call fails and says so; the checked file stays on the printer's storage. …

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST01

LOW

Authorization escalation languageREADME.md:200 · Authorization escalation language · informational: not an instruction file

…connection_type: "lan"`), which a P1S on authorization firmware accepts without Developer Mode, or Bambu Cloud (`"cloud"`). Every print still passes the same inspection and f…

Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Authorization escalation languageREADME.md:55 · Authorization escalation language · informational: not an instruction fileexplain any LAN Only Mode or Developer Mode setting I need to enable.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

MEDIUM

File type combined with upload actiondist/cad/contracts.js:355 · File type combined with upload action — agent may exfiltrate local data files

…th script, output_dir and a plain name. It saves <name>.py and <name>.parameters.json before running, then exports <name>.stl and <name>.step in a fresh subfolder. For an edit, one cad_run with script_path pointing to the earlier .py, para…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Access to sensitive file pathssrc/index.ts:330 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actionsrc/cad/contracts.ts:392 · File type combined with upload action — agent may exfiltrate local data files

…th script, output_dir and a plain name. It saves <name>.py and <name>.parameters.json before running, then exports <name>.stl and <name>.step in a fresh subfolder. For an edit, one cad_run with script_path pointing to the earlier .py, para…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiondist/cad/contracts.js:106 · File type combined with upload action — agent may exfiltrate local data files

… output_dir, never overwriting previous artifacts. The saved .py and .parameters.json are the recovery checkpoint even after cancellation. Returns independently measured geometry, STL/STEP, six orthographic renders, a perspective view and …

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

LOW

Authorization escalation languageREADME.md:702 · Authorization escalation language · informational: not an instruction file

…ses the command (HMS 0500-0500-0001-0007 on firmware 01.08.05 and later without Developer Mode), the call fails and says so; the checked file stays on the printer's storage. …

Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

HIGH

Access to sensitive file pathssrc/index.ts:1735 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Process kill commanddist/cad/process.js:4 · Process kill command — agent can terminate processes/** No shell, no inherited printer/provider environment, bounded output, and kill the entire dispatched group. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File type combined with upload actionsrc/index.ts:70 · File type combined with upload action — agent may exfiltrate local data files// A result.json that says success can still leave no output: the report says failed all the same.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionsrc/index.ts:2763 · File type combined with upload action — agent may exfiltrate local data files

…ut_dir as <name>.stl (export_stl), <name>.f3d (export_f3d) and <name>.parameters.json (the design's user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh and its size compared with the Fusion body …

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Process kill commandsrc/cad/process.ts:37 · Process kill command — agent can terminate processesconst kill = () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandsrc/cad/process.ts:20 · Process kill command — agent can terminate processes/** No shell, no inherited printer/provider environment, bounded output, and kill the entire dispatched group. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Access to sensitive file pathssrc/index.ts:167 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// dotenv's own .env lookup is: slicer CLIs receive paths under it, and Bambu Studio failsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Process kill commanddist/cad/process.js:15 · Process kill command — agent can terminate processesconst kill = () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File type combined with upload actiondist/cad/contracts.js:358 · File type combined with upload action — agent may exfiltrate local data files

…t selection and edits: set final: true only on the result you select. cad-result.json in each immediate run folder is protected from script writes and retains final, completed_at, lineage_id (source hash), full checks and artifact paths; c…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionsrc/cad/contracts.ts:116 · File type combined with upload action — agent may exfiltrate local data files

… output_dir, never overwriting previous artifacts. The saved .py and .parameters.json are the recovery checkpoint even after cancellation. Returns independently measured geometry, STL/STEP, six orthographic renders, a perspective view and …

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Access to sensitive file pathssrc/index.ts:1797 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…s this server drives (each PRINTER_TYPE) and the settings it reads for each, by .env variable name: label, hint, whether required, the fixed values a kind needs (PR…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

Cost to the agent

Instructions loaded

≈58 tok

1 file · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-3d-printer-server@1.2.76 as of 30 h ago. This is the package itself, not its dependencies.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Unclaimed publisher≈ +8 on the totalClaim dmontgomery40: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.

Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dmontgomery40 Propose a patch to the maintainer