Kiln3d MCP Server
kiln3d
PyPI
v1.2.0
Published by codeofaxel — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 11 = 89. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
| ✓ | inspection depth (source) — how much of the target the scan could see |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 12
high Reads a sensitive credential path or dumps the environment (src/kiln/plugins/marketplace_tools.py)MTC-SRC-006
In the server's implementation (`src/kiln/plugins/marketplace_tools.py:324`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ~/.ssh
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/plugins/marketplace_tools.py
high Shell/command execution in server code (src/kiln/cli/bridge_commands.py)MTC-SRC-002
In the server's implementation (`src/kiln/cli/bridge_commands.py:254`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.Popen(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/cli/bridge_commands.py
high Shell/command execution in server code (src/kiln/cli/install_openscad.py)MTC-SRC-002
In the server's implementation (`src/kiln/cli/install_openscad.py:66`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.run(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/cli/install_openscad.py
high Shell/command execution in server code (src/kiln/cli/main.py)MTC-SRC-002
In the server's implementation (`src/kiln/cli/main.py:336`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.run(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/cli/main.py
high Shell/command execution in server code (src/kiln/credential_store.py)MTC-SRC-002
In the server's implementation (`src/kiln/credential_store.py:202`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.check_output(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/credential_store.py
high Shell/command execution in server code (src/kiln/decoration_helpers.py)MTC-SRC-002
In the server's implementation (`src/kiln/decoration_helpers.py:169`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.run(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/decoration_helpers.py
high Shell/command execution in server code (src/kiln/design_reasoning.py)MTC-SRC-002
In the server's implementation (`src/kiln/design_reasoning.py:1909`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.run(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/design_reasoning.py
high Shell/command execution in server code (src/kiln/device.py)MTC-SRC-002
In the server's implementation (`src/kiln/device.py:94`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.run(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/device.py
high Shell/command execution in server code (src/kiln/emboss_generator.py)MTC-SRC-002
In the server's implementation (`src/kiln/emboss_generator.py:70`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.run(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/emboss_generator.py
high Shell/command execution in server code (src/kiln/generation/gemini.py)MTC-SRC-002
In the server's implementation (`src/kiln/generation/gemini.py:1078`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.run(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/generation/gemini.py
high Shell/command execution in server code (src/kiln/generation/openscad.py)MTC-SRC-002
In the server's implementation (`src/kiln/generation/openscad.py:137`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: subprocess.run(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/kiln/generation/openscad.py
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([tax_jurisdiction_lookup, download_generated_model, model_files, download_model, browse_models, list_model_categories, marketplace_diagnostics]) co-exist with external-action tools ([analyze_warping_risk]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [tax_jurisdiction_lookup, download_generated_model, model_files, download_model, browse_models, list_model_categories, marketplace_diagnostics] → sink
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow tax_jurisdiction_lookup → analyze_warping_risk
Tools 200
Each tool and what it can reach — statically extracted from the published source.
analyze_warping_risknetwork egressbrowse_modelsingests untrusted inputdownload_generated_modelingests untrusted inputdownload_modelingests untrusted inputlist_model_categoriesingests untrusted inputmarketplace_diagnosticsingests untrusted inputmodel_filesingests untrusted inputtax_jurisdiction_lookupingests untrusted inputadd_assembly_interfaceno sensitive capabilityadd_assembly_partno sensitive capabilityadd_mesh_chamferno sensitive capabilityadd_mesh_filletno sensitive capabilityanalyze_design_requirementsno sensitive capabilityanalyze_mesh_geometryno sensitive capabilityanalyze_non_manifold_edgesno sensitive capabilityanalyze_scad_codeno sensitive capabilityanalyze_structural_risksno sensitive capabilityapply_decorationno sensitive capabilityapply_design_reinforcementsno sensitive capabilityarrange_parts_on_plateno sensitive capabilityassess_load_bearingno sensitive capabilityaudit_original_designno sensitive capabilityauto_arrange_parts_on_plateno sensitive capabilityauto_color_by_heightno sensitive capabilityauto_color_by_regionno sensitive capabilityawait_generationno sensitive capabilityboolean_mesh_opno sensitive capabilitybuild_generation_promptno sensitive capabilitybuild_parametric_promptno sensitive capabilitycache_designno sensitive capabilitycache_design_with_sourceno sensitive capabilitycache_modelno sensitive capabilitycenter_model_on_bedno sensitive capabilitycheck_assembly_clearancesno sensitive capabilitycheck_firmware_statusno sensitive capabilitycheck_material_environmentno sensitive capabilitycheck_material_sufficiencyno sensitive capabilitycheck_multi_material_pairingno sensitive capabilitycheck_print_healthno sensitive capabilitycheck_print_readinessno sensitive capabilitycheck_printer_material_compatibilityno sensitive capabilitycommunity_statsno sensitive capabilitycompare_mesh_versionsno sensitive capabilitycompile_scadno sensitive capabilitycompose_assembly_partsno sensitive capabilitycompose_modelsno sensitive capabilitycompose_part_from_primitivesno sensitive capabilityconsumer_onboardingno sensitive capabilitycontribute_community_printno sensitive capabilitycreate_assemblyno sensitive capabilitycross_section_viewno sensitive capabilitydecoration_infono sensitive capabilitydecoration_quota_statusno sensitive capabilitydelete_agent_noteno sensitive capabilitydelete_cached_modelno sensitive capabilitydelete_shipping_profileno sensitive capabilitydesign_advisorno sensitive capabilitydesign_improvement_planno sensitive capabilitydetect_mesh_pocketsno sensitive capabilitydiagnose_meshno sensitive capabilitydonate_infono sensitive capabilityestimate_before_designno sensitive capabilityestimate_costno sensitive capabilityestimate_material_costno sensitive capabilityestimate_mesh_print_timeno sensitive capabilityestimate_mesh_weightno sensitive capabilityestimate_priceno sensitive capabilityestimate_print_cost_from_meshno sensitive capabilityestimate_print_progressno sensitive capabilityestimate_print_timeno sensitive capabilityestimate_structural_loadno sensitive capabilityestimate_support_materialno sensitive capabilityestimate_timelineno sensitive capabilityexport_model_3mfno sensitive capabilityextract_model_from_3mfno sensitive capabilityfind_design_templatesno sensitive capabilityfind_material_matchno sensitive capabilityfind_printers_with_materialno sensitive capabilityfind_similar_printsno sensitive capabilityfingerprint_modelno sensitive capabilityfirmware_statusno sensitive capabilityforecast_material_consumptionno sensitive capabilityfulfillment_alertsno sensitive capabilityfulfillment_cancelno sensitive capabilityfulfillment_materialsno sensitive capabilityfulfillment_orderno sensitive capabilityfulfillment_order_statusno sensitive capabilityfulfillment_quoteno sensitive capabilitygenerate_and_printno sensitive capabilitygenerate_modelno sensitive capabilitygenerate_model_from_imageno sensitive capabilitygenerate_model_with_providerno sensitive capabilitygenerate_template_variationsno sensitive capabilitygenerate_textureno sensitive capabilitygeneration_statusno sensitive capabilityget_active_materialno sensitive capabilityget_brand_filament_profileno sensitive capabilityget_cached_designno sensitive capabilityget_cached_modelno sensitive capabilityget_community_insightno sensitive capabilityget_compatible_materialsno sensitive capabilityget_design_sourceno sensitive capabilityget_design_template_infono sensitive capabilityget_fleet_material_summaryno sensitive capabilityget_joint_recommendationno sensitive capabilityget_material_consumption_historyno sensitive capabilityget_material_design_profileno sensitive capabilityget_material_infono sensitive capabilityget_material_purchase_urlsno sensitive capabilityget_model_print_historyno sensitive capabilityget_post_processing_guideno sensitive capabilityget_print_diagnosticno sensitive capabilityget_printer_design_capabilitiesno sensitive capabilityget_printer_insightsno sensitive capabilityget_restock_suggestionsno sensitive capabilityhollow_mesh_modelno sensitive capabilityinfer_print_settingsno sensitive capabilityinsert_into_scadno sensitive capabilityissue_shipping_confirmation_tokenno sensitive capabilityiterate_designno sensitive capabilitykiln_signinno sensitive capabilitykiln_signin_pollno sensitive capabilitylist_available_materialsno sensitive capabilitylist_brand_filament_profilesno sensitive capabilitylist_cached_designsno sensitive capabilitylist_cached_modelsno sensitive capabilitylist_credentialsno sensitive capabilitylist_decorationsno sensitive capabilitylist_design_componentsno sensitive capabilitylist_design_materialsno sensitive capabilitylist_design_templates_catalogno sensitive capabilitylist_generation_providersno sensitive capabilitylist_material_catalogno sensitive capabilitylist_multi_material_addonsno sensitive capabilitylist_printer_design_profilesno sensitive capabilitylist_shipping_profilesno sensitive capabilitymarketplace_statusno sensitive capabilitymatch_design_componentsno sensitive capabilitymatch_design_requirementsno sensitive capabilitymerge_mesh_filesno sensitive capabilitymesh_quality_scorecardno sensitive capabilitymirror_mesh_modelno sensitive capabilitymodel_detailsno sensitive capabilitymodify_scad_moduleno sensitive capabilitymonitor_print_visionno sensitive capabilitymy_toolno sensitive capabilityoptimize_fleet_assignmentno sensitive capabilityoptimize_print_orientationno sensitive capabilityoptimize_template_paramsno sensitive capabilityparse_scad_parametersno sensitive capabilitypredict_print_settingsno sensitive capabilitypreview_generated_modelno sensitive capabilityrecommend_design_materialno sensitive capabilityrecommend_design_reinforcementsno sensitive capabilityrecommend_materialno sensitive capabilityrecord_print_dnano sensitive capabilityremove_mesh_floating_regionsno sensitive capabilityrepair_meshno sensitive capabilityrepair_mesh_advancedno sensitive capabilityrescale_modelno sensitive capabilityresolve_filament_profileno sensitive capabilityretrieve_credentialno sensitive capabilityrollback_printer_firmwareno sensitive capabilitysave_decorationno sensitive capabilitysave_shipping_profileno sensitive capabilityscale_mesh_to_fitno sensitive capabilitysearch_all_modelsno sensitive capabilitysearch_cached_modelsno sensitive capabilitysearch_material_catalogno sensitive capabilitysearch_modelsno sensitive capabilitysimplify_mesh_modelno sensitive capabilityslice_and_estimateno sensitive capabilitysmart_generate_from_templateno sensitive capabilitysolve_template_constraintsno sensitive capabilitysplice_mesh_at_zno sensitive capabilitysplit_mesh_by_componentno sensitive capabilitystop_watch_printno sensitive capabilitystore_credentialno sensitive capabilitysuggest_material_for_orderno sensitive capabilitysuggest_printer_for_jobno sensitive capabilitysuggest_spool_swapsno sensitive capabilitysupported_shipping_countriesno sensitive capabilitytax_estimateno sensitive capabilitytax_jurisdictionsno sensitive capabilitythicken_mesh_wallsno sensitive capabilitytroubleshoot_print_issueno sensitive capabilitytweak_and_compile_scadno sensitive capabilityupdate_printer_firmwareno sensitive capabilityupdate_scad_parameterno sensitive capabilityvalidate_and_prepare_meshno sensitive capabilityvalidate_assemblyno sensitive capabilityvalidate_design_for_requirementsno sensitive capabilityvalidate_gcodeno sensitive capabilityvalidate_gcode_safeno sensitive capabilityvalidate_generated_meshno sensitive capabilityvalidate_print_qualityno sensitive capabilityvalidate_scad_parametersno sensitive capabilityvalidate_shipping_addressno sensitive capabilitywatch_printno sensitive capabilitywatch_print_statusno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.2.0 latest |
B 89/100 | 12 | 1.8.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan kiln3d --online --registry pypiMore in Productivity & Workflow
Security scan results for the Agentchat MCP server.
Security scan results for the Airthings Consumer MCP server.
Security scan results for the Alltrails MCP server.
Security scan results for the Anki MCP server.
Security scan results for the Apple Notes Ts MCP server.
Security scan results for the Bullet MCP server.