Bambu Printer (rowbotik) MCP Server

Tools that read sensitive data ([list_printer_files]) and tools that can send data out ([upload_file, blender_mcp_edit_model]) are exposed together. An agent can move private data to the sink.

Evidence: sources [list_printer_files] → sinks [upload_file, blender_mcp_edit_model]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow list_printer_files → upload_file

Tool "blender_mcp_edit_model" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool blender_mcp_edit_model

In the server's implementation (`dist/index.js:2207`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); const { promisify } = await import("node:util"); const execFile

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`dist/printers/bambu.js:1044`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); const tmpOut = pathMod.join(os.tmpdir(), `bambu-snap-${Date.now()}-${Ma

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/printers/bambu.js

In the server's implementation (`dist/stl/stl-manipulator.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execFile } from 'child_process'; import { flattenForCli, detectProfilesRoot } from '../slicer/profile-flatten.js'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/stl/stl-manipulator.js

In the server's implementation (`src/index.ts:2717`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); const { promisify } = await import("node:util"); const execFileAsync =

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/index.ts

In the server's implementation (`src/printers/bambu.ts:1329`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); const tmpOut = pathMod.join(os.tmpdir(), `bambu-snap-${Date.now()}-${Math.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/printers/bambu.ts

In the server's implementation (`src/stl/stl-manipulator.ts:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execFile } from 'child_process'; import { flattenForCli, detectProfilesRoot } from '../slicer/profile-flatten.js'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/stl/stl-manipulator.ts

Tool "upload_file" takes a URL/host parameter "host" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).

Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.

Location: tool upload_file · inputSchema.properties.host

Tool "blender_mcp_edit_model" takes a command-shaped parameter "bridge_command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool blender_mcp_edit_model · inputSchema.properties.bridge_command

Tool "blender_mcp_edit_model" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool blender_mcp_edit_model