MCP Safety Notes

Prompt injection is an open problem for tool-using agents. A downloaded model's description, a README inside an archive, 3MF metadata, or a web page can all contain instructions aimed at your agent. Practical mitigations:

• Treat tool output and downloaded files as untrusted input.
• Keep printer keys and access codes in server configuration, with the least privilege your printer software allows.
• Keep per-call executable selectors off. Slicer, bridge, and Blender commands come from server configuration unless MCP_ALLOW_EXECUTABLE_ARG=1 is set.
• Prints and positive heating start without a server prompt: the client's own print action is the approval, so give print tools only to clients and agents you trust to start a print. The file, ceiling and printer-state checks still run, and there is no bed check, so clear the plate before you print.
• Heater ceilings come only from server configuration (PRINTER_MAX_NOZZLE_TEMP, PRINTER_MAX_BED_TEMP, PRINTER_MAX_CHAMBER_TEMP, or Bambu's per-model limits). Tool arguments and G-code never raise them.
• Run the streamable HTTP transport on a trusted network. It binds to 127.0.0.1 by default and has no built-in authentication.
• Set BAMBU_MODEL correctly and never substitute a similar model.