Is CutOptim Engine MCP server safe?

Findings (1)

• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool optimize_nest: …Metered: one Engine API call (needs an API key; not available with the demo key). Nest free-form polygon parts on sheets. True-shape (irregular / polygon) nesting. Pack ARBITRARY POLYGONS onto fixed sheets, letting parts interlock into each other's concave pockets — an L-bracket, a gasket, a laser-cut profile. This is a different class from the rectangular modes: a part is an outline (`polygon`, optional interior `holes`), not a width×height, so a bounding-box packer's notch-air is reclaimed. On a representative 272-part job it uses 6 sheets where the same parts by bounding box need 9 (−33 % material). Two things the rectangular API cannot express come for free here: per-sheet EXCLUSION ZONES (`stock[].exclusions` — a defect, a clamp footprint, a pre-printed area; a `quality`-0 zone is a no-go region for any part), and true-shape holes. Material partition (`material`) and the opaque `meta` passthrough work exactly as on the other modes. ⚠️ `density` is the placed POLYGON area over used sheet area — the honest fill, with concave pockets counted as empty. It is NOT comparable to a rectangular packer's `yieldPct` (which counts each bounding box as solid and so reads higher for a worse result); the cross-comparable metric is `sheetCount` on the same parts. A placed part carries the rigid transform (`rotation` in degrees, then `x`/`y` translation), NOT a re-emitted polygon: your input outline plus that transform reconstructs the placement exactly. Deterministic (a pinned seed); set `options.seed` to reproduce a layout. Engines: `lbf` (default) is synchronous and instant. Besides its own pass it tries the parts restricted to the right angles they allow, and their bounding boxes packed by an exact rectangle packer — which finds grids a sampling search misses (three 500-wide parts on a 1500-wide sheet at zero spacing) — and keeps whichever ranks best; on a tie, the plan that fills its sheets front to back, then the one with fewer parts off the right angles. `max` is ASYNCHRONOUS: the call answers **202** with a `jobId`, and you poll `GET /v1/jobs/{id}` for the result — the same response shape, with `engine: "max"`. It runs the `lbf` pass first and then a time-budgeted search (`options.timeBudgetMs`, default 60 s, 10–180 s) that fills sheets one at a time looking for a layout with FEWER sheets; it never returns more sheets than `lbf` would — nor a plan that ranks worse by the sheet-size ranking below — and says in `warnings` when it kept the `lbf` layout. Several sheet sizes per material and `respectStock` are modelled; a `polygon` sheet or `exclusions` (which its strip search cannot model) are served by the `lbf` pass inside the job, with a warning — never refused. `sparrow` is a deprecated alias of `max`. **Sheet sizes and cost.** With two or more stock rows for a material, both engines compare arrangements (your order, each row alone, cheapest-first) and then re-nest each sheet — the least-filled first — onto the cheaper or smaller rows, so a plan may MIX sizes (e.g. two large sheets and a small last one). Ranking: most must-cut (`priority`) parts placed → most parts placed → (with `minimizeCost`) lowest total price → least total sheet area → fewest sheets. `sheets[].stock` and `stockUsage[]` say which row each sheet came from. **Used area.** `sheets[].usedWidth` / `usedHeight` are the farthest extent of any placed part from the sheet origin (the corner the parts are packed into), `usedArea` their product, and `stockUsage[].usedArea` the sum per row — the numbers an ERP needs to charge a partial sheet (full sheet, a horizontal or vertical cut, or the bounding box; the charging rule stays yours). Both engines compact the least-filled sheet of each material: its parts are re-nested on the same sheet with rotation SUBSETS of what each part allows ({0,180}, {0,90,180,270}, a single orientation — never a new angle) and the variant with the smallest used area is kept; with `max` that sheet is then also re-packed by the search itself, along the sheet's height and (on a one-sheet plan) along its width, and the tighter layout is kept under the same rule. Sheet count, sizes, price and placed parts never change. `options.compact: false` returns the uncompacted layout, and `options.compactFor` (`box` · `horizontal` · `vertical`) picks the measure to minimise when you charge a full-width or full-height strip. `metrics.cutLength` / `sheets[].cutLength` is the summed perimeter of the placed parts' outlines and holes; `pierces` counts one per closed contour (no common-line cutting, lead-ins or micro-joints — your CAM adds those). **Parts from CAD files.** A part may carry `source` — an SVG or DXF document — instead of `polygon` coordinates; the server reads the outline (and its holes) out of the file with the same parser the CutOptim app uses. The file replaces ONLY the geometry, and the response then carries an `imported` block saying what the files contributed. One file describes ONE part; `POST /v1/import/nest` splits a multi-part drawing first. Nothing is stored: the bytes are parsed in memory and gone with the response. Because a drawing is far larger than a JSON parts list, this path accepts a **10 MB body** (the rectangular endpoints keep 1 MB), with per-file and per-request character caps on `source.content`.…