Is InkFE Print MCP server safe?

Findings (3)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool create_business_card_design: …Applies the buyer's field values (and logo, if the template needs one) to a template, fits the text to its printable area, renders both sides as preview images, and returns a design token. Before creating a guest design, explain: unpaid, unsaved drafts expire 30 days after the design request starts. Verified saving keeps the draft; checkout and unresolved purchase artwork is protected. Seven-day token expiry is separate from deletion. Call list_business_card_templates first and collect a non-blank value for every field it lists, keyed by `attribute`; a blank or missing value fails with missing_required_fields. Pass a public https PNG or JPEG URL as `logoUrl` only when the template has an imageUrl field; omit it otherwise. Returns designToken, designId, templateId, revisionId, expiresAt (7 days out), previews (a 300-second signed URL plus width/height for each side; the pixels are also attached as image content blocks), and any text_shrunk warnings from fitting a value to its layer. Present both attached proof images directly, or provide labeled front/back links to the exact preview URLs if the host cannot display them. Do not require computer setup, downloads or re-uploading for proof review. Refresh expired links rather than creating another design. An accountOwned result identifies a verified customer, not an integration key. Results also include a private saveUrl for browser ownership verification; offer it only when the buyer wants to save. Saving requires sign-in; subsequent checkout of that design requires an AI connection authorized by the same InkFE account. If customer OAuth is unavailable, complete checkout before saving. Use a stable requestId; retry the same request after a timeout. Revise with revise_business_card_design and refresh expired links with refresh_design_proof. Show both previews and warnings, get exact print options and get_quote, then record explicit customer approval with approve_design_proof before create_checkout. Fails with unknown_template, missing_required_fields {attributes}, unknown_field {attribute}, value_too_long {attribute}, unsupported_characters {attribute}, logo_required, logo_fetch_failed, logo_unsupported, rate_limited {retryAfterSeconds} (too many designs from this API key in a short time), or connector_unavailable.…

• lowNo source repository listedmaint.no-repo