Skip to content

Agentic Fabrication Network (AFN)

by agenticfabricationnetwork.ai · remote · no sign-in to list tools · v0.1.1 · published by ai.agenticfabricationnetwork

Turn designs into shipped parts: quote 3D printing, CNC, and decals, then check out.

Deletes · 2Final · 1Changes · 4

13 tools: 2 can delete or cancel things, 1 do something that can't be undone, 4 change things and 6 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ufp https://agenticfabricationnetwork.ai/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • The server marks "get_fabrication_quote" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "get_fabrication_quote" says "get": a word for reading.

    What this check looks for
  • The server marks "finalize_quote" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "finalize_quote" says "finalize": a word for a change that another call does not undo.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

13 tools

Deletes or cancels 2Claude Code: deny
  • leave_reviewRecord the user's verified-purchase review of how a UFP order turned out.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Record the user's verified-purchase review of how a UFP order turned out. YOUR JOB IS TO STRUCTURE THE FEEDBACK: turn what the user actually said into stars (1-5 overall) and facet scores — "the cut was sloppy" -> quality, "parts arrived 2 days late" -> timeliness, "wrong color" -> accuracy. Keep the optional comment to a short factual summary of their words; never embellish. ALWAYS draft the review (stars, facets, comment) and confirm it with the user BEFORE calling this tool — e.g. "I'll rate this 2 stars with timeliness 1 because it arrived 2 days late — send it?". One review per order: submitting again updates the existing review. Use list_orders first if you need to resolve which order they mean.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
  • reply_to_makerSend the user's answer to a question the maker (vendor) asked about a UFP order — get_order_status surfaces an open question when one is waiting.Can send data outNo findings

    Why it is in this group

    • The name "reply_to_maker" says "reply": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "reply_to_maker" says "reply": it sends or publishes something to other people.
    Description, as the server wrote it
    Send the user's answer to a question the maker (vendor) asked about a UFP order — get_order_status surfaces an open question when one is waiting. Confirm the answer with the user before sending. The network relays it: the maker sees plain text from the network account with the user's contact details and links stripped, so never include emails, phone numbers, or URLs the answer depends on.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
Can't be undone 1Claude Code: ask
  • finalize_quoteONLY for the case where a quote response came back with an EMPTY board and told you to call this: waits for the vendors to answer (up to ~40s) and returns their offers as a full bo…1 finding

    Why it is in this group

    • The name "finalize_quote" says "finalize": a word for a change that another call does not undo.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "finalize_quote" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "finalize_quote" says "finalize": a word for a change that another call does not undo.

      What this check looks for
    Description, as the server wrote it
    ONLY for the case where a quote response came back with an EMPTY board and told you to call this: waits for the vendors to answer (up to ~40s) and returns their offers as a full board. Call with just quote_id, immediately, and say nothing substantive before it. NEVER call it on a response that already listed offers — that board is final, and this would add nothing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
Changes things 4Claude Code: ask
  • create_checkoutCreate the order and get a hosted payment link for a chosen offer.Can send data outNo findings

    Why it is in this group

    • The name "create_checkout" says "create": a word for a change.

    What it can reach

    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    Create the order and get a hosted payment link for a chosen offer. Call this as soon as the user picks an offer + shipping speed — do NOT ask for their address first: the secure payment page collects the shipping address and email. Only pass address fields if the user already volunteered them. Returns checkout_url — give it to the user to pay; UFP places the vendor order automatically after payment.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
  • get_fabrication_quoteGet ranked, purchasable offers (price, ETA, preview image) for fabricating a physical item from a design file.Reads private data1 finding

    Why it is in this group

    • The name "get_fabrication_quote" says "get": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • private-dataThe description's first sentence says "get" and "file": it reads files.
    • private-dataThe input names a file (input.design_file), and the tool reads: it reads files.

    Findings

    • Warn

      The server marks "get_fabrication_quote" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "get_fabrication_quote" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Get ranked, purchasable offers (price, ETA, preview image) for fabricating a physical item from a design file. process=fdm_print for 3D printing a model (STL/OBJ/PLY/3MF/AMF/STEP/IGES), process=cnc or process=sheetmetal for machined/bent metal parts (STEP, IGES, DXF), process=decal for stickers/decals from artwork (any common image or design file — PNG/JPG/HEIC/TIFF/GIF/BMP/WEBP/AVIF/SVG/PDF/AI/EPS/PSD/CDR, auto-converted). A .ufp file (UFP part container: the design plus saved spec/constraints in one) is accepted anywhere a design file is — its saved intent applies automatically and anything the user states now wins. If the user just drops a file and asks for a price, omit process — UFP routes it. Provide the design either as design_file (an image/file the user attached or you generated — preferred) or file_url (a public URL). REORDERS: if the user has a UFP part number (from a receipt email or a previous session, looks like UFP-… or part_…), pass it as part_number INSTEAD of any file — the stored design and spec are reused and re-shopped across all current vendors. Locked parts additionally require share_key (from the owner's share link). Returns offers across vendors like Google Flights returns flights.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
  • poll_quoteINTERNAL — the offer board calls this to refresh itself while vendors finish pricing.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    INTERNAL — the offer board calls this to refresh itself while vendors finish pricing. Never call this yourself. The board you were given is already final for its turn; do not reach for refine_quote to look at it again either, that paints a duplicate board.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • refine_quoteNarrow an existing quote with new constraints (destination ZIP the user just provided, deadline, outdoor/waterproof/heat/food-safety requirements, budget, vendor reliability, verba…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Narrow an existing quote with new constraints (destination ZIP the user just provided, deadline, outdoor/waterproof/heat/food-safety requirements, budget, vendor reliability, verbatim requirements terms, drawing callouts, a process filter — "no, I meant in sheet metal" → processes — a ship-from country filter — "only US vendors" → ships_from — or a vendor filter — "only show A3D Manufacturing" → vendors) — or CHANGE its spec: material, color, or quantities. Changing material/quantity is a spec change, not a narrowing — pass it via the material/color/quantities args, NOT as a requirements term; the affected lanes re-price with the new spec through warm vendor sessions. For side-by-side comparisons ("how does carbon steel compare?"), add a scenario label — labeled refines coexist instead of replacing each other (max 4). "Organize by" ("sort by cheapest", "soonest arrival on top", "most green first") is also this tool: sort_by for objective orders, sort_order + sort_label for orders you judged yourself from the previews — presentation only, instant, nothing re-prices. GOING BACK is also this tool: undo_last_step ALONE takes back exactly one refine step (the quote's steps[] names each step, newest first — the network restores the previous stored state exactly); clear removes whole constraints ("drop the deadline" → clear ["deadline"]); remove_requirements takes back individual requirements terms. Call with ONLY quote_id to re-read the quote (e.g. to pick up preview images that finished rendering).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
Only reads 6Claude Code: allow
  • get_material_guideHonest, cited material intelligence for material-choice / strength / durability / heat / outdoor questions ("my PLA part broke, what's stronger?", "will this survive outdoors?").No findings

    Why it is in this group

    • The name "get_material_guide" says "get": a word for reading.
    Description, as the server wrote it
    Honest, cited material intelligence for material-choice / strength / durability / heat / outdoor questions ("my PLA part broke, what's stronger?", "will this survive outdoors?"). Returns caveats-FIRST facts: published specs (tensile, heat-deflection, UV/outdoor, chemical) each tagged vendor-cited vs general engineering knowledge, "stronger/tougher/hotter than X" ladders (PLA→PETG→ABS/ASA→nylon/PC→metals), and finish/coating options. Call it BEFORE answering such a question, then relay the facts. It supplies FACTS ONLY — comparative specs and vendor-admitted caveats, never a fitness-for-purpose or safety guarantee (that stays your judgment boundary); name express vendor claims "advertised", not "certified".

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_network_capabilitiesThe LIVE catalog of what the fabrication network can do RIGHT NOW — no quote needed.No findings

    Why it is in this group

    • The name "get_network_capabilities" says "get": a word for reading.
    Description, as the server wrote it
    The LIVE catalog of what the fabrication network can do RIGHT NOW — no quote needed. Returns the services ledger (tapping, inserts, welding, bending, finishes… with each shop's own size/material/thickness windows), the network's sheet gauge ladder, the stocked hardware combinations (species x thread) with stocked lengths and shop counts — the most-stocked length is the steering default for an unspecified length — the finish options with their stocked color menus, and per-process manufacturability rules. This is live state, not a spec sheet: it changes as connectors join, leave, or have capability branches toggled, so call it fresh when the user asks what's possible (materials, gauges, hardware, colors, services) rather than answering from memory.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_order_statusCheck status, ETA and tracking for a UFP order.No findings

    Why it is in this group

    • The name "get_order_status" says "get": a word for reading.
    Description, as the server wrote it
    Check status, ETA and tracking for a UFP order.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_shop_gaugesEvery sheet thickness (gauge) ONE named shop stocks right now, per material — read live off the shop's declared catalog, no quote needed.No findings

    Why it is in this group

    • The name "get_shop_gauges" says "get": a word for reading.
    Description, as the server wrote it
    Every sheet thickness (gauge) ONE named shop stocks right now, per material — read live off the shop's declared catalog, no quote needed. Call it when the user asks what thicknesses/gauges a specific maker carries ("what thicknesses does SendCutSend have in mild steel?"). For the whole network's ladder use get_network_capabilities instead. Never answer a gauge question from memory.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • list_ordersList this agent's recent UFP orders (newest first): order id, what was made, vendor, status, total, ETA, created date.No findings

    Why it is in this group

    • The name "list_orders" says "list": a word for reading.
    Description, as the server wrote it
    List this agent's recent UFP orders (newest first): order id, what was made, vendor, status, total, ETA, created date. Use it to resolve vague references — "my sticker order", "that order from 6 days ago" — to a concrete order_id before calling get_order_status or leave_review.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • preview_quoteINTERNAL client rail — the routing half of refine_quote with NOTHING committed: takes the same arguments as refine_quote and answers how many distinct fabricators (and which proces…Reads private dataNo findings

    Why it is in this group

    • The name "preview_quote" says "preview": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    Description, as the server wrote it
    INTERNAL client rail — the routing half of refine_quote with NOTHING committed: takes the same arguments as refine_quote and answers how many distinct fabricators (and which process lanes) the network WOULD ask for the refined part, plus the exclusion notes, without creating a child quote, asking any vendor, superseding in-flight work, or logging demand. An expectation, never a promise — lanes can still decline once asked. Never call this to look at prices; it carries none. Use refine_quote to actually re-price.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 0.1.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http ufp https://agenticfabricationnetwork.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__ufp__preview_quote",
      "mcp__ufp__get_order_status",
      "mcp__ufp__list_orders",
      "mcp__ufp__get_material_guide",
      "mcp__ufp__get_network_capabilities",
      "mcp__ufp__get_shop_gauges"
    ],
    "ask": [
      "mcp__ufp__get_fabrication_quote",
      "mcp__ufp__refine_quote",
      "mcp__ufp__poll_quote",
      "mcp__ufp__finalize_quote",
      "mcp__ufp__create_checkout"
    ],
    "deny": [
      "mcp__ufp__reply_to_maker",
      "mcp__ufp__leave_review"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as ufp. Review it before you use it.

Capability tags behind 4 rules
  • mcp__ufp__get_fabrication_quote private-data
  • mcp__ufp__preview_quote private-data
  • mcp__ufp__create_checkout outbound
  • mcp__ufp__reply_to_maker outbound