package Figma-Context-MCP
No known issues
Grade A (Few risk signals). Use --ignore-scripts and pin exact version.
Earlier reports: Versions before 0.6.3 were affected (figma-developer-mcp vulnerable to command injection in get_figma_data tool, Sep 30, 2025, GHSA-gxw4-4fc5-9gr5, link). The current version, 0.13.2, is not named.
- Latest version
- 0.13.2
- First published
- 21 months ago
- Maintainers
- 1
- Catalog grade
- A — Few risk signals
- Est. context load
- ~980 tokens / turn (~6 tool schemas, 0.49% of 200k context)
Threat reports
- Reportedfigma-developer-mcp vulnerable to command injection in get_figma_data tool (Sep 30, 2025, GHSA-gxw4-4fc5-9gr5, link)
Install it pinned and without install scripts:
npm install --ignore-scripts --save-exact "figma-developer-mcp"Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee. Answers change through the day.