figwright
Free, two-way Figma MCP server. Turn designs into framework-aware code, and push code back to the canvas. Works with Claude Code, Cursor, Codex, and any MCP client.
No outside reports on file
Use this tool only if you trust your Figma files and keep your API tokens private and rotated regularly.
Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsRequires API key or tokenREVIEW
- Package sourceGitHub (awdr74100/figwright)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/awdr74100/figwright ↗
About Figwright
Figwright is an MCP server that connects Figma design files to code. It can read your Figma designs and generate code for different frameworks, and it can also push code changes back into Figma as design updates.
Who it’s for
Designers and developers who want to work with Figma designs directly in Claude, Cursor, or other MCP-compatible AI tools. It's useful if you want AI to help turn design mockups into working code.
Alternatives
- Figma-to-code tools (Framer, Builder.io, or Locofy) as standalone services
- Generic code generation MCPs that don't tie to Figma
- Manual design handoff using Figma's native export features with human code review
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README at https://github.com/awdr74100/figwright (opens external site) for installation and configuration steps specific to your MCP client.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.2k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Figma API access: The tool needs a Figma API token to read and write your design files, so compromised tokens could expose your designs and allow unauthorized changes.
- Code generation trust: AI-generated code from designs may contain bugs or security flaws that you need to review carefully before using.
- Design information leakage: Your Figma file contents could be logged or exposed if the tool or its dependencies are compromised.
- Malicious design payloads: Figma files created by attackers could contain hidden elements or data designed to trick the AI into generating harmful code.
- Dependency risks: The tool depends on other npm packages that could be updated with malicious code.
How to lower the risk
Least-privilege permissions
- Create a Figma API token with only read permissions if you don't need push-to-canvas features.
- Restrict token access to specific Figma teams or files when possible.
Network isolation
- Run the MCP server on a trusted machine, not a shared or public computer.
- Monitor outbound connections to Figma's servers.
Monitoring
- Review generated code carefully before committing or running it.
- Check your Figma file change history for unexpected modifications.
Red flags to watch for
- API token errors or unexpected authentication failures.
- Generated code that looks suspicious or too complex for the design.
- Figma designs that change without your action.
Questions
How do I install Figwright?
Figwright does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/awdr74100/figwright.
Are there security reports about Figwright?
No reports found for this package in our research (last checked 2026-10-29). Figwright currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include figma api access, code generation trust, design information leakage.
Is Figwright actively maintained?
Figwright has 1.2k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/awdr74100/figwright before pinning it in production.
What are alternatives to Figwright?
Notable alternatives to Figwright include Figma-to-code tools, Generic code generation MCPs, Manual design handoff. You can also compare Figwright side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Figwright? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/awdr74100-figwright)HTML embed:
<a href="https://agentarmorhq.com/skills/awdr74100-figwright"><img src="https://agentarmorhq.com/api/badge/awdr74100-figwright" alt="AgentArmorHQ Risk Grade for Figwright" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "awdr74100-figwright"Share with your security lead
Need sign-off to use figwright? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: figwright
- **Listing URL:** https://agentarmorhq.com/skills/awdr74100-figwright
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.2k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** GitHub (awdr74100/figwright)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/awdr74100/figwright
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- awdr74100
- Source code
- github.com/awdr74100/figwright
- Est. context load
- ~700 tokens / turn (~4 tool schemas, 0.35% of 200k context)
- Popularity
- 1.2k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-22
Community
Discussions for Figwright
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude