figma-console-mcp
The most comprehensive MCP server for Figma — design tokens, variables, components, write tools, version history diff, accessibility audits, FigJam, Slides, and more. Local (WebSocket Desktop Bridge plugin) and Cloudflare Workers (paired + remote) modes.
No outside reports on file
This tool requires strong Figma credentials and careful handling of sensitive design data; misconfiguration or token leakage could let attackers modify your design files or expose confidential designs.
Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsRequires API key or tokenREVIEW
- Package sourcenpm (figma-console-mcp)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
npx -y figma-console-mcpAbout Figma Console MCP
This is an MCP server that connects Claude to Figma design files. It lets Claude read and write design tokens, variables, components, view version history, run accessibility checks, and work with FigJam and Slides. It can run locally via a desktop plugin or remotely through Cloudflare Workers.
Who it’s for
Design teams and developers who want Claude to help analyze, audit, or modify Figma files programmatically. Useful for automating design tasks or getting AI feedback on design systems.
Alternatives
- Figma REST API (direct integration via code, more control but requires development)
- Zapier + Figma integration (automation platform, less AI-native but pre-built workflows)
- Claude's native file upload (read-only; ask Claude to analyze exported design files or screenshots)
Setup
Check these steps against the project’s own instructions before running anything.
Install via npm:
npm install figma-console-mcp
Then follow the project's README on GitHub for configuration steps, which vary depending on whether you choose local (WebSocket Desktop Bridge) or remote (Cloudflare Workers) mode.
Why this grade
Signal-based grade (1/7 points): no public source code found. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 2.6k
- Weekly npm downloads
- 35.7k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Figma account access: Needs a Figma token to read and write files; anyone with that token can access all your design files and make changes.
- Design data exposure: Could accidentally leak sensitive design assets, brand guidelines, or unreleased product mockups in conversation history.
- Malicious file content: A Figma file created by an attacker could contain confusing data designed to trick Claude into misinterpreting requests or outputting harmful instructions.
- Remote mode security: Cloudflare Workers mode sends design data through external servers; unclear what security controls are in place.
- Write permissions: Can modify your Figma files; a compromise or misconfiguration could result in accidental or intentional file corruption.
How to lower the risk
Least-privilege permissions
- Use a Figma service account or restricted API token with only the files/projects you need.
- Never share your Figma token; rotate it regularly.
Network isolation
- If using local mode, keep the WebSocket bridge on a trusted network only.
- For Cloudflare Workers mode, verify the security model and data handling practices.
Monitoring
- Check Figma's activity log for unexpected file changes or access.
- Review Claude conversation logs for accidentally leaked design URLs or sensitive asset names.
Red flags to watch for
- Figma tokens appearing in chat transcripts or logs.
- Unexpected modifications to design files after using this tool.
- Slow or blocked requests that might indicate network issues or tampering.
Questions
How do I install Figma Console MCP?
Run npx -y figma-console-mcp in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/southleft/figma-console-mcp.
Are there security reports about Figma Console MCP?
No reports found for this package in our research (last checked 2026-10-29). Figma Console MCP currently holds Grade D (High risk signals) based on public adoption and transparency signals. Key risk areas to watch include figma account access, design data exposure, malicious file content.
Is Figma Console MCP actively maintained?
Figma Console MCP has 2.6k GitHub stars and 35.7k weekly npm downloads. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/southleft/figma-console-mcp before pinning it in production.
What are alternatives to Figma Console MCP?
Notable alternatives to Figma Console MCP include Figma REST API, Zapier + Figma integration, Claude's native file upload. You can also compare Figma Console MCP side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Figma Console MCP? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/southleft-figma-console-mcp)HTML embed:
<a href="https://agentarmorhq.com/skills/southleft-figma-console-mcp"><img src="https://agentarmorhq.com/api/badge/southleft-figma-console-mcp" alt="AgentArmorHQ Risk Grade for Figma Console MCP" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "southleft-figma-console-mcp"Share with your security lead
Need sign-off to use figma-console-mcp? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: figma-console-mcp
- **Listing URL:** https://agentarmorhq.com/skills/southleft-figma-console-mcp
- **Type:** App connector
- **Risk Grade:** Grade D (High risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 2.6k GitHub stars, 35.7k weekly npm downloads
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** npm (figma-console-mcp)
#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts figma-console-mcp`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- southleft
- Source code
- github.com/southleft/figma-console-mcp
- Install command
- npm install figma-console-mcp
- Est. context load
- ~1.1k tokens / turn (~6 tool schemas, 0.55% of 200k context)
- Popularity
- 2.6k GitHub stars, 35.7k weekly npm downloads
- Last updated
- 2026-10-29
- Last graded
- 2026-10-27
Community
Discussions for Figma Console MCP
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude