io.github.duncanbottrill/deskhand
NPM · DESKHAND
Claude in your Figma file. Builds with your components, checks what it wrote. Runs on your computer.
Available components
Last scanned (3 hours ago)
Scores higher than 31% of npm servers
Category Design and Media
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (fair).Partial
- Tool/resource definitions use about 7975 tokens (~83/item across 96 items; 94 tools + 2 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage81
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 42% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "figma_execute" implies "execute" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 96 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 62
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/deskhand@1.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
figma_add_mode ~34
Add a new mode to a variable collection.
| Name | Type | Req | Description |
|---|---|---|---|
| collectionId | string | yes | – |
| name | string | yes | – |
No output schema declared.
No examples provided.
figma_add_reaction ~52
Prototype (Figma Design only): add an interaction to a node; existing reactions are kept.
| Name | Type | Req | Description |
|---|---|---|---|
| action | object | yes | – |
| nodeId | string | yes | – |
| trigger | object | yes | – |
No output schema declared.
No examples provided.
figma_apply_style ~79
Apply a local style (paint, text, stroke, effect, grid) to a node using Figma's async setters. The applied id is read back: appliedStyleId with verified: true, or STYLE_NOT_APPLIED.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeId | string | yes | – |
| property | string | yes | – |
| styleId | string | yes | – |
No output schema declared.
No examples provided.
figma_brand_styles ~84
Read the brand the open file already defines: local paint/text/effect styles, every component and set (keys, variant properties, all pages) and common frame sizes; samples fills and fonts when there are no styles. Use its colours, type and components in everything you build. Cached under ~/.deskhand/brands/ so bridge.instance(name) can import components later.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
figma_bridge_diagnostics ~41
Check the bridge end to end: versions, plugin handshake, buffered events, reverse round-trip timing. Call when a tool fails or after an upgrade.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
figma_clone_nodes ~45
Duplicate nodes.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeIds | array | yes | – |
| offset | object | – | Offset from the originals |
| parentId | string | – | Parent id for the clones |
No output schema declared.
No examples provided.
figma_combine_as_variants ~45
Combine components into a variant set; names must use variant naming (e.g. "Size=Large").
| Name | Type | Req | Description |
|---|---|---|---|
| componentIds | array | yes | Minimum 2 |
No output schema declared.
No examples provided.
figma_compare_to_reference ~144
Pixel-diff a built frame against a reference node. Both render at the reference's effective scale; returns mismatchPercent, a per-quadrant breakdown (tl/tr/bl/br), the size delta and paths to the diff/ref/built PNGs. A mismatch in one quadrant usually means one misplaced element.
| Name | Type | Req | Description |
|---|---|---|---|
| builtNodeId | string | yes | Built frame |
| inlineDiff | boolean | – | Also return the diff PNG inline |
| maxPixels | integer | – | – |
| refNodeId | string | yes | Reference node |
| scale | number | – | – |
| threshold | number | – | pixelmatch colour threshold (0 = exact, 1 = anything matches) |
No output schema declared.
No examples provided.
figma_create_component ~92
Create a component.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| fills | – | – | Fill color |
| fromNodeId | string | – | Convert this node to a component |
| height | number | – | – |
| name | string | – | – |
| parentId | string | – | Parent id (default: page) |
| width | number | – | – |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_create_ellipse ~107
Create ellipse. Use arcData for arcs/rings.
| Name | Type | Req | Description |
|---|---|---|---|
| arcData | object | – | Arcs and rings |
| fills | – | – | Fill color |
| height | number | – | Height in pixels (same as width for circle) |
| name | string | – | – |
| parentId | string | – | Parent id (default: page) |
| width | number | – | Width in pixels (diameter for circle) |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_create_frame ~70
Create a frame.
| Name | Type | Req | Description |
|---|---|---|---|
| fills | – | – | Fill color |
| height | number | – | – |
| name | string | – | – |
| parentId | string | – | Parent id (default: page) |
| width | number | – | – |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_create_instance ~62
Create a component instance.
| Name | Type | Req | Description |
|---|---|---|---|
| componentId | string | yes | – |
| name | string | – | Default: component name |
| parentId | string | – | Parent id (default: page) |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_create_line ~104
Create a line.
| Name | Type | Req | Description |
|---|---|---|---|
| length | number | – | – |
| name | string | – | – |
| parentId | string | – | Parent id (default: page) |
| rotation | number | – | Degrees (0 = horizontal) |
| strokeCap | string | – | ARROW_LINES/ARROW_EQUILATERAL for arrows |
| strokeWeight | number | – | – |
| strokes | – | – | Stroke color |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_create_page ~63
Create a page. Figma Design only: FigJam returns FIGMA_DESIGN_ONLY (create FigJam pages in its UI).
| Name | Type | Req | Description |
|---|---|---|---|
| index | number | – | Position in the page list (0 = first). Defaults to end. |
| name | string | yes | – |
No output schema declared.
No examples provided.
figma_create_paint_style ~49
Create a paint style.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| fills | – | yes | Fill color |
| name | string | yes | "/" makes folders, e.g. "Brand/Primary" |
No output schema declared.
No examples provided.
figma_create_rectangle ~70
Create a rectangle.
| Name | Type | Req | Description |
|---|---|---|---|
| fills | – | – | Fill color |
| height | number | – | – |
| name | string | – | – |
| parentId | string | – | Parent id (default: page) |
| width | number | – | – |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_create_section ~139
Create a labeled section (works in both Figma Design and FigJam) to group content. Supports dev status (READY_FOR_DEV/COMPLETED).
| Name | Type | Req | Description |
|---|---|---|---|
| devStatus | string | – | Only valid on sections directly under a page or section |
| devStatusDescription | string | – | – |
| fills | – | – | Section background fill |
| height | number | – | – |
| name | string | – | – |
| parentId | string | – | Parent id (default: page) |
| sectionContentsHidden | boolean | – | Collapse the section's contents |
| width | number | – | – |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_create_text ~88
Create a text node.
| Name | Type | Req | Description |
|---|---|---|---|
| fills | – | – | Text color |
| fontFamily | string | – | – |
| fontSize | number | – | – |
| fontStyle | string | – | – |
| name | string | – | – |
| parentId | string | – | Parent id (default: page) |
| text | string | – | – |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_create_text_style ~85
Create a text style.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| fontFamily | string | – | – |
| fontSize | number | – | – |
| fontStyle | string | – | – |
| letterSpacing | – | – | – |
| lineHeight | – | – | – |
| name | string | yes | "/" makes folders |
| textCase | string | – | – |
| textDecoration | string | – | – |
No output schema declared.
No examples provided.
figma_create_variable ~92
Create a variable in a collection.
| Name | Type | Req | Description |
|---|---|---|---|
| aliasOf | string | – | Variable id to alias instead of a value |
| collectionId | string | yes | – |
| description | string | – | – |
| name | string | yes | "/" makes groups, e.g. "colors/primary" |
| scopes | array | – | Allowed scopes |
| type | string | yes | – |
| value | – | – | Initial value (default mode) |
No output schema declared.
No examples provided.
figma_create_variable_collection ~36
Create a variable collection.
| Name | Type | Req | Description |
|---|---|---|---|
| modes | array | – | Default: ["Mode 1"] |
| name | string | yes | – |
No output schema declared.
No examples provided.
figma_delete_mode ~40
Delete a mode from a variable collection. Cannot delete the last mode.
| Name | Type | Req | Description |
|---|---|---|---|
| collectionId | string | yes | – |
| modeId | string | yes | – |
No output schema declared.
No examples provided.
figma_delete_nodes ~21
Delete nodes.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeIds | array | yes | – |
No output schema declared.
No examples provided.
figma_delete_page ~29
Delete a page. The last page cannot be deleted.
| Name | Type | Req | Description |
|---|---|---|---|
| pageId | string | yes | – |
No output schema declared.
No examples provided.
figma_delete_style ~50
Delete a local style (paint, text, effect or grid). Library styles return REMOTE_STYLE. Nodes keep their resolved values but lose the link.
| Name | Type | Req | Description |
|---|---|---|---|
| styleId | string | yes | Style id |
No output schema declared.
No examples provided.
figma_delete_variable_collection ~32
Delete a variable collection and all its variables. Cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| collectionId | string | yes | – |
No output schema declared.
No examples provided.
figma_delete_variables ~25
Delete variables. Cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| variableIds | array | yes | – |
No output schema declared.
No examples provided.
figma_detach_instance ~40
Detach an instance into a regular frame: keeps overrides, severs the link to the main component.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeId | string | yes | – |
No output schema declared.
No examples provided.
figma_duplicate_page ~57
Clone a page and its contents, inserted after the original. Figma Design only (FIGMA_DESIGN_ONLY in FigJam).
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Default: "<original> copy" |
| pageId | string | yes | – |
No output schema declared.
No examples provided.
figma_execute ~246
Run JavaScript in the Figma plugin: an async function body with figma (Plugin API) and bridge (log, sleep, icon, text, instance, image, snapshot; progress/cancelled in jobs). Return plain data, never nodes (EXECUTE_BAD_RETURN). Errors: EXECUTE_SYNC_API, EXECUTE_SYNTAX, EXECUTE_FAILED. job: true past 30 s, then figma_job_status (waits). screenshot renders it. Recipes: figma_get_design_rules.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Async function body; return plain data. |
| job | boolean | – | Run as a background job and return { jobId }. One at a time (JOB_BUSY). Cap 10 min. |
| label | string | – | Job label |
| lint | boolean | – | Lint top-level frames the script created; findings come back as _lint (empty = clean). |
| screenshot | boolean|string | – | Render a node in the reply: a node id, or true for the returned { id }. |
| timeoutMs | integer | – | Sync timeout ms (default 30000); a script still running then becomes a job (jobId returned). |
No output schema declared.
No examples provided.
figma_export_batch ~128
Export many nodes in one call, each at a scale or targetWidth (scale = targetWidth / node width, clamped 0.01–4). Files go to outputDir (default: a fresh folder under ~/.deskhand/exports/) named by namePattern with tokens {name} {id} {scale} {ext} {index}. One row per item (path and size, or an error); nothing is inlined.
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | yes | – |
| namePattern | string | – | – |
| outputDir | string | – | Absolute directory (created if missing) |
No output schema declared.
No examples provided.
figma_export_node ~155
Export a node as PNG, SVG, JPG or PDF to disk and return { path, format, scale, bytes }; read the file to view it. outputPath sets the destination; returnBase64: true inlines raw data instead. To see the render in context use figma_screenshot.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | – |
| nodeId | string | yes | – |
| outputPath | string | – | Absolute output path (directories created). Default: auto-named file in the OS temp dir. |
| returnBase64 | boolean | – | Return base64 inline instead of a file (rarely useful) |
| scale | number | – | Scale (1 = 100%), clamped to 0.01–4 |
No output schema declared.
No examples provided.
figma_get_children ~115
Immediate children of a node — more efficient than figma_get_nodes for browsing hierarchy. Default limit 100, with truncated/next for paging. Compact results include x/y for layout. Composite instance-sublayer parent IDs resolve too.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | – | Minimal data (id, name, type, x, y, parentId, childCount); false for full serialization. |
| limit | integer | – | Maximum number of children to return |
| offset | integer | – | – |
| parentId | string | yes | – |
No output schema declared.
No examples provided.
figma_get_context ~34
File info, current page and selection. Call once per conversation; every tool reports NOT_CONNECTED if the plugin is down.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
figma_get_design_rules ~79
One cookbook section as markdown: rules plus a runnable figma_execute recipe. Sections: helpers, auto-layout, components, variants, text, lint, jobs, reference-match. Read it before building that kind of thing. Whole cookbook: skill://deskhand/COOKBOOK.md. Needs no plugin.
| Name | Type | Req | Description |
|---|---|---|---|
| section | string | yes | – |
No output schema declared.
No examples provided.
figma_get_local_styles ~76
List all local styles (colors, text, effects, grids). To find specific styles by name use figma_search_styles: fewer tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Per category |
| offset | integer | – | – |
| type | string | – | – |
| verbose | boolean | – | Full paints array, not compact hex[] |
No output schema declared.
No examples provided.
figma_get_local_variables ~83
All local variables and collections: types (COLOR, FLOAT, STRING, BOOLEAN), modes, values. Paged: limit (default 100) and offset; next gives the following page.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of variables to return (collections are always returned in full) |
| offset | integer | – | – |
| type | string | – | – |
No output schema declared.
No examples provided.
figma_get_nodes ~157
Full node details by id: geometry, fills, strokes, effects, auto-layout, text, constraints, boundVariables, explicitVariableModes, childIds. Default-valued props are omitted unless verbose. Composite instance ids (I<inst>;<child>) resolve; unknown ids land in notFound. Find ids with figma_search_nodes/figma_get_children first.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | string | – | minimal (id, name, type, childIds), compact (+ x/y/size, parentId, childIds), full (all props; default). |
| nodeIds | array | yes | Node ids, e.g. ["1:23"] |
| verbose | boolean | – | Include default-valued props and skip caps on long fields |
No output schema declared.
No examples provided.
figma_get_reactions ~37
Prototype (Figma Design only): get a node's reactions (trigger and action details).
| Name | Type | Req | Description |
|---|---|---|---|
| nodeId | string | yes | – |
No output schema declared.
No examples provided.
figma_get_selection_history ~82
Recent selection changes, newest first, with timestamps. Default: the user's own selections; source: 'all' adds those made by bridge commands. Served from a server buffer, so it works after the plugin disconnects. If the default returns nothing, retry with source: 'all'.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| source | string | – | – |
No output schema declared.
No examples provided.
figma_group_nodes ~28
Group nodes.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | – |
| nodeIds | array | yes | – |
No output schema declared.
No examples provided.
figma_job_cancel ~52
Ask a running figma_execute job to stop (sets the flag bridge.cancelled() returns; scripts that never check it run to completion). Poll figma_job_status.
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | yes | – |
No output schema declared.
No examples provided.
figma_job_status ~95
Waits for a figma_execute job to end (up to waitMs), then returns state (running | done | error | cancelled | timeout), progress and the result or error. Jobs live for the server session.
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | yes | From figma_execute with job: true |
| waitMs | integer | – | Max ms to wait for the end (default 20000; 0 = now). |
No output schema declared.
No examples provided.
figma_licence_activate ~32
Activate a Deskhand licence key.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | Licence key from your purchase email |
No output schema declared.
No examples provided.
figma_licence_status ~27
Deskhand licence state: trial days left, masked key, last check.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
figma_list_pages ~27
List pages (ids and names). The active page is in figma_get_context.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
figma_list_snapshots ~37
List saved snapshots in this file, newest first, with whether each clone still exists. Returns { count, page, snapshots }.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
figma_move_nodes ~70
Move nodes. Use relative=true for offset.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeIds | array | yes | – |
| relative | boolean | – | x/y are offsets from the current position |
| x | number | – | Absolute X, or offset if relative |
| y | number | – | Absolute Y, or offset if relative |
No output schema declared.
No examples provided.
figma_move_to_page ~53
Move nodes from their current page to a different page.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeIds | array | yes | – |
| targetPageId | string | yes | – |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_place_chrome ~108
Insert an iOS chrome template (status-bar 393×54, home-indicator 393×34, keyboard 393×291), named chrome/<kind>. With parentId it scales to the parent width, top or bottom unless y is given.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | yes | – |
| parentId | string | – | Screen frame id (default: page) |
| theme | string | – | dark on a dark screen |
| y | number | – | Vertical position inside the parent |
No output schema declared.
No examples provided.
How do I install the io.github.duncanbottrill/deskhand MCP server?
io.github.duncanbottrill/deskhand runs locally as an npm package, launched with npx -y deskhand. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · deskhand
claude mcp add duncanbottrill-deskhand -- npx -y deskhand
What is the io.github.duncanbottrill/deskhand MCP server?
io.github.duncanbottrill/deskhand is an MCP server listed in the public MCP registry as io.github.duncanbottrill/deskhand. Claude in your Figma file. Builds with your components, checks what it wrote. Runs on your computer. This page covers its npm package (deskhand).
Is the io.github.duncanbottrill/deskhand MCP server safe to use?
io.github.duncanbottrill/deskhand scores 64 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.duncanbottrill/deskhand MCP server expose?
io.github.duncanbottrill/deskhand exposes 94 tools: figma_server_info, figma_get_context, figma_get_selection_history, figma_bridge_diagnostics, figma_licence_status, and 89 more. Their descriptions and schemas cost roughly 7,278 tokens of context every time the server is loaded.
Is the io.github.duncanbottrill/deskhand MCP server still maintained?
io.github.duncanbottrill/deskhand is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.duncanbottrill/deskhand MCP server under?
io.github.duncanbottrill/deskhand declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.