io.github.duncanbottrill/deskhand
NPM · DESKHAND
Claude in your Figma file. Builds with your components, checks what it wrote. Runs on your computer.
Available components
Last scanned (4 hours ago)
Scores higher than 31% of npm servers
Category Design and Media
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (fair).Partial
- Tool/resource definitions use about 7975 tokens (~83/item across 96 items; 94 tools + 2 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage81
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 42% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "figma_execute" implies "execute" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 96 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 62
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/deskhand@1.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
figma_place_icon ~128
Insert a Lucide icon as a vector frame named icon/<concept>. Resolves like figma_resolve_icon. Appended to parentId (or the current page) at x/y, scaled and stroked.
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | – | Hex colour (default black) |
| concept | string | yes | Icon concept, e.g. "search" |
| parentId | string | – | Parent frame id (default: page) |
| size | number | – | Rendered size in px (icons are 24 px squares) |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
figma_remove_reaction ~52
Prototype (Figma Design only): remove a reaction by its zero-based index; find it with figma_get_reactions first.
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | – |
| nodeId | string | yes | – |
No output schema declared.
No examples provided.
figma_rename_mode ~42
Rename a mode in a variable collection.
| Name | Type | Req | Description |
|---|---|---|---|
| collectionId | string | yes | – |
| modeId | string | yes | – |
| name | string | yes | – |
No output schema declared.
No examples provided.
figma_rename_node ~47
Rename one or more nodes (a batch shares one name).
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
| nodeId | string | – | – |
| nodeIds | array | – | Batch |
No output schema declared.
No examples provided.
figma_rename_page ~30
Rename a page.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
| pageId | string | yes | – |
No output schema declared.
No examples provided.
figma_rename_variable ~34
Rename a variable; "/" makes groups.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
| variableId | string | yes | – |
No output schema declared.
No examples provided.
figma_rename_variable_collection ~32
Rename a variable collection.
| Name | Type | Req | Description |
|---|---|---|---|
| collectionId | string | yes | – |
| name | string | yes | – |
No output schema declared.
No examples provided.
figma_reorder_node ~102
Change a node's z-order among its siblings. position is the FINAL index (0 = back/bottom, childCount-1 = front/top); 'back' and 'front' also work. Out-of-range values are clamped. Verified by readback (REORDER_FAILED otherwise). Children of instances cannot be reordered (INSTANCE_SUBLAYER_RESTRICTED): reorder on the master.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeId | string | yes | – |
| position | – | yes | – |
No output schema declared.
No examples provided.
figma_reparent_nodes ~62
Move nodes to a different parent.
| Name | Type | Req | Description |
|---|---|---|---|
| index | number | – | Position within the new parent (0 = bottom/back). Defaults to top/front. |
| newParentId | string | yes | Frame, group or page |
| nodeIds | array | yes | – |
No output schema declared.
No examples provided.
figma_resize_nodes ~106
Resize nodes to explicit pixels. To fit a child to its parent prefer figma_set_layout_align STRETCH (keeps size binds). Instance sublayers are rejected (INSTANCE_SUBLAYER_RESTRICTED): resize the master. Size binds are re-applied; the result is read back: RESIZE_NO_OP for a no-op, a clamp is a warning.
| Name | Type | Req | Description |
|---|---|---|---|
| height | number | – | – |
| nodeIds | array | yes | – |
| width | number | – | – |
No output schema declared.
No examples provided.
figma_resolve_icon ~85
Check icon concepts against the bundled Lucide set before drawing anything; never hand-draw glyphs. Aliases resolve (close → x), then exact names; otherwise you get real-name suggestions: pick one, do not invent. Insert with figma_place_icon or bridge.icon.
| Name | Type | Req | Description |
|---|---|---|---|
| concepts | array | yes | Concept names, e.g. ["search", "close"] |
No output schema declared.
No examples provided.
figma_restore_snapshot ~83
Undo to a snapshot: removes the current node (if present) and moves the saved clone back to its recorded parent/index/position/name. New id: restoredId — update ids you held. Snapshot is consumed. SNAPSHOT_NOT_FOUND if unknown or the clone was deleted.
| Name | Type | Req | Description |
|---|---|---|---|
| snapshotId | string | yes | From figma_snapshot or figma_list_snapshots |
No output schema declared.
No examples provided.
figma_review_screen ~119
Per-screen quality gate: lint one frame → { pass, findings, counts, fixes }; a finding carries its own fix only when it differs from fixes[code]. Errors: invisible text, overflow, zero-size, collapsed auto-layout, low contrast. Warnings: misaligned rows, hand-drawn icons, placeholder avatars, raw fills/text, detached instances. Capped at 200, errors first.
| Name | Type | Req | Description |
|---|---|---|---|
| checks | array | – | Restrict to these codes (default: all) |
| nodeId | string | yes | The frame to review |
No output schema declared.
No examples provided.
figma_screenshot ~146
Render a node (or the selection) as PNG and return it inline, with path, pixel size and scale. Scale is reduced to fit maxPixels (default 1,000,000); the inline image stays under 200 KB (one retry at half scale), larger renders stay on disk. Use after layout changes: readback cannot see overlap, clipping or mid-word breaks.
| Name | Type | Req | Description |
|---|---|---|---|
| inline | boolean | – | false: write to disk only and return the path |
| maxPixels | integer | – | Pixel budget (width × height) |
| nodeId | string | – | Default: the first selected node |
| scale | number | – | Export scale (1 = 100%) |
No output schema declared.
No examples provided.
figma_search_components ~76
Search local components by name. Returns compact metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | – | – |
| includeVariants | boolean | – | Include variants from component sets |
| limit | number | – | – |
| nameContains | string | – | Case-insensitive substring |
| namePattern | string | – | Glob pattern |
| offset | integer | – | – |
No output schema declared.
No examples provided.
figma_search_nodes ~156
Search nodes by name within a scope (parentId required). Preferred for finding frames, sections or elements; compact results (~50 tokens/node).
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | – | Return minimal data (id, name, type, parentId, childCount) |
| limit | number | – | – |
| maxDepth | number | – | -1 = unlimited, 1 = immediate children |
| nameContains | string | – | Case-insensitive substring |
| namePattern | string | – | Glob, e.g. "*button*", "Header/*" |
| offset | integer | – | – |
| parentId | string | yes | Scope: page/frame/section id |
| types | array | – | Node types, e.g. FRAME, TEXT, INSTANCE |
No output schema declared.
No examples provided.
figma_search_styles ~64
Search local styles by name; cheaper than figma_get_local_styles.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | – | – |
| limit | number | – | – |
| nameContains | string | – | Case-insensitive substring |
| offset | integer | – | – |
| type | string | – | – |
No output schema declared.
No examples provided.
figma_search_variables ~127
Search variables by name pattern (e.g. "tailwind/orange/*"). Compact results, far fewer tokens than figma_get_local_variables.
| Name | Type | Req | Description |
|---|---|---|---|
| collectionName | string | – | Collection name (partial ok) |
| compact | boolean | – | Minimal data (id, name, hex/value); false for full metadata |
| limit | number | – | – |
| nameContains | string | – | Case-insensitive substring |
| namePattern | string | – | Wildcard pattern, e.g. "tailwind/orange/*" |
| offset | integer | – | – |
| type | string | – | – |
No output schema declared.
No examples provided.
figma_server_info ~24
Server version, WebSocket port, connection state and connected document info.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
figma_set_auto_layout ~185
Configure auto-layout on a frame: direction, sizing modes, alignment, padding, spacing, wrap. Size variable binds are captured and re-applied (rebound/warnings). See skill://deskhand/SKILL.md.
| Name | Type | Req | Description |
|---|---|---|---|
| counterAxisAlignItems | string | – | – |
| counterAxisSizingMode | string | – | – |
| counterAxisSpacing | number | – | Space between wrapped rows |
| itemSpacing | number | – | – |
| layoutMode | string | – | NONE disables; HORIZONTAL = row, VERTICAL = column |
| layoutWrap | string | – | – |
| nodeId | string | yes | – |
| paddingBottom | number | – | – |
| paddingLeft | number | – | – |
| paddingRight | number | – | – |
| paddingTop | number | – | – |
| primaryAxisAlignItems | string | – | – |
| primaryAxisSizingMode | string | – | – |
No output schema declared.
No examples provided.
figma_set_clips_content ~57
Set whether frame-like nodes (FRAME, COMPONENT, COMPONENT_SET, INSTANCE, SLOT, SLIDE) clip children to their bounds; others error.
| Name | Type | Req | Description |
|---|---|---|---|
| clipsContent | boolean | yes | – |
| nodeIds | array | yes | – |
No output schema declared.
No examples provided.
figma_set_constraints ~95
Set resize constraints on a node: how it resizes when its parent frame resizes. Only for nodes inside frames (not auto-layout frames).
| Name | Type | Req | Description |
|---|---|---|---|
| horizontal | string | – | MIN = left, MAX = right, STRETCH = both, SCALE = proportional |
| nodeId | string | yes | – |
| vertical | string | – | MIN = top, MAX = bottom, STRETCH = both, SCALE = proportional |
No output schema declared.
No examples provided.
figma_set_corner_radius ~70
Set corner radius. Use individual values for asymmetric.
| Name | Type | Req | Description |
|---|---|---|---|
| bottomLeft | number | – | – |
| bottomRight | number | – | – |
| nodeId | string | yes | Node id |
| radius | number | – | – |
| topLeft | number | – | – |
| topRight | number | – | – |
No output schema declared.
No examples provided.
figma_set_current_page ~30
Switch to a different page in the Figma document.
| Name | Type | Req | Description |
|---|---|---|---|
| pageId | string | yes | – |
No output schema declared.
No examples provided.
figma_set_effects ~35
Set effects. Replaces existing.
| Name | Type | Req | Description |
|---|---|---|---|
| effects | array | yes | – |
| nodeId | string | yes | Node id |
No output schema declared.
No examples provided.
figma_set_fills ~40
Set fill color. Accepts hex shorthand or fills array.
| Name | Type | Req | Description |
|---|---|---|---|
| fills | – | yes | Fill color |
| nodeId | string | yes | Node id |
No output schema declared.
No examples provided.
figma_set_flow_starting_point ~91
Prototype (Figma Design only): set a top-level frame as a flow starting point on the page, or clear it. Stored page-level as { nodeId, name } entries.
| Name | Type | Req | Description |
|---|---|---|---|
| clear | boolean | – | – |
| flowName | string | – | Default "Flow 1"; renames an existing starting point |
| nodeId | string | yes | FRAME, COMPONENT or COMPONENT_SET |
No output schema declared.
No examples provided.
figma_set_image_fill ~125
Fill a node with an image from an absolute path (~/ allowed) or http(s) URL: PNG, JPEG, GIF or WebP, up to 4096 px per side and 20 MB. Replaces the fills with one IMAGE fill. Use for photos, avatars and reference art instead of placeholder shapes; bridge.image does the same in scripts.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeId | string | yes | Any node with fills |
| scaleMode | string | – | FILL (cover, default), FIT (contain), CROP, TILE |
| source | string | yes | – |
No output schema declared.
No examples provided.
figma_set_layout_align ~110
Set how a child behaves in an auto-layout frame: alignment (STRETCH), growth (fill container) and absolute positioning.
| Name | Type | Req | Description |
|---|---|---|---|
| layoutAlign | string | – | Counter-axis alignment: STRETCH to fill width/height |
| layoutGrow | number | – | Primary-axis growth: 0 = fixed size, 1 = fill available space |
| layoutPositioning | string | – | AUTO = follow auto-layout, ABSOLUTE = manually positioned |
| nodeId | string | yes | – |
No output schema declared.
No examples provided.
figma_set_opacity ~35
Set opacity (0-1).
| Name | Type | Req | Description |
|---|---|---|---|
| nodeId | string | yes | Node id |
| opacity | number | yes | – |
No output schema declared.
No examples provided.
figma_set_rotation ~103
Rotate nodes by degrees. pivot 'center' (default) keeps the visual centre in place; 'top-left' is Figma's raw rotation, which moves the centre. Children of auto-layout parents (unless ABSOLUTE) cannot use a centre pivot: they get top-left plus a warning. Echoes appliedPivot, rotation and absoluteBoundingBox.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeIds | array | yes | – |
| pivot | string | – | – |
| rotation | number | yes | – |
No output schema declared.
No examples provided.
figma_set_section ~70
Update a section's name, dev status, or content visibility. Pass devStatus: null to clear.
| Name | Type | Req | Description |
|---|---|---|---|
| devStatus | – | – | – |
| devStatusDescription | string | – | – |
| name | string | – | – |
| nodeId | string | yes | – |
| sectionContentsHidden | boolean | – | – |
No output schema declared.
No examples provided.
figma_set_selection ~36
Set selection. Empty array clears.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeIds | array | yes | Array of node IDs to select (empty array to clear) |
No output schema declared.
No examples provided.
figma_set_size_limits ~115
Set or clear minWidth/maxWidth/minHeight/maxHeight: a number sets, null clears, omit leaves it. Applies to auto-layout frames and their direct children (others get a warning). Verified by readback (LIMIT_NOT_APPLIED / LIMIT_NOT_CLEARED). A variable-bound field keeps its bound value; unbind with figma_unbind_variable.
| Name | Type | Req | Description |
|---|---|---|---|
| maxHeight | – | – | – |
| maxWidth | – | – | – |
| minHeight | – | – | – |
| minWidth | – | – | – |
| nodeIds | array | yes | – |
No output schema declared.
No examples provided.
figma_set_strokes ~157
Set stroke color and/or weight. Per-side weights (strokeTopWeight etc., for border-top-only dividers) work on RECTANGLE and frame-like nodes only. Omit `strokes` to change weights only.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeId | string | yes | Node id |
| strokeBottomWeight | number | – | – |
| strokeLeftWeight | number | – | – |
| strokeRightWeight | number | – | – |
| strokeTopWeight | number | – | – |
| strokeWeight | number | – | Uniform weight (px), applied before per-side weights |
| strokes | – | – | { color: "#RRGGBB[AA]" } | { r, g, b, a? } (0–1) | Figma fills array |
No output schema declared.
No examples provided.
figma_set_text ~37
Set text content. Auto-loads fonts.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeId | string | yes | Text node id |
| text | string | yes | – |
No output schema declared.
No examples provided.
figma_set_text_style ~116
Set text font properties.
| Name | Type | Req | Description |
|---|---|---|---|
| fontFamily | string | – | – |
| fontSize | number | – | – |
| fontStyle | string | – | – |
| letterSpacing | – | – | Letter spacing (PIXELS or PERCENT with value) |
| lineHeight | – | – | Line height (AUTO, or PIXELS/PERCENT with value) |
| nodeId | string | yes | – |
| textAlignHorizontal | string | – | – |
| textAlignVertical | string | – | – |
| textCase | string | – | – |
| textDecoration | string | – | – |
No output schema declared.
No examples provided.
figma_set_variable ~235
Set a variable's value for a mode, or bind it to a node property or local style (styleId + field). Text styles bind font/spacing fields; paint styles bind 'paints'. Verified by readback (BIND_NOT_APPLIED otherwise). width/height on an instance sublayer: INSTANCE_SUBLAYER_RESTRICTED, bind the master.
| Name | Type | Req | Description |
|---|---|---|---|
| field | string | – | Property or text field (fontSize, lineHeight, letterSpacing, paragraphSpacing, paragraphIndent, fontFamily, fontStyle, fontWeight), or 'paints' for paint styles |
| modeId | string | – | Required when setting a value |
| nodeId | string | – | Node to bind to (a style id here routes to the style path) |
| paintIndex | number | – | Paint index for fills, strokes or a paint style |
| styleId | string | – | Local style id (e.g. "S:abc123") to bind a TEXT or PAINT style, instead of nodeId |
| value | – | – | number, string, boolean or color object |
| variableId | string | yes | – |
No output schema declared.
No examples provided.
figma_set_variable_mode ~123
Pin an explicit variable mode on nodes or pages (e.g. a mobile frame pinned to the Spacing collection's mobile mode), or clear: true to unpin. Works on scene nodes and page ids. Echoes explicitVariableModes ({} = nothing pinned).
| Name | Type | Req | Description |
|---|---|---|---|
| clear | boolean | – | Remove this collection's pin instead of setting one |
| collectionId | string | yes | Pins are per collection |
| modeId | string | – | Required unless clear is true; must belong to collectionId |
| nodeIds | array | yes | Node or page ids |
No output schema declared.
No examples provided.
figma_set_visible ~47
Show or hide nodes via node.visible; don't bind a BOOLEAN variable or set opacity to 0 for this.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeIds | array | yes | – |
| visible | boolean | yes | – |
No output schema declared.
No examples provided.
figma_snapshot ~91
Save a restorable copy of a node before a risky edit: cloned onto a "🗄 Bridge Snapshots" page with parent/index/position recorded. Keeps the newest 10 per file. Restore with figma_restore_snapshot or bridge.snapshot() in scripts.
| Name | Type | Req | Description |
|---|---|---|---|
| label | string | – | Short note shown in the list, e.g. "before restyle" |
| nodeId | string | yes | – |
No output schema declared.
No examples provided.
figma_swap_instance ~40
Swap an instance to a different component, keeping position and size.
| Name | Type | Req | Description |
|---|---|---|---|
| instanceId | string | yes | – |
| newComponentId | string | yes | – |
No output schema declared.
No examples provided.
figma_unbind_variable ~100
Remove a variable binding from a node property, verified by readback (UNBIND_FAILED otherwise). For minWidth/maxWidth/minHeight/maxHeight the leftover literal clamp is cleared too (previousLiteral, clearedLiteral).
| Name | Type | Req | Description |
|---|---|---|---|
| field | string | yes | e.g. fills, strokes, opacity, cornerRadius, minWidth, maxWidth |
| nodeId | string | yes | – |
| paintIndex | number | – | Paint index for fills/strokes |
No output schema declared.
No examples provided.
figma_ungroup_nodes ~24
Ungroup nodes.
| Name | Type | Req | Description |
|---|---|---|---|
| nodeIds | array | yes | – |
No output schema declared.
No examples provided.
How do I install the io.github.duncanbottrill/deskhand MCP server?
io.github.duncanbottrill/deskhand runs locally as an npm package, launched with npx -y deskhand. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · deskhand
claude mcp add duncanbottrill-deskhand -- npx -y deskhand
What is the io.github.duncanbottrill/deskhand MCP server?
io.github.duncanbottrill/deskhand is an MCP server listed in the public MCP registry as io.github.duncanbottrill/deskhand. Claude in your Figma file. Builds with your components, checks what it wrote. Runs on your computer. This page covers its npm package (deskhand).
Is the io.github.duncanbottrill/deskhand MCP server safe to use?
io.github.duncanbottrill/deskhand scores 64 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.duncanbottrill/deskhand MCP server expose?
io.github.duncanbottrill/deskhand exposes 94 tools: figma_server_info, figma_get_context, figma_get_selection_history, figma_bridge_diagnostics, figma_licence_status, and 89 more. Their descriptions and schemas cost roughly 7,278 tokens of context every time the server is loaded.
Is the io.github.duncanbottrill/deskhand MCP server still maintained?
io.github.duncanbottrill/deskhand is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.duncanbottrill/deskhand MCP server under?
io.github.duncanbottrill/deskhand declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.