Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

figmcp

NPM · @IRSHAD.IO/FIGMA-LOCAL-MCP

Local Figma MCP server: frames to Flutter, React and HTML code, and design in Figma. No API limits.

+7 this week 73 Trust /100

Last scanned (21 hours ago)

Scores higher than 43% of npm servers

Category Design and Media

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 35 of 117 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability75
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4232 tokens (~282/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 91% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 22 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Oct 26 +5
    • Tool safety: pass → unverified ▼ security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • Schema quality: 218 → 282 ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Schema quality: unverified → 100 ▲ functional
    • Stability: unverified → 0.13 ▲ functional
    • Schema quality: good → excellent functional
    • Destructive annotations: All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation. functional
    • Package version: 1.4.2 → 1.6.0 functional
  • 15 Oct 26 +28
    • Injection markers: unverified → pass ▲ security
    • First check of Judged manipulation: pass security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • Tool coverage: unverified → 100 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • First check of Schema quality: fail functional
    • First check of Schema quality: fail functional
    • First check of Tool coverage: 95 functional
    • First check of Destructive annotations: 0 functional
    • First check of Schema quality: good functional
  • 14 Oct 26 38

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 23 Oct 2026 · Analysed npm/@irshad.io/figma-local-mcp@1.6.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 117 packages
Packages resolved 117
Stale 35
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 15 exposed · ~4,129 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_code_connect_map ~186

Map a design component to a code component, so get_design_context names the code component for every instance of it. Pass an instance, component or component set id; a component in a set maps the whole set.

NameTypeReqDescription
componentNamestringyesCode component name, e.g. AppPrimaryButton.
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
labelstring–Framework, e.g. Flutter or React.
nodeIdstringyesThe ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.
sourcestringyesPath of the code component in the project.

No output schema declared.

No examples provided.

download_assets ~181

Download assets for a single node: an exported render (`export`), the original images used as fills (`rawImages`, up to 20) and SVGs of the vector layers (`svgAssets`, up to 20). defaultFormat and defaultScale set the export format (png, jpg, svg, pdf) and scale (default png at 1).

NameTypeReqDescription
defaultFormatstring––
defaultScalenumber––
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
nodeIdstring–The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

No output schema declared.

No examples provided.

get_code_connect_map ~152

Get the mapping from the component instances in a node to code components: { nodeId: { codeConnectName, codeConnectSrc, label } }, plus the components that are not mapped yet. Mappings live in the project (.figma-local/code-connect.json under the working directory).

NameTypeReqDescription
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
nodeIdstring–The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

No output schema declared.

No examples provided.

get_design_context ~614

Get design context for a Figma node — the primary tool for design-to-code workflows. Returns reference code (Flutter widgets for Flutter projects, HTML + Tailwind for static sites, React + Tailwind otherwise), the assets it uses, a screenshot and the variables in the node. The code must be adapted to the target project. Use the nodeId parameter to specify a node id; from a URL like https://figma.com/design/:fileKey/:fileName?node-id=1-2 the node id is 1:2. With no nodeId the current selection in Figma is used. Large nodes return metadata instead of code unless forceCode is set.

NameTypeReqDescription
assetsDirstring–Folder of the asset files in the code. Flutter default: the svg/png/images folders of the project's pubspec.yaml, else assets/figma. React default: public/figma (static/figma for SvelteKit), loaded b…
clientFrameworksstring–Comma separated frameworks of the client, e.g. "flutter" (picks the framework).
clientLanguagesstring–Comma separated languages of the client, e.g. "dart" (picks the framework).
disableCodeConnectboolean–Draw mapped components from their layers instead of naming the code component.
excludeScreenshotboolean–Leave the screenshot out of the response.
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
forceCodeboolean–Always return code, even for very large nodes.
frameworkstring–Code to generate: react, html or flutter. Default: from clientFrameworks / clientLanguages, else FIGMA_LOCAL_MCP_FRAMEWORK, else flutter when the project has a pubspec.yaml, html for a static site (i…
nodeIdstring–The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.
pageboolean–React and HTML: draw the node as a web page that fills the viewport, never narrower than the design, with full-width sections stretching (default: frames 768 or more wide).
screenboolean–Draw the node as a phone screen that fills the screen and scrolls when tall (default: portrait frames 300-480 wide).
screenUtilboolean–Flutter: write lengths with flutter_screenutil (.w, .h, .r, .sp) so the layout scales from the design size (default: when the project's pubspec.yaml depends on flutter_screenutil).
skillNamesstring–Accepted for compatibility (logging only).

No output schema declared.

No examples provided.

get_metadata ~189

IMPORTANT: Always prefer to use get_design_context. Get metadata for a node or page in XML format: node IDs, layer types, names, positions and sizes, useful for an overview of the structure. nodeId can be a page id (e.g. 0:1). When nodeId is omitted, returns the pages of the document (and saved snapshots) instead. When something is selected in Figma, the response starts with a "Currently selected nodes:" block.

NameTypeReqDescription
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
nodeIdstring–The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

No output schema declared.

No examples provided.

get_screenshot ~223

Generate a screenshot for a given node or the currently selected node in Figma. maxDimension (default 1024) caps the longer edge of the PNG (up to 2x the node size). The response gives a local URL and file path plus width/height and original_width/original_height. Set enableBase64Response to also get the image inline.

NameTypeReqDescription
contentsOnlyboolean–Render the node in isolation, without overlapping content.
enableBase64Responseboolean–Also include the PNG inline as base64.
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
maxDimensioninteger–Longest edge of the PNG in pixels (default 1024).
nodeIdstring–The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

No output schema declared.

No examples provided.

get_variable_defs ~184

Get variable definitions for a given node id. E.g. {'icon/default/secondary': #949494}. Variables and styles are reusable values applied to colours, fonts, sizes and spacings. Values resolve for the node's own mode. Read-only; with no nodeId it uses the selection. Use it for design tokens, and get_design_context for the layout. Without the plugin, a saved snapshot gives the raw values only, without names.

NameTypeReqDescription
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
nodeIdstring–The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

No output schema declared.

No examples provided.

import_design_export ~109

Save a design export JSON (frames with node trees, as the plugin produces) as a snapshot, so its nodes can be read without the plugin. Use it for an export made earlier with save_design_export or the plugin. Copies the file into the local snapshot store, replacing an earlier snapshot of the same frames; the source file and the Figma file are not changed. Fails if the JSON is not a design export.

NameTypeReqDescription
pathstringyesAbsolute path of the export JSON file.

No output schema declared.

No examples provided.

place_image ~332

Put an image file from this computer into the file open in Figma Desktop: a PNG, JPG or GIF becomes a rectangle with the image fill (or the fill of the layer `nodeId`), and an SVG becomes editable vector layers. Use it for the project's own assets (logos, icons, photos) while designing; use_figma with figma.createImageAsync(url) takes images from the web. The new layer goes into `parentId` (default: the current page, right of its content), sized by `width`/`height` (one keeps the aspect ratio; default: the image's own size). Images larger than 4096 px on a side are scaled down by Figma.

NameTypeReqDescription
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
heightnumber––
keepFillsboolean–With nodeId: add the image above the existing fills instead of replacing them.
namestring–Layer name (default: the file name).
nodeIdstring–Set the image as the fill of this layer instead of making a new one (not for SVG).
parentIdstring–Frame or group to put the new layer in.
pathstringyesPath of the image file (absolute, or relative to the project).
scaleModestring–How the image fills the layer (default FILL).
widthnumber––
xnumber––
ynumber––

No output schema declared.

No examples provided.

remove_code_connect_map ~161

Remove the code component mapping saved by add_code_connect_map, so get_design_context stops naming that code component. Pass an instance, component or component set id. Only the local mapping file changes, never the design; returns how many mappings were removed (0 when none existed). Add it again with add_code_connect_map to undo.

NameTypeReqDescription
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
nodeIdstringyesThe ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

No output schema declared.

No examples provided.

save_design_export ~191

Write a full design export of a node (default: the selection) to a JSON file: the node tree with every layout, paint, text, variable, style, component and interaction detail, icon SVGs, renders of masked or rotated groups, image fills and a 2x preview. Mapped components carry their code component. Use it to hand a frame to a build script.

NameTypeReqDescription
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
nodeIdstring–The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.
pathstring–Absolute .json path to write (default: the data folder).

No output schema declared.

No examples provided.

search_design_system ~286

Search the design system of the file open in Figma Desktop: local components and component sets (with their properties and variant options), library components the file already uses (with an instance to copy), and local paint, text and effect styles and variables (with their default-mode values). Every word of `query` must appear in the name or description; leave it empty to list everything. Call it before designing with use_figma, and reuse what it finds: figma.getNodeByIdAsync(id) then component.createInstance(), instance.clone() for a library component, figma.getStyleByIdAsync and figma.variables.getVariableByIdAsync. Libraries the file does not use yet are not visible to the plugin; instancesNotScanned means the page was too large to look through all its instances. Needs the plugin and Design mode.

NameTypeReqDescription
allPagesboolean–Search components on every page, not just the current one (slower on large files).
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
kindsarray–What to search (default: all of components, styles, variables).
limitinteger–Most results per kind (default 50).
querystring–Words to look for, e.g. "button primary".

No output schema declared.

No examples provided.

use_figma ~564

Create or edit designs in the file open in Figma Desktop by running JavaScript against the Figma plugin API. `code` is the body of an async function with `figma` in scope: use await, and `return` a value (nodes come back as {id, name, type, x, y, width, height}); console.log output is returned too. The whole run is one undo step. If the script throws, the changes it made before the error stay. Rules of the plugin API here: - The file uses dynamic page loading: use figma.getNodeByIdAsync, figma.setCurrentPageAsync, await page.loadAsync() before reading another page, getMainComponentAsync, and the *Async style/variable getters. - Load every font before setting text or text properties: await figma.loadFontAsync({ family: "Inter", style: "Regular" }). Check figma.listAvailableFontsAsync() when unsure a font exists. - Colours are 0-1 RGB: fills = [{ type: "SOLID", color: { r: 1, g: 0.4, b: 0 } }]. Paint arrays are immutable: assign a new array. - Prefer auto layout: layoutMode, itemSpacing, padding*, primaryAxisAlignItems, counterAxisAlignItems; set layoutSizingHorizontal/Vertical ("FILL", "HUG", "FIXED") only after the node is appended to an auto-layout parent. - New nodes land on the current page: place top-level frames clear of existing ones, and append children with parent.appendChild(node). - Reuse what the file has: find its components, styles and variables with search_design_system first, and set bound variables with figma.variables.setBoundVariableForPaint. - Images from the web: const img = await figma.createImageAsync(url), then fills = [{ type: "IMAGE", imageHash: img.hash, scaleMode: "FILL" }]. fetch(url) works too (e.g. an SVG for figma.createNodeFromSvg). Local files go in with place_image. - figma.currentPage.selection = [node] and figma.viewport.scrollAndZoomIntoView([node]) show the result. Build a screen in a few calls (structure, then sections), return the ids, and check each step with get_screenshot.

NameTypeReqDescription
codestringyesBody of an async function run with `figma` in scope.
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
timeoutMsinteger–How long to wait for the script, in ms (default 60000).

No output schema declared.

No examples provided.

verify_code ~701

Check Flutter or React + Tailwind code against the design: renders it at 2x (Flutter with `flutter test`, React in headless Chrome with Tailwind) and compares the render with Figma's own 2x render of the node. Returns analyzer or runtime errors (overflows, missing assets, broken images), the share of differing pixels and a diff image (the design in grey, differing pixels in red). React and HTML: without `file` it checks the code get_design_context generates and compares every layer's box too. With `file` (a .jsx or .tsx under a folder with package.json, or an .html page) it renders that file's default export or page: it must be self-contained apart from React and image imports; images load from the project's public folder. Pass `css` for the stylesheet with its tokens. React and Tailwind load from a CDN and the fonts from the system or Google Fonts. Needs Chrome and the puppeteer-core package. Flutter: With `file`, it checks that widget inside its own Flutter project: the project's packages and assets, inside a MaterialApp, scaled by flutter_screenutil to the frame size when the project uses it. The widget needs a constructor without arguments. Without `file`, it checks the reference code get_design_context generates and also compares every layer's box. Use it after implementing a frame, and fix what it reports. Text in fonts it cannot find is drawn in a fallback font, and emoji have no colour font in the test, so text after them shifts. A run takes from 20 seconds to a few minutes.

NameTypeReqDescription
clientFrameworksstring–Comma separated frameworks of the client, e.g. "flutter" (picks the framework).
clientLanguagesstring–Comma separated languages of the client, e.g. "dart" (picks the framework).
cssstring–React: a CSS file to load with the component, e.g. its global stylesheet with the design tokens.
filestring–Flutter: the .dart file with the widget, under the project's lib/. React: the .jsx/.tsx component file. Absolute, or relative to the project.
fileKeystring–The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
flutterstring–Path of the flutter tool, when it is not on PATH.
fontsarray–Folders with font files (default: the project's assets/fonts and the system fonts).
frameworkstring–flutter or react (default: from the file, else as get_design_context picks: the client, then the project).
nodeIdstring–The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.
tailwind––React: the Tailwind major version (default: the project's, else 4).
viewportstring–Lay the code out on a screen of this size, e.g. "360x780", and report runtime errors (overflows) and layers pushed off screen instead of comparing.
widgetstring–Flutter: the widget class in `file` (default: its first widget class).

No output schema declared.

No examples provided.

whoami ~56

Status of the local Figma connection: whether the plugin is connected, the pairing code it needs, the open file, page and selection, the project and its Code Connect file, and the saved snapshots. Use it when a read fails.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Install

How do I install the figmcp MCP server?

figmcp runs locally as an npm package, launched with npx -y @irshad.io/figma-local-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @irshad.io/figma-local-mcp

# add to Claude Code
claude mcp add irshadio-figmcp -- npx -y @irshad.io/figma-local-mcp
Common questions

What is the figmcp MCP server?

figmcp is an MCP server listed in the public MCP registry as io.github.irshadio/figmcp. Local Figma MCP server: frames to Flutter, React and HTML code, and design in Figma. No API limits. This page covers its npm package (@irshad.io/figma-local-mcp).

Is the figmcp MCP server safe to use?

figmcp scores 73 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 23 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the figmcp MCP server expose?

figmcp exposes 15 tools: get_design_context, get_metadata, get_screenshot, get_variable_defs, download_assets, and 10 more. Their descriptions and schemas cost roughly 4,129 tokens of context every time the server is loaded.

Is the figmcp MCP server still maintained?

figmcp is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the figmcp MCP server under?

figmcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.