# figmcp (npm · @irshad.io/figma-local-mcp)

Local Figma MCP server: frames to Flutter, React and HTML code, and design in Figma. No API limits.

- Trust score: 73/100 (medium)
- Change this week: +7
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-23

## Components

- npm · `@irshad.io/figma-local-mcp`: 73/100 (this document), [markdown](https://verifymcp.io/servers/irshadio-figmcp/irshad-io-figma-local-mcp.md), [page](https://verifymcp.io/servers/irshadio-figmcp/irshad-io-figma-local-mcp)

## Channel facts

- Registry: `npm`
- Package: `@irshad.io/figma-local-mcp`
- Version: `1.6.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-23.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 35 of 117 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 75/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4232 tokens (~282/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 91% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the figmcp MCP server?

figmcp runs locally as an npm package, launched with npx -y @irshad.io/figma-local-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add irshadio-figmcp -- npx -y @irshad.io/figma-local-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "irshadio-figmcp": {
      "command": "npx",
      "args": [
        "-y",
        "@irshad.io/figma-local-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "irshadio-figmcp": {
      "command": "npx",
      "args": [
        "-y",
        "@irshad.io/figma-local-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add irshadio-figmcp -- npx -y @irshad.io/figma-local-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "irshadio-figmcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@irshad.io/figma-local-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add irshadio-figmcp --command npx --arg -y --arg @irshad.io/figma-local-mcp
```

### Hermes

```yaml
mcp_servers:
  irshadio-figmcp:
    command: "npx"
    args: ["-y", "@irshad.io/figma-local-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "irshadio-figmcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@irshad.io/figma-local-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add irshadio-figmcp -t stdio -c npx -a -y @irshad.io/figma-local-mcp
```

### Other

```json
{
  "mcpServers": {
    "irshadio-figmcp": {
      "command": "npx",
      "args": [
        "-y",
        "@irshad.io/figma-local-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-22 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-20 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-19 (score 71, +5)

- [security regression] Tool safety: pass → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Schema quality: 218 → 282
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Stability: unverified → 0.13
- [functional] Schema quality: good → excellent
- [functional] Destructive annotations: All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
- [functional] Package version: 1.4.2 → 1.6.0

### 2026-10-15 (score 66, +28)

- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 95
- [functional] First check of Destructive annotations: 0
- [functional] First check of Schema quality: good

### 2026-10-14 (score 38)

First indexed and scored.

## MCP tools (15)

### `get_design_context` (~614 tokens)

Get Design Context

Get design context for a Figma node — the primary tool for design-to-code workflows. Returns reference code (Flutter widgets for Flutter projects, HTML + Tailwind for static sites, React + Tailwind otherwise), the assets it uses, a screenshot and the variables in the node. The code must be adapted to the target project. Use the nodeId parameter to specify a node id; from a URL like https://figma.com/design/:fileKey/:fileName?node-id=1-2 the node id is 1:2. With no nodeId the current selection in Figma is used. Large nodes return metadata instead of code unless forceCode is set.

Input parameters:

- `assetsDir` (string): Folder of the asset files in the code. Flutter default: the svg/png/images folders of the project's pubspec.yaml, else assets/figma. React default: public/figma (static/figma for SvelteKit), loaded b…
- `clientFrameworks` (string): Comma separated frameworks of the client, e.g. "flutter" (picks the framework).
- `clientLanguages` (string): Comma separated languages of the client, e.g. "dart" (picks the framework).
- `disableCodeConnect` (boolean): Draw mapped components from their layers instead of naming the code component.
- `excludeScreenshot` (boolean): Leave the screenshot out of the response.
- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `forceCode` (boolean): Always return code, even for very large nodes.
- `framework` (string): Code to generate: react, html or flutter. Default: from clientFrameworks / clientLanguages, else FIGMA_LOCAL_MCP_FRAMEWORK, else flutter when the project has a pubspec.yaml, html for a static site (i…
- `nodeId` (string): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.
- `page` (boolean): React and HTML: draw the node as a web page that fills the viewport, never narrower than the design, with full-width sections stretching (default: frames 768 or more wide).
- `screen` (boolean): Draw the node as a phone screen that fills the screen and scrolls when tall (default: portrait frames 300-480 wide).
- `screenUtil` (boolean): Flutter: write lengths with flutter_screenutil (.w, .h, .r, .sp) so the layout scales from the design size (default: when the project's pubspec.yaml depends on flutter_screenutil).
- `skillNames` (string): Accepted for compatibility (logging only).

### `get_metadata` (~189 tokens)

Get Metadata

IMPORTANT: Always prefer to use get_design_context. Get metadata for a node or page in XML format: node IDs, layer types, names, positions and sizes, useful for an overview of the structure. nodeId can be a page id (e.g. 0:1). When nodeId is omitted, returns the pages of the document (and saved snapshots) instead. When something is selected in Figma, the response starts with a "Currently selected nodes:" block.

Input parameters:

- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `nodeId` (string): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

### `get_screenshot` (~223 tokens)

Get Screenshot

Generate a screenshot for a given node or the currently selected node in Figma. maxDimension (default 1024) caps the longer edge of the PNG (up to 2x the node size). The response gives a local URL and file path plus width/height and original_width/original_height. Set enableBase64Response to also get the image inline.

Input parameters:

- `contentsOnly` (boolean): Render the node in isolation, without overlapping content.
- `enableBase64Response` (boolean): Also include the PNG inline as base64.
- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `maxDimension` (integer): Longest edge of the PNG in pixels (default 1024).
- `nodeId` (string): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

### `get_variable_defs` (~184 tokens)

Get Variable Definitions

Get variable definitions for a given node id. E.g. {'icon/default/secondary': #949494}. Variables and styles are reusable values applied to colours, fonts, sizes and spacings. Values resolve for the node's own mode. Read-only; with no nodeId it uses the selection. Use it for design tokens, and get_design_context for the layout. Without the plugin, a saved snapshot gives the raw values only, without names.

Input parameters:

- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `nodeId` (string): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

### `download_assets` (~181 tokens)

Download Assets

Download assets for a single node: an exported render (`export`), the original images used as fills (`rawImages`, up to 20) and SVGs of the vector layers (`svgAssets`, up to 20). defaultFormat and defaultScale set the export format (png, jpg, svg, pdf) and scale (default png at 1).

Input parameters:

- `defaultFormat` (string)
- `defaultScale` (number)
- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `nodeId` (string): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

### `get_code_connect_map` (~152 tokens)

Get Code Connect Mapping

Get the mapping from the component instances in a node to code components: { nodeId: { codeConnectName, codeConnectSrc, label } }, plus the components that are not mapped yet. Mappings live in the project (.figma-local/code-connect.json under the working directory).

Input parameters:

- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `nodeId` (string): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

### `add_code_connect_map` (~186 tokens)

Add Code Connect Mapping

Map a design component to a code component, so get_design_context names the code component for every instance of it. Pass an instance, component or component set id; a component in a set maps the whole set.

Input parameters:

- `componentName` (string, required): Code component name, e.g. AppPrimaryButton.
- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `label` (string): Framework, e.g. Flutter or React.
- `nodeId` (string, required): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.
- `source` (string, required): Path of the code component in the project.

### `remove_code_connect_map` (~161 tokens)

Remove Code Connect Mapping

Remove the code component mapping saved by add_code_connect_map, so get_design_context stops naming that code component. Pass an instance, component or component set id. Only the local mapping file changes, never the design; returns how many mappings were removed (0 when none existed). Add it again with add_code_connect_map to undo.

Input parameters:

- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `nodeId` (string, required): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.

### `whoami` (~56 tokens)

Connection Status

Status of the local Figma connection: whether the plugin is connected, the pairing code it needs, the open file, page and selection, the project and its Code Connect file, and the saved snapshots. Use it when a read fails.

### `import_design_export` (~109 tokens)

Import Design Export

Save a design export JSON (frames with node trees, as the plugin produces) as a snapshot, so its nodes can be read without the plugin. Use it for an export made earlier with save_design_export or the plugin. Copies the file into the local snapshot store, replacing an earlier snapshot of the same frames; the source file and the Figma file are not changed. Fails if the JSON is not a design export.

Input parameters:

- `path` (string, required): Absolute path of the export JSON file.

### `save_design_export` (~191 tokens)

Save Design Export

Write a full design export of a node (default: the selection) to a JSON file: the node tree with every layout, paint, text, variable, style, component and interaction detail, icon SVGs, renders of masked or rotated groups, image fills and a 2x preview. Mapped components carry their code component. Use it to hand a frame to a build script.

Input parameters:

- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `nodeId` (string): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.
- `path` (string): Absolute .json path to write (default: the data folder).

### `use_figma` (~564 tokens)

Edit Design

Create or edit designs in the file open in Figma Desktop by running JavaScript against the Figma plugin API. `code` is the body of an async function with `figma` in scope: use await, and `return` a value (nodes come back as {id, name, type, x, y, width, height}); console.log output is returned too. The whole run is one undo step. If the script throws, the changes it made before the error stay.

Rules of the plugin API here:
\- The file uses dynamic page loading: use figma.getNodeByIdAsync, figma.setCurrentPageAsync, await page.loadAsync() before reading another page, getMainComponentAsync, and the *Async style/variable getters.
\- Load every font before setting text or text properties: await figma.loadFontAsync({ family: "Inter", style: "Regular" }). Check figma.listAvailableFontsAsync() when unsure a font exists.
\- Colours are 0-1 RGB: fills = [{ type: "SOLID", color: { r: 1, g: 0.4, b: 0 } }]. Paint arrays are immutable: assign a new array.
\- Prefer auto layout: layoutMode, itemSpacing, padding*, primaryAxisAlignItems, counterAxisAlignItems; set layoutSizingHorizontal/Vertical ("FILL", "HUG", "FIXED") only after the node is appended to an auto-layout parent.
\- New nodes land on the current page: place top-level frames clear of existing ones, and append children with parent.appendChild(node).
\- Reuse what the file has: find its components, styles and variables with search_design_system first, and set bound variables with figma.variables.setBoundVariableForPaint.
\- Images from the web: const img = await figma.createImageAsync(url), then fills = [{ type: "IMAGE", imageHash: img.hash, scaleMode: "FILL" }]. fetch(url) works too (e.g. an SVG for figma.createNodeFromSvg). Local files go in with place_image.
\- figma.currentPage.selection = [node] and figma.viewport.scrollAndZoomIntoView([node]) show the result.

Build a screen in a few calls (structure, then sections), return the ids, and check each step with get_screenshot.

Input parameters:

- `code` (string, required): Body of an async function run with `figma` in scope.
- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `timeoutMs` (integer): How long to wait for the script, in ms (default 60000).

### `place_image` (~332 tokens)

Place Image

Put an image file from this computer into the file open in Figma Desktop: a PNG, JPG or GIF becomes a rectangle with the image fill (or the fill of the layer `nodeId`), and an SVG becomes editable vector layers. Use it for the project's own assets (logos, icons, photos) while designing; use_figma with figma.createImageAsync(url) takes images from the web. The new layer goes into `parentId` (default: the current page, right of its content), sized by `width`/`height` (one keeps the aspect ratio; default: the image's own size). Images larger than 4096 px on a side are scaled down by Figma.

Input parameters:

- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `height` (number)
- `keepFills` (boolean): With nodeId: add the image above the existing fills instead of replacing them.
- `name` (string): Layer name (default: the file name).
- `nodeId` (string): Set the image as the fill of this layer instead of making a new one (not for SVG).
- `parentId` (string): Frame or group to put the new layer in.
- `path` (string, required): Path of the image file (absolute, or relative to the project).
- `scaleMode` (string): How the image fills the layer (default FILL).
- `width` (number)
- `x` (number)
- `y` (number)

### `verify_code` (~701 tokens)

Verify Code

Check Flutter or React + Tailwind code against the design: renders it at 2x (Flutter with `flutter test`, React in headless Chrome with Tailwind) and compares the render with Figma's own 2x render of the node. Returns analyzer or runtime errors (overflows, missing assets, broken images), the share of differing pixels and a diff image (the design in grey, differing pixels in red).

React and HTML: without `file` it checks the code get_design_context generates and compares every layer's box too. With `file` (a .jsx or .tsx under a folder with package.json, or an .html page) it renders that file's default export or page: it must be self-contained apart from React and image imports; images load from the project's public folder. Pass `css` for the stylesheet with its tokens. React and Tailwind load from a CDN and the fonts from the system or Google Fonts. Needs Chrome and the puppeteer-core package.

Flutter: With `file`, it checks that widget inside its own Flutter project: the project's packages and assets, inside a MaterialApp, scaled by flutter_screenutil to the frame size when the project uses it. The widget needs a constructor without arguments. Without `file`, it checks the reference code get_design_context generates and also compares every layer's box. Use it after implementing a frame, and fix what it reports. Text in fonts it cannot find is drawn in a fallback font, and emoji have no colour font in the test, so text after them shifts. A run takes from 20 seconds to a few minutes.

Input parameters:

- `clientFrameworks` (string): Comma separated frameworks of the client, e.g. "flutter" (picks the framework).
- `clientLanguages` (string): Comma separated languages of the client, e.g. "dart" (picks the framework).
- `css` (string): React: a CSS file to load with the component, e.g. its global stylesheet with the design tokens.
- `file` (string): Flutter: the .dart file with the widget, under the project's lib/. React: the .jsx/.tsx component file. Absolute, or relative to the project.
- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `flutter` (string): Path of the flutter tool, when it is not on PATH.
- `fonts` (array): Folders with font files (default: the project's assets/fonts and the system fonts).
- `framework` (string): flutter or react (default: from the file, else as get_design_context picks: the client, then the project).
- `nodeId` (string): The ID of the node, eg. "123:456" or "123-456" (instance ids like "I1:2;3:4" work too). Omit it to use the current selection in Figma.
- `tailwind`: React: the Tailwind major version (default: the project's, else 4).
- `viewport` (string): Lay the code out on a screen of this size, e.g. "360x780", and report runtime errors (overflows) and layers pushed off screen instead of comparing.
- `widget` (string): Flutter: the widget class in `file` (default: its first widget class).

### `search_design_system` (~286 tokens)

Search Design System

Search the design system of the file open in Figma Desktop: local components and component sets (with their properties and variant options), library components the file already uses (with an instance to copy), and local paint, text and effect styles and variables (with their default-mode values). Every word of `query` must appear in the name or description; leave it empty to list everything. Call it before designing with use_figma, and reuse what it finds: figma.getNodeByIdAsync(id) then component.createInstance(), instance.clone() for a library component, figma.getStyleByIdAsync and figma.variables.getVariableByIdAsync. Libraries the file does not use yet are not visible to the plugin; instancesNotScanned means the page was too large to look through all its instances. Needs the plugin and Design mode.

Input parameters:

- `allPages` (boolean): Search components on every page, not just the current one (slower on large files).
- `fileKey` (string): The key of the Figma file. Accepted for compatibility; the file open in Figma Desktop is always used.
- `kinds` (array): What to search (default: all of components, styles, variables).
- `limit` (integer): Most results per kind (default 50).
- `query` (string): Words to look for, e.g. "button primary".

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/irshadio-figmcp/irshad-io-figma-local-mcp#diagnostics

## Score history

- 2026-10-23: 73
- 2026-10-22: 73
- 2026-10-21: 72
- 2026-10-20: 72
- 2026-10-19: 71
- 2026-10-18: 66
- 2026-10-17: 66
- 2026-10-16: 66
- 2026-10-15: 66
- 2026-10-14: 38

## Common questions

### What is the figmcp MCP server?

figmcp is an MCP server listed in the public MCP registry as io.github.irshadio/figmcp. Local Figma MCP server: frames to Flutter, React and HTML code, and design in Figma. No API limits. This page covers its npm package (@irshad.io/figma-local-mcp).

### Is the figmcp MCP server safe to use?

figmcp scores 73 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 23 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the figmcp MCP server expose?

figmcp exposes 15 tools: get_design_context, get_metadata, get_screenshot, get_variable_defs, download_assets, and 10 more. Their descriptions and schemas cost roughly 4,129 tokens of context every time the server is loaded.

### Is the figmcp MCP server still maintained?

figmcp is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the figmcp MCP server under?

figmcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@irshad.io/figma-local-mcp
- Socket report: https://socket.dev/npm/package/@irshad.io/figma-local-mcp
- Repository: https://github.com/irshadio/figmcp
- Website: https://figmcp.web.app/
- Changelog RSS feed: https://verifymcp.io/servers/irshadio-figmcp/irshad-io-figma-local-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/irshadio-figmcp/irshad-io-figma-local-mcp.json
- HTML version of this page: https://verifymcp.io/servers/irshadio-figmcp/irshad-io-figma-local-mcp