Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.LucasGorgal/localfig

NPM · LOCALFIG · SCANNED SEP 21

The Figma desktop app as an MCP server: full Plugin API for AI agents. Local, no token, no quota.

Available components

69 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency45
Schema Quality & AI Usability66
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2962 tokens (~296/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the io.github.LucasGorgal/localfig MCP server?

io.github.LucasGorgal/localfig runs locally as an npm package, launched with npx -y localfig. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · localfig

# add to Claude Code
claude mcp add lucasgorgal-localfig -- npx -y localfig
// .cursor/mcp.json
{
  "mcpServers": {
    "lucasgorgal-localfig": {
      "command": "npx",
      "args": [
        "-y",
        "localfig"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "lucasgorgal-localfig": {
      "command": "npx",
      "args": [
        "-y",
        "localfig"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add lucasgorgal-localfig -- npx -y localfig
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "lucasgorgal-localfig": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "localfig"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add lucasgorgal-localfig --command npx --arg -y --arg localfig
# ~/.hermes/config.yaml
mcp_servers:
  lucasgorgal-localfig:
    command: "npx"
    args: ["-y", "localfig"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "lucasgorgal-localfig": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "localfig"
      ]
    }
  }
}
# add to Vellum
assistant mcp add lucasgorgal-localfig -t stdio -c npx -a -y localfig
// mcp.json
{
  "mcpServers": {
    "lucasgorgal-localfig": {
      "command": "npx",
      "args": [
        "-y",
        "localfig"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 15 Sept 26 69

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 21 Sept 2026 · Analysed npm/localfig@0.4.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 0 packages
Packages resolved 0
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 10 exposed · ~2,917 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
figma_changes ~232

Report what changed in the file since your last check: nodes created, deleted or edited, with the properties that changed. Use it before editing a design the person may have touched, so you do not overwrite their work, and pass the returned seq as since on the next call. Edits made by localfig's own tools are hidden unless includePlugin is true. They are recognized by timing, so an edit the person makes within two seconds of a tool call can be misattributed. Only pages the plugin has seen are tracked, and the buffer keeps the last 1000 changes. Read-only. Returns {seq, total, returned, summary, changes}, where summary groups the listed changes per node.

NameTypeReqDescription
includePluginbooleanAlso include edits made by localfig's own tools. Default false.
limitintegerMaximum number of changes to list, keeping the newest. The summary covers only the listed changes. Default 200.
sinceintegerThe seq value returned by your previous call; only newer changes are returned. Omit to get everything still in the buffer.

No output schema declared.

No examples provided.

figma_eval ~479

Run JavaScript against the Figma file where the localfig plugin is open, with the full Figma Plugin API. Use it to create, edit, move or delete nodes, and for anything the other tools do not cover. For reading a design, prefer figma_metadata, figma_find and figma_tokens; for images from disk, use figma_place_image. Behavior: the code can change or delete anything in the file. Each call is one undo step for the person, and figma_history can undo it within 60 seconds. Returns the JSON-serialized value of your return statement. Return plain data such as ids, names and numbers, because Figma nodes collapse to {id, name, type}. Code rules: - The body runs inside an async function, so await and return both work. Globals: figma and helpers. - Use await figma.getNodeByIdAsync(id); the synchronous getNodeById is unavailable. Switch pages with await figma.setCurrentPageAsync(page). - Load fonts before changing text, or use helpers.setText. - resize() resets text auto-resize and auto-layout sizing modes, so set those after resizing, or use helpers.set and helpers.createText, which do it in the right order. - End with helpers.reveal(nodes) so the person sees what changed. helpers: setText(node, chars), loadNodeFonts(node), createText({characters, font, fontSize, color, width, lineHeight, letterSpacing, name, parent, x, y}), set(node, props), rgb("#rrggbb"), rgba("#rrggbbaa"), query(root, selector), createAutoLayout(direction, props), reveal(nodes), notify(message), collection(name, modes), token(collection, name, type, value), bind(node, property, variable), importComponent(key), instance(key, parent, props), command(kind, payload).

NameTypeReqDescription
codestringyesJavaScript body to run. Use return to send JSON-serializable data back, for example: const n = await figma.getNodeByIdAsync("10:59"); return { id: n.id, name: n.name };
timeoutMsintegerHow long to wait for the code to finish, in milliseconds. Raise it for long batch edits. Default 60000.

No output schema declared.

No examples provided.

figma_export ~375

Render nodes to image or data files, to see a design or hand it off. Use PNG to check your work visually: PNG and JPG results up to 2 MB come back inline as images. Use SVG for icons and vector assets, PDF for print, and JSON for the node tree in Figma REST API format, which design-to-code tools read; SVG and JSON up to 200 KB also come back inline as text. For layer structure without rendering, use figma_metadata. Does not change the Figma file. Writes files to the localfig exports folder, replacing files with the same name. Omitting nodeIds exports the current selection. Returns {exported}: one entry per node with its file name, path, size in bytes and, for SVG or JSON, the text.

NameTypeReqDescription
contentsOnlybooleanExport only this node, ignoring other layers that overlap it. Default true.
formatstringPNG or JPG for images, SVG for vectors, PDF for print, JSON for the node tree in Figma REST API format. Default PNG.
inlinebooleanReturn PNG and JPG results as images in the response. Set false for large batches when only the files are needed. Default true.
nodeIdsarrayIds of the nodes to export, for example ["10:59"]. Omit to export the nodes selected in Figma; the call fails if nothing is selected.
scalenumberPNG and JPG only. Size multiplier: 1 is actual size, 2 is double resolution, 0.5 is a quick preview. Default 1.
useAbsoluteBoundsbooleanUse the node's full dimensions even where it is cropped or surrounded by empty space, for example to export text layers without cropping. Default false.

No output schema declared.

No examples provided.

figma_find ~288

Search the file for nodes by type, layer name or text content. Use it to locate things in a large file before reading them with figma_metadata or editing them with figma_eval. To browse one known frame, use figma_metadata instead. Read-only. Filters combine, so a node must match every filter given; with no filters, every node is listed up to the limit. Searching all pages first loads every page, which is slower on big files. Returns {hits, scanned, pages, truncated}. Each hit has id, name, type, page, position and size, plus the first 120 characters for text nodes.

NameTypeReqDescription
limitintegerMaximum number of hits to return; truncated is true when the limit was reached. Default 200.
namestringRegular expression matched against layer names, case-insensitive, for example "button" or "^Card".
scopestring"current" searches the page open in Figma; "all" loads and searches every page, which is slower. Default current.
textstringRegular expression matched against the text of TEXT nodes, case-insensitive. When set, other node types never match.
typesarrayNode types to include, in capitals, for example ["TEXT"] or ["FRAME", "INSTANCE", "COMPONENT"]. Omit to include every type.

No output schema declared.

No examples provided.

figma_history ~233

Save a restore point, or undo localfig's most recent edit. action "snapshot" saves a named version to the file's version history, which the person can restore from Figma; use it before large or risky changes. action "undo" reverts every edit made by the most recent figma_eval, figma_place_image or figma_library import, but only within 60 seconds of that call; after that, the person can still press Ctrl+Z in Figma, where each tool call is one undo step. Snapshot adds a version and changes nothing else; undo modifies the file. Returns {ok, action}, plus the title and version id for a snapshot.

NameTypeReqDescription
actionstringyes"snapshot" saves a named version of the file; "undo" reverts the last editing tool call if it ran within the last 60 seconds.
descriptionstringSnapshot only. A longer note stored with the version.
titlestringSnapshot only. Name for the version, for example "Before redesign". Default "localfig" followed by the current date and time.

No output schema declared.

No examples provided.

figma_library ~365

Use components, styles and variables from the team libraries enabled for this file. action "collections" lists the library variable collections available; "variables" lists the variables in one collection; "import" copies one component, component set, style or variable into this file by its key and, for a component, can also place an instance. Use it to build with the team's design system instead of recreating parts. Component keys of existing instances come from figma_metadata with styles:true. Listing is read-only; import adds items to the file and counts as one undo step. Needs the teamlibrary permission, which the localfig plugin requests. Returns the list for collections and variables, or {id, name, kind} plus instanceId for an import.

NameTypeReqDescription
actionstringyes"collections" lists library variable collections; "variables" lists the variables in one collection and needs collectionKey; "import" brings one item into the file and needs key.
collectionKeystringFor action "variables": the key of a collection, taken from the collections result.
instancebooleanWhen importing a component: also place an instance of it in the file. Default false.
keystringFor action "import": the library key of the component, component set, style or variable to import.
kindstringFor action "import": what the key refers to. Default component.
parentIdstringFor a placed instance: id of the frame or page that receives it. Default is the current page.
xnumberFor a placed instance: horizontal position in pixels, relative to its parent.
ynumberFor a placed instance: vertical position in pixels, relative to its parent.

No output schema declared.

No examples provided.

figma_metadata ~309

Read the layer tree of a node or of the current page: ids, names, types, positions, sizes and text content. Use it to understand an existing design and to get node ids before editing with figma_eval. To search a large file by name or text, use figma_find instead; for the file's variables and styles, use figma_tokens. Read-only. With styles:true each node also lists its fills, strokes, effects, corner radius, auto-layout, fonts, bound variables, named styles and component properties; css:true adds the CSS Figma generates for each node. Returns {tree, nodeCount, truncated}; reading stops at maxNodes and sets truncated to true.

NameTypeReqDescription
cssbooleanAdd the CSS Figma generates for each node, for design-to-code handoff. Default false.
depthintegerHow many levels of children to include below the starting node. 0 returns only that node. Default 6.
maxNodesintegerStop after this many nodes and set truncated to true. Default 400.
nodeIdstringId of the node to start from, as returned by figma_find or figma_status, for example "10:59". Omit to read the whole current page.
stylesbooleanAdd visual properties to every node: fills, strokes, effects, opacity, corner radius, auto-layout, fonts, bound variables, named styles and component properties. Default false.

No output schema declared.

No examples provided.

figma_place_image ~284

Fill a node with a local image file, such as a photo or an illustration. Use it instead of figma_eval whenever the image comes from disk. The node must support fills, like a rectangle, ellipse or frame, and its existing fills are replaced by the image. Any format a browser can read works, including PNG, JPG, WebP, GIF, BMP and AVIF; images larger than maxSide are scaled down first, and formats Figma cannot read are converted to PNG. Counts as one undo step. Returns the image and node sizes, plus a prepared object describing any resizing or conversion.

NameTypeReqDescription
filePathstringyesAbsolute path of the image file on this computer, for example "C:/Users/me/Pictures/photo.jpg" or "/Users/me/photo.png".
maxSideintegerLargest allowed width or height in pixels; larger images are scaled down first. Default 4096, which is also Figma's limit.
nodeIdstringyesId of the node that receives the image, for example "10:59". It must support fills, such as a rectangle, ellipse or frame.
scaleModestringFILL covers the whole node and crops the overflow, FIT shows the whole image inside the node, CROP positions it with a crop transform, TILE repeats it. Default FILL.

No output schema declared.

No examples provided.

figma_status ~145

Check whether localfig can reach Figma and what the plugin is looking at. Call it first in a session, whenever another tool reports that no plugin is connected or times out, and after the person switches files. Read-only. Returns the bridge state: owner or client, version and export folder. When the Figma plugin is connected it also returns the file name, editor type, current page, all pages, the current selection, the top-level layers of the page with positions and sizes, the signed-in user's name when available, and whether code execution is available for figma_eval. When the plugin is not connected, the result explains how to start it in Figma.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

figma_tokens ~207

List the design system defined in the open file: every local variable collection with its modes and each variable's value per mode, plus local paint, text and effect styles. Use it before generating code from a design or building new screens, so you reuse existing tokens instead of hard-coding colors and sizes. Variables from team libraries are not included; use figma_library for those. To see which token a specific node uses, call figma_metadata with styles:true. Read-only. Colors are hex strings and aliases appear as {variable name}. Returns {collections, styles, counts}.

NameTypeReqDescription
collectionstringOnly return collections whose name contains this text, case-insensitive, for example "Brand". Omit for all collections.
includeStylesbooleanInclude local paint, text and effect styles. Default true.
maxVariablesintegerStop after this many variables in total; the collection being read when the limit is reached is marked truncated. Default 2000.

No output schema declared.

No examples provided.

Common questions

What is the io.github.LucasGorgal/localfig MCP server?

io.github.LucasGorgal/localfig is an MCP server listed in the public MCP registry as io.github.LucasGorgal/localfig. The Figma desktop app as an MCP server: full Plugin API for AI agents. Local, no token, no quota. This page covers its npm package (localfig).

Is the io.github.LucasGorgal/localfig MCP server safe to use?

io.github.LucasGorgal/localfig scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.LucasGorgal/localfig MCP server expose?

io.github.LucasGorgal/localfig exposes 10 tools: figma_status, figma_eval, figma_metadata, figma_export, figma_tokens, and 5 more. Their descriptions and schemas cost roughly 2,917 tokens of context every time the server is loaded.

Is the io.github.LucasGorgal/localfig MCP server still maintained?

io.github.LucasGorgal/localfig is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.LucasGorgal/localfig MCP server under?

io.github.LucasGorgal/localfig declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.