io.github.LucasGorgal/localfig
NPM · LOCALFIG · SCANNED SEP 21
The Figma desktop app as an MCP server: full Plugin API for AI agents. Local, no token, no quota.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 6 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2962 tokens (~296/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the io.github.LucasGorgal/localfig MCP server?
io.github.LucasGorgal/localfig runs locally as an npm package, launched with npx -y localfig. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · localfig
claude mcp add lucasgorgal-localfig -- npx -y localfig
{
"mcpServers": {
"lucasgorgal-localfig": {
"command": "npx",
"args": [
"-y",
"localfig"
]
}
}
} {
"servers": {
"lucasgorgal-localfig": {
"command": "npx",
"args": [
"-y",
"localfig"
]
}
}
} codex mcp add lucasgorgal-localfig -- npx -y localfig
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"lucasgorgal-localfig": {
"type": "local",
"command": [
"npx",
"-y",
"localfig"
],
"enabled": true
}
}
} openclaw mcp add lucasgorgal-localfig --command npx --arg -y --arg localfig
mcp_servers:
lucasgorgal-localfig:
command: "npx"
args: ["-y", "localfig"] {
"McpServers": {
"lucasgorgal-localfig": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"localfig"
]
}
}
} assistant mcp add lucasgorgal-localfig -t stdio -c npx -a -y localfig
{
"mcpServers": {
"lucasgorgal-localfig": {
"command": "npx",
"args": [
"-y",
"localfig"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 15 Sept 26 69
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/localfig@0.4.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
figma_changes Recent changes in the file ~232
Report what changed in the file since your last check: nodes created, deleted or edited, with the properties that changed. Use it before editing a design the person may have touched, so you do not overwrite their work, and pass the returned seq as since on the next call. Edits made by localfig's own tools are hidden unless includePlugin is true. They are recognized by timing, so an edit the person makes within two seconds of a tool call can be misattributed. Only pages the plugin has seen are tracked, and the buffer keeps the last 1000 changes. Read-only. Returns {seq, total, returned, summary, changes}, where summary groups the listed changes per node.
| Name | Type | Req | Description |
|---|---|---|---|
| includePlugin | boolean | – | Also include edits made by localfig's own tools. Default false. |
| limit | integer | – | Maximum number of changes to list, keeping the newest. The summary covers only the listed changes. Default 200. |
| since | integer | – | The seq value returned by your previous call; only newer changes are returned. Omit to get everything still in the buffer. |
No output schema declared.
No examples provided.
figma_eval Run Figma Plugin API code ~479
Run JavaScript against the Figma file where the localfig plugin is open, with the full Figma Plugin API. Use it to create, edit, move or delete nodes, and for anything the other tools do not cover. For reading a design, prefer figma_metadata, figma_find and figma_tokens; for images from disk, use figma_place_image. Behavior: the code can change or delete anything in the file. Each call is one undo step for the person, and figma_history can undo it within 60 seconds. Returns the JSON-serialized value of your return statement. Return plain data such as ids, names and numbers, because Figma nodes collapse to {id, name, type}. Code rules: - The body runs inside an async function, so await and return both work. Globals: figma and helpers. - Use await figma.getNodeByIdAsync(id); the synchronous getNodeById is unavailable. Switch pages with await figma.setCurrentPageAsync(page). - Load fonts before changing text, or use helpers.setText. - resize() resets text auto-resize and auto-layout sizing modes, so set those after resizing, or use helpers.set and helpers.createText, which do it in the right order. - End with helpers.reveal(nodes) so the person sees what changed. helpers: setText(node, chars), loadNodeFonts(node), createText({characters, font, fontSize, color, width, lineHeight, letterSpacing, name, parent, x, y}), set(node, props), rgb("#rrggbb"), rgba("#rrggbbaa"), query(root, selector), createAutoLayout(direction, props), reveal(nodes), notify(message), collection(name, modes), token(collection, name, type, value), bind(node, property, variable), importComponent(key), instance(key, parent, props), command(kind, payload).
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | JavaScript body to run. Use return to send JSON-serializable data back, for example: const n = await figma.getNodeByIdAsync("10:59"); return { id: n.id, name: n.name }; |
| timeoutMs | integer | – | How long to wait for the code to finish, in milliseconds. Raise it for long batch edits. Default 60000. |
No output schema declared.
No examples provided.
figma_export Export or render nodes ~375
Render nodes to image or data files, to see a design or hand it off. Use PNG to check your work visually: PNG and JPG results up to 2 MB come back inline as images. Use SVG for icons and vector assets, PDF for print, and JSON for the node tree in Figma REST API format, which design-to-code tools read; SVG and JSON up to 200 KB also come back inline as text. For layer structure without rendering, use figma_metadata. Does not change the Figma file. Writes files to the localfig exports folder, replacing files with the same name. Omitting nodeIds exports the current selection. Returns {exported}: one entry per node with its file name, path, size in bytes and, for SVG or JSON, the text.
| Name | Type | Req | Description |
|---|---|---|---|
| contentsOnly | boolean | – | Export only this node, ignoring other layers that overlap it. Default true. |
| format | string | – | PNG or JPG for images, SVG for vectors, PDF for print, JSON for the node tree in Figma REST API format. Default PNG. |
| inline | boolean | – | Return PNG and JPG results as images in the response. Set false for large batches when only the files are needed. Default true. |
| nodeIds | array | – | Ids of the nodes to export, for example ["10:59"]. Omit to export the nodes selected in Figma; the call fails if nothing is selected. |
| scale | number | – | PNG and JPG only. Size multiplier: 1 is actual size, 2 is double resolution, 0.5 is a quick preview. Default 1. |
| useAbsoluteBounds | boolean | – | Use the node's full dimensions even where it is cropped or surrounded by empty space, for example to export text layers without cropping. Default false. |
No output schema declared.
No examples provided.
figma_find Find nodes ~288
Search the file for nodes by type, layer name or text content. Use it to locate things in a large file before reading them with figma_metadata or editing them with figma_eval. To browse one known frame, use figma_metadata instead. Read-only. Filters combine, so a node must match every filter given; with no filters, every node is listed up to the limit. Searching all pages first loads every page, which is slower on big files. Returns {hits, scanned, pages, truncated}. Each hit has id, name, type, page, position and size, plus the first 120 characters for text nodes.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of hits to return; truncated is true when the limit was reached. Default 200. |
| name | string | – | Regular expression matched against layer names, case-insensitive, for example "button" or "^Card". |
| scope | string | – | "current" searches the page open in Figma; "all" loads and searches every page, which is slower. Default current. |
| text | string | – | Regular expression matched against the text of TEXT nodes, case-insensitive. When set, other node types never match. |
| types | array | – | Node types to include, in capitals, for example ["TEXT"] or ["FRAME", "INSTANCE", "COMPONENT"]. Omit to include every type. |
No output schema declared.
No examples provided.
figma_history Save a version or undo ~233
Save a restore point, or undo localfig's most recent edit. action "snapshot" saves a named version to the file's version history, which the person can restore from Figma; use it before large or risky changes. action "undo" reverts every edit made by the most recent figma_eval, figma_place_image or figma_library import, but only within 60 seconds of that call; after that, the person can still press Ctrl+Z in Figma, where each tool call is one undo step. Snapshot adds a version and changes nothing else; undo modifies the file. Returns {ok, action}, plus the title and version id for a snapshot.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | "snapshot" saves a named version of the file; "undo" reverts the last editing tool call if it ran within the last 60 seconds. |
| description | string | – | Snapshot only. A longer note stored with the version. |
| title | string | – | Snapshot only. Name for the version, for example "Before redesign". Default "localfig" followed by the current date and time. |
No output schema declared.
No examples provided.
figma_library Use team library items ~365
Use components, styles and variables from the team libraries enabled for this file. action "collections" lists the library variable collections available; "variables" lists the variables in one collection; "import" copies one component, component set, style or variable into this file by its key and, for a component, can also place an instance. Use it to build with the team's design system instead of recreating parts. Component keys of existing instances come from figma_metadata with styles:true. Listing is read-only; import adds items to the file and counts as one undo step. Needs the teamlibrary permission, which the localfig plugin requests. Returns the list for collections and variables, or {id, name, kind} plus instanceId for an import.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | "collections" lists library variable collections; "variables" lists the variables in one collection and needs collectionKey; "import" brings one item into the file and needs key. |
| collectionKey | string | – | For action "variables": the key of a collection, taken from the collections result. |
| instance | boolean | – | When importing a component: also place an instance of it in the file. Default false. |
| key | string | – | For action "import": the library key of the component, component set, style or variable to import. |
| kind | string | – | For action "import": what the key refers to. Default component. |
| parentId | string | – | For a placed instance: id of the frame or page that receives it. Default is the current page. |
| x | number | – | For a placed instance: horizontal position in pixels, relative to its parent. |
| y | number | – | For a placed instance: vertical position in pixels, relative to its parent. |
No output schema declared.
No examples provided.
figma_metadata Read the layer tree ~309
Read the layer tree of a node or of the current page: ids, names, types, positions, sizes and text content. Use it to understand an existing design and to get node ids before editing with figma_eval. To search a large file by name or text, use figma_find instead; for the file's variables and styles, use figma_tokens. Read-only. With styles:true each node also lists its fills, strokes, effects, corner radius, auto-layout, fonts, bound variables, named styles and component properties; css:true adds the CSS Figma generates for each node. Returns {tree, nodeCount, truncated}; reading stops at maxNodes and sets truncated to true.
| Name | Type | Req | Description |
|---|---|---|---|
| css | boolean | – | Add the CSS Figma generates for each node, for design-to-code handoff. Default false. |
| depth | integer | – | How many levels of children to include below the starting node. 0 returns only that node. Default 6. |
| maxNodes | integer | – | Stop after this many nodes and set truncated to true. Default 400. |
| nodeId | string | – | Id of the node to start from, as returned by figma_find or figma_status, for example "10:59". Omit to read the whole current page. |
| styles | boolean | – | Add visual properties to every node: fills, strokes, effects, opacity, corner radius, auto-layout, fonts, bound variables, named styles and component properties. Default false. |
No output schema declared.
No examples provided.
figma_place_image Place an image ~284
Fill a node with a local image file, such as a photo or an illustration. Use it instead of figma_eval whenever the image comes from disk. The node must support fills, like a rectangle, ellipse or frame, and its existing fills are replaced by the image. Any format a browser can read works, including PNG, JPG, WebP, GIF, BMP and AVIF; images larger than maxSide are scaled down first, and formats Figma cannot read are converted to PNG. Counts as one undo step. Returns the image and node sizes, plus a prepared object describing any resizing or conversion.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | yes | Absolute path of the image file on this computer, for example "C:/Users/me/Pictures/photo.jpg" or "/Users/me/photo.png". |
| maxSide | integer | – | Largest allowed width or height in pixels; larger images are scaled down first. Default 4096, which is also Figma's limit. |
| nodeId | string | yes | Id of the node that receives the image, for example "10:59". It must support fills, such as a rectangle, ellipse or frame. |
| scaleMode | string | – | FILL covers the whole node and crops the overflow, FIT shows the whole image inside the node, CROP positions it with a crop transform, TILE repeats it. Default FILL. |
No output schema declared.
No examples provided.
figma_status Figma connection status ~145
Check whether localfig can reach Figma and what the plugin is looking at. Call it first in a session, whenever another tool reports that no plugin is connected or times out, and after the person switches files. Read-only. Returns the bridge state: owner or client, version and export folder. When the Figma plugin is connected it also returns the file name, editor type, current page, all pages, the current selection, the top-level layers of the page with positions and sizes, the signed-in user's name when available, and whether code execution is available for figma_eval. When the plugin is not connected, the result explains how to start it in Figma.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
figma_tokens Read design tokens and styles ~207
List the design system defined in the open file: every local variable collection with its modes and each variable's value per mode, plus local paint, text and effect styles. Use it before generating code from a design or building new screens, so you reuse existing tokens instead of hard-coding colors and sizes. Variables from team libraries are not included; use figma_library for those. To see which token a specific node uses, call figma_metadata with styles:true. Read-only. Colors are hex strings and aliases appear as {variable name}. Returns {collections, styles, counts}.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | – | Only return collections whose name contains this text, case-insensitive, for example "Brand". Omit for all collections. |
| includeStyles | boolean | – | Include local paint, text and effect styles. Default true. |
| maxVariables | integer | – | Stop after this many variables in total; the collection being read when the limit is reached is marked truncated. Default 2000. |
No output schema declared.
No examples provided.
What is the io.github.LucasGorgal/localfig MCP server?
io.github.LucasGorgal/localfig is an MCP server listed in the public MCP registry as io.github.LucasGorgal/localfig. The Figma desktop app as an MCP server: full Plugin API for AI agents. Local, no token, no quota. This page covers its npm package (localfig).
Is the io.github.LucasGorgal/localfig MCP server safe to use?
io.github.LucasGorgal/localfig scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.LucasGorgal/localfig MCP server expose?
io.github.LucasGorgal/localfig exposes 10 tools: figma_status, figma_eval, figma_metadata, figma_export, figma_tokens, and 5 more. Their descriptions and schemas cost roughly 2,917 tokens of context every time the server is loaded.
Is the io.github.LucasGorgal/localfig MCP server still maintained?
io.github.LucasGorgal/localfig is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.LucasGorgal/localfig MCP server under?
io.github.LucasGorgal/localfig declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.