# Figme (npm · figme-mcp)

MCP server that reads local Figma .fig files, fully offline

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-25

## Components

- npm · `figme-mcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/ntson9p-figme-mcp/figme-mcp.md), [page](https://verifymcp.io/servers/ntson9p-figme-mcp/figme-mcp)

## Channel facts

- Registry: `npm`
- Package: `figme-mcp`
- Version: `1.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-25.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 96 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2844 tokens (~237/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Figme MCP server?

Figme runs locally as an npm package, launched with npx -y figme-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add ntson9p-figme-mcp -- npx -y figme-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "ntson9p-figme-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "figme-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "ntson9p-figme-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "figme-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add ntson9p-figme-mcp -- npx -y figme-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ntson9p-figme-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "figme-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ntson9p-figme-mcp --command npx --arg -y --arg figme-mcp
```

### Hermes

```yaml
mcp_servers:
  ntson9p-figme-mcp:
    command: "npx"
    args: ["-y", "figme-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "ntson9p-figme-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "figme-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add ntson9p-figme-mcp -t stdio -c npx -a -y figme-mcp
```

### Other

```json
{
  "mcpServers": {
    "ntson9p-figme-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "figme-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-25 (score 68, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-21 (score 68)

First indexed and scored.

## MCP tools (12)

### `fig_overview` (~115 tokens)

Figma file overview

Open a local Figma .fig file and summarise it: document name, export date, node counts by type, the page list, and how many components / variables / images it holds. START HERE. Then fig_tree a page, then fig_node / fig_style on interesting guids; fig_find jumps straight to a name or a piece of text. Everything is read-only and offline.

Input parameters:

- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).

### `fig_tree` (~258 tokens)

Explore the layer tree

List the layers under a node, breadth-limited by depth (default 2, max 6). Returns a FLAT list in document order; each entry carries `depth` (relative to the requested root) and `parent`, so the hierarchy is reconstructable, and `children` (count) so you can see where to deepen. format:"outline" returns indented text lines instead of JSON and is roughly 4x denser for browsing. Large subtrees are truncated with truncated:true and a nextCursor you can pass back to continue.

Input parameters:

- `cursor` (string): Opaque nextCursor from a previous truncated response; resumes where it stopped.
- `depth` (integer): Levels below the root to include (default 2, max 6).
- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `format` (string): Default "json".
- `root` (string): Guid to start from, e.g. "2:1339"; a Figma node-id or link works too. Defaults to the DOCUMENT node.
- `types` (array): Only include these node types, e.g. ["FRAME","TEXT"]. Depth still applies.

### `fig_node` (~187 tokens)

Inspect a node

Inspect one node by guid (e.g. "2:1339"). detail:"full" (default) gives geometry, fills/strokes/effects as hex colours, corner radii, auto-layout, text basics, component and variable links, plus child summaries. detail:"raw" returns the decoded Figma record verbatim — the escape hatch for fields this server does not map yet; it is limited to one node per call and can be large.

Input parameters:

- `detail` (string): Default "full".
- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `guid` (string, required): Node guid, "sessionID:localID", e.g. "2:1339". A Figma node-id or link works too.
- `includeChildren` (boolean): Include summaries of direct children (default true).

### `fig_find` (~206 tokens)

Search layers and text

Search a file for nodes by name and by text content (case-insensitive substring), optionally restricted to node types and/or a subtree. Each hit comes back with the page it lives on, a breadcrumb of ancestor names, and which field matched — so you can jump straight to a guid and then call fig_node / fig_style. Omit `query` to list every node of the given types.

Input parameters:

- `cursor` (string): Opaque nextCursor from a previous truncated response; resumes where it stopped.
- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `limit` (integer): Default 50.
- `query` (string): Case-insensitive substring matched against layer names AND text content.
- `scope` (string): Only search inside this guid subtree. A Figma node-id or link works too.
- `types` (array): Restrict to node types, e.g. ["TEXT"].

### `fig_text` (~238 tokens)

Text inventory

Extract every string of copy in the file (or in one subtree via `scope`), in document order: guid, layer name, the characters, the page, and the base typography (font, size, line-height, colour). With includeRuns:true each node also carries its styled runs — the mixed-format spans Figma stores per UTF-16 code unit — with only the fields each run overrides. Use this for copy audits and translation passes rather than walking the tree.

Input parameters:

- `cursor` (string): Opaque nextCursor from a previous truncated response; resumes where it stopped.
- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `includePath` (boolean): Include the ancestor breadcrumb per node (default false; costs tokens).
- `includeRuns` (boolean): Include per-run style overrides (default false; costs many more tokens).
- `includeStyle` (boolean): Include font / size / line-height / colour per node (default true).
- `scope` (string): Only collect text inside this guid subtree. A Figma node-id or link works too.

### `fig_style` (~165 tokens)

Resolved style of a node

The flattened style of one node, shaped for writing code: hex fills / strokes / effects, corner radii, typography, and auto-layout translated into CSS flexbox terms (display, direction, gap, padding, justifyContent, alignItems, sizing) plus how the node behaves inside its parent layout (flexGrow, alignSelf, margin). Shared styles and variable bindings are named whenever they resolve inside this file.

Input parameters:

- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `guid` (string, required): Node guid, e.g. "2:1339". A Figma node-id or link works too.
- `includeRuns` (boolean): For TEXT nodes, also return styled runs (default false).

### `fig_components` (~176 tokens)

Component catalogue

List the components (SYMBOL nodes) defined in the file: guid, name, description, the component-set it belongs to when it is a variant, its property definitions with defaults, and how many instances of it exist. Filter with `query` (case-insensitive substring of the name). Sorted by instance count, most-used first, so the load-bearing parts of the design system come back before one-off symbols. Follow up with fig_instance on a specific INSTANCE guid.

Input parameters:

- `cursor` (string): Opaque nextCursor from a previous truncated response; resumes where it stopped.
- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `limit` (integer): Default 50.
- `query` (string): Case-insensitive substring of the component name.

### `fig_instance` (~132 tokens)

Instance overrides

Explain one component INSTANCE: which SYMBOL it points at, its component-property assignments with the property names resolved, and every override it applies — each with the path down into the component, the node that path addresses, and the fields it changes. Use it to see how an instance differs from its component without diffing two subtrees.

Input parameters:

- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `guid` (string, required): Guid of an INSTANCE node, e.g. "2:1329". A Figma node-id or link works too.

### `fig_variables` (~203 tokens)

Variables and modes

List the design tokens in the file: every variable collection (VARIABLE_SET) with its modes, and every variable with its value per mode — colours as hex, numbers and strings verbatim. Aliases are followed when the target variable lives in this file; a variable published from another library is returned as its opaque assetRef instead. Filter with `set` (collection name or guid) or `query` (substring of the variable name).

Input parameters:

- `cursor` (string): Opaque nextCursor from a previous truncated response; resumes where it stopped.
- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `includeSets` (boolean): Include the collection list with their modes (default true).
- `limit` (integer): Default 100.
- `query` (string): Case-insensitive substring of the variable name.
- `set` (string): Only variables from this collection (name or guid).

### `fig_image` (~238 tokens)

Embedded image

Fetch a bitmap stored inside the .fig: pass `hash` (the 40-hex image id reported by fig_node / fig_style on an image paint), or `guid` to take the image(s) used by that node, or hash:"thumbnail" for the document preview. Small images come back as viewable image content; larger ones come back as metadata (mime, byte size, pixel dimensions) — give `savePath` to write the exact bytes to disk instead. NOTE: a .fig contains no rendered pictures of frames, only the bitmaps placed in image fills plus thumbnail.png, so this cannot screenshot a design.

Input parameters:

- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `guid` (string): Node guid; uses the image fills on that node. A Figma node-id or link works too.
- `hash` (string): 40-hex image hash, or the literal "thumbnail" for thumbnail.png.
- `savePath` (string): Write the bytes to this path (parent directories are created) instead of inlining.

### `fig_blob` (~179 tokens)

Raw blob bytes

Return the raw bytes of one entry in the file's blob table. Vector geometry, glyph outlines and similar bulk payloads are stored there and referenced by index from fields such as `vectorData.vectorNetworkBlob` and `Path.commandsBlob` (fig_node reports these as `vector.networkBlob` / `vector.fillBlobs`). This server does not decode the vector-network format — you get the bytes, base64 or hex, truncated to maxBytes with a flag when longer.

Input parameters:

- `encoding` (string): Default "base64".
- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `index` (integer, required): Blob index, as reported by fig_node `vector.*`.
- `maxBytes` (integer): Bytes to return before truncating (default 65536).

### `fig_render` (~350 tokens)

Render a node to an image

Render a node — frame, component, instance, group, shape, text, or a whole page — to a PNG the model can look at, or to SVG. Fully offline: geometry, text outlines and images all come from the file. Rendering is best-effort: read `approximated` and `unsupported` in the report before trusting fine details; exact values remain available from fig_node / fig_style / fig_text. Default output is PNG at 2x, capped to 1568 px on the longest edge; use `savePath` to write a file instead of inlining it.

Input parameters:

- `background` (string): Default "transparent". "page" fills with the page background colour.
- `file` (string, required): Path to the .fig / .figma file (absolute, or relative to the server CWD).
- `format` (string): Default "png". Falls back to SVG text when the optional rasterizer is not installed.
- `guid` (string, required): Node to render, e.g. "2:1339"; a Figma node-id or link works too. A page guid renders the whole page, downscaled to fit maxSize.
- `maxNodes` (integer): Refuse subtrees larger than this. Default 20000.
- `maxSize` (integer): Longest edge in pixels. Default 1568.
- `savePath` (string): Write the PNG/SVG to this path (directories are created) instead of inlining it. Required when the PNG exceeds 2097152 bytes or the SVG exceeds 50000 characters.
- `scale` (number): Device scale factor. Default 2. Lowered automatically to respect maxSize.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/ntson9p-figme-mcp/figme-mcp#diagnostics

## Score history

- 2026-09-25: 68
- 2026-09-24: 68
- 2026-09-23: 68
- 2026-09-22: 68
- 2026-09-21: 68

## Common questions

### What is the Figme MCP server?

Figme is an MCP server listed in the public MCP registry as io.github.ntson9p/figme-mcp. MCP server that reads local Figma .fig files, fully offline. This page covers its npm package (figme-mcp).

### Is the Figme MCP server safe to use?

Figme scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Figme MCP server expose?

Figme exposes 12 tools: fig_overview, fig_tree, fig_node, fig_find, fig_text, and 7 more. Their descriptions and schemas cost roughly 2,447 tokens of context every time the server is loaded.

### Is the Figme MCP server still maintained?

Figme is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Figme MCP server under?

Figme declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/figme-mcp
- Socket report: https://socket.dev/npm/package/figme-mcp
- Repository: https://github.com/ntson9p/figme-mcp
- Changelog RSS feed: https://verifymcp.io/servers/ntson9p-figme-mcp/figme-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/ntson9p-figme-mcp/figme-mcp.json
- HTML version of this page: https://verifymcp.io/servers/ntson9p-figme-mcp/figme-mcp