figma-unified-mcp (sso-ss/figma-unified-mcp) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 108 tools. No publisher has claimed this listing.
A comprehensive MCP server that enables Claude to read, create, edit, and generate code from Figma designs. Supports design tokens, code generation to multiple frameworks, and accessibility checks.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
sso-ss
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
figma_scan_codebaseScan a local codebase directory for UI components (React, Vue, Svelte, Swift, Compose, Angular, Flutter). Returns a list of discovered components with their file paths and frameworks. Use this before figma_match_components to find code-to-design mappings.
figma_match_componentsMatch Figma components to codebase components using fuzzy name matching. Requires plugin connection for Figma scanning, and a codebase path for code scanning. Returns a mapping with confidence scores. Review before publishing.
figma_publish_dev_resourcesPublish dev resource links to Figma Dev Mode. Attaches code file URLs to component nodes. Run figma_match_components first to generate the mapping, then publish selected matches. The links will appear in Figma's Dev Mode panel for each component.
figma_get_dev_resourcesGet existing dev resources (code links) attached to nodes in a Figma file.
figma_generate_cssGenerate CSS from a node's styles.
figma_generate_reactGenerate React component from a node.
figma_generate_swiftuiGenerate SwiftUI code from a node.
figma_generate_htmlGenerate semantic HTML from a node.
figma_generate_tailwind_configGenerate Tailwind config from Figma design tokens.
figma_generate_tokensExport design tokens (CSS vars, JSON, SCSS).
figma_analyze_for_codegenAnalyze node structure for best codegen strategy.
figma_codegen_bundleGet a complete design-to-code bundle in a single call (REST-only, no plugin needed). Returns: - Compact tree with colors, fonts, layout, image refs, gradients, shadows - Image fill URLs (CDN links for raster images) - Vector/icon SVG URLs (rendered via Figma API) - Screenshot of the node (base64 PNG…
figma_statusCheck server, bridge, and REST API status.
figma_connect_pluginConnect to Figma plugin via WebSocket.
figma_send_commandSend a raw command to the plugin.
figma_create_frameCreate a frame with full auto-layout, stroke, and nested children support.
figma_create_rectangleCreate a rectangle.
figma_create_ellipseCreate an ellipse/circle.
figma_create_textCreate a text node. Accepts 'text' or 'content' for the string value.
figma_create_componentCreate a reusable component with full auto-layout, stroke, and nested children support.
figma_create_instanceCreate an instance of a component.
figma_create_lineCreate a line.
figma_create_pathCreate a vector path from points. Much simpler than create_from_svg for charts, curves, and shapes. Supports straight lines and smooth (Catmull-Rom) curves. Examples: - Line chart: points=[{x:0,y:80},{x:50,y:20},{x:100,y:60}], curveType="smooth" - Triangle: points=[{x:50,y:0},{x:100,y:100},{x:0,y:1…
figma_create_from_svgCreate a vector node from raw SVG markup. Use this for charts, icons, curves, and any complex shapes that can't be made with rectangles/ellipses/lines. Supports <path>, <circle>, <rect>, gradients, and all SVG elements.
figma_batchBatch multiple create, modify, and variable operations in one round-trip. Max 200 ops. ALWAYS prefer this over calling individual tools in a loop. Use "$ref:N" to reference node ID from operation N. create_frame/create_component support nested "children" and inline auto-layout params. Commands: cre…
figma_runfigma_move_nodeMove a node to a new position.
figma_resize_nodeResize a node.
figma_set_fillSet fill of a node. Supports solid colors, gradients, and images. Simple solid: { nodeId, color: {r,g,b} } Gradient: { nodeId, fills: [{ type:"GRADIENT_LINEAR", gradientStops:[{color:{r,g,b,a},position:0},{color:{r,g,b,a},position:1}] }] } Image: { nodeId, fills: [{ type:"IMAGE", imageUrl:"https://…
figma_set_strokeSet stroke (border) of a node.
figma_set_opacitySet node opacity.
figma_set_visibleShow or hide a node.
figma_set_corner_radiusSet corner radius of a node.
figma_set_text_contentUpdate text content. Supports batch via updates array. Accepts 'text' or 'content' for the string value.
figma_set_text_stylefigma_rename_nodeRename a node.
figma_delete_nodeDelete one or more nodes.
figma_set_auto_layoutConfigure auto-layout (flexbox) on a frame.
figma_set_effectsApply effects (shadows, blurs) to a node.
figma_group_nodesGroup nodes together.
figma_set_constraintsSet resize constraints for a node.
figma_reparent_nodeMove a node to a different parent.
figma_clone_nodeClone a node with optional offset.
figma_get_annotationsGet annotations on a node or the whole document.
figma_set_annotationSet annotation(s) on node(s).
figma_get_instance_overridesGet override properties from a component instance.
figma_set_instance_overridesApply overrides to component instances.
figma_create_interactionAdd a prototype interaction to a node.
figma_remove_interactionsRemove all interactions from a node.
figma_create_flowCreate a prototype flow starting point on a frame.
figma_remove_flowRemove a flow starting point from a frame.
figma_get_flowsGet all prototype flows in the current page.
figma_set_default_transitionSet default transition for this frame.
figma_setup_overlayConfigure a frame as an overlay in prototypes.
figma_set_scroll_behaviorConfigure scrolling for a frame in prototypes.
figma_get_interactionsGet all interactions on a node.
figma_present_prototypeOpen prototype presentation view.
figma_get_fileGet file document tree. Defaults to depth=2 (pages + top-level frames). Set higher depth for deeper traversal, or use figma_get_node for a specific subtree.
figma_get_nodeGet a node with properties, styles, and children.
figma_get_nodesGet multiple nodes in one request. Batch alternative to get_node.
figma_get_stylesGet styles. fileKey→REST file styles, omit→plugin local styles.
figma_get_componentsGet components. source: file (REST — published components with importable keys), local (plugin — current page), library (plugin — discovered from instances on canvas).
figma_get_variablesGet local variables and collections (design tokens). Filter by type or name to reduce token usage.
figma_get_commentsGet comments on a file.
figma_post_commentPost a comment on a file or node.
figma_searchSearch for nodes by name or type in a file.
figma_get_selectionGet currently selected nodes.
figma_get_team_componentsGet published components from a team. Requires Organization or Enterprise plan.
figma_get_team_stylesGet published styles from a team.
figma_get_componentGet a published component by key.
figma_get_styleGet a published style by key.
figma_get_library_items_usedFind external library components/styles used in a file.
figma_get_file_versionsGet version history of a file.
figma_get_team_projectsList all projects in a team.
figma_get_project_filesList all files in a project.
figma_scan_text_nodesScan text nodes with chunking for large pages.
figma_scan_nodes_by_typesFind nodes by type (FRAME, TEXT, COMPONENT, etc.).
figma_set_focusSelect and scroll viewport to a node.
figma_set_selectionsSelect multiple nodes and scroll to show them.
figma_get_library_collectionsGet enabled library variable collections.
figma_get_library_variablesGet variables from a library collection by key. Filter by type or name to reduce token usage.
figma_get_viewportGet viewport position, zoom, and visible bounds.
figma_import_component_by_keyImport a published component by its library key and create an instance. Get keys from figma_get_components with source='file'. IMPORTANT: This only works for components published within the same Figma team library. For external/linked design system libraries, use figma_clone_node to clone an existin…
figma_import_style_by_keyImport library styles by key so they become available locally. Use figma_get_styles to find keys. Supports batch import via styleKeys array. After import, styles can be applied with figma_apply_style by name.
figma_get_code_connect_mapMap Figma components to source code locations.
figma_get_design_system_rulesExtract design system rules: colors, typography, spacing, etc.
figma_export_pngExport a node as PNG/SVG/PDF with base64 data.
figma_create_pageCreate a new page. Optionally switch to it.
figma_switch_pageSwitch to a page by name, ID, or index.
figma_boolean_operationBoolean op (union/subtract/intersect/exclude) on 2+ nodes.
figma_check_accessibilityComprehensive WCAG 2.1 accessibility audit. Works via REST API (no plugin needed) when fileKey is provided, or via plugin bridge for the live canvas. Checks: text contrast (1.4.3/1.4.6), non-text contrast (1.4.11), touch targets (2.5.5/2.5.8), alt text (1.1.1), typography & text spacing (1.4.4/1.4.…
figma_validate_layoutCheck overlaps, bounds, padding, alignment issues.
figma_cacheManage library/component/style cache. action: 'stats' (view cached keys), 'clear' (clear all), 'invalidate' (clear by prefix, e.g., 'get_components'). Cache auto-expires after 5 minutes. Cached tools: get_components, get_styles, get_library_collections, get_library_variables, get_team_components, ge…
figma_skillfigma_create_variable_collectionCreate a variable collection for design tokens. Uses REST API — no plugin required.
figma_create_variableCreate a variable (COLOR, FLOAT, STRING, BOOLEAN). Uses REST API — no plugin required.
figma_set_variable_valueSet variable value for a mode. Uses REST API — no plugin required. Use mode ID (get from figma_get_variables).
figma_update_variableUpdate variable properties (name, description, scopes). Uses REST API — no plugin required.
figma_delete_variableDelete a variable. Uses REST API — no plugin required.
figma_delete_variable_collectionDelete a variable collection. Uses REST API — no plugin required.
8 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
ws affected by a DoS when handling a request with many HTTP headers
ws: Memory exhaustion DoS from tiny fragments and data chunks
ws: Uninitialized memory disclosure
FIGMA_ACCESS_TOKEN"": "figd_YOUR_TOKEN_HERE"FIGMA_BRIDGE_ONLYFIGMA_FILE_KEYFIGMA_WS_PORT1. Port 18211 is not in use (change with env var)Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
108/108 tools missing one or more hints — figma_scan_codebase (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); figma_match_components (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); figma_publish_dev_resources (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +105 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
90/99 tool handlers declare input schemas (91%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool test coverage
Only 25/108 tools referenced in tests (23%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
9 child_process/subprocess calls in production code — runs shell commands (src/cli.ts:326, src/transport/plugin-bridge.ts:198, src/transport/plugin-bridge.ts:220)
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), ws@8.16.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sso-ss/figma-unified-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check