figma-unified-mcp (sso-ss/figma-unified-mcp) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 108 tools. No publisher has claimed this listing.

D
Caution
56/100

figma-unified-mcp

A comprehensive MCP server that enables Claude to read, create, edit, and generate code from Figma designs. Supports design tokens, code generation to multiple frameworks, and accessibility checks.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

sso-ss

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 2 credentials: FIGMA_ACCESS_TOKEN, FIGMA_FILE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes108 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

figma_scan_codebase

Scan a local codebase directory for UI components (React, Vue, Svelte, Swift, Compose, Angular, Flutter). Returns a list of discovered components with their file paths and frameworks. Use this before figma_match_components to find code-to-design mappings.

figma_match_components

Match Figma components to codebase components using fuzzy name matching. Requires plugin connection for Figma scanning, and a codebase path for code scanning. Returns a mapping with confidence scores. Review before publishing.

figma_publish_dev_resources

Publish dev resource links to Figma Dev Mode. Attaches code file URLs to component nodes. Run figma_match_components first to generate the mapping, then publish selected matches. The links will appear in Figma's Dev Mode panel for each component.

figma_get_dev_resources

Get existing dev resources (code links) attached to nodes in a Figma file.

figma_generate_css

Generate CSS from a node's styles.

figma_generate_react

Generate React component from a node.

figma_generate_swiftui

Generate SwiftUI code from a node.

figma_generate_html

Generate semantic HTML from a node.

figma_generate_tailwind_config

Generate Tailwind config from Figma design tokens.

figma_generate_tokens

Export design tokens (CSS vars, JSON, SCSS).

figma_analyze_for_codegen

Analyze node structure for best codegen strategy.

figma_codegen_bundle

Get a complete design-to-code bundle in a single call (REST-only, no plugin needed). Returns: - Compact tree with colors, fonts, layout, image refs, gradients, shadows - Image fill URLs (CDN links for raster images) - Vector/icon SVG URLs (rendered via Figma API) - Screenshot of the node (base64 PNG

figma_status

Check server, bridge, and REST API status.

figma_connect_plugin

Connect to Figma plugin via WebSocket.

figma_send_command

Send a raw command to the plugin.

figma_create_frame

Create a frame with full auto-layout, stroke, and nested children support.

figma_create_rectangle

Create a rectangle.

figma_create_ellipse

Create an ellipse/circle.

figma_create_text

Create a text node. Accepts 'text' or 'content' for the string value.

figma_create_component

Create a reusable component with full auto-layout, stroke, and nested children support.

figma_create_instance

Create an instance of a component.

figma_create_line

Create a line.

figma_create_path

Create a vector path from points. Much simpler than create_from_svg for charts, curves, and shapes. Supports straight lines and smooth (Catmull-Rom) curves. Examples: - Line chart: points=[{x:0,y:80},{x:50,y:20},{x:100,y:60}], curveType="smooth" - Triangle: points=[{x:50,y:0},{x:100,y:100},{x:0,y:1

figma_create_from_svg

Create a vector node from raw SVG markup. Use this for charts, icons, curves, and any complex shapes that can't be made with rectangles/ellipses/lines. Supports <path>, <circle>, <rect>, gradients, and all SVG elements.

figma_batch

Batch multiple create, modify, and variable operations in one round-trip. Max 200 ops. ALWAYS prefer this over calling individual tools in a loop. Use "$ref:N" to reference node ID from operation N. create_frame/create_component support nested "children" and inline auto-layout params. Commands: cre

figma_run
figma_move_node

Move a node to a new position.

figma_resize_node

Resize a node.

figma_set_fill

Set fill of a node. Supports solid colors, gradients, and images. Simple solid: { nodeId, color: {r,g,b} } Gradient: { nodeId, fills: [{ type:"GRADIENT_LINEAR", gradientStops:[{color:{r,g,b,a},position:0},{color:{r,g,b,a},position:1}] }] } Image: { nodeId, fills: [{ type:"IMAGE", imageUrl:"https://

figma_set_stroke

Set stroke (border) of a node.

figma_set_opacity

Set node opacity.

figma_set_visible

Show or hide a node.

figma_set_corner_radius

Set corner radius of a node.

figma_set_text_content

Update text content. Supports batch via updates array. Accepts 'text' or 'content' for the string value.

figma_set_text_style
figma_rename_node

Rename a node.

figma_delete_node

Delete one or more nodes.

figma_set_auto_layout

Configure auto-layout (flexbox) on a frame.

figma_set_effects

Apply effects (shadows, blurs) to a node.

figma_group_nodes

Group nodes together.

figma_set_constraints

Set resize constraints for a node.

figma_reparent_node

Move a node to a different parent.

figma_clone_node

Clone a node with optional offset.

figma_get_annotations

Get annotations on a node or the whole document.

figma_set_annotation

Set annotation(s) on node(s).

figma_get_instance_overrides

Get override properties from a component instance.

figma_set_instance_overrides

Apply overrides to component instances.

figma_create_interaction

Add a prototype interaction to a node.

figma_remove_interactions

Remove all interactions from a node.

figma_create_flow

Create a prototype flow starting point on a frame.

figma_remove_flow

Remove a flow starting point from a frame.

figma_get_flows

Get all prototype flows in the current page.

figma_set_default_transition

Set default transition for this frame.

figma_setup_overlay

Configure a frame as an overlay in prototypes.

figma_set_scroll_behavior

Configure scrolling for a frame in prototypes.

figma_get_interactions

Get all interactions on a node.

figma_present_prototype

Open prototype presentation view.

figma_get_file

Get file document tree. Defaults to depth=2 (pages + top-level frames). Set higher depth for deeper traversal, or use figma_get_node for a specific subtree.

figma_get_node

Get a node with properties, styles, and children.

figma_get_nodes

Get multiple nodes in one request. Batch alternative to get_node.

figma_get_styles

Get styles. fileKey→REST file styles, omit→plugin local styles.

figma_get_components

Get components. source: file (REST — published components with importable keys), local (plugin — current page), library (plugin — discovered from instances on canvas).

figma_get_variables

Get local variables and collections (design tokens). Filter by type or name to reduce token usage.

figma_get_comments

Get comments on a file.

figma_post_comment

Post a comment on a file or node.

figma_search

Search for nodes by name or type in a file.

figma_get_selection

Get currently selected nodes.

figma_get_team_components

Get published components from a team. Requires Organization or Enterprise plan.

figma_get_team_styles

Get published styles from a team.

figma_get_component

Get a published component by key.

figma_get_style

Get a published style by key.

figma_get_library_items_used

Find external library components/styles used in a file.

figma_get_file_versions

Get version history of a file.

figma_get_team_projects

List all projects in a team.

figma_get_project_files

List all files in a project.

figma_scan_text_nodes

Scan text nodes with chunking for large pages.

figma_scan_nodes_by_types

Find nodes by type (FRAME, TEXT, COMPONENT, etc.).

figma_set_focus

Select and scroll viewport to a node.

figma_set_selections

Select multiple nodes and scroll to show them.

figma_get_library_collections

Get enabled library variable collections.

figma_get_library_variables

Get variables from a library collection by key. Filter by type or name to reduce token usage.

figma_get_viewport

Get viewport position, zoom, and visible bounds.

figma_import_component_by_key

Import a published component by its library key and create an instance. Get keys from figma_get_components with source='file'. IMPORTANT: This only works for components published within the same Figma team library. For external/linked design system libraries, use figma_clone_node to clone an existin

figma_import_style_by_key

Import library styles by key so they become available locally. Use figma_get_styles to find keys. Supports batch import via styleKeys array. After import, styles can be applied with figma_apply_style by name.

figma_get_code_connect_map

Map Figma components to source code locations.

figma_get_design_system_rules

Extract design system rules: colors, typography, spacing, etc.

figma_export_png

Export a node as PNG/SVG/PDF with base64 data.

figma_create_page

Create a new page. Optionally switch to it.

figma_switch_page

Switch to a page by name, ID, or index.

figma_boolean_operation

Boolean op (union/subtract/intersect/exclude) on 2+ nodes.

figma_check_accessibility

Comprehensive WCAG 2.1 accessibility audit. Works via REST API (no plugin needed) when fileKey is provided, or via plugin bridge for the live canvas. Checks: text contrast (1.4.3/1.4.6), non-text contrast (1.4.11), touch targets (2.5.5/2.5.8), alt text (1.1.1), typography & text spacing (1.4.4/1.4.

figma_validate_layout

Check overlaps, bounds, padding, alignment issues.

figma_cache

Manage library/component/style cache. action: 'stats' (view cached keys), 'clear' (clear all), 'invalidate' (clear by prefix, e.g., 'get_components'). Cache auto-expires after 5 minutes. Cached tools: get_components, get_styles, get_library_collections, get_library_variables, get_team_components, ge

figma_skill
figma_create_variable_collection

Create a variable collection for design tokens. Uses REST API — no plugin required.

figma_create_variable

Create a variable (COLOR, FLOAT, STRING, BOOLEAN). Uses REST API — no plugin required.

figma_set_variable_value

Set variable value for a mode. Uses REST API — no plugin required. Use mode ID (get from figma_get_variables).

figma_update_variable

Update variable properties (name, description, scopes). Uses REST API — no plugin required.

figma_delete_variable

Delete a variable. Uses REST API — no plugin required.

figma_delete_variable_collection

Delete a variable collection. Uses REST API — no plugin required.

8 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies1 critical3 high3 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@4.0.18GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highws@8.16.0GHSA-3h5v-q93c-6h6q

ws affected by a DoS when handling a request with many HTTP headers

highws@8.16.0GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

ws: Uninitialized memory disclosure

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretFIGMA_ACCESS_TOKEN"": "figd_YOUR_TOKEN_HERE"
configFIGMA_BRIDGE_ONLY
🔐 secretFIGMA_FILE_KEY
configFIGMA_WS_PORT1. Port 18211 is not in use (change with env var)
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

108/108 tools missing one or more hints — figma_scan_codebase (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); figma_match_components (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); figma_publish_dev_resources (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +105 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

90/99 tool handlers declare input schemas (91%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

Only 25/108 tools referenced in tests (23%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

9 child_process/subprocess calls in production code — runs shell commands (src/cli.ts:326, src/transport/plugin-bridge.ts:198, src/transport/plugin-bridge.ts:220)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), ws@8.16.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/sso-ss/figma-unified-mcp?variant=verified)](https://m8ven.ai/mcp/sso-ss/figma-unified-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 1f089393e73da8a5955bd48b973b3af2ac7def28
code hash: e120feef54a5345f0c1366be30f51d730fb9c12a100bb13a5b277e1db77787cd
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client