TalkToFigma (Takeaki0817/figma-local-bridge) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 49 tools. No publisher has claimed this listing.

C
Caution
60/100

TalkToFigma

Enables local AI agents to generate and edit Figma designs via the Plugin API through a WebSocket relay, with no rate limits and all communication remaining local.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Takeaki0817

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes49 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_document_info

Get detailed information about the current Figma document

get_selection

Get information about the current selection in Figma

read_my_design

Get detailed information about the current selection in Figma, including all node details

get_node_info

Get detailed information about a specific node in Figma

get_nodes_info

Get detailed information about multiple nodes in Figma

create_rectangle

Create a new rectangle in Figma

create_frame

Create a new frame in Figma

create_text

Create a new text element in Figma

set_fill_color

Set the fill color of a node in Figma can be TextNode or FrameNode

set_stroke_color

Set the stroke color of a node in Figma

move_node

Move a node to a new position in Figma

clone_node

Clone an existing node in Figma

resize_node

Resize a node in Figma

delete_node

Delete a node from Figma

delete_multiple_nodes

Delete multiple nodes from Figma at once

export_node_as_image

Export a node as an image from Figma

set_text_content

Set the text content of an existing text node in Figma

get_styles

Get all styles from the current Figma document

get_local_components

Get all local components from the Figma document

get_annotations

Get all annotations in the current document or specific node

set_annotation

Create or update an annotation

set_multiple_annotations

Set multiple annotations parallelly in a node

create_component_instance

Create an instance of a component in Figma. For LOCAL components (from get_local_components), use componentId with the id field. For published LIBRARY components, use componentKey with the publishedKey field.

get_instance_overrides

Get all override properties from a selected component instance. These overrides can be applied to other instances, which will swap them to match the source component.

set_instance_overrides

Apply previously copied overrides to selected component instances. Target instances will be swapped to the source component and all copied override properties will be applied.

set_corner_radius

Set the corner radius of a node in Figma

scan_text_nodes

Scan all text nodes in the selected Figma node

scan_nodes_by_types

Scan for child nodes with specific types in the selected Figma node

set_multiple_text_contents

Set multiple text contents parallelly in a node

set_layout_mode

Set the layout mode and wrap behavior of a frame in Figma

set_padding

Set padding values for an auto-layout frame in Figma

set_axis_align

Set primary and counter axis alignment for an auto-layout frame in Figma

set_layout_sizing

Set horizontal and vertical sizing modes for an auto-layout frame in Figma

set_item_spacing

Set distance between children in an auto-layout frame

get_reactions

Get Figma Prototyping Reactions from multiple nodes. CRITICAL: The output MUST be processed using the 'reaction_to_connector_strategy' prompt IMMEDIATELY to generate parameters for connector lines via the 'create_connections' tool.

set_default_connector

Set a copied connector node as the default connector

create_connections

Create connections between nodes using the default connector style

set_focus

Set focus on a specific node in Figma by selecting it and scrolling viewport to it

set_selections

Set selection to multiple nodes in Figma and scroll viewport to show them

set_parent

Move a node so it becomes a child of another node (reparent). Uses appendChild, or insertChild when an index is given. Works with Auto Layout parents. Set keepPosition to preserve the node's absolute position (ignored for auto-layout parents).

reorder_children

Change the order of a child node within its parent's children array by moving it to a new index

set_text_style

Set detailed typography on a TEXT node in one call. Only the provided fields are applied. Font is loaded automatically before changes. lineHeight/letterSpacing accept an object with value+unit ({unit:'AUTO'} for lineHeight auto).

get_variables

List local variable collections (with their modes) and variables (id, name, resolvedType, valuesByMode). Optionally filter to a single collection.

create_variable_collection

Create a local variable collection. Optionally provide mode names; the first renames the default mode and the rest are added.

create_variable

Create a variable inside a collection, optionally seeding per-mode values. COLOR values are { r, g, b, a } (0-1). Get modeIds from get_variables or create_variable_collection.

bind_variable

Bind a variable to a node property. property 'fills' or 'strokes' binds the first solid paint's color (setBoundVariableForPaint). Other properties (width, height, cornerRadius, top/bottom/left/right radius, padding*, itemSpacing, counterAxisSpacing, strokeWeight, opacity, min/maxWidth, min/maxHeight

create_component_from_node

Convert an existing node into a component (figma.createComponentFromNode). The node cannot already be a component, component set, or instance, nor be nested inside one. Returns the new component's ID.

create_component

Create a new empty component. Supports the same Auto Layout parameters as create_frame. Returns the component's ID for use as a parentId or with create_component_instance.

join_channel

Join a specific channel to communicate with Figma

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.13.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.13.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.13.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

49/49 tools missing one or more hints — get_document_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_selection (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); read_my_design (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +46 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

42/49 tool handlers declare input schemas (86%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.13.1 (high), @modelcontextprotocol/sdk@1.13.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/takeaki0817/figma-local-bridge?variant=verified)](https://m8ven.ai/mcp/takeaki0817/figma-local-bridge)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 6e1abeb8fe7213678bbb41d3485a91a6d3887f6b
code hash: e15400d56a329a667e963707076b7d1462510963ca58fd6dbaf4aab99c1baf52
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client