designxcode-mcp (thevoiduniverse/designxcode-mcp) is an MCP server listed on the M8ven Trust Index. It scores 72 out of 100, grade C. It declares 13 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Caution
72/100

designxcode-mcp

MCP server that keeps Figma design systems and code in sync - auditing token drift, component parity, and generating sync PRs

→ thevoiduniverse/designxcode-mcp· listed on github_code

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

thevoiduniverse

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
13 tools verified — handlers match their declared behaviour
11 read-only tools verified — handlers contain no write/delete/exec
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: FIGMA_ACCESS_TOKEN, GITHUB_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes13 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

audit_component_parity

Compare Figma components against code components to find coverage gaps. Fetches components from Figma and compares against a Storybook manifest or component mapping from GitHub. Uses fuzzy name matching (normalizes casing, strips spaces/hyphens) to find matches. Args: - figma_file_key (string): …

audit_system_health

Run a comprehensive health check on your design system, combining token drift analysis and component parity into a single sync score. This is an orchestrator tool that calls extract_tokens + audit_component_parity internally and merges the results into a unified health report. Args: - figma_file…

detect_unused_tokens

Scan a GitHub repository for design token usage and identify unused tokens. Extracts tokens from a Figma file, derives CSS/SCSS/Tailwind variable names, and searches the GitHub repo for references. Reports which tokens have zero references in the codebase. Args: - figma_file_key (string): The Fi…

export_assets

Export SVG/PNG/JPG/PDF assets from Figma components. Renders component nodes as images via the Figma Image API. Can export specific nodes by ID, filter by component name or page, and optionally fetch SVG content inline. Args: - figma_file_key (string): The Figma file key from the URL - node_id…

extract_styles

Extract typography, fill, effect, and grid styles from a Figma file with resolved values. Unlike variables/tokens, styles contain visual properties like font families, colors, shadows, and grid layouts. This tool fetches style metadata AND resolves the actual property values from document nodes. A…

extract_tokens

Extract design tokens (variables) from a Figma file and convert to standard formats. Fetches all Figma Variables from the specified file and converts them to the requested format. Supports W3C Design Token Community Group format, Style Dictionary input format, or raw Figma API response. Args: - …

generate_coded_components

Generate production-ready, pixel-perfect coded components from Figma. Extracts layout, colors, typography, spacing, effects from Figma node trees, resolves variable bindings to design tokens, diffs variants for state/dimensional overrides, detects nested components, and emits framework-specific cod…

generate_sync_pr

Create a GitHub pull request to sync design token changes from Figma to code. Takes an array of file updates (typically from sync_tokens_to_code output) and creates a branch, commits the files, and opens a PR. Supports dry_run mode to preview without creating. Args: - github_repo (string): GitHu…

generate_theme_config

Extract multi-theme configurations from Figma Variable modes. Generates theme-aware output files (CSS custom properties with theme selectors, Tailwind config, or TypeScript ThemeProvider) from Figma Variable modes (Light/Dark/etc). Args: - figma_file_key (string): The Figma file key - output_f…

get_design_context

Load design system context (tokens, components, patterns, rules) from a Figma file. Call this before generating UI code to ensure the output uses correct design tokens, reuses existing components, and follows established patterns. Args: - figma_file_key (string): The Figma file key - task_desc…

implement_design

Convert a Figma frame into production code using design system tokens and components. Every visual value (color, spacing, typography, shadow) is matched against the project's design system tokens. Matched values use token references (e.g., var(--primary)); unmatched values use raw Figma values and …

set_design_rules

Define explicit design rules that the AI should follow when generating code. Rules supplement auto-inferred patterns and take precedence over them. Stored locally and persist across sessions. Args: - figma_file_key (string): The Figma file key to associate rules with - rules (array): Design ru…

sync_tokens_to_code

Generate platform-specific design token files from Figma variables. Extracts tokens from Figma, transforms them through Style Dictionary into platform-specific code (CSS custom properties, SCSS variables, Tailwind config, Swift UIColor, Kotlin Compose, or JSON). This tool does NOT commit files — i…

// known CVEs in dependencies2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.6.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.6.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretFIGMA_ACCESS_TOKENclaude mcp add designxcode -e =your-token -e GITHUB_TOKEN=your-token -- npx designxcode-mcp-server
🔐 secretGITHUB_TOKENclaude mcp add designxcode -e FIGMA_ACCESS_TOKEN=your-token -e =your-token -- npx designxcode-mcp-server
// quality suggestions

Tool inputs are validated

Only 0/13 tool handlers declare input schemas (0%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 2 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/thevoiduniverse/designxcode-mcp?variant=verified)](https://m8ven.ai/mcp/thevoiduniverse/designxcode-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 1cea18420d954f76be0590d350dfee6096def57c
code hash: 8a85216b28bf53e2f25ffb00419756c4c15dba3ea2b07e51a47bde4f4a98bba6
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client