Figma Agent MCP (TrungLee003/figma-agent-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 50 tools. No publisher has claimed this listing.
A local-first MCP server that connects AI clients to Figma via a WebSocket bridge and native plugin, enabling deterministic design operations like inspection, creation, mutation, styling, validation, and optimization.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
TrungLee003
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
figma.export_nodeExport a Figma node to an image (PNG, JPG), vector (SVG), or document (PDF) with scale or constraints, returning Base64 data, MIME type, and UTF-8 SVG string.
figma.set_export_settingsConfigure permanent export preset settings on a Figma node (e.g. 1x PNG, 2x PNG, SVG).
figma.set_image_fillSet an image fill on a Figma node from a Base64 string or data URI, with FILL, FIT, CROP, or TILE scaling mode.
figma.create_componentCreate a new Master Component (ComponentNode) on canvas or inside a container, with optional Component Property Definitions (BOOLEAN, TEXT, VARIANT, INSTANCE_SWAP).
figma.create_instanceCreate a new InstanceNode from a Master Component with optional initial component property overrides.
figma.set_component_propertiesOverride and set component property values on a Figma InstanceNode.
figma.detach_instanceDetach a Figma InstanceNode from its Master Component, converting it into a standard FrameNode. Requires explicit destructive: true safety flag.
figma.get_local_componentsRetrieve all local Master Components (ComponentNode) and Component Sets in the document with their variants and property definitions.
figma.get_connectionCheck the current connection status to the Figma Plugin and query active capabilities.
figma.join_channelJoin or switch to a specific Figma bridge channel to communicate with a target Figma window.
figma.compile_contextCompile and compress Figma document or node tree into AI-optimized representations (markdown, dsl, compact) with substantial context reduction and dynamic token budget enforcement.
figma.resolve_design_systemIntelligently resolve semantic user intents (e.g. "primary button", "#6366F1", 16px) to matching Design System Components, Color Variables, Spacing Tokens, or audit a Node for token bindings.
figma.get_documentGet compact metadata for the active Figma document including file name, current page ID, and all available pages.
figma.get_selectionInspect currently selected node(s) on the active Figma canvas in normalized SimplifiedNode format.
figma.set_auto_layoutConfigure Auto Layout properties on a Frame container node (mode, padding, itemSpacing, alignment, sizing modes).
figma.set_layout_sizingSet horizontal and/or vertical layout sizing modes (FIXED, HUG, or FILL) for a node inside Auto Layout.
figma.create_frameCreate a new Frame container node on the canvas or inside a parent container with dimensions and optional Auto Layout mode.
figma.create_textCreate a new Text node with specified characters, position, font family, style, and size. Asynchronously loads the required font.
figma.create_rectangleCreate a new Rectangle vector node with specified position, width, height, and optional corner radius.
figma.create_sectionCreate a new Section canvas organization container node to group screens and frames.
figma.move_nodeMove a node to new absolute (x, y) coordinates relative to its parent container.
figma.resize_nodeResize a node to new width and height dimensions.
figma.rename_nodeRename a node layer in the Figma document.
figma.delete_nodeDelete and remove a node permanently from the Figma document. Requires explicit destructive: true safety flag.
figma.clone_nodeClone and duplicate an existing node with all its children and styles to a new position or target parent.
figma.set_parentReparent and move a node into another container or section with an optional child index position.
figma.get_nodeRetrieve a single Figma node by ID with simplified hierarchical structure, bounds, styles, layout, and text properties.
figma.get_nodesRetrieve multiple Figma nodes in a single batch request by an array of node IDs.
figma.list_skillsList available Composite Agent Skills (e.g. skill.create_design_system, skill.auto_fix_accessibility, skill.convert_wireframe_to_hifi) with their input schemas.
figma.run_skillExecute a high-level Composite Agent Skill workflow (e.g. skill.create_design_system, skill.auto_fix_accessibility, skill.convert_wireframe_to_hifi).
figma.batch_executeExecute multiple Figma commands sequentially with symbolic ref resolution (ref, parentRef, nodeRef, $ref:name), in-memory idempotency deduplication, and compensating creation rollback on failure.
figma.set_fillsSet fill colors, gradients (linear/radial), opacity, or images on a Figma node.
figma.set_strokesSet stroke/border color, weight, alignment (INSIDE/OUTSIDE/CENTER), and per-side weights on a Figma node.
figma.set_corner_radiusSet uniform or individual (top-left, top-right, bottom-right, bottom-left) corner radius with optional iOS corner smoothing on a Figma node.
figma.set_opacitySet layer opacity for a Figma node (value between 0.0 and 1.0).
figma.set_effectsSet visual effects such as DROP_SHADOW, INNER_SHADOW, LAYER_BLUR, or BACKGROUND_BLUR on a Figma node.
figma.set_text_contentUpdate the text string content of a Figma TextNode, safely preloading required fonts.
figma.set_font_sizeSet the font size in points/pixels for an entire TextNode or a character range (start, end).
figma.set_font_familyChange font family and font weight/style (e.g. Inter Bold) for an entire TextNode or character range, with automatic font loading and fallback.
figma.set_text_alignmentSet horizontal (LEFT, CENTER, RIGHT, JUSTIFIED) and vertical (TOP, CENTER, BOTTOM) text alignment.
figma.set_line_heightSet the line height for a TextNode in PIXELS, PERCENT, or AUTO.
figma.set_letter_spacingSet the letter spacing (tracking) for a TextNode in PIXELS or PERCENT.
figma.validate_nodeValidate a Figma node or document tree against WCAG 2.1 contrast, Auto Layout rules, token scales (spacing, typography, corner radius), and component health, returning a structured issues report.
figma.check_contrastCheck color contrast ratio between any foreground and background colors according to WCAG 2.1 AA/AAA accessibility standards.
figma.get_local_variablesRetrieve all local Figma Variable Collections and Variables including their modes, types, and values by mode.
figma.create_variableCreate a new Design Token Variable (COLOR, FLOAT, STRING, or BOOLEAN) in a collection with initial or per-mode values.
figma.set_variable_valueSet the value of a Figma Variable for a specific mode (e.g. Light or Dark mode).
figma.bind_variableBind a Design Token Variable to a specific property of a Figma node (e.g. fills, strokes, opacity, padding, cornerRadius, width, height).
figma.get_local_stylesRetrieve all local Styles (PAINT, TEXT, EFFECT, GRID) defined in the active Figma document.
figma.create_paint_styleCreate a new reusable Paint Style in the active Figma document with solid or gradient fills.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
ws: Memory exhaustion DoS from tiny fragments and data chunks
ws: Uninitialized memory disclosure
MCP_ALLOWED_ORIGINSMCP_ALLOW_REMOTE_SSEMCP_HOSTMCP_PORTMCP_SSE_TOKENMCP_TRANSPORTPORTTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
50/50 tools missing one or more hints — figma.export_node (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); figma.set_export_settings (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); figma.set_image_fill (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +47 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
README present
No README found
Add a README.md describing the server and its tools.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Domain consistency
npm scope @figma-agent doesn't match GitHub owner trunglee003
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/trunglee003/figma-agent-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check