Figma Agent MCP (TrungLee003/figma-agent-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 50 tools. No publisher has claimed this listing.

D
Caution
58/100

Figma Agent MCP

A local-first MCP server that connects AI clients to Figma via a WebSocket bridge and native plugin, enabling deterministic design operations like inspection, creation, mutation, styling, validation, and optimization.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

TrungLee003

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: MCP_SSE_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes50 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

figma.export_node

Export a Figma node to an image (PNG, JPG), vector (SVG), or document (PDF) with scale or constraints, returning Base64 data, MIME type, and UTF-8 SVG string.

figma.set_export_settings

Configure permanent export preset settings on a Figma node (e.g. 1x PNG, 2x PNG, SVG).

figma.set_image_fill

Set an image fill on a Figma node from a Base64 string or data URI, with FILL, FIT, CROP, or TILE scaling mode.

figma.create_component

Create a new Master Component (ComponentNode) on canvas or inside a container, with optional Component Property Definitions (BOOLEAN, TEXT, VARIANT, INSTANCE_SWAP).

figma.create_instance

Create a new InstanceNode from a Master Component with optional initial component property overrides.

figma.set_component_properties

Override and set component property values on a Figma InstanceNode.

figma.detach_instance

Detach a Figma InstanceNode from its Master Component, converting it into a standard FrameNode. Requires explicit destructive: true safety flag.

figma.get_local_components

Retrieve all local Master Components (ComponentNode) and Component Sets in the document with their variants and property definitions.

figma.get_connection

Check the current connection status to the Figma Plugin and query active capabilities.

figma.join_channel

Join or switch to a specific Figma bridge channel to communicate with a target Figma window.

figma.compile_context

Compile and compress Figma document or node tree into AI-optimized representations (markdown, dsl, compact) with substantial context reduction and dynamic token budget enforcement.

figma.resolve_design_system

Intelligently resolve semantic user intents (e.g. "primary button", "#6366F1", 16px) to matching Design System Components, Color Variables, Spacing Tokens, or audit a Node for token bindings.

figma.get_document

Get compact metadata for the active Figma document including file name, current page ID, and all available pages.

figma.get_selection

Inspect currently selected node(s) on the active Figma canvas in normalized SimplifiedNode format.

figma.set_auto_layout

Configure Auto Layout properties on a Frame container node (mode, padding, itemSpacing, alignment, sizing modes).

figma.set_layout_sizing

Set horizontal and/or vertical layout sizing modes (FIXED, HUG, or FILL) for a node inside Auto Layout.

figma.create_frame

Create a new Frame container node on the canvas or inside a parent container with dimensions and optional Auto Layout mode.

figma.create_text

Create a new Text node with specified characters, position, font family, style, and size. Asynchronously loads the required font.

figma.create_rectangle

Create a new Rectangle vector node with specified position, width, height, and optional corner radius.

figma.create_section

Create a new Section canvas organization container node to group screens and frames.

figma.move_node

Move a node to new absolute (x, y) coordinates relative to its parent container.

figma.resize_node

Resize a node to new width and height dimensions.

figma.rename_node

Rename a node layer in the Figma document.

figma.delete_node

Delete and remove a node permanently from the Figma document. Requires explicit destructive: true safety flag.

figma.clone_node

Clone and duplicate an existing node with all its children and styles to a new position or target parent.

figma.set_parent

Reparent and move a node into another container or section with an optional child index position.

figma.get_node

Retrieve a single Figma node by ID with simplified hierarchical structure, bounds, styles, layout, and text properties.

figma.get_nodes

Retrieve multiple Figma nodes in a single batch request by an array of node IDs.

figma.list_skills

List available Composite Agent Skills (e.g. skill.create_design_system, skill.auto_fix_accessibility, skill.convert_wireframe_to_hifi) with their input schemas.

figma.run_skill

Execute a high-level Composite Agent Skill workflow (e.g. skill.create_design_system, skill.auto_fix_accessibility, skill.convert_wireframe_to_hifi).

figma.batch_execute

Execute multiple Figma commands sequentially with symbolic ref resolution (ref, parentRef, nodeRef, $ref:name), in-memory idempotency deduplication, and compensating creation rollback on failure.

figma.set_fills

Set fill colors, gradients (linear/radial), opacity, or images on a Figma node.

figma.set_strokes

Set stroke/border color, weight, alignment (INSIDE/OUTSIDE/CENTER), and per-side weights on a Figma node.

figma.set_corner_radius

Set uniform or individual (top-left, top-right, bottom-right, bottom-left) corner radius with optional iOS corner smoothing on a Figma node.

figma.set_opacity

Set layer opacity for a Figma node (value between 0.0 and 1.0).

figma.set_effects

Set visual effects such as DROP_SHADOW, INNER_SHADOW, LAYER_BLUR, or BACKGROUND_BLUR on a Figma node.

figma.set_text_content

Update the text string content of a Figma TextNode, safely preloading required fonts.

figma.set_font_size

Set the font size in points/pixels for an entire TextNode or a character range (start, end).

figma.set_font_family

Change font family and font weight/style (e.g. Inter Bold) for an entire TextNode or character range, with automatic font loading and fallback.

figma.set_text_alignment

Set horizontal (LEFT, CENTER, RIGHT, JUSTIFIED) and vertical (TOP, CENTER, BOTTOM) text alignment.

figma.set_line_height

Set the line height for a TextNode in PIXELS, PERCENT, or AUTO.

figma.set_letter_spacing

Set the letter spacing (tracking) for a TextNode in PIXELS or PERCENT.

figma.validate_node

Validate a Figma node or document tree against WCAG 2.1 contrast, Auto Layout rules, token scales (spacing, typography, corner radius), and component health, returning a structured issues report.

figma.check_contrast

Check color contrast ratio between any foreground and background colors according to WCAG 2.1 AA/AAA accessibility standards.

figma.get_local_variables

Retrieve all local Figma Variable Collections and Variables including their modes, types, and values by mode.

figma.create_variable

Create a new Design Token Variable (COLOR, FLOAT, STRING, or BOOLEAN) in a collection with initial or per-mode values.

figma.set_variable_value

Set the value of a Figma Variable for a specific mode (e.g. Light or Dark mode).

figma.bind_variable

Bind a Design Token Variable to a specific property of a Figma node (e.g. fills, strokes, opacity, padding, cornerRadius, width, height).

figma.get_local_styles

Retrieve all local Styles (PAINT, TEXT, EFFECT, GRID) defined in the active Figma document.

figma.create_paint_style

Create a new reusable Paint Style in the active Figma document with solid or gradient fills.

// known CVEs in dependencies3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.6.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.6.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highws@8.18.0GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

ws: Uninitialized memory disclosure

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configMCP_ALLOWED_ORIGINS
configMCP_ALLOW_REMOTE_SSE
configMCP_HOST
configMCP_PORT
🔐 secretMCP_SSE_TOKEN
configMCP_TRANSPORT
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

50/50 tools missing one or more hints — figma.export_node (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); figma.set_export_settings (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); figma.set_image_fill (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +47 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

README present

No README found

Add a README.md describing the server and its tools.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Domain consistency

npm scope @figma-agent doesn't match GitHub owner trunglee003

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/trunglee003/figma-agent-mcp?variant=verified)](https://m8ven.ai/mcp/trunglee003/figma-agent-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: edcd2cc91ac15788d580620e72ba5028aa999cc9
code hash: 1aaf3a69d8fa2411810bb9da6324db3f0f868f5a863a60051694c36f573f6e85
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client