Figma (Context)
GLips' Figma Context MCP. The de facto Figma MCP for AI coding agents, feeds simplified layout JSON to Cursor/Claude for design-to-code.
Delv Safety Grade: B
Score 72/100 · assessed 2026-04-28
Figma Context MCP is a community-maintained server that pulls design data from Figma's API and feeds it to AI coding agents. It's distributed via npm with a straightforward npx install and requires only a Figma API key for authentication. The permissions footprint is narrow: read-only API access to Figma files, no filesystem writes or shell execution. The maintainer (GLips) appears to be a solo developer with reasonable activity, though the bus factor is a concern. The package is open source with adequate documentation and a clear purpose. Supply chain is standard npm with no known incidents. The main risk is dependency on a single maintainer and the need to protect the Figma API key, which grants access to all designs in the linked account. Overall it's a well-scoped tool with limited attack surface, suitable for teams comfortable with community packages.
Lethal Trifecta (prompt-injection exposure)
TRIFECTA RISKPrivate design files, comments from collaborators (some not vetted), outbound via webhooks and embeds.
Green flags
- Read-only API access, no filesystem or shell permissions
- Standard npm distribution with clear versioning
- Open source with visible code and issue tracker
- Narrow scope: only Figma API interaction
- No known security incidents or malicious versions
Red flags
- Solo maintainer with single point of failure
- Figma API key grants access to all account designs
- Limited commit history and contributor base
- No evidence of security audit or formal review
Permissions requested
Install
npx -y figma-developer-mcp --figma-api-key=YOUR-KEY --stdio
FIGMA_API_KEYReview
Install this if you code from Figma files more than once a week. It eliminates the screenshot-and-describe workflow and gives Claude the layout data it needs to write accurate components. Skip if you don't use Figma or prefer manual implementation.
Good at
- Reads actual Figma node structure so Claude doesn't hallucinate spacing or hierarchy.
- One-shot component generation from design files without manual spec writing.
- Works across Claude Desktop, Cursor, Windsurf, and VS Code with MCP support.
- Simplified JSON format keeps token usage reasonable even for complex frames.
- Useful for extracting design tokens and spotting drift between design and code.
Watch out
- Read-only, so you can't push code changes back to Figma or update designs from the agent.
- Requires developer access to Figma files, which not all teams grant freely.
- Doesn't export images or assets, you still handle those separately.
- Quality of output depends entirely on how well-organised the Figma file is.
- Hosts beyond Claude Desktop need manual config editing, no auto-setup.
Use cases
- One-shot design implementation in any framework
- Pulling layout tokens into a component file
- Spec extraction without screenshots
- Cross-referencing components to existing code
Getting started
Works with
Similar MCPs
- GitHubFull GitHub API access - manage repos, issues, PRs, and code search. One of the most useful MCPs for any developer workflow.
- GrafanaGrafana Labs' official MCP. Read dashboards, datasources, alerts, and run Loki/Prometheus queries from inside your agent.
- SentryPull live errors, issues, and replays from Sentry into Claude. Great for debugging sessions where the model can see what actually broke in prod.
- MCP CLIInteractive CLI inspector for MCP servers supporting OAuth, tool calls, resource reads, and prompt runs.