Figma ProSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://mseep.ai/app/artemsvit-figma-mcp-pro)
[](https://smithery.ai/server/@artemsvit/figma-mcp-pro)
Professional Model Context Protocol (MCP) server for AI-optimized Figma design analysis. Clean 5-step workflow for comprehensive design-to-code conversion with smart comment processing and asset downloads.
🚀 Key Features
- 5-Step Workflow: Framework selection → Design data → Comments → Assets → Reference analysis
- AI-Optimized: Structured data specifically formatted for AI code generation
- 10 Framework Support: React, Vue, Angular, Svelte, HTML/CSS/JS, SwiftUI, UIKit, Electron, Tauri, NW.js
- Smart Comments: Coordinate-based matching of designer comments to UI elements
- Asset Downloads: Batch download with original Figma export settings
- CSS Generation: Automatic CSS from Figma properties (padding, margins, borders, effects)
📦 Installation
Installing via Smithery
To install figma-mcp-pro for Claude Desktop automatically via Smithery:
npx -y @smithery/cli install @artemsvit/figma-mcp-pro --client claude
Manual Installation
npm install -g figma-mcp-pro
⚙️ Quick Setup
1. Get Your Figma API Key
Get your API token from Figma Account Settings → Personal access tokens
2. Copy & Paste MCP Configuration
📋 Use the copy button on the code block below, then replace your-api-key-here with your actual API key:
{
"mcpServers": {
"Figma MCP PRO": {
"command": "npx",
"args": ["figma-mcp-pro@latest", "--figma-api-key", "your-api-key-here"],
"env": {
"DEBUG": "true"
}
}
}
}Configuration File Locations:
- Claude Desktop:
claude_desktop_config.json - **Claud
f53326850661OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add figma-mcp-pro --env FIGMA_API_KEY=${FIGMA_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"figma-mcp-pro": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"FIGMA_API_KEY": "${FIGMA_API_KEY}"
}
}
}
}Exposed tools (12)
12 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Angular | read | Angular with TypeScript and component architecture |
Electron | read | Cross-platform desktop apps with web technologies |
NW.js | read | Node.js and Chromium combined for desktop applications |
React | read | Modern React with TypeScript, functional components, and hooks |
Svelte | read | Svelte with TypeScript and reactive statements |
SwiftUI | read | Apple\ |
Tauri | read | Lightweight desktop apps with Rust backend and web frontend |
UIKit | read | Traditional Apple UI framework with programmatic and Storyboard support |
check_reference | read | STEP 5: Analyze reference.png file for design understanding. Provides design context, layout analysis, component structure guidance, and framework-specific development recommendations before starting code implementation. |
download_design_assets | read | STEP 4: Automatically scan selected area for ALL export-ready assets and download them with reference.png. Takes Figma URL, finds all nodes with export settings in selected area, downloads them with Figma export settings, plus creates reference.png of whole selection. |
process_design_comments | read | STEP 3: Process designer comments with smart coordinate matching. Use AFTER get_figma_data when you want to analyze designer instructions. Converts comments into actionable AI prompts for implementation. |
show_frameworks | read | STEP 1: Show available frameworks to user. Call with empty object {}. Shows options, then STOP and wait for user to tell you their choice. DO NOT make further tool calls until user provides their framework preference. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (3)
@modelcontextprotocol/sdk, axios, chalk, commander, dotenv, node-cache, p-limit, p-retry
- **Full Permissions**: Sets `mode: 0o755` for universal compatibility
- Full permission settings (`mode: 0o755`) for universal compatibility
Gates applied: no_behavioural_pass.
f53326850661full audit observations/trust-audit/mcp-server/artemsvit__figma-pro.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | f53326850661 | SAFE | B | 89 | first audit |
Questions
What tools does Figma Pro expose?
12 in total: 12 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Figma Pro safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Figma Pro need?
It reads FIGMA_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Figma Pro run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as figma-mcp-pro at 3.49.0.
How current is this page?
The grade is for one exact copy of the source (f53326850661), read on 2026-10-08. The repository is watched and re-audited when it changes.