Atlas / MCP servers / asifkabirantu / Figsor

FigsorSAFE

Name: Figsor
Author: asifkabirantu

mcp/asifkabirantu/figsor

MCP server by asifkabirantu · Audited 2026-10-07

Figsor is an MCP server that bridges Cursor to Figma, enabling chat-driven design creation and editing - directly on your Figma canvas.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

45 21r · 20w · 4d

Transport

stdio

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Chat in Cursor. Design in Figma.

Figsor is an MCP server that bridges Cursor AI to Figma, enabling chat-driven design creation and editing — directly on your Figma canvas.

Cursor → MCP (stdio) → Figsor Server → WebSocket → Figma Plugin → Design on Canvas

Setup

1. Install the Figma Plugin (Sideload)

Clone this repo and import the plugin into Figma:

https://github.com/AsifKabirAntu/figsor.git

In Figma: Plugins → Development → Import plugin from manifest → select figsor/figma-plugin/manifest.json

2. Add to Cursor

Open your Cursor MCP settings and add:

{
"mcpServers": {
"figsor": {
"command": "npx",
"args": ["-y", "figsor"]
}
}
}

3. Start Designing

Open a Figma file
Run the Figsor plugin (Plugins → Development → Figsor)
Chat in Cursor:

"Create a mobile login screen with email and password fields"

"Design a dashboard with a sidebar, KPI cards, and charts"

"Edit the selected frame — make the button rounded and change the color to blue"

Available Tools (45+)

Create & Layout

Read & Inspect

Read from source at commit 9dab07acb603OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add figsor -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "figsor": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (45)

21 read · 20 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`bind_variable`	read	Bind a variable (design token) to a node property. When the variable value changes or the mode switches, the bound property updates automatically. Supports: opacity, visible, corner radii, padding, spacing, stroke weight, dimensions.
`boolean_operation`	read	Perform boolean operations on two or more nodes. UNION combines shapes, SUBTRACT cuts the second shape from the first, INTERSECT keeps only overlapping areas, EXCLUDE keeps only non-overlapping areas. The result replaces the input nodes.
`create_component`	write	Create a new main component. Components are reusable design elements — instances created from a component stay linked to it. Use this to define buttons, cards, inputs, and other reusable UI elements. Works like create_frame but produces a Component node.
`create_component_instance`	write	Create an instance of an existing component. Use list_components first to find available components and their IDs. For component sets (variants), use the specific variant
`create_component_set`	write	Combine multiple components into a component set (variants). Each component becomes a variant. Name each component using
`create_ellipse`	write	Create an ellipse (circle or oval). Useful for avatars, status indicators, decorative elements. Set equal width/height for a perfect circle.
`create_frame`	write	Create a new frame in Figma. Frames are the primary container/layout element (like a div in HTML). Use them for screens, sections, cards, navigation bars, buttons, etc. Returns the new frame
`create_line`	write	Create a line element. Useful for dividers, separators, and decorative lines.
`create_rectangle`	write	Create a rectangle shape. Useful for backgrounds, dividers, decorative elements, image placeholders, etc.
`create_svg_node`	write	Create a node from an SVG string. Great for icons, logos, and vector illustrations.
`create_text`	write
`create_variable`	write	Create a design token (variable) within a collection. Variables can be COLOR (hex), FLOAT (number), STRING, or BOOLEAN. Set different values per mode for theming. Bind to node properties with bind_variable.
`create_variable_collection`	write	Create a new variable collection (design token group). Collections contain variables and can have multiple modes (e.g. Light/Dark theme). Use this to set up a design token system.
`create_vector`	write
`delete_node`	destructive	Delete a node from the Figma document.
`detach_instance`	read	Detach a component instance, converting it into a regular frame. Useful when you need to customize an instance beyond its variant properties.
`dismiss_all_agents`	destructive	Remove ALL design agent cursors from the canvas. Call this when the entire design task is complete.
`dismiss_design_agent`	destructive	Remove a design agent
`export_as_svg`	read	Export a Figma node as SVG markup string. Can export a single node or all direct children of a frame (batch mode). Use this to extract icon SVGs before applying animations, or to get raw SVG data for any visual element.
`find_nodes`	read	Search for nodes by name or type on the current page. Also searches text content for text nodes. Use this to find existing elements before editing them. For example, find all buttons, headers, or nodes matching a name pattern.
`flatten_nodes`	read	Flatten one or more nodes into a single vector. Useful for converting shapes, frames, or groups into a single editable vector path. Similar to Object > Flatten in Figma.
`get_connection_status`	read
`get_design_craft_guide`	read
`get_local_styles`	read	Get all local styles (colors, text styles, effect styles) defined in the Figma file. These represent the file
`get_page_structure`	read	Get the hierarchical structure of all nodes on the current Figma page. Returns node IDs, names, types, positions, sizes, and children. Use this to understand the current state of the design.
`get_selection`	read	Get information about the currently selected nodes in Figma. Useful for understanding what the user is looking at or wants to modify.
`get_uploaded_image_status`	read	Check if an image has been uploaded in the Figsor plugin
`get_variables`	read	Get all local variable collections and variables defined in the file. Use this to discover existing design tokens before creating new ones or binding them to nodes.
`list_available_fonts`	read	List fonts available in the Figma environment, grouped by family with their styles. Also returns
`list_components`	read
`modify_node`	write	Modify properties of an existing node. Works on any node type. For text nodes, you can also update characters and fontSize. For auto-layout children, you can set layoutSizingHorizontal/layoutSizingVertical to control how they fill space.
`move_to_parent`	write	Move a node into a different parent frame. Use this to restructure the layer hierarchy.
`quiver_generate_svg`	read
`quiver_vectorize_svg`	read	Convert a raster image (PNG, JPG, etc.) into a clean SVG using Quiver AI. Provide either an image URL, base64-encoded image data, or set use_plugin_image to true to use an image uploaded in the Figsor plugin
`read_node_properties`	read	Get detailed properties of a specific node by ID, including its children. Use this to inspect a node before modifying it.
`set_auto_layout`	write	Configure auto-layout on a frame (Figma
`set_constraints`	write	Set responsive constraints on a node. Controls how the node behaves when its parent frame is resized. MIN=pin to left/top, CENTER=center, MAX=pin to right/bottom, STRETCH=pin both sides, SCALE=scale proportionally. Only works on children of non-auto-layout frames.
`set_effects`	destructive	Apply visual effects (drop shadow, inner shadow, layer blur, background blur) to a node. Replaces existing effects.
`set_fill`	write	Set fills on a node. Supports solid colors, linear gradients, radial gradients, angular gradients, and diamond gradients. Can set multiple fills on a single node. Use this for advanced fill configurations that modify_node
`set_image_fill`	write	Apply an image fill to a node, or create a new image placeholder. Currently creates styled placeholder rectangles — real image support (Unsplash, URL) coming soon. Use placeholderText to describe what image should go here (e.g.
`set_selection`	write	Select specific nodes in Figma and scroll the viewport to show them. Useful for highlighting elements for the user.
`set_stroke`	write	Add or modify the stroke (border) on a node.
`show_animation_preview`	read	Show animated SVG icons in a preview modal inside the Figma plugin. The modal displays all icons with their CSS animations playing live. Users can click individual icons to download, or use
`spawn_design_agent`	read
`style_text_range`	read

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (5 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (4)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_node, dismiss_all_agents, dismiss_design_agent, set_effects

Why it matters. 4 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.no_license · CWE-1104

Why it matters. no LICENSE file and no repo licence

Fix. add a licence

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

mcp-server/package.json

@modelcontextprotocol/sdk, ws, zod, @types/node, @types/ws, typescript

Why it matters. 6 dependency range(s) float

Fix. pin exact versions or ship a lockfile

INFOInventory / provenance · inv.oversize · CWE-1104

figma-plugin/Dashboard - Real Estate.png

figma-plugin/Dashboard - Real Estate.png

Why it matters. 1812910 bytes not read

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-07 · audit v0.4.1 · source sha 9dab07acb603full audit observations/trust-audit/mcp-server/asifkabirantu__figsor.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-07	`9dab07acb603`	SAFE	B	89	first audit

Questions

What is the Figsor MCP server?

Figsor is an MCP server that bridges Cursor to Figma, enabling chat-driven design creation and editing - directly on your Figma canvas.

What tools does Figsor expose?

45 in total: 21 read-only, 20 that write, and 4 that can delete or overwrite (delete_node, dismiss_all_agents, dismiss_design_agent, set_effects). Every one is listed on this page with its risk.

Is Figsor safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 4 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Figsor need?

No credential environment variables were found in its source, so it appears to need none.

How does Figsor run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as figsor at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (9dab07acb603), read on 2026-10-07. The repository is watched and re-audited when it changes.

Source	asifkabirantu/figsor
npm	`figsor@1.0.0`
Transports	stdio
Activity	pushed 209d ago