MCP server · Org-owned · Audited from source

Cursor Talk to Figma MCP server

by grab/cursor-talk-to-figma-mcpMIT licenceAudited 21 Sep 2026 · source 3b14afdfa9c1

npm talk-to-figma-mcp 1.0.0stdio★ 7,031

✓SAFEGrade B · 89/100 · 21 Sep 2026 · 3b14afd

7,031GitHub stars

Is it safe? Yes — SAFE, grade B (89/100). It exposes 44 tools: 16 read, 26 write and 2 destructive. The audit recorded 7 findings (0 critical, 0 high, 1 medium, 6 low). Maintainer's description: TalkToFigma: MCP integration between AI Agent (Cursor, Claude Code, Codex) and Figma, allowing Agentic AI to communicate with Figma for reading designs and modifying them programmatically.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Cursor Talk to Figma MCP server (grab/cursor-talk-to-figma-mcp)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/grab/cursor-talk-to-figma-4

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score89/100✓SAFE B

0 critical0 high1 medium6 low0 info

7 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared1 observation
NetworkDeclared5 observations
ShellNone observedNothing seen in the source
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS
`L1` Static source	Secrets, path traversal, supply chain	PASS 2 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS 4 findings
`L3` Inventory	Declared tools match the source	WARN 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner grabOrganizationAccount type recorded when we read the repository.
PackagePublished on npmtalk-to-figma-mcp at version 1.0.0
LicenceMITFrom the repository, as read at the audited commit.
Last push56 days agoActivity of the repository when we read it.
Source commit read3b14afdfa9c1The audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory44 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (7)

Sorted by severity

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

delete_multiple_nodes, delete_node

Why: 2 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

uuid, ws, @types/bun, bun-types, tsup, typescript

Why: 6 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · src/talk_to_figma_mcp/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

uuid, ws, @types/node, @types/uuid, @types/ws, ts-node, typescript

Why: 7 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainprompt.pipe_to_shell · DRAGME.md:444

F-08 Supply chainCWE-829 · CWE-1357Layer L2

curl -fsSL https://bun.sh/install | bash

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainprompt.pipe_to_shell · DRAGME.md:1057

F-08 Supply chainCWE-829 · CWE-1357Layer L2

curl -fsSL https://bun.sh/install | bash

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainprompt.pipe_to_shell · DRAGME.md:1148

F-08 Supply chainCWE-829 · CWE-1357Layer L2

[ "$SUDO_AVAILABLE" = "YES" ] && cd ~/Desktop && git clone https://github.com/sonnylazuardi/cursor-talk-to-figma-mcp.git && cd cursor-talk-to-figma-mcp && curl -fsSL https://bun.sh/install | bash && s

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainprompt.pipe_to_shell · README.md:18

F-08 Supply chainCWE-829 · CWE-1357Layer L2

curl -fsSL https://bun.sh/install | bash

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

44 declared in source · 2 destructive

16 read26 write2 destructive

2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	Risk	What it does
`delete_multiple_nodes`	destructive	Delete multiple nodes from Figma at once
`delete_node`	destructive	Delete a node from Figma
`create_component_instance`	write	Create an instance of a component in Figma. For LOCAL components (from get_local_components), use componentId with the id field. For published LIBRARY components, use componentKey with the publishedKey field.
`create_connections`	write	Create connections between nodes using the default connector style
`create_frame`	write	Create a new frame in Figma
`create_rectangle`	write	Create a new rectangle in Figma
`create_section`	write	Create a section in Figma to group related content on the canvas
`create_text`	write	Create a new text element in Figma
`move_node`	write	Move a node to a new position in Figma
`rename_node`	write	Rename a node in Figma
`set_annotation`	write	Create or update an annotation
`set_axis_align`	write	Set primary and counter axis alignment for an auto-layout frame in Figma
`set_corner_radius`	write	Set the corner radius of a node in Figma
`set_default_connector`	write	Set a copied connector node as the default connector
`set_fill_color`	write	Set the fill color of a node in Figma can be TextNode or FrameNode
`set_focus`	write	Set focus on a specific node in Figma by selecting it and scrolling viewport to it
`set_image_fill`	write	Fill a node in Figma with an image from a local file path, a URL, or base64 data (replaces the node
`set_instance_overrides`	write	Apply previously copied overrides to selected component instances. Target instances will be swapped to the source component and all copied override properties will be applied.
`set_item_spacing`	write	Set distance between children in an auto-layout frame
`set_layout_mode`	write	Set the layout mode and wrap behavior of a frame in Figma
`set_layout_sizing`	write	Set horizontal and vertical sizing modes for an auto-layout frame in Figma
`set_multiple_annotations`	write	Set multiple annotations parallelly in a node
`set_multiple_text_contents`	write	Set multiple text contents parallelly in a node
`set_padding`	write	Set padding values for an auto-layout frame in Figma
`set_parent`	write	Move a node into a new parent node (e.g. a section, frame or group). Preserves the node
`set_selections`	write	Set selection to multiple nodes in Figma and scroll viewport to show them
`set_stroke_color`	write	Set the stroke color of a node in Figma
`set_text_content`	write	Set the text content of an existing text node in Figma
`clone_node`	read	Clone an existing node in Figma
`export_node_as_image`	read	Export a node as an image from Figma
`get_annotations`	read	Get all annotations in the current document or specific node
`get_document_info`	read	Get detailed information about the current Figma document
`get_instance_overrides`	read	Get all override properties from a selected component instance. These overrides can be applied to other instances, which will swap them to match the source component.
`get_local_components`	read	Get all local components from the Figma document
`get_node_info`	read	Get detailed information about a specific node in Figma
`get_nodes_info`	read	Get detailed information about multiple nodes in Figma
`get_reactions`	read	Get Figma Prototyping Reactions from multiple nodes. CRITICAL: The output MUST be processed using the
`get_selection`	read	Get information about the current selection in Figma
`get_styles`	read	Get all styles from the current Figma document
`join_channel`	read	Join a specific channel to communicate with Figma
`read_my_design`	read	Get detailed information about the current selection in Figma, including all node details
`resize_node`	read	Resize a node in Figma
`scan_nodes_by_types`	read	Scan for child nodes with specific types in the selected Figma node
`scan_text_nodes`	read	Scan all text nodes in the selected Figma node

Install

Package version 1.0.0 · audited commit 3b14afd

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 1.0.0. The audit covers commit 3b14afd only.

claude mcp add talk-to-figma-mcp -- npx -y [email protected]

{
  "mcpServers": {
    "talk-to-figma-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

The command pins the package version recorded in the source (1.0.0); the audit covers commit 3b14afdfa9c1. Transport: stdio. No environment variables required.

Audit history

2026-09-21
✓SAFE B 89 / 100
Source changed, verdict held · 3b14afdfa9c1

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: SAFE B](https://modelsatlas.com/mcp/grab/cursor-talk-to-figma-4/badge.svg)](https://modelsatlas.com/mcp/grab/cursor-talk-to-figma-4/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Cursor Talk to Figma MCP server

What is the Cursor Talk to Figma MCP server?

TalkToFigma: MCP integration between AI Agent (Cursor, Claude Code, Codex) and Figma, allowing Agentic AI to communicate with Figma for reading designs and modifying them programmatically.

What tools does Cursor Talk to Figma expose?

44 in total: 16 read-only, 26 that write, and 2 that can delete or overwrite (delete_multiple_nodes, delete_node). Every one is listed on this page with its risk.

Is Cursor Talk to Figma safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Cursor Talk to Figma need?

No credential environment variables were found in its source, so it appears to need none.

How does Cursor Talk to Figma run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as talk-to-figma-mcp at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (3b14afdfa9c1), read on 2026-09-21. The repository is watched and re-audited when it changes.

Sources

grab/cursor-talk-to-figma-mcp on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — SAFE verdict for commit 3b14afdfa9c1Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Cursor Talk to Figma MCP server?
GChatGPT CClaude PPerplexity
What tools does Cursor Talk to Figma expose?
GChatGPT CClaude PPerplexity
Is Cursor Talk to Figma safe to connect to an agent?
GChatGPT CClaude PPerplexity