io.github.arimunandar/figsnap-mcp is an MCP server that the Figma file you have open, as MCP tools. Extract, edit, and keep a saved set. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 54/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"figsnap-mcp": {
"args": [
"-y",
"figsnap-mcp"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
The Figma file you have open, as MCP tools. Extract, edit, and keep a saved set.
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
npx -y 'figsnap-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories - click any category to see the underlying evidence.
No known CVEs.
Checked figsnap-mcp against OSV.dev.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in design
Design tokens from any live site: colours, type, spacing, components, drift against a baseline.
Draw and visually collaborate with your agents on tldraw's canvas.
MeiGen-AI-Design-MCP — Turn Claude Code / OpenClaw into your local Lovart. Local ComfyUI, 1,400+ prompt library, multi-direction parallel generation.
Inspect and edit Three.js scenes, materials, shaders, lights in real time from any AI agent
MCP Security Weekly
Get CVE alerts and security updates for io.github.arimunandar/figsnap-mcp and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
The Figma file you have open, as MCP tools — and nothing else.
claude mcp add figsnap-mcp -s user -- npx -y figsnap-mcp
Those install the MCP server. It answers nothing until the daemon is running and the Figma plugin is open — see Getting it running, which is five steps and takes about two minutes.
A Figma plugin, a local daemon, and an MCP server. Your coding agent reads the design, extracts a node as PNG, React, HTML or CSS, edits the canvas when you allow it, and shares a saved set of components with you. No relay, no account, no network beyond loopback.
MCP client figsnap-mcp daemon the plugin
(Claude Code) stdio (stateless HTTP :3058 ws (open in Figma)
─────────────────► proxy) ──────────► /panel ──────────► figma.*
127.0.0.1 only
Three processes and one rule: figma.* exists only while the plugin is open, so
the plugin holds the connection and everything else asks questions down it.
This repo is a derivative of Figsnap, cut down to one job. Figsnap
ships four products from one package.json — the plugin, a Cloudflare Worker
relay with accounts, an ACP chat client, and this MCP server. If all you want is
MCP tools and a saved set, you had to clone all of it, build a 4,200-line panel
you would never open, and load a plugin whose manifest whitelists a Worker you
would never sign in to.
So: no ACP client, no harness discovery, no session store, no relay, no accounts, no chat, no API browser, no code-export UI. What is left is the extraction engine, the 41 tools, and a panel with three panes.
Figsnap is not modified by any of this, and the two can run side by side — this
daemon is on port 3058 with its token in ~/.figsnap-mcp/agent-token, where
Figsnap's is on 3056 with its token in ~/.figsnap/agent-token.
One caution on that manifest: Figma validates allowedDomains and refuses an IP
literal — Invalid value for allowedDomains. 'ws://127.0.0.1:3058' must be a valid URL — and a manifest it refuses is a manifest it does not load, so the
plugin quietly keeps running the last good one. Name localhost, and check the
console after any change here, because nothing else reports it.
They are kept apart in Figma too. clientStorage is keyed by plugin id, so the
manifest carries an id of its own rather than Figsnap's REPLACE_ON_PUBLISH, and
every key this plugin writes is prefixed figsnap-mcp: on top of that. Sharing
either one means sharing the stored daemon address, and a panel that inherits
ws://localhost:3056 is then blocked by its own manifest's CSP — with a console
error the designer never sees. The panel also refuses any stored or typed address
outside the port its manifest allows, and drops the token that came with it.
npm install -g figsnap-mcp
Two commands come with it:
figsnap-mcp-daemon | the bri |