io.github.NBhey/figma-vault is an MCP server that figma designs pulled once into a local vault; AI agents read them offline with no rate limits. Its tool list has not been published yet over stdio and sse, requires no API key, and scores 55/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"io-github-nbhey-figma-vault": {
"args": [
"-y",
"figma-vault"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Figma designs pulled once into a local vault; AI agents read them offline with no rate limits
This server supports HTTP transport. Be the first to test it - help the community know if it works.
Five weighted categories - click any category to see the underlying evidence.
No known CVEs.
Checked figma-vault against OSV.dev.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in design / ai-ml
A cross-platform desktop application for managing AI Agents and MCP Servers. 一款用于管理AI智能体与MCP服务器的跨平台桌面应用程序。
Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.
Design tokens from any live site: colours, type, spacing, components, drift against a baseline.
An open-source AI agent that brings the power of Gemini directly into your terminal.
MCP Security Weekly
Get CVE alerts and security updates for io.github.NBhey/figma-vault and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
English · Русский
Pull a Figma frame once. Then Claude Code, Codex or any MCP agent reads it as often as it likes: offline, with no Figma token and no rate limits.
Try it in 30 seconds. You don't need a Figma token for this:
npm i -g figma-vault
figma-vault init && figma-vault demo && figma-vault check
How it works: the pull normalizes the frame and writes it to disk. The agent then reads it over MCP.
one developer: figma-vault add <link> → vault → git commit
the rest of the team: the agent reads it over MCP, no Figma token needed
Figma's MCP server and REST API are rate-limited, and on some seats the limit is tiny. While building a UI, an agent goes back to the design all the time to check a margin, a colour or a font size. That can mean dozens of calls in one session. You hit the limit fast and the work stops.
With figma-vault, the number of Figma calls doesn't depend on what the agent does. Each design costs a fixed number of calls, spent once when you pull it.
| Figma Dev Mode MCP | figma-vault | |
|---|---|---|
| who calls Figma | the agent, while it works | the CLI, once |
| how many calls | grows with the agent's work | fixed per design |
| does every reader need a token | yes | no |
| works offline | no | yes |
There's a side effect: the design becomes a file in your repository. A developer without access to the Figma file (no licence, no permissions, no token) still gets the whole design.
Other projects work on the same problem. The Framelink Exporter plugin exports a design to a zip for offline use, and there are caching forks of Framelink's Figma MCP. figma-vault takes a different approach:
doc.json follows a written contract,
and a strict validator checks every file.Requires Node.js 22+.
npm i -g figma-vault
figma-vault init
This creates .figma-vault/, registers the server in the project's .mcp.json (other
entries are left alone), adds .env to .gitignore and installs a /figma slash command
for Claude Code.
Use --no-command to skip the /figma command, so the agent gets only the read-only
vault_* tools.
figma-vault init --global
The vault lives in ~/.figma-vault/ and the server is registered in the agent's user
config. The project repository never learns the tool exists. Use this when you can't add
config or dependencies to the project.
figma-vault add "https://figma.com/design/KEY/Project?node-id=127-4532"
# Export
... [View full README on GitHub](https://github.com/nbhey/figma-vault#readme)