Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 1
- 4 8
- 3 7
- 2 0
- 1 0
Trust in production
- Trust it - 38%
- With caveats - 63%
- Wouldn't - 0%
94% would recommend this server
How reviewers scored it
- Setup & docs 3.6
- Auth experience 3.7
- Reliability 3.6
- Maintainer responsiveness 4.4
Why it got a B
Hosted by Figma over HTTPS, with browser sign-in through OAuth and PKCE; only clients in Figma's catalog can connect. Write tools can create files, upload assets and run model-written Plugin API code in any file you can edit, and there is no read-only option (the desktop server has no write tools). The CVEs listed under "figma mcp" belong to the third-party Framelink server. Biggest deduction: OAuth offers one all-or-nothing scope, and the server is closed source, so maintenance is one band lower.
How to connect
// Cursor Settings > Tools & MCP
{ "mcpServers": { "figma": { "url": "https://mcp.figma.com/mcp" } } }// mcp.json (MCP: Open User Configuration)
{ "inputs": [], "servers": { "figma": { "url": "https://mcp.figma.com/mcp", "type": "http" } } }claude mcp add --transport http figma https://mcp.figma.com/mcpIs Figma MCP Server safe?
Is Figma MCP Server safe to use?
Figma MCP Server grades B (solid, with minor gaps). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can. Upkeep is hard to verify (closed source or a single maintainer), so pin the version you tested.
Does Figma MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Figma MCP Server support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Developer Tools
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
- A GitLab MCP ServerGitLab's built-in MCP server for projects, merge requests, work items, code, and CI pipelines, on GitLab.com or your own instance.
Embed this badge
[](https://trustedmcp.io/servers/figma-mcp-server)<a href="https://trustedmcp.io/servers/figma-mcp-server"><img src="https://trustedmcp.io/badge/figma-mcp-server.svg" alt="TrustedMCP grade B" height="80"></a>Community reviews
Surprisingly polished
I use this almost daily. Sign-in flow was painless and I never had to paste a key into a config file. Would recommend without hesitation.
Used for Looking up Figma data without leaving the editor
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Works, just lock it down
Works well enough for what I need. Scoped the token to just what the agent needs and it respected that.
Used for Code review summaries for pull requests
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 4/5
Set it up once, forgot about it
Tried it on a side project first, then rolled it out at work. Nice to use something maintained by Figma rather than a random fork. Releases come often and the changelog is clear. Auth is handled properly, and revoking access later was one click. Happy to run it in production.
Used for Letting a coding agent open and triage issues
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Promising, a bit raw
It does the job, but it took some tweaking. Updates land regularly, and nothing broke when I upgraded.
Used for CI failure investigation
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Useful, with a few rough edges
Useful tool, though I would not hand it to a junior unsupervised. Sign-in flow was painless and I never had to paste a key into a config file. The OAuth flow worked first time in Claude Code. You can tell it is actively maintained, the rough edges keep getting fixed.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 2/5
- Maintainer responsiveness 5/5
Mixed feelings after two weeks
Mostly reliable, with the odd timeout. Sign-in flow was painless and I never had to paste a key into a config file. You can tell it is actively maintained, the rough edges keep getting fixed. Fine in production if you sandbox it.
Used for Keeping project tickets in sync with code changes
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Quietly reliable
Simple to set up in Cursor, simple to reason about. Sign-in flow was painless and I never had to paste a key into a config file. Being official from Figma counts for a lot when I pitch it to security. Recommended, with sensible guardrails.
Used for Debugging sessions in Cursor
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Does the job, docs could be better
I like it, with reservations. Auth is handled properly, and revoking access later was one click. I would use it in prod, but only with a human approving writes.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Exactly what I needed from Figma
Set this up for our team after comparing a few options. Filed an issue and got a reply within two days. Hosted endpoint means no local process to babysit. Auth is handled properly, and revoking access later was one click. It is in our production agent and I sleep fine.
Used for Automating release notes
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Better than the DIY script it replaced
Hooked Figma MCP Server into Claude Code and it worked on the first try. Scoped the token to just what the agent needs and it respected that. Turned on read-only mode on day one, highly recommend doing the same.
Used for Keeping project tickets in sync with code changes
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Good defaults, good docs
Replaced a homegrown script with Figma MCP Server and have not looked back. Auth is handled properly, and revoking access later was one click.
Used for Generating boilerplate from existing patterns
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Capable but needs guardrails
Some tools are great, a couple feel half finished. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Read-only mode is the first thing I enable, and it covers most of what I need.
Used for Looking up Figma data without leaving the editor
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Fine once configured properly
Took longer to configure than I expected. The OAuth flow worked first time in Claude Code. Worth it, just do not skip the hardening steps.
Used for Internal developer assistant
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Earned a permanent spot in my config
Started with it as an experiment, now it is a fixture. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Releases come often and the changelog is clear. Easy recommendation.
Used for Internal developer assistant
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Easy win for our agent setup
Been running this for about a month now. Scoped the token to just what the agent needs and it respected that. Hosted endpoint means no local process to babysit.
Used for Scripting routine maintenance tasks
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Our team uses it every day
Installed it on a Friday, it was part of my workflow by Monday. The OAuth flow worked first time in Claude Code.
Used for Letting a coding agent open and triage issues
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.