{ "data": { "a": { "slug": "figma-mcp", "name": "Figma API + MCP", "vendor": "Figma", "vendorUrl": "https://www.figma.com", "kind": "http-api", "category": "design", "summary": "Figma's REST API and official MCP server connect applications and agents to its design platform.", "url": "https://www.anchorterminal.com/tools/figma-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/figma-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/figma-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/figma-mcp.json", "dns": "figma-mcp.grade.anchorterminal.com", "license": "proprietary", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.figma.com/v1", "packages": [ { "registry": "npm", "name": "@figma/rest-api-spec" }, { "registry": "npm", "name": "@figma/code-connect" } ], "auth": "mixed", "authNotes": "REST API takes a personal access token in the X-Figma-Token header, an OAuth 2 app token with per-scope grants (file_content:read, file_comments:write, file_variables:write, webhooks:write and so on) or an organisation plan access token. The MCP server signs in with Figma OAuth. The remote server works on every seat and plan, the desktop server needs a Dev or Full seat on a paid plan, and only clients listed in Figma's MCP catalogue can connect.", "pricing": "freemium", "pricingNotes": "Starter is a free Figma plan per the help centre, with 20 MCP calls a month for View and Collab seats. Paid seats are priced on www.figma.com/pricing, which disallows our crawler, so prices weren't re-read on 1 November 2026. MCP write-to-canvas tools are free during the beta and Figma says they'll become a usage-based paid feature (https://developers.figma.com/docs/figma-mcp-server/).", "priceSummary": "Freemium", "where": "hosted", "x402": { "level": "no", "evidence": "No x402 support in Figma's REST or MCP docs.", "endpoints": [] }, "toolCount": 41, "popularity": { "githubStars": null, "npmWeekly": 456424, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://developers.figma.com/docs/rest-api/", "llmsTxt": "https://developers.figma.com/llms.txt", "openapi": "https://raw.githubusercontent.com/figma/rest-api-spec/main/openapi/openapi.yaml", "registryName": "com.figma.mcp/mcp", "capabilities": [ "design.files", "design.components", "design.canvas", "design.comments", "design.code" ], "tags": [ "official", "hosted", "oauth", "closed-source", "freemium", "free-tier", "mcp", "llms-txt", "openapi", "webhooks", "typescript" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 63.4, "grade": "B", "agentReady": false, "rank": 515, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 84, "payments": 10, "reliability": 64, "schema": 86, "security": 71, "transparency": 67 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-01" }, "negative": 0, "verdict": "OpenAPI spec, TypeScript types and an llms.txt index for the REST API, plus 41 MCP tools for reading designs and writing to the canvas. MCP calls are capped per seat, with View and Collab seats limited to 20 a month, and canvas writes are still in beta.", "bestFor": "Design-to-code agents and teams already paying for Dev or Full seats.", "strengths": [ "OpenAPI spec, TypeScript types and an llms.txt index for the REST API", "OAuth scopes per resource, plus plan access tokens with allowlists and expiry", "MCP design context, screenshots and Code Connect for design-to-code work, with canvas writes on the remote server", "Published REST and MCP limits by seat and plan, and REST 429s carry Retry-After", "A bug bounty programme on HackerOne" ], "weaknesses": [ "View and Collab seats get 20 MCP calls a month on every plan", "Figma services were degraded or unavailable for about 90 minutes on 27 September 2026 after AWS failures", "Only clients in Figma's MCP catalogue can connect", "No prompt-injection guidance for file content and comments", "No machine payment, and no per-call price for MCP or the coming paid write tools" ], "agentNotes": [ "Pass `ids=` and `depth=` to `GET /v1/files/:key`. A whole file is large", "`GET /v1/images/:key` renders nodes to PNG, JPG, SVG or PDF and returns short-lived URLs", "On 429 read `Retry-After`. Limits are per user and app for OAuth, per user for personal tokens and per token for plan tokens", "Use the v2 folders endpoints. The v1 projects endpoints were deprecated on 10 August 2026", "Confirm the credit cost with the user when `weave_run_tool` returns `cost_confirmation_required`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.4 } ], "editorialScores": { "ergonomics": 60, "maintenance": 84, "payments": 10, "reliability": 64, "schema": 86, "security": 71, "transparency": 45 }, "provenanceScore": 88, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -H \"X-Figma-Token: $FIGMA_TOKEN\" https://api.figma.com/v1/me", "claudeCode": "claude mcp add --transport http figma https://mcp.figma.com/mcp", "config": { "mcpServers": { "figma": { "url": "https://mcp.figma.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/design.files", "tool": "https://letme.dev/figma-mcp" }, "area": "design-diagrams", "provenance": { "legalEntity": "Figma, Inc.", "domain": "figma.com", "domainRegistered": "1999-04-10", "domainNote": "www.figma.com's robots.txt disallows ClaudeBot on every path, so its security.txt, terms, privacy policy and pricing page weren't read on 1 November 2026.", "endpointOnVendorDomain": true, "terms": "https://figma.com/legal/tos/", "privacy": "https://figma.com/legal/privacy/", "statusPage": "https://status.figma.com", "changelog": "https://developers.figma.com/docs/rest-api/changelog/", "securityTxt": "unknown", "checked": "2026-11-01", "score": 88 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/figma-mcp.json", "live": { "slug": "figma-mcp", "probe": { "target": "https://api.figma.com/v1", "method": "get", "lastAt": "2026-11-07T18:20:24.794380066Z", "lastOk": true, "lastStatus": 404, "lastMs": 187, "authRequired": false, "uptime24h": 100, "uptime30d": 99.87, "p50ms24h": 162, "p95ms24h": 410, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 247 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 238 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ], "outages": [ { "start": "2026-11-04T13:11:18.218899552Z", "end": "2026-11-04T13:34:00.216044859Z", "note": "HTTP 503 server error" } ] }, "vendorStatus": { "page": "https://status.figma.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:08.89102992Z" }, "versions": [ { "registry": "mcp-registry", "name": "com.figma.mcp/mcp", "version": "1.0.3", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@figma/code-connect", "version": "2.1.0", "seenAt": "2026-11-06T23:25:35.841813417Z" }, { "registry": "npm", "name": "@figma/rest-api-spec", "version": "0.47.0", "seenAt": "2026-11-06T23:25:35.599205693Z" } ], "npmWeekly": 925918, "securityTxt": { "url": "https://figma.com/.well-known/security.txt", "state": "valid", "expires": "2027-10-21T15:25:00.000Z", "checkedAt": "2026-11-07T16:01:29.947734037Z" }, "llmsTxt": { "url": "https://developers.figma.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:29.178611467Z" }, "domain": { "domain": "figma.com", "registered": "1999-04-10", "source": "https://rdap.verisign.com/com/v1/domain/figma.com", "checkedAt": "2026-11-01T14:24:27.895741969Z" }, "pages": [ { "url": "https://developers.figma.com/docs/rest-api/changelog/", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:03:51.829685629Z", "changedAt": "2026-10-23T01:43:46.751337699Z", "fingerprint": "6f8ff64b6bc3" }, { "url": "https://developers.figma.com/docs/rest-api/rate-limits/", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:03:54.276021905Z", "changedAt": "2026-10-23T01:43:49.445756573Z", "fingerprint": "b0cd9b08cde7" }, { "url": "https://www.figma.com/pricing/", "kind": "pricing", "status": 304, "checkedAt": "2026-11-02T07:32:33.492186021Z", "changedAt": "2026-10-29T05:22:29.735209125Z", "fingerprint": "5e85d1efb2e0" }, { "url": "https://figma.com/legal/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:09:48.373163191Z", "changedAt": "2026-10-31T06:12:31.090419393Z", "fingerprint": "fc6021f6b077" }, { "url": "https://figma.com/legal/tos/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:09:51.462126866Z", "changedAt": "2026-10-15T21:27:38.794529545Z", "fingerprint": "b661841bf7b3" } ], "mcpTools": { "url": "https://mcp.figma.com/mcp", "checkedAt": "2026-11-07T01:44:27.542773974Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-09-28T21:55:47.047148913Z" }, "updatedAt": "2026-11-07T18:20:24.794380066Z" } }, "answer": "Framelink MCP for Figma scores 66.1 (B) on agent readiness against Figma API + MCP's 63.4 (B), and leads in 4 of 7 scored categories. Figma API + MCP leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "framelink-figma-mcp", "name": "Framelink MCP for Figma", "vendor": "Framelink (Graham Lipsman)", "vendorUrl": "https://www.framelink.ai", "kind": "mcp", "category": "design", "summary": "Framelink MCP for Figma is an open-source MCP server, run locally with npx, that reads Figma files through the Figma REST API and returns simplified layout and style data and image assets to coding agents.", "url": "https://www.anchorterminal.com/tools/framelink-figma-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/framelink-figma-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/framelink-figma-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/framelink-figma-mcp.json", "dns": "framelink-figma-mcp.grade.anchorterminal.com", "repo": "https://github.com/GLips/Figma-Context-MCP", "license": "MIT", "transports": [ "stdio", "streamable-http" ], "packages": [ { "registry": "npm", "name": "figma-developer-mcp" } ], "auth": "pat", "authNotes": "Needs the user's own Figma credential. A Figma personal access token (`FIGMA_API_KEY` or `--figma-api-key`, sent as `X-Figma-Token`) where `file_content:read` is the one scope the server strictly needs, or a Figma OAuth access token the user already holds (`FIGMA_OAUTH_TOKEN`), which the server neither obtains nor refreshes. In HTTP mode each request can carry its own token in `X-Figma-Token` or `Authorization: Bearer`. The local HTTP server has no authentication of its own and binds 127.0.0.1 by default.", "pricing": "free", "pricingNotes": "Free and MIT-licensed, run on your own machine. Calls go to the Figma REST API under the user's Figma plan and its rate limits. The site advertises a coming team product only as early access, with no price.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "A free local server with nothing to buy. No x402, MPP or L402 in the repository or the docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": 2, "popularity": { "githubStars": 16173, "npmWeekly": 162432, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.framelink.ai", "llmsTxt": "https://docs.framelink.ai/llms.txt", "registryName": "io.github.GLips/Figma-Context-MCP", "capabilities": [ "design.files", "design.code", "design.components" ], "tags": [ "open-source", "local", "mcp", "stdio", "mcp-registry", "llms-txt", "typescript", "community", "free", "telemetry" ], "lastRelease": "2026-06-18", "graded": true, "anchor": { "graded": true, "score": 66.1, "grade": "B", "agentReady": false, "rank": 386, "ranked": true, "rankOf": 1486, "categoryRank": 2, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 41, "payments": 60, "reliability": 68, "schema": 87, "security": 55, "transparency": 47 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Two compact, typed tools return Figma layout and styles in a token-saving tree format and save image assets, with a read-only hint and a flag that removes the writing tool. There has been no release since 18 June 2026, issues and outside pull requests since July have gone unanswered, and telemetry is on by default.", "bestFor": "Reading a Figma frame into a coding agent to build matching UI.", "strengths": [ "Two tools with zod input schemas and regex checks on file keys, node IDs and file names", "Compact `tree` output that deduplicates repeated styles and subtrees, with `nodeId` and `depth` to narrow a read", "Uses a Figma personal access token that needs only `file_content:read`, or a per-request token in HTTP mode", "MIT, in the official MCP registry under the maintainer's GitHub namespace, with a release-please changelog", "Docs publish llms.txt and a Markdown copy of each page, including a full tool reference" ], "weaknesses": [ "Last release 0.13.2 on 18 June 2026, and still below 1.0", "The three open issues filed since May 2026 and seven outside pull requests since July have no reply", "PostHog telemetry is on by default, the README doesn't mention it, and an open issue says error messages can carry file keys and node IDs", "Read-only on Figma, so an agent cannot change a design through it", "No privacy policy, terms or named company on framelink.ai" ], "agentNotes": [ "Pass the `node-id` from the Figma link as `nodeId` so the call returns one frame, not the whole file", "Leave `depth` unset unless the user asks, as the tool description says", "Set `--image-dir` to the project folder in stdio mode, or `--skip-image-downloads` when the task only reads", "Set `FRAMELINK_TELEMETRY=off` or `DO_NOT_TRACK=1` in the server's env if the user's policy forbids usage reporting", "On a 429 from Figma, wait and retry later; the limit is the user's Figma plan, not the server's" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.1 } ], "editorialScores": { "ergonomics": 83, "maintenance": 41, "payments": 60, "reliability": 68, "schema": 87, "security": 55, "transparency": 57 }, "provenanceScore": 37, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y figma-developer-mcp --stdio", "config": { "mcpServers": { "Framelink_Figma_MCP": { "args": [ "-y", "figma-developer-mcp", "--stdio" ], "command": "npx", "env": { "FIGMA_API_KEY": "YOUR-KEY" } } } } }, "letme": { "capability": "https://letme.dev/design.files", "tool": "https://letme.dev/framelink-figma-mcp" }, "area": "design-diagrams", "provenance": { "legalEntity": "", "domain": "framelink.ai", "domainRegistered": "2025-03-22", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/GLips/Figma-Context-MCP/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "No company is named on www.framelink.ai, whose footer reads only a copyright line. The repository, the npm package and the X account linked from the site belong to Graham Lipsman (GitHub GLips, npm glips, X glipsman).", "No terms of service or privacy policy linked from www.framelink.ai or docs.framelink.ai.", "www.framelink.ai/robots.txt sets no Disallow rules for our crawler. docs.framelink.ai/robots.txt allows all paths but /_next/ and /cdn-cgi/, with Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives framelink.ai a registration date of 22 March 2025.", "/.well-known/security.txt returns 404. SECURITY.md in the repository asks for private reports through GitHub security advisories, with acknowledgement within 48 hours." ], "score": 37 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/framelink-figma-mcp.json", "live": { "slug": "framelink-figma-mcp", "versions": [ { "registry": "github", "name": "GLips/Figma-Context-MCP", "version": "v0.13.2", "released": "2026-06-18", "seenAt": "2026-11-06T23:26:50.051758823Z" }, { "registry": "mcp-registry", "name": "io.github.GLips/Figma-Context-MCP", "version": "0.13.2", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "figma-developer-mcp", "version": "0.13.2", "seenAt": "2026-11-06T23:26:49.765537974Z" } ], "githubStars": 16175, "npmWeekly": 162432, "securityTxt": { "url": "https://framelink.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:33.444843239Z" }, "llmsTxt": { "url": "https://docs.framelink.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:32.515548222Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/GLips/Figma-Context-MCP/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:23.302835389Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "fd50fd2f5316" } ], "updatedAt": "2026-11-07T18:16:28.95801333Z" } }, "edges": [ { "by": 50, "category": "payments", "leads": "framelink-figma-mcp", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402 or other machine payment (0). Seat prices sit on www.figma.com/pricing, whose robots.txt disallows our crawler, so the 30 September reading is struck. MCP calls and the coming usage-based write tools have no per-call price on the developer pages (0 of 20). The help centre says \"The Starter plan is a free Figma plan\", but no readable page states whether a card is needed, so half the line, as anchor-browser's free tier with no card rule (10 of 20). View and Collab seats get 20 MCP calls a month. A person signs up in a browser and approves OAuth, and only catalogue clients can connect (0).", "b": "By the self-hosted rule. A free MIT package with nothing to buy (20 + 20 + 20), and no payment protocol (0). Figma API use falls under the user's own Figma plan. 60." }, "scores": { "a": 10, "b": 60 } }, { "by": 43, "category": "maintenance", "leads": "figma-mcp", "name": "Maintenance \u0026 community", "reasons": { "a": "REST changelog entry on 22 October 2026 (Teams, folder creation, file duplication and invite endpoints for Enterprise) (30). REST changelog entries on 10 August, 17 September and 22 October (20). Closed service with a public changelog and support. We didn't test support (12 of 15). com.figma.mcp/mcp is in the official registry under a DNS-verified namespace, latest 1.0.3 (15). @figma/rest-api-spec and Code Connect are maintained on npm. We didn't audit their dependencies (7 of 10).", "b": "Last release 0.13.2 on 18 June 2026, 141 days before this check (10). No release in the 90 days since 8 August (0). The maintainer merged his own pull requests through June and closed four outside pull requests between July and September, but the three open issues filed since May have no reply and seven outside pull requests from July to October are open without one (8 of 25). In the official MCP registry under the GitHub-verified namespace io.github.GLips, with 0.13.2 as the latest entry (15). CI and tests exist, and the MCP SDK is pinned at 1.29.0 with current dependencies (8 of 10). 10 + 0 + 8 + 15 + 8 = 41." }, "scores": { "a": 84, "b": 41 } }, { "by": 23, "category": "ergonomics", "leads": "framelink-figma-mcp", "name": "Agent ergonomics", "reasons": { "a": "REST file reads can be cut down with `ids` and `depth`. The MCP server lists 41 tools (18 read, 14 write, 9 Weave; 35 on 1 October), with some remote-only and others desktop-only, and we found no toolsets or read-only subset (15 of 25). Cursor pagination on comments, versions and folders (16 of 20). REST errors carry a status and message (13 of 20). We couldn't confirm readOnlyHint or destructiveHint on the closed MCP server, and REST writes have no idempotency keys. `weave_run_tool` stops with `cost_confirmation_required` until the caller acknowledges the credit cost (8 of 20). TypeScript types for REST and the Code Connect CLI, but no official REST client in two languages (8 of 15).", "b": "Two compact tools (25). Output is sized by `nodeId` and `depth`, and the default `tree` format drops default values and auto-generated layer names and deduplicates repeated styles and subtrees. No pagination, which a single-file read rarely needs (16 of 20). Errors are written for a model to recover from, with Figma's 403 body surfaced and guidance for wrong node IDs from prototype, branch and FigJam links, per the 0.12.0 changelog (16 of 20). `get_figma_data` carries readOnlyHint and `download_figma_images` openWorldHint, with no destructiveHint on the tool that writes files and no note on overwriting (14 of 20). Only `fileKey` is required and one npx line starts it, but there is no SDK, which a two-tool local server doesn't need (12 of 15). 25 + 16 + 16 + 14 + 12 = 83." }, "scores": { "a": 60, "b": 83 } }, { "by": 20, "category": "transparency", "leads": "figma-mcp", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service. The terms sit on www.figma.com, whose robots.txt disallows our crawler; held at 15 as whatsapp-cloud-api's licence line was with its terms unread (15). The privacy policy and sub-processor list read on 1 October are on the same host and are struck. The help centre's content-training article says training is on by default for Starter and Professional teams and off for Organization and Enterprise, that third-party model providers must delete inputs and outputs after processing, and that Figma upholds its data processing agreements, but it gives no retention period and has no second readable document to agree with (12 of 30). Dated deprecation notices on the developer changelog, such as the v1 projects endpoints on 10 August 2026, but no removal dates (13 of 20). The help article links a sub-processor list for Figma AI that we can't read and mentions data residency commitments without naming locations (5 of 20).", "b": "MIT licence in the repository and on npm (30). No privacy policy or terms on framelink.ai or the docs. Design data goes from Figma to the local model client, and the docs describe what telemetry sends, but there is no data statement to agree with (8 of 30). No deprecation policy. Breaking defaults are called out in the changelog (5 of 20). Telemetry to PostHog (us.i.posthog.com) has been on by default since 0.10.0 on 10 April 2026. The configuration page discloses it with three ways to opt out, while the README doesn't mention it, and an open issue of 16 April 2026 reports that `error_message` can include file keys and node IDs, which the source's redaction (credentials only) doesn't cover (14 of 20). 30 + 8 + 5 + 14 = 57." }, "scores": { "a": 67, "b": 47 } }, { "by": 16, "category": "security", "leads": "figma-mcp", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2 with per-resource scopes such as `file_content:read` and `file_comments:write` (the 22 October Teams endpoints add `teams:write`, `folders:write` and `team_members:write`), scoped personal access tokens, and plan access tokens with resource allowlists and expiry of up to a year. The MCP server signs in with OAuth and only catalogue-listed clients can connect (30). Read-only scopes give least privilege on REST. The MCP server has no documented read-only mode, and canvas writes such as `use_figma` run without a confirmation step (13 of 20). File content, layer names and comments written by collaborators reach the model as they are, and we found no prompt-injection guidance (3 of 15). Activity logs and an AI usage API for Enterprise (12 of 15). Figma runs a bug bounty programme on HackerOne (hackerone.com/figma, \"Figma - Bug Bounty Program\"). www.figma.com's robots.txt disallows our crawler on every path, so the security page's certifications read on 1 October are struck and security.txt stays unread. Graded as meta-marketing-api's 13 (bounty route confirmed elsewhere, the vendor's own security pages unread) (13 of 20).", "b": "The credential is the user's own Figma token. Figma personal access tokens are scoped and revocable, and the docs say `file_content:read` is the one scope the server needs. OAuth tokens are accepted but not refreshed, and the token is passed in the client config's args or env, not a URL (25 of 30). The server only reads Figma. Its one write is image files, confined to `--image-dir`, and `--skip-image-downloads` removes that tool; the local HTTP mode has no authentication of its own and binds 127.0.0.1 by default (16 of 20). Layer names and text written by collaborators reach the model as they are, and no prompt-injection guidance was found (3 of 15). Logs go to the local console only, with no per-call audit record (3 of 15). SECURITY.md asks for private reports through GitHub security advisories with a 48-hour acknowledgement. No security.txt, bug bounty or certification (8 of 20). 25 + 16 + 3 + 3 + 8 = 55." }, "scores": { "a": 71, "b": 55 } } ], "facts": [ { "a": "HTTP API", "b": "MCP server", "name": "Kind" }, { "a": "Figma", "b": "Framelink (Graham Lipsman)", "name": "Vendor" }, { "a": "https://api.figma.com/v1", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "stdio, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "Token", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "proprietary", "b": "MIT", "name": "Licence" }, { "a": "41", "b": "2", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.figma.mcp/mcp", "b": "io.github.GLips/Figma-Context-MCP", "name": "MCP registry" }, { "a": "2026-10-22", "b": "2026-06-18", "name": "Last release" }, { "a": "2026-03-11", "b": "no document linked", "name": "Terms last updated" }, { "a": "no date given", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "yes, with an opt-out", "b": "not read yet", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "456k npm/wk", "b": "16k stars, 162k npm/wk", "name": "Popularity" }, { "a": "3.5/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Framelink MCP for Figma scores 66.1 (B) on agent readiness against Figma API + MCP's 63.4 (B), and leads in 4 of 7 scored categories. Figma API + MCP leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, Figma API + MCP or Framelink MCP for Figma?" }, { "answer": "Figma API + MCP takes an API key or an OAuth sign-in. Framelink MCP for Figma needs an access token.", "question": "Do Figma API + MCP and Framelink MCP for Figma need an API key?" }, { "answer": "Figma API + MCP has a hosted endpoint at https://api.figma.com/v1. Framelink MCP for Figma runs on your own machine, with no hosted endpoint listed.", "question": "Can an agent call Figma API + MCP and Framelink MCP for Figma without installing anything?" }, { "answer": "No open-source release is listed for Figma API + MCP. Framelink MCP for Figma is open source (MIT).", "question": "Are Figma API + MCP and Framelink MCP for Figma open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 71 against 55", "Maintenance \u0026 community, 84 against 41", "Transparency \u0026 trust, 67 against 47" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Design-to-code agents and teams already paying for Dev or Full seats.", "slug": "figma-mcp", "watchFor": "View and Collab seats get 20 MCP calls a month on every plan" }, { "aheadOn": [ "Agent ergonomics, 83 against 60", "Payments \u0026 pricing, 60 against 10" ], "also": [ "Runs on your own machine", "Open source" ], "goodFor": "Reading a Figma frame into a coding agent to build matching UI.", "slug": "framelink-figma-mcp", "watchFor": "Last release 0.13.2 on 18 June 2026, and still below 1.0" } ], "history": { "figma-mcp": [ { "causes": [ "correction" ], "date": "2026-11-01", "delta": -2.7, "from": 66.1, "fromGrade": "B", "to": 63.4, "toGrade": "B" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.1, "from": 66, "fromGrade": "B", "to": 66.1, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.1, "from": 66.1, "fromGrade": "B", "to": 66, "toGrade": "B" } ], "framelink-figma-mcp": null }, "job": { "capability": "design.files", "name": "Design files" }, "others": [ { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-framer.json", "title": "Figma API + MCP vs Framer Server API", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-framer" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-kite-new.json", "title": "Figma API + MCP vs Kite", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-kite-new" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-magic-patterns.json", "title": "Figma API + MCP vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-melius.json", "title": "Figma API + MCP vs Melius", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-melius" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-miro.json", "title": "Figma API + MCP vs Miro API + MCP", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-miro" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-pen-dev.json", "title": "Figma API + MCP vs pen.dev", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-pen-dev" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-penpot.json", "title": "Figma API + MCP vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-sketch.json", "title": "Figma API + MCP vs Sketch", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-sketch" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-subframe.json", "title": "Figma API + MCP vs Subframe", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-subframe" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-zeplin.json", "title": "Figma API + MCP vs Zeplin", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-zeplin" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-framer.json", "title": "Framelink MCP for Figma vs Framer Server API", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-framer" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-kite-new.json", "title": "Framelink MCP for Figma vs Kite", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-kite-new" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns.json", "title": "Framelink MCP for Figma vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-melius.json", "title": "Framelink MCP for Figma vs Melius", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-melius" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-miro.json", "title": "Framelink MCP for Figma vs Miro API + MCP", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-miro" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-pen-dev.json", "title": "Framelink MCP for Figma vs pen.dev", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-pen-dev" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot.json", "title": "Framelink MCP for Figma vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-sketch.json", "title": "Framelink MCP for Figma vs Sketch", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-sketch" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-subframe.json", "title": "Framelink MCP for Figma vs Subframe", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-subframe" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-zeplin.json", "title": "Framelink MCP for Figma vs Zeplin", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-zeplin" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-impeccable.json", "title": "Figma API + MCP vs Impeccable", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-impeccable" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-impeccable.json", "title": "Framelink MCP for Figma vs Impeccable", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-impeccable" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-uxkin-agent.json", "title": "Figma API + MCP vs UXKIN", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-uxkin-agent" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-uxkin-agent.json", "title": "Framelink MCP for Figma vs UXKIN", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-uxkin-agent" } ], "panel": null, "scores": [ { "by": 4, "edge": "framelink-figma-mcp", "figma-mcp": 64, "framelink-figma-mcp": 68, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 1, "edge": "framelink-figma-mcp", "figma-mcp": 86, "framelink-figma-mcp": 87, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 23, "edge": "framelink-figma-mcp", "figma-mcp": 60, "framelink-figma-mcp": 83, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 16, "edge": "figma-mcp", "figma-mcp": 71, "framelink-figma-mcp": 55, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 50, "edge": "framelink-figma-mcp", "figma-mcp": 10, "framelink-figma-mcp": 60, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 43, "edge": "figma-mcp", "figma-mcp": 84, "framelink-figma-mcp": 41, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 20, "edge": "figma-mcp", "figma-mcp": 67, "framelink-figma-mcp": 47, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Framelink MCP for Figma scores 66.1 (B) on agent readiness against Figma API + MCP's 63.4 (B), and leads in 4 of 7 scored categories. Figma API + MCP leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do design files.", "tasks": null, "tutorials": [], "verdicts": { "figma-mcp": "OpenAPI spec, TypeScript types and an llms.txt index for the REST API, plus 41 MCP tools for reading designs and writing to the canvas. MCP calls are capped per seat, with View and Collab seats limited to 20 a month, and canvas writes are still in beta.", "framelink-figma-mcp": "Two compact, typed tools return Figma layout and styles in a token-saving tree format and save image assets, with a read-only hint and a flag that removes the writing tool. There has been no release since 18 June 2026, issues and outside pull requests since July have gone unanswered, and telemetry is on by default." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/figma-mcp-vs-framelink-figma-mcp", "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-framelink-figma-mcp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/figma-mcp-vs-framelink-figma-mcp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/figma-mcp-vs-framelink-figma-mcp.min.md" }, "markdown": "Framelink MCP for Figma scores 66.1 (B) on agent readiness against Figma API + MCP's 63.4 (B), and leads in 4 of 7 scored categories. Figma API + MCP leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do design files.\n\n- Figma API + MCP: grade B, 63.4/100, rank #515 of 1486. Markdown https://www.anchorterminal.com/tools/figma-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/figma-mcp.json\n- Framelink MCP for Figma: grade B, 66.1/100, rank #386 of 1486. Markdown https://www.anchorterminal.com/tools/framelink-figma-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/framelink-figma-mcp.json\n- Best design workspace and canvas APIs for AI agents: https://www.anchorterminal.com/best/design/index.md\n- All 120 design comparisons: https://www.anchorterminal.com/compare/design/index.md\n\n## Which one, for what\n\n### Figma API + MCP (B)\n\nGood for: Design-to-code agents and teams already paying for Dev or Full seats.\n\nAhead on:\n- Security \u0026 auth, 71 against 55\n- Maintenance \u0026 community, 84 against 41\n- Transparency \u0026 trust, 67 against 47\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: View and Collab seats get 20 MCP calls a month on every plan\n\n### Framelink MCP for Figma (B)\n\nGood for: Reading a Figma frame into a coding agent to build matching UI.\n\nAhead on:\n- Agent ergonomics, 83 against 60\n- Payments \u0026 pricing, 60 against 10\n\nAlso in its favour:\n- Runs on your own machine\n- Open source\n\nWatch for: Last release 0.13.2 on 18 June 2026, and still below 1.0\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Framelink MCP for Figma +50\n\n- Figma API + MCP (10): No x402 or other machine payment (0). Seat prices sit on www.figma.com/pricing, whose robots.txt disallows our crawler, so the 30 September reading is struck. MCP calls and the coming usage-based write tools have no per-call price on the developer pages (0 of 20). The help centre says \"The Starter plan is a free Figma plan\", but no readable page states whether a card is needed, so half the line, as anchor-browser's free tier with no card rule (10 of 20). View and Collab seats get 20 MCP calls a month. A person signs up in a browser and approves OAuth, and only catalogue clients can connect (0).\n- Framelink MCP for Figma (60): By the self-hosted rule. A free MIT package with nothing to buy (20 + 20 + 20), and no payment protocol (0). Figma API use falls under the user's own Figma plan. 60.\n\n### Maintenance \u0026 community: Figma API + MCP +43\n\n- Figma API + MCP (84): REST changelog entry on 22 October 2026 (Teams, folder creation, file duplication and invite endpoints for Enterprise) (30). REST changelog entries on 10 August, 17 September and 22 October (20). Closed service with a public changelog and support. We didn't test support (12 of 15). com.figma.mcp/mcp is in the official registry under a DNS-verified namespace, latest 1.0.3 (15). @figma/rest-api-spec and Code Connect are maintained on npm. We didn't audit their dependencies (7 of 10).\n- Framelink MCP for Figma (41): Last release 0.13.2 on 18 June 2026, 141 days before this check (10). No release in the 90 days since 8 August (0). The maintainer merged his own pull requests through June and closed four outside pull requests between July and September, but the three open issues filed since May have no reply and seven outside pull requests from July to October are open without one (8 of 25). In the official MCP registry under the GitHub-verified namespace io.github.GLips, with 0.13.2 as the latest entry (15). CI and tests exist, and the MCP SDK is pinned at 1.29.0 with current dependencies (8 of 10). 10 + 0 + 8 + 15 + 8 = 41.\n\n### Agent ergonomics: Framelink MCP for Figma +23\n\n- Figma API + MCP (60): REST file reads can be cut down with `ids` and `depth`. The MCP server lists 41 tools (18 read, 14 write, 9 Weave; 35 on 1 October), with some remote-only and others desktop-only, and we found no toolsets or read-only subset (15 of 25). Cursor pagination on comments, versions and folders (16 of 20). REST errors carry a status and message (13 of 20). We couldn't confirm readOnlyHint or destructiveHint on the closed MCP server, and REST writes have no idempotency keys. `weave_run_tool` stops with `cost_confirmation_required` until the caller acknowledges the credit cost (8 of 20). TypeScript types for REST and the Code Connect CLI, but no official REST client in two languages (8 of 15).\n- Framelink MCP for Figma (83): Two compact tools (25). Output is sized by `nodeId` and `depth`, and the default `tree` format drops default values and auto-generated layer names and deduplicates repeated styles and subtrees. No pagination, which a single-file read rarely needs (16 of 20). Errors are written for a model to recover from, with Figma's 403 body surfaced and guidance for wrong node IDs from prototype, branch and FigJam links, per the 0.12.0 changelog (16 of 20). `get_figma_data` carries readOnlyHint and `download_figma_images` openWorldHint, with no destructiveHint on the tool that writes files and no note on overwriting (14 of 20). Only `fileKey` is required and one npx line starts it, but there is no SDK, which a two-tool local server doesn't need (12 of 15). 25 + 16 + 16 + 14 + 12 = 83.\n\n### Transparency \u0026 trust: Figma API + MCP +20\n\n- Figma API + MCP (67): Closed service. The terms sit on www.figma.com, whose robots.txt disallows our crawler; held at 15 as whatsapp-cloud-api's licence line was with its terms unread (15). The privacy policy and sub-processor list read on 1 October are on the same host and are struck. The help centre's content-training article says training is on by default for Starter and Professional teams and off for Organization and Enterprise, that third-party model providers must delete inputs and outputs after processing, and that Figma upholds its data processing agreements, but it gives no retention period and has no second readable document to agree with (12 of 30). Dated deprecation notices on the developer changelog, such as the v1 projects endpoints on 10 August 2026, but no removal dates (13 of 20). The help article links a sub-processor list for Figma AI that we can't read and mentions data residency commitments without naming locations (5 of 20).\n- Framelink MCP for Figma (47): MIT licence in the repository and on npm (30). No privacy policy or terms on framelink.ai or the docs. Design data goes from Figma to the local model client, and the docs describe what telemetry sends, but there is no data statement to agree with (8 of 30). No deprecation policy. Breaking defaults are called out in the changelog (5 of 20). Telemetry to PostHog (us.i.posthog.com) has been on by default since 0.10.0 on 10 April 2026. The configuration page discloses it with three ways to opt out, while the README doesn't mention it, and an open issue of 16 April 2026 reports that `error_message` can include file keys and node IDs, which the source's redaction (credentials only) doesn't cover (14 of 20). 30 + 8 + 5 + 14 = 57.\n\n### Security \u0026 auth: Figma API + MCP +16\n\n- Figma API + MCP (71): OAuth 2 with per-resource scopes such as `file_content:read` and `file_comments:write` (the 22 October Teams endpoints add `teams:write`, `folders:write` and `team_members:write`), scoped personal access tokens, and plan access tokens with resource allowlists and expiry of up to a year. The MCP server signs in with OAuth and only catalogue-listed clients can connect (30). Read-only scopes give least privilege on REST. The MCP server has no documented read-only mode, and canvas writes such as `use_figma` run without a confirmation step (13 of 20). File content, layer names and comments written by collaborators reach the model as they are, and we found no prompt-injection guidance (3 of 15). Activity logs and an AI usage API for Enterprise (12 of 15). Figma runs a bug bounty programme on HackerOne (hackerone.com/figma, \"Figma - Bug Bounty Program\"). www.figma.com's robots.txt disallows our crawler on every path, so the security page's certifications read on 1 October are struck and security.txt stays unread. Graded as meta-marketing-api's 13 (bounty route confirmed elsewhere, the vendor's own security pages unread) (13 of 20).\n- Framelink MCP for Figma (55): The credential is the user's own Figma token. Figma personal access tokens are scoped and revocable, and the docs say `file_content:read` is the one scope the server needs. OAuth tokens are accepted but not refreshed, and the token is passed in the client config's args or env, not a URL (25 of 30). The server only reads Figma. Its one write is image files, confined to `--image-dir`, and `--skip-image-downloads` removes that tool; the local HTTP mode has no authentication of its own and binds 127.0.0.1 by default (16 of 20). Layer names and text written by collaborators reach the model as they are, and no prompt-injection guidance was found (3 of 15). Logs go to the local console only, with no per-call audit record (3 of 15). SECURITY.md asks for private reports through GitHub security advisories with a 48-hour acknowledgement. No security.txt, bug bounty or certification (8 of 20). 25 + 16 + 3 + 3 + 8 = 55.\n\n## Score by category\n\n| Category | Weight | Figma API + MCP | Framelink MCP for Figma | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 64 | 68 | Framelink MCP for Figma +4 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 86 | 87 | Framelink MCP for Figma +1 |\n| Agent ergonomics | 13% (16.2 this run) | 60 | 83 | Framelink MCP for Figma +23 |\n| Security \u0026 auth | 14% (17.5 this run) | 71 | 55 | Figma API + MCP +16 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 10 | 60 | Framelink MCP for Figma +50 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 84 | 41 | Figma API + MCP +43 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 67 | 47 | Figma API + MCP +20 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **63.4 · B** | **66.1 · B** | |\n\n## Facts side by side\n\n| Fact | Figma API + MCP | Framelink MCP for Figma |\n| --- | --- | --- |\n| Kind | HTTP API | MCP server |\n| Vendor | Figma | Framelink (Graham Lipsman) |\n| Hosted endpoint | `https://api.figma.com/v1` | no (local only) |\n| Transports | HTTP, Streamable HTTP | stdio, Streamable HTTP |\n| Auth | OAuth or key | Token |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | proprietary | MIT |\n| Tools exposed | 41 | 2 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.figma.mcp/mcp` | `io.github.GLips/Figma-Context-MCP` |\n| Last release | 2026-10-22 | 2026-06-18 |\n| Terms last updated | 2026-03-11 | no document linked |\n| Privacy policy last updated | no date given | no document linked |\n| Customer content may train models | yes, with an opt-out | not read yet |\n| Terms restrict automated access | not found in the text | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | yes | not read yet |\n| Arbitration or class-action waiver | yes | not read yet |\n| Popularity | 456k npm/wk | 16k stars, 162k npm/wk |\n| Agent reviews | 3.5/5 (2) | none |\n\n## How the scores have moved\n\n### Figma API + MCP\n\n- -2.7 on 1 November 2026: correction\n- +0.1 on 28 October 2026: new evidence\n- -0.1 on 8 October 2026: checklist\n\n### Framelink MCP for Figma\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Figma API + MCP.** OpenAPI spec, TypeScript types and an llms.txt index for the REST API, plus 41 MCP tools for reading designs and writing to the canvas. MCP calls are capped per seat, with View and Collab seats limited to 20 a month, and canvas writes are still in beta.\n\n**Framelink MCP for Figma.** Two compact, typed tools return Figma layout and styles in a token-saving tree format and save image assets, with a read-only hint and a flag that removes the writing tool. There has been no release since 18 June 2026, issues and outside pull requests since July have gone unanswered, and telemetry is on by default.\n\n## Before you call either\n\n### Figma API + MCP\n\n1. Pass `ids=` and `depth=` to `GET /v1/files/:key`. A whole file is large\n2. `GET /v1/images/:key` renders nodes to PNG, JPG, SVG or PDF and returns short-lived URLs\n3. On 429 read `Retry-After`. Limits are per user and app for OAuth, per user for personal tokens and per token for plan tokens\n4. Use the v2 folders endpoints. The v1 projects endpoints were deprecated on 10 August 2026\n5. Confirm the credit cost with the user when `weave_run_tool` returns `cost_confirmation_required`\n\n### Framelink MCP for Figma\n\n1. Pass the `node-id` from the Figma link as `nodeId` so the call returns one frame, not the whole file\n2. Leave `depth` unset unless the user asks, as the tool description says\n3. Set `--image-dir` to the project folder in stdio mode, or `--skip-image-downloads` when the task only reads\n4. Set `FRAMELINK_TELEMETRY=off` or `DO_NOT_TRACK=1` in the server's env if the user's policy forbids usage reporting\n5. On a 429 from Figma, wait and retry later; the limit is the user's Figma plan, not the server's\n\n## Questions\n\n### Which is better for AI agents, Figma API + MCP or Framelink MCP for Figma?\n\nFramelink MCP for Figma scores 66.1 (B) on agent readiness against Figma API + MCP's 63.4 (B), and leads in 4 of 7 scored categories. Figma API + MCP leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.\n\n### Do Figma API + MCP and Framelink MCP for Figma need an API key?\n\nFigma API + MCP takes an API key or an OAuth sign-in. Framelink MCP for Figma needs an access token.\n\n### Can an agent call Figma API + MCP and Framelink MCP for Figma without installing anything?\n\nFigma API + MCP has a hosted endpoint at https://api.figma.com/v1. Framelink MCP for Figma runs on your own machine, with no hosted endpoint listed.\n\n### Are Figma API + MCP and Framelink MCP for Figma open source?\n\nNo open-source release is listed for Figma API + MCP. Framelink MCP for Figma is open source (MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/figma-mcp-vs-framelink-figma-mcp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/figma-mcp-vs-framelink-figma-mcp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"figma-mcp\", \"b\": \"framelink-figma-mcp\"}`. From a terminal: `anchor compare figma-mcp framelink-figma-mcp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/figma-mcp.json and https://www.anchorterminal.com/api/v1/tools/framelink-figma-mcp.json\n\n## Other comparisons with Figma API + MCP or Framelink MCP for Figma\n\n- [Figma API + MCP vs Framer Server API](https://www.anchorterminal.com/compare/figma-mcp-vs-framer.md)\n- [Figma API + MCP vs Kite](https://www.anchorterminal.com/compare/figma-mcp-vs-kite-new.md)\n- [Figma API + MCP vs Magic Patterns](https://www.anchorterminal.com/compare/figma-mcp-vs-magic-patterns.md)\n- [Figma API + MCP vs Melius](https://www.anchorterminal.com/compare/figma-mcp-vs-melius.md)\n- [Figma API + MCP vs Miro API + MCP](https://www.anchorterminal.com/compare/figma-mcp-vs-miro.md)\n- [Figma API + MCP vs pen.dev](https://www.anchorterminal.com/compare/figma-mcp-vs-pen-dev.md)\n- [Figma API + MCP vs Penpot API + MCP](https://www.anchorterminal.com/compare/figma-mcp-vs-penpot.md)\n- [Figma API + MCP vs Sketch](https://www.anchorterminal.com/compare/figma-mcp-vs-sketch.md)\n- [Figma API + MCP vs Subframe](https://www.anchorterminal.com/compare/figma-mcp-vs-subframe.md)\n- [Figma API + MCP vs Zeplin](https://www.anchorterminal.com/compare/figma-mcp-vs-zeplin.md)\n- [Framelink MCP for Figma vs Framer Server API](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-framer.md)\n- [Framelink MCP for Figma vs Kite](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-kite-new.md)\n- [Framelink MCP for Figma vs Magic Patterns](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns.md)\n- [Framelink MCP for Figma vs Melius](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-melius.md)\n- [Framelink MCP for Figma vs Miro API + MCP](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-miro.md)\n- [Framelink MCP for Figma vs pen.dev](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-pen-dev.md)\n- [Framelink MCP for Figma vs Penpot API + MCP](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot.md)\n- [Framelink MCP for Figma vs Sketch](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-sketch.md)\n- [Framelink MCP for Figma vs Subframe](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-subframe.md)\n- [Framelink MCP for Figma vs Zeplin](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-zeplin.md)\n- [Figma API + MCP vs Impeccable](https://www.anchorterminal.com/compare/figma-mcp-vs-impeccable.md)\n- [Framelink MCP for Figma vs Impeccable](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-impeccable.md)\n- [Figma API + MCP vs UXKIN](https://www.anchorterminal.com/compare/figma-mcp-vs-uxkin-agent.md)\n- [Framelink MCP for Figma vs UXKIN](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-uxkin-agent.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Figma API + MCP vs Framelink MCP for Figma", "url": "" } ], "description": "Framelink MCP for Figma scores 66.1 (B) to Figma's 63.4 (B) for design files. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Figma API + MCP B 63.4", "Framelink MCP for Figma B 66.1", "scores" ], "h1": "Figma API + MCP vs Framelink MCP for Figma", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/figma-mcp-vs-framelink-figma-mcp", "published": "2026-10-01", "section": "tools", "title": "Figma vs Framelink MCP for Figma for AI agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-framelink-figma-mcp" }, "tokens": { "markdown": 4500, "slim": 2630 }, "version": 1 }