# Figma API + MCP vs UX Pilot MCP server (slim)

> Figma scores 63.4 (B) to UX Pilot's 33 (F) for design canvases. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/figma-mcp-vs-ux-pilot-mcp.md (~4,200 tokens) · this version ~2,530 tokens · JSON https://www.anchorterminal.com/compare/figma-mcp-vs-ux-pilot-mcp.json · canonical https://www.anchorterminal.com/compare/figma-mcp-vs-ux-pilot-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Figma API + MCP scores 63.4 (B) on agent readiness against UX Pilot MCP server's 33 (F), and leads in 6 of 7 scored categories. UX Pilot MCP server leads on payments & pricing. Both do design canvases.

- Figma API + MCP: B 63.4, rank #517 of 1510 · https://www.anchorterminal.com/tools/figma-mcp.min.md
- UX Pilot MCP server: F 33, rank #1410 of 1510 · https://www.anchorterminal.com/tools/ux-pilot-mcp.min.md
- Figma API + MCP, good for Design-to-code agents and teams already paying for Dev or Full seats. Ahead on Reliability, 64 against 15; Schema & documentation, 86 against 45; Agent ergonomics, 60 against 46; Security & auth, 71 against 39; Maintenance & community, 84 against 45; Transparency & trust, 67 against 22.
- UX Pilot MCP server, good for Designers on UX Pilot who want an agent to organise screens, review UX and build React prototypes. Ahead on Payments & pricing, 20 against 10.

| Category | Figma API + MCP | UX Pilot MCP server |
| --- | --- | --- |
| Reliability (16%) | 64 | 15 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 86 | 45 |
| Agent ergonomics (13%) | 60 | 46 |
| Security & auth (14%) | 71 | 39 |
| Payments & pricing (10%) | 10 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 84 | 45 |
| Transparency & trust (7%) | 67 | 22 |

| Fact (where they differ) | Figma API + MCP | UX Pilot MCP server |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Figma | UX Pilot |
| Hosted endpoint | `https://api.figma.com/v1` | `https://mcp.uxpilot.net/mcp` |
| Transports | HTTP, Streamable HTTP | Streamable HTTP |
| Auth | OAuth or key | OAuth |
| Licence | proprietary | none |
| Tools exposed | 41 | none |
| llms.txt | yes | no |
| MCP registry | `com.figma.mcp/mcp` | `ai.uxpilot/uxpilot` |
| Last release | 2026-10-22 | none |
| Terms last updated | 2026-03-11 | no document linked |
| Privacy policy last updated | no date given | no document linked |
| Customer content may train models | yes, with an opt-out | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | yes | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | 456k npm/wk | none |
| Agent reviews | 3.5/5 (2) | none |

Why the edge:
- Reliability, Figma API + MCP +49: Figma API + MCP 64 (Statuspage at status.figma.com with history, read from its Atom feed (20). From 3 August to 1 November the feed posts four incidents. The 27 September "Service disruption" ("Figma Services are degraded or unavailable because of failures with AWS and other dependencies", 01:04 to 02:32 UTC) hit every service and reads as a major. The 26 August "Figma MCP Disruption" (10:14 to about 14:03 UTC) kept "some Codex and ChatGPT users" from seeing MCP tools, so it's partial and minor. The 13 October Figma agent and Make errors and the 30 October Sites publishing problem don't touch the REST API or the MCP server. The 27 July file-editing incident left the window. One major (10). Published limits for REST by tier, seat and plan, and for MCP by seat (Full and Dev up to 200 calls a day and 10 a minute on Professional, 15 on Organization, 600 a day and 20 a minute on Enterprise; View and Collab 20 a month on every plan) (15). REST 429s carry `Retry-After`, `X-Figma-Plan-Tier` and `X-Figma-Rate-Limit-Type`. No idempotency guidance for comment or variable writes (12 of 15). No SLA found on the developer pages (0). REST is GA, and writing to the canvas is still "free during the beta period" on the MCP introduction (7 of 10).); UX Pilot MCP server 15 (No status page found (0). No history (5). No limits found (0). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.)
- Transparency & trust, Figma API + MCP +45: Figma API + MCP 67 (Closed service. The terms sit on www.figma.com, whose robots.txt disallows our crawler; held at 15 as whatsapp-cloud-api's licence line was with its terms unread (15). The privacy policy and sub-processor list read on 1 October are on the same host and are struck. The help centre's content-training article says training is on by default for Starter and Professional teams and off for Organization and Enterprise, that third-party model providers must delete inputs and outputs after processing, and that Figma upholds its data processing agreements, but it gives no retention period and has no second readable document to agree with (12 of 30). Dated deprecation notices on the developer changelog, such as the v1 projects endpoints on 10 August 2026, but no removal dates (13 of 20). The help article links a sub-processor list for Figma AI that we can't read and mentions data residency commitments without naming locations (5 of 20).); UX Pilot MCP server 22 (Terms and privacy render with script and weren't readable (0). Data handling not read (0). A tool that maps old tool names to new calls eased the 3.0 change, no dates (5 of 20). Subprocessors not found (0). 0 + 0 + 5 + 0 = 5.)
- Schema & documentation, Figma API + MCP +41: Figma API + MCP 86 (Public OpenAPI spec in figma/rest-api-spec, with TypeScript types on npm (25). llms.txt at developers.figma.com (10). The MCP tools page explains each tool and splits read, write and Weave groups, but the server is closed, so we couldn't read its own tool definitions (13 of 20). Typed parameters with enums such as image `format` (png, jpg, svg, pdf) and `depth` limits (13 of 15). Reference examples throughout. We didn't read an error catalogue (10 of 15). A dated REST changelog with deprecation notices and v1 and v2 paths (15).); UX Pilot MCP server 45 (Schemas not read without sign-in (15 of 25). No llms.txt read (0). Tools grouped by job (find, organise, delete, import, review, React), with a help tool that maps old names to new calls (14 of 20). Inputs not verifiable (5 of 15). A tool that returns any action's fields with an example (8 of 15). Registry 3.0.0 on 4 November; no changelog (3 of 15). 15 + 0 + 14 + 5 + 8 + 3 = 45.)
- Maintenance & community, Figma API + MCP +39: Figma API + MCP 84 (REST changelog entry on 22 October 2026 (Teams, folder creation, file duplication and invite endpoints for Enterprise) (30). REST changelog entries on 10 August, 17 September and 22 October (20). Closed service with a public changelog and support. We didn't test support (12 of 15). com.figma.mcp/mcp is in the official registry under a DNS-verified namespace, latest 1.0.3 (15). @figma/rest-api-spec and Code Connect are maintained on npm. We didn't audit their dependencies (7 of 10).); UX Pilot MCP server 45 (Registry 3.0.0 and repository on 4 November 2026 (30). Dated releases not found (0). Issues not read (0). Official registry entry ai.uxpilot/uxpilot (15). README-only repository (0). 30 + 0 + 0 + 15 + 0 = 45. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.)
- Security & auth, Figma API + MCP +32: Figma API + MCP 71 (OAuth 2 with per-resource scopes such as `file_content:read` and `file_comments:write` (the 22 October Teams endpoints add `teams:write`, `folders:write` and `team_members:write`), scoped personal access tokens, and plan access tokens with resource allowlists and expiry of up to a year. The MCP server signs in with OAuth and only catalogue-listed clients can connect (30). Read-only scopes give least privilege on REST. The MCP server has no documented read-only mode, and canvas writes such as `use_figma` run without a confirmation step (13 of 20). File content, layer names and comments written by collaborators reach the model as they are, and we found no prompt-injection guidance (3 of 15). Activity logs and an AI usage API for Enterprise (12 of 15). Figma runs a bug bounty programme on HackerOne (hackerone.com/figma, "Figma - Bug Bounty Program"). www.figma.com's robots.txt disallows our crawler on every path, so the security page's certifications read on 1 October are struck and security.txt stays unread. Graded as meta-marketing-api's 13 (bounty route confirmed elsewhere, the vendor's own security pages unread) (13 of 20).); UX Pilot MCP server 39 (OAuth or a bearer key; scopes not published (20 of 30). Organise tools never delete, and deletes need confirmation (14 of 20). Imported AI output and comments are third-party text; no injection guidance (3 of 15). No audit log (0). No security programme found (2 of 20). 20 + 14 + 3 + 0 + 2 = 39.)
- Agent ergonomics, Figma API + MCP +14: Figma API + MCP 60 (REST file reads can be cut down with `ids` and `depth`. The MCP server lists 41 tools (18 read, 14 write, 9 Weave; 35 on 1 October), with some remote-only and others desktop-only, and we found no toolsets or read-only subset (15 of 25). Cursor pagination on comments, versions and folders (16 of 20). REST errors carry a status and message (13 of 20). We couldn't confirm readOnlyHint or destructiveHint on the closed MCP server, and REST writes have no idempotency keys. `weave_run_tool` stops with `cost_confirmation_required` until the caller acknowledges the credit cost (8 of 20). TypeScript types for REST and the Code Connect CLI, but no official REST client in two languages (8 of 15).); UX Pilot MCP server 46 (Tool count not published; grouped actions (10). Search by keyword and list calls (10 of 20). No documented errors (3 of 20). 'Nothing is deleted' by the organise tools, and deletes run only once the user confirms (15 of 20). OAuth or a key, no SDKs (8 of 15). 10 + 10 + 3 + 15 + 8 = 46.)