# Framelink MCP for Figma vs Melius (slim)

> Framelink MCP for Figma scores 66.1 (B) to Melius's 53.3 (D) for design files. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-melius.md (~5,200 tokens) · this version ~3,280 tokens · JSON https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-melius.json · canonical https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-melius
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Framelink MCP for Figma scores 66.1 (B) on agent readiness against Melius's 53.3 (D), and leads in 4 of 7 scored categories. Melius leads on maintenance & community and transparency & trust. Both do design files.

- Framelink MCP for Figma: B 66.1, rank #387 of 1510 · https://www.anchorterminal.com/tools/framelink-figma-mcp.min.md
- Melius: D 53.3, rank #954 of 1510 · https://www.anchorterminal.com/tools/melius.min.md
- Framelink MCP for Figma, good for Reading a Figma frame into a coding agent to build matching UI. Ahead on Schema & documentation, 87 against 70; Agent ergonomics, 83 against 51; Security & auth, 55 against 43; Payments & pricing, 60 against 20. Also Runs on your own machine; Open source.
- Melius, good for An agent producing batches of ad creative, product images or short videos on a shared canvas that people then review, with many models behind one key. Ahead on Maintenance & community, 56 against 41; Transparency & trust, 56 against 47. Also A hosted endpoint, with nothing to install.

| Category | Framelink MCP for Figma | Melius |
| --- | --- | --- |
| Reliability (16%) | 68 | 69 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 87 | 70 |
| Agent ergonomics (13%) | 83 | 51 |
| Security & auth (14%) | 55 | 43 |
| Payments & pricing (10%) | 60 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 41 | 56 |
| Transparency & trust (7%) | 47 | 56 |

| Fact (where they differ) | Framelink MCP for Figma | Melius |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | Framelink (Graham Lipsman) | Melius AI, Inc. |
| Hosted endpoint | no (local only) | `https://api.melius.com/api/v1` |
| Transports | stdio, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | Token | OAuth or key |
| Pricing | Free | Freemium |
| Licence | MIT | Proprietary service under Melius's terms of service. The mel CLI on npm is MIT, with no public source repository found |
| Tools exposed | 2 | 75 |
| MCP registry | `io.github.GLips/Figma-Context-MCP` | not listed |
| Last release | 2026-06-18 | 2026-09-10 |
| Terms last updated | no document linked | no date given |
| Privacy policy last updated | no document linked | no date given |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | 16k stars, 162k npm/wk | 9 npm/wk |

Why the edge:
- Payments & pricing, Framelink MCP for Figma +40: Framelink MCP for Figma 60 (By the self-hosted rule. A free MIT package with nothing to buy (20 + 20 + 20), and no payment protocol (0). Figma API use falls under the user's own Figma plan. 60.); Melius 20 (No machine payment protocol (0). Plan prices and monthly credits are public, but per-model credit costs sit behind an authenticated endpoint and the top-up price is not published (10 of 20). A Free plan at $0 gives trial credits. The amount is not published and we couldn't confirm that sign-up needs no card (10 of 20). A person signs up in a browser and creates the first key in Team settings. POST /api-keys needs an existing key (0). Per the 8 October check, not re-read on 4 November, because the terms of 30 October 2026 bar automated access to melius.com and its subdomains.)
- Agent ergonomics, Framelink MCP for Figma +32: Framelink MCP for Figma 83 (Two compact tools (25). Output is sized by `nodeId` and `depth`, and the default `tree` format drops default values and auto-generated layer names and deduplicates repeated styles and subtrees. No pagination, which a single-file read rarely needs (16 of 20). Errors are written for a model to recover from, with Figma's 403 body surfaced and guidance for wrong node IDs from prototype, branch and FigJam links, per the 0.12.0 changelog (16 of 20). `get_figma_data` carries readOnlyHint and `download_figma_images` openWorldHint, with no destructiveHint on the tool that writes files and no note on overwriting (14 of 20). Only `fileKey` is required and one npx line starts it, but there is no SDK, which a two-tool local server doesn't need (12 of 15). 25 + 16 + 16 + 14 + 12 = 83.); Melius 51 (The MCP reference lists 75 tools, in the over-30 band, with `get_guide` and `get_docs` loading guidance on demand and 18 Cast tools shown only to teams with access (10 of 25). Four list operations take `limit` and `offset` and three take `search`, canvas content can be narrowed to one node or to media summaries, and the CLI has `--fields` (14 of 20). REST errors carry `statusCode`, `error` and `message`, the CLI adds a `code` and a `suggestion`, and `CANVAS_TOO_LARGE` is documented as not worth retrying. A shortage of credits arrives as a plain 400 (14 of 20). No idempotency keys, and we couldn't read MCP annotations without an account. The docs do give safe-retry guidance (5 of 20). Auto model selection and defaults keep required fields few. There is no SDK library, only the CLI and generated code samples in six languages (8 of 15). Per the 8 October check, not re-read on 4 November, because the terms of 30 October 2026 bar automated access to melius.com and its subdomains.)
- Schema & documentation, Framelink MCP for Figma +17: Framelink MCP for Figma 87 (Both tools have typed zod input schemas in src/mcp/tools, with regex checks on fileKey, nodeId and fileName (25). docs.framelink.ai serves llms.txt and a Markdown copy of each page (10). The tool reference explains what each tool returns and how the two chain through `imageDownloadArguments`, and the `depth` parameter says not to use it unless the user asks. The `get_figma_data` description itself is one line and says nothing about when not to call it (14 of 20). Required fields and patterns are typed, and `fileName` must end in .png, .svg or .gif, with no enum for output format at call time (13 of 15). Config and request examples in the docs, a documented `Error fetching file:` prefix and purpose-built 403 and 429 messages, but no list of error cases (10 of 15). Semver releases and a public changelog (15). 25 + 10 + 14 + 13 + 10 + 15 = 87.); Melius 70 (Public OpenAPI 3.0.2 spec with 59 operations (25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). 58 of the 59 operations have a summary and no description. The MCP reference gives each of 75 tools one line, with ordering rules for `get_guide`, `show_presence` and `canvas_plan_layout`, and the tool definitions themselves need a signed-in client, so we didn't read them (8 of 20). Request bodies are typed with 336 enums, ranges, UUID formats and required fields, with 52 open `additionalProperties` objects (13 of 15). 401, 403 and 429 are declared on every operation and 400, 404 and 409 where they apply, but the spec has no examples and most error bodies are a bare `message` (9 of 15). The path is versioned at /api/v1 and the CLI states semantic versioning. No public changelog found (5 of 15). Per the 8 October check, not re-read on 4 November, because the terms of 30 October 2026 bar automated access to melius.com and its subdomains.)
- Maintenance & community, Melius +15: Framelink MCP for Figma 41 (Last release 0.13.2 on 18 June 2026, 141 days before this check (10). No release in the 90 days since 8 August (0). The maintainer merged his own pull requests through June and closed four outside pull requests between July and September, but the three open issues filed since May have no reply and seven outside pull requests from July to October are open without one (8 of 25). In the official MCP registry under the GitHub-verified namespace io.github.GLips, with 0.13.2 as the latest entry (15). CI and tests exist, and the MCP SDK is pinned at 1.29.0 with current dependencies (8 of 10). 10 + 0 + 8 + 15 + 8 = 41.); Melius 56 (The newest dated release is the CLI, 0.16.2 on 10 September 2026 per the 8 October npm reading, 55 days before this check. The vendor's Homebrew tap, whose bot tracks npm hourly, has no version after 0.16.2, and no other dated source could be read (20). Versions 0.15.0 to 0.16.2, eight in all, fall between 7 August and 10 September by the tap's bump commits, which match the 19 versions since 10 July in the 8 October npm reading (20). Closed service with no public changelog or issue tracker. Support is by email at support@melius.com and a Discord server linked from the site (5 of 15). There is no SDK library, though the CLI is on npm and Homebrew (5 of 15). The CLI has three dependencies, needs Node.js 20 and is published from GitHub Actions through npm trusted publishing. Its source is not public (6 of 10).)
- Security & auth, Framelink MCP for Figma +12: Framelink MCP for Figma 55 (The credential is the user's own Figma token. Figma personal access tokens are scoped and revocable, and the docs say `file_content:read` is the one scope the server needs. OAuth tokens are accepted but not refreshed, and the token is passed in the client config's args or env, not a URL (25 of 30). The server only reads Figma. Its one write is image files, confined to `--image-dir`, and `--skip-image-downloads` removes that tool; the local HTTP mode has no authentication of its own and binds 127.0.0.1 by default (16 of 20). Layer names and text written by collaborators reach the model as they are, and no prompt-injection guidance was found (3 of 15). Logs go to the local console only, with no per-call audit record (3 of 15). SECURITY.md asks for private reports through GitHub security advisories with a 48-hour acknowledgement. No security.txt, bug bounty or certification (8 of 20). 25 + 16 + 3 + 3 + 8 = 55.); Melius 43 (API keys are revocable at once, can expire and are shown once, but have no scopes. A key works with its creator's access in every team that user belongs to, capped at the user's role. The MCP OAuth flow uses S256 PKCE and dynamic client registration, lists no scopes, and ties the connector key to one team (22 of 30). A key made by a viewer can only read, `bulk_delete_node` asks the user to confirm and a run can return a pending approval, but there is no read-only key and the setup guide tells users to select Always Allow for every tool (9 of 20). Canvas text, comments from collaborators and files fetched by `url_to_canvas` reach the model, and no prompt-injection guidance was found (2 of 15). Keys list a `lastUsedAt` time, connector keys are named after the client, and generation history is kept per member. No audit log is documented (7 of 15). No security.txt, disclosure policy or bug bounty found. A Vanta trust centre exists at trust.melius.com but needs JavaScript, so certifications are unchecked (3 of 20). Per the 8 October check, not re-read on 4 November, because the terms of 30 October 2026 bar automated access to melius.com and its subdomains.)
- Transparency & trust, Melius +9: Framelink MCP for Figma 47 (MIT licence in the repository and on npm (30). No privacy policy or terms on framelink.ai or the docs. Design data goes from Figma to the local model client, and the docs describe what telemetry sends, but there is no data statement to agree with (8 of 30). No deprecation policy. Breaking defaults are called out in the changelog (5 of 20). Telemetry to PostHog (us.i.posthog.com) has been on by default since 0.10.0 on 10 April 2026. The configuration page discloses it with three ways to opt out, while the README doesn't mention it, and an open issue of 16 April 2026 reports that `error_message` can include file keys and node IDs, which the source's redaction (credentials only) doesn't cover (14 of 20). 30 + 8 + 5 + 14 = 57.); Melius 56 (Closed service under terms effective 30 October 2026, read on 4 November, which name Melius AI, Inc. and Delaware law. The CLI package is MIT with no public repository (15 of 30). The new terms (section 5.6, no training of models on user input or outputs), the privacy policy and the pricing FAQ agree that user input and outputs are not used to train models, and say third-party model providers process content under their own terms without a guarantee from Melius. Retention is described as a reasonable period with no numbers, and no DPA was found (14 of 30). Deprecated models keep working for an unstated grace period with an in-app warning. No API deprecation policy found (5 of 20). No sub-processor list or hosting location found beyond a statement that data is processed in the United States (4 of 20). The privacy policy, deprecation and sub-processor readings are per the 8 October check, not re-read on 4 November.)