Framelink MCP for Figma vs Miro API + MCP

Framelink MCP for Figma 83

Two compact tools (25). Output is sized by nodeId and depth, and the default tree format drops default values and auto-generated layer names and deduplicates repeated styles and subtrees. No pagination, which a single-file read rarely needs (16 of 20). Errors are written for a model to recover from, with Figma's 403 body surfaced and guidance for wrong node IDs from prototype, branch and FigJam links, per the 0.12.0 changelog (16 of 20). get_figma_data carries readOnlyHint and download_figma_images openWorldHint, with no destructiveHint on the tool that writes files and no note on overwriting (14 of 20). Only fileKey is required and one npx line starts it, but there is no SDK, which a two-tool local server doesn't need (12 of 15). 25 + 16 + 16 + 14 + 12 = 83.

Miro API + MCP 53

The MCP tools page now lists 52 tools (24 read, 28 write), up from 18 on 1 October, which is the more-than-30 band. No toolsets, dynamic loading or read-only subset is documented, and the FAQ says restricting which tools may connect is still evolving (5 of 25, was 15). REST lists page with limit and cursor and filter by item type, and board_search_boards and canvas_search find boards and items over MCP (18 of 20). Errors carry a machine code and message (16 of 20). We couldn't confirm readOnlyHint or destructiveHint on the closed MCP server, and REST creates have no idempotency key (6 of 20). The official Node client, @mirohq/miro-api 2.2.4, was last released on 5 February 2025 (8 of 15). 5 + 18 + 16 + 6 + 8 = 53.

Framelink MCP for Figma 60

By the self-hosted rule. A free MIT package with nothing to buy (20 + 20 + 20), and no payment protocol (0). Figma API use falls under the user's own Figma plan. 60.

Miro API + MCP 30

No machine payment protocol (0). Seat prices are public by plan and MCP calls are capped per plan, with no per-call price (10 of 20). Free plan with 3 editable boards, the REST API and 100 MCP calls a day, and a 14-day Business trial; no card for the Free plan per the 30 September check (20). A person creates the OAuth app or approves the MCP sign-in in a browser (0). 0 + 10 + 20 + 0 = 30.

Framelink MCP for Figma 47

MIT licence in the repository and on npm (30). No privacy policy or terms on framelink.ai or the docs. Design data goes from Figma to the local model client, and the docs describe what telemetry sends, but there is no data statement to agree with (8 of 30). No deprecation policy. Breaking defaults are called out in the changelog (5 of 20). Telemetry to PostHog (us.i.posthog.com) has been on by default since 0.10.0 on 10 April 2026. The configuration page discloses it with three ways to opt out, while the README doesn't mention it, and an open issue of 16 April 2026 reports that error_message can include file keys and node IDs, which the source's redaction (credentials only) doesn't cover (14 of 20). 30 + 8 + 5 + 14 = 57.

Miro API + MCP 77

Closed service under published terms. The miro-ai plugins and skills are MIT (17 of 30). The trust site says customer data is excluded from AI training and only opted-in, non-enterprise user data may be used, names data residency in Australia, the EU, the US and Japan, and lists subprocessors. We didn't read retention periods (22 of 30). Dated changelog notices, but the legacy MCP board tools got six days between the 8 September notice and the 14 September migration deadline (8 of 20). Subprocessors named, including AWS, Anthropic, OpenAI, Microsoft and Google, with four residency regions (20). 17 + 22 + 8 + 20 = 67.

Framelink MCP for Figma 41

Last release 0.13.2 on 18 June 2026, 141 days before this check (10). No release in the 90 days since 8 August (0). The maintainer merged his own pull requests through June and closed four outside pull requests between July and September, but the three open issues filed since May have no reply and seven outside pull requests from July to October are open without one (8 of 25). In the official MCP registry under the GitHub-verified namespace io.github.GLips, with 0.13.2 as the latest entry (15). CI and tests exist, and the MCP SDK is pinned at 1.29.0 with current dependencies (8 of 10). 10 + 0 + 8 + 15 + 8 = 41.

Miro API + MCP 67

The newest changelog entry is 17 September 2026, 46 days before 2 November, so the recency line is in the within-90-days band (20 of 30, was 30, cause time). Four dated entries since 4 August, on 12 and 19 August and 8 and 17 September; the MCP registry entry (1.0.2, 6 March 2026) and the Node client (2.2.4, February 2025) add nothing in the window (20). Closed service with a public changelog and a developer community. The miro-ai repository of plugins and skills last had commits on 16 and 17 September (10 of 15). io.github.miroapp/mcp-server is in the official registry under a GitHub-verified namespace, latest 1.0.2, but the Node client hasn't had a release since February 2025 (13 of 15). Node client stale for 21 months; the api-clients repository gets only dependency bumps (4 of 10). 20 + 20 + 10 + 13 + 4 = 67.

Framelink MCP for Figma 55

The credential is the user's own Figma token. Figma personal access tokens are scoped and revocable, and the docs say file_content:read is the one scope the server needs. OAuth tokens are accepted but not refreshed, and the token is passed in the client config's args or env, not a URL (25 of 30). The server only reads Figma. Its one write is image files, confined to --image-dir, and --skip-image-downloads removes that tool; the local HTTP mode has no authentication of its own and binds 127.0.0.1 by default (16 of 20). Layer names and text written by collaborators reach the model as they are, and no prompt-injection guidance was found (3 of 15). Logs go to the local console only, with no per-call audit record (3 of 15). SECURITY.md asks for private reports through GitHub security advisories with a 48-hour acknowledgement. No security.txt, bug bounty or certification (8 of 20). 25 + 16 + 3 + 3 + 8 = 55.

Miro API + MCP 67

REST uses OAuth 2.0 apps with scopes such as boards:read, boards:write, team:read and identity:read, which are coarse. The MCP server uses OAuth 2.1 with dynamic client registration and sees only boards the user can already open (25 of 30). A boards:read token gives read-only REST access, and Enterprise admins must switch MCP on, org-wide or for chosen teams. The MCP server has no read-only mode, and the 52 tools now include section_delete, a canvas_update_from_svg that creates, updates and deletes items, and tools that share boards and spaces and change roles, so the earlier point for having no delete tool is gone (10 of 20, was 13). Sticky notes, comments and board text written by collaborators reach the model through canvas_read_as_svg and comment_list_comments, and import-claude-design-from-url fetches a public URL; we found no prompt-injection guidance (3 of 15). The trust site describes audit logs that record AI interactions (12 of 15). ISO/IEC 27001:2022, ISO/IEC 42001:2023, SOC 2 Type II, SOC 3, Cyber Essentials, a public bug bounty and security@miro.com on the trust site. No security.txt (miro.com/.well-known/security.txt answers 404) (17 of 20). 25 + 10 + 3 + 12 + 17 = 67.

Framelink MCP for Figma 68

Read with the local-software lines, because the server runs on the user's machine and calls the Figma REST API. Installs from the official npm package figma-developer-mcp, with Node 20.20 or later stated in package.json (20). A CI workflow runs prettier, eslint, a type check and the vitest suite, but only on pull requests, and the five newest runs (outside pull requests from 22 August to 2 October) all failed, so passing on the default branch couldn't be confirmed (15). Eight open issues, the oldest open one a 429 rate-limit thread from November 2025 with 30 comments, and nothing open that reports a crash in the current release (18). Release-please changelog with semver tags and breaking defaults called out, such as the switch to tree output in 0.13.0 (15). Version 0.13.2, below 1.0 and not declared stable (0). 20 + 15 + 18 + 15 + 0 = 68.

Miro API + MCP 73

incident.io status page at status.miro.com with components (Application, Log in ability, MCP server, Web Site, Mail System, Billing) and history (20). In the 90 days from 4 August the history lists intermittent registration and login problems on 31 August and username-and-password sign-in unavailable on 9 September, both login only, and a scheduled CDN maintenance notice on 3 October, with no API, board or MCP incident (20 of 30). REST limits are published as credits, 100,000 a minute with calls costing 50 to 2,000 credits by level, and MCP calls are capped per day by plan (15). 429s return a JSON body with code: tooManyRequests and X-RateLimit-Limit, -Remaining and -Reset headers, and the docs advise exponential backoff. No Retry-After and no idempotency guidance for creates (10 of 15). No SLA found (0). REST v2 is GA. We didn't see a beta label on the MCP tools page, but didn't confirm the server's status either (8 of 10). 20 + 20 + 15 + 10 + 0 + 8 = 73.