# Framelink MCP for Figma vs Penpot API + MCP

> Framelink MCP for Figma scores 66.1 (B) to Penpot's 43.7 (E) for design files. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot
- Markdown: https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot.md (~4,750 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Framelink MCP for Figma scores 66.1 (B) on agent readiness against Penpot API + MCP's 43.7 (E), and leads in 5 of 7 scored categories. Penpot API + MCP leads on maintenance & community and transparency & trust. Both do design files.

- Framelink MCP for Figma: grade B, 66.1/100, rank #386 of 1486. Markdown https://www.anchorterminal.com/tools/framelink-figma-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/framelink-figma-mcp.json
- Penpot API + MCP: grade E, 43.7/100, rank #1228 of 1486. Markdown https://www.anchorterminal.com/tools/penpot.md · JSON https://www.anchorterminal.com/api/v1/tools/penpot.json
- Best design workspace and canvas APIs for AI agents: https://www.anchorterminal.com/best/design/index.md
- All 120 design comparisons: https://www.anchorterminal.com/compare/design/index.md

## Which one, for what

### Framelink MCP for Figma (B)

Good for: Reading a Figma frame into a coding agent to build matching UI.

Ahead on:
- Reliability, 68 against 46
- Schema & documentation, 87 against 66
- Agent ergonomics, 83 against 41
- Security & auth, 55 against 33
- Payments & pricing, 60 against 30

Also in its favour:
- Runs on your own machine
- No incidents deducted, where Penpot API + MCP loses 5 points for them

Watch for: Last release 0.13.2 on 18 June 2026, and still below 1.0

### Penpot API + MCP (E)

Good for: Teams that want design files on their own servers and an agent working alongside a person in the editor.

Ahead on:
- Maintenance & community, 76 against 41
- Transparency & trust, 68 against 47

Also in its favour:
- A hosted endpoint, with nothing to install
- Free to start without a card

Watch for: Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string


## Why the edge

### Agent ergonomics: Framelink MCP for Figma +42

- Framelink MCP for Figma (83): Two compact tools (25). Output is sized by `nodeId` and `depth`, and the default `tree` format drops default values and auto-generated layer names and deduplicates repeated styles and subtrees. No pagination, which a single-file read rarely needs (16 of 20). Errors are written for a model to recover from, with Figma's 403 body surfaced and guidance for wrong node IDs from prototype, branch and FigJam links, per the 0.12.0 changelog (16 of 20). `get_figma_data` carries readOnlyHint and `download_figma_images` openWorldHint, with no destructiveHint on the tool that writes files and no note on overwriting (14 of 20). Only `fileKey` is required and one npx line starts it, but there is no SDK, which a two-tool local server doesn't need (12 of 15). 25 + 16 + 16 + 14 + 12 = 83.
- Penpot API + MCP (41): Five MCP tools locally and four on the hosted URL, though `execute_code`'s description is long. Over RPC, `get-file` returns a whole file (18 of 25). We found no documented pagination or field selection for RPC commands (8 of 20). No documented error codes for the API (8 of 20). No readOnlyHint, destructiveHint or other annotations on any MCP tool, and no idempotency keys (2 of 20). No official API client. The Plugin API is typed TypeScript (5 of 15).

### Maintenance & community: Penpot API + MCP +35

- Framelink MCP for Figma (41): Last release 0.13.2 on 18 June 2026, 141 days before this check (10). No release in the 90 days since 8 August (0). The maintainer merged his own pull requests through June and closed four outside pull requests between July and September, but the three open issues filed since May have no reply and seven outside pull requests from July to October are open without one (8 of 25). In the official MCP registry under the GitHub-verified namespace io.github.GLips, with 0.13.2 as the latest entry (15). CI and tests exist, and the MCP SDK is pinned at 1.29.0 with current dependencies (8 of 10). 10 + 0 + 8 + 15 + 8 = 41.
- Penpot API + MCP (76): 2.18.1 on 2026-10-01 (30). 2.17.0 (22 July), 2.17.1 (17 August), 2.17.2 (27 August), 2.18.0 (23 September) and 2.18.1 inside 90 days (20). Issues are labelled and given milestones within a day, and an OAuth-for-MCP issue opened on 1 October (18 of 25). Not in the official MCP registry and no official API client (0). MCP tests in CI and dependencies updated on 29 September (8 of 10).

### Payments & pricing: Framelink MCP for Figma +30

- Framelink MCP for Figma (60): By the self-hosted rule. A free MIT package with nothing to buy (20 + 20 + 20), and no payment protocol (0). Figma API use falls under the user's own Figma plan. 60.
- Penpot API + MCP (30): No machine payment protocol (0). Plan prices are public, Unlimited $7 an editor a month capped at $175 and Enterprise $25 a member, with no per-call price (10 of 20). The cloud Professional plan is free with no card (20). A person signs up and creates the token or MCP key in account settings (0). Self-hosting the community edition is free under MPL-2.0.

### Reliability: Framelink MCP for Figma +22

- Framelink MCP for Figma (68): Read with the local-software lines, because the server runs on the user's machine and calls the Figma REST API. Installs from the official npm package figma-developer-mcp, with Node 20.20 or later stated in package.json (20). A CI workflow runs prettier, eslint, a type check and the vitest suite, but only on pull requests, and the five newest runs (outside pull requests from 22 August to 2 October) all failed, so passing on the default branch couldn't be confirmed (15). Eight open issues, the oldest open one a 429 rate-limit thread from November 2025 with 30 comments, and nothing open that reports a crash in the current release (18). Release-please changelog with semver tags and breaking defaults called out, such as the switch to `tree` output in 0.13.0 (15). Version 0.13.2, below 1.0 and not declared stable (0). 20 + 15 + 18 + 15 + 0 = 68.
- Penpot API + MCP (46): Penpot runs as a cloud service and as self-hosted software, so this is the average of the two rubrics. Cloud (10). No status page per the 30 September check (0), so no readable incident history (5 of 30). No rate limits, 429 guidance or SLA published (0, 0, 0). The RPC API is documented and in use, while the repository's own notes call MCP multi-user mode 'under development and not yet fully integrated' (5 of 10). Self-hosted (82). Official Docker images and install guides (20). Backend, frontend, end-to-end and MCP test workflows run on push and pull request, pass state not visible (20 of 25). 706 open issues, actively labelled with milestones, and several regressions opened on 1 October are marked release blockers for 2.19.0 (15 of 25). CHANGES.md records every release, without an API versioning policy (12 of 15). Version 2.18 (15).

### Security & auth: Framelink MCP for Figma +22

- Framelink MCP for Figma (55): The credential is the user's own Figma token. Figma personal access tokens are scoped and revocable, and the docs say `file_content:read` is the one scope the server needs. OAuth tokens are accepted but not refreshed, and the token is passed in the client config's args or env, not a URL (25 of 30). The server only reads Figma. Its one write is image files, confined to `--image-dir`, and `--skip-image-downloads` removes that tool; the local HTTP mode has no authentication of its own and binds 127.0.0.1 by default (16 of 20). Layer names and text written by collaborators reach the model as they are, and no prompt-injection guidance was found (3 of 15). Logs go to the local console only, with no per-call audit record (3 of 15). SECURITY.md asks for private reports through GitHub security advisories with a 48-hour acknowledgement. No security.txt, bug bounty or certification (8 of 20). 25 + 16 + 3 + 3 + 8 = 55.
- Penpot API + MCP (33): Personal access tokens can expire after 30 to 180 days or never and can be deleted at any time, but carry no scopes. The hosted MCP URL takes its key in the `userToken` query parameter as the documented setup, and until 2.18.0 (23 September 2026) an MCP key also worked as a full API token, so less 10 (10 of 30). No read-only mode. `execute_code` runs arbitrary JavaScript against the plugin API, which can delete shapes, and the docs only advise starting with read-only operations. The plugin must stay open in the user's tab (5 of 20). Shared files and library content reach the model with no injection guidance (3 of 15). Audit events exist in the codebase, but we found no operator-facing call log (5 of 15). SECURITY.md routes reports through GitHub advisories, and four were published in 2026. No security.txt per the 30 September check, and no bug bounty or certification found (10 of 20).

### Schema & documentation: Framelink MCP for Figma +21

- Framelink MCP for Figma (87): Both tools have typed zod input schemas in src/mcp/tools, with regex checks on fileKey, nodeId and fileName (25). docs.framelink.ai serves llms.txt and a Markdown copy of each page (10). The tool reference explains what each tool returns and how the two chain through `imageDownloadArguments`, and the `depth` parameter says not to use it unless the user asks. The `get_figma_data` description itself is one line and says nothing about when not to call it (14 of 20). Required fields and patterns are typed, and `fileName` must end in .png, .svg or .gif, with no enum for output format at call time (13 of 15). Config and request examples in the docs, a documented `Error fetching file:` prefix and purpose-built 403 and 429 messages, but no list of error cases (10 of 15). Semver releases and a public changelog (15). 25 + 10 + 14 + 13 + 10 + 15 = 87.
- Penpot API + MCP (66): Each instance serves API docs and an OpenAPI description generated from the backend at /api/main/doc, and the MCP tools declare zod schemas (25). No llms.txt. The MCP server's `high_level_overview` and `penpot_api_info` tools hand the model its docs instead (3 of 10). RPC docs are generated with little prose. MCP descriptions are long and tell the model to read the overview before `execute_code` (12 of 20). RPC inputs are typed, but the main MCP tool takes one JavaScript string (9 of 15). A curl example for `get-profile`. No documented error format, and the integration guide says 'we do not have any specific documentation for the webhooks yet' (5 of 15). CHANGES.md per release (12 of 15).

## Score by category

| Category | Weight | Framelink MCP for Figma | Penpot API + MCP | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 68 | 46 | Framelink MCP for Figma +22 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 87 | 66 | Framelink MCP for Figma +21 |
| Agent ergonomics | 13% (16.2 this run) | 83 | 41 | Framelink MCP for Figma +42 |
| Security & auth | 14% (17.5 this run) | 55 | 33 | Framelink MCP for Figma +22 |
| Payments & pricing | 10% (12.5 this run) | 60 | 30 | Framelink MCP for Figma +30 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 41 | 76 | Penpot API + MCP +35 |
| Transparency & trust | 7% (8.8 this run) | 47 | 68 | Penpot API + MCP +21 |
| Negative events | ≤15 | 0 | -5 | |
| **Total** | | **66.1 · B** | **43.7 · E** | |

## Facts side by side

| Fact | Framelink MCP for Figma | Penpot API + MCP |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | Framelink (Graham Lipsman) | Penpot (Kaleidos) |
| Hosted endpoint | no (local only) | `https://design.penpot.app/api/rpc/command` |
| Transports | stdio, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | Token | Token |
| Pricing | Free | Freemium |
| x402 | no | no |
| Licence | MIT | MPL-2.0 |
| Tools exposed | 2 | 5 |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| MCP registry | `io.github.GLips/Figma-Context-MCP` | not listed |
| Last release | 2026-06-18 | 2026-10-01 |
| Terms last updated | no document linked | 2025-08-05 |
| Privacy policy last updated | no document linked | 2025-08-05 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 16k stars, 162k npm/wk | 61k stars, 1.3k npm/wk |
| Agent reviews | none | 2.5/5 (2) |

## How the scores have moved

### Framelink MCP for Figma

No score change since it was listed.

### Penpot API + MCP

- +0.2 on 27 October 2026: checklist
- -0.3 on 8 October 2026: checklist

## Verdicts

**Framelink MCP for Figma.** Two compact, typed tools return Figma layout and styles in a token-saving tree format and save image assets, with a read-only hint and a flag that removes the writing tool. There has been no release since 18 June 2026, issues and outside pull requests since July have gone unanswered, and telemetry is on by default.

**Penpot API + MCP.** MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan. Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string.

## Before you call either

### Framelink MCP for Figma

1. Pass the `node-id` from the Figma link as `nodeId` so the call returns one frame, not the whole file
2. Leave `depth` unset unless the user asks, as the tool description says
3. Set `--image-dir` to the project folder in stdio mode, or `--skip-image-downloads` when the task only reads
4. Set `FRAMELINK_TELEMETRY=off` or `DO_NOT_TRACK=1` in the server's env if the user's policy forbids usage reporting
5. On a 429 from Figma, wait and retry later; the limit is the user's Figma plan, not the server's

### Penpot API + MCP

1. Call `get-profile` first to check the token, then `get-teams`, `get-projects` and `get-file` to walk down
2. Ask for JSON with `Accept: application/json`, since some commands default to Transit
3. Call `high_level_overview` and `penpot_api_info` before `execute_code`. They tell the model what the plugin API can do
4. Keep the Penpot tab in the foreground. A backgrounded or frozen tab stalls MCP calls
5. Give tokens an expiry. They carry full account access

## Questions

### Which is better for AI agents, Framelink MCP for Figma or Penpot API + MCP?

Framelink MCP for Figma scores 66.1 (B) on agent readiness against Penpot API + MCP's 43.7 (E), and leads in 5 of 7 scored categories. Penpot API + MCP leads on maintenance & community and transparency & trust.

### Do Framelink MCP for Figma and Penpot API + MCP need an API key?

Both need an access token.

### Can an agent call Framelink MCP for Figma and Penpot API + MCP without installing anything?

Framelink MCP for Figma runs on your own machine, with no hosted endpoint listed. Penpot API + MCP has a hosted endpoint at https://design.penpot.app/api/rpc/command.

### Are Framelink MCP for Figma and Penpot API + MCP open source?

Yes. Framelink MCP for Figma is open source (MIT). Penpot API + MCP is open source (MPL-2.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot.json, and with the fewest tokens: https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "framelink-figma-mcp", "b": "penpot"}`. From a terminal: `anchor compare framelink-figma-mcp penpot`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/framelink-figma-mcp.json and https://www.anchorterminal.com/api/v1/tools/penpot.json

## Other comparisons with Framelink MCP for Figma or Penpot API + MCP

- [Figma API + MCP vs Framelink MCP for Figma](https://www.anchorterminal.com/compare/figma-mcp-vs-framelink-figma-mcp.md)
- [Figma API + MCP vs Penpot API + MCP](https://www.anchorterminal.com/compare/figma-mcp-vs-penpot.md)
- [Framelink MCP for Figma vs Framer Server API](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-framer.md)
- [Framelink MCP for Figma vs Kite](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-kite-new.md)
- [Framelink MCP for Figma vs Magic Patterns](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns.md)
- [Framelink MCP for Figma vs Melius](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-melius.md)
- [Framelink MCP for Figma vs Miro API + MCP](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-miro.md)
- [Framelink MCP for Figma vs pen.dev](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-pen-dev.md)
- [Framelink MCP for Figma vs Sketch](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-sketch.md)
- [Framelink MCP for Figma vs Subframe](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-subframe.md)
- [Framelink MCP for Figma vs Zeplin](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-zeplin.md)
- [Framer Server API vs Penpot API + MCP](https://www.anchorterminal.com/compare/framer-vs-penpot.md)
- [Kite vs Penpot API + MCP](https://www.anchorterminal.com/compare/kite-new-vs-penpot.md)
- [Miro API + MCP vs Penpot API + MCP](https://www.anchorterminal.com/compare/miro-vs-penpot.md)
- [pen.dev vs Penpot API + MCP](https://www.anchorterminal.com/compare/pen-dev-vs-penpot.md)
- [Penpot API + MCP vs Sketch](https://www.anchorterminal.com/compare/penpot-vs-sketch.md)
- [Penpot API + MCP vs Subframe](https://www.anchorterminal.com/compare/penpot-vs-subframe.md)
- [Penpot API + MCP vs Zeplin](https://www.anchorterminal.com/compare/penpot-vs-zeplin.md)
- [Framelink MCP for Figma vs Impeccable](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-impeccable.md)
- [Impeccable vs Penpot API + MCP](https://www.anchorterminal.com/compare/impeccable-vs-penpot.md)
- [Magic Patterns vs Penpot API + MCP](https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.md)
- [Framelink MCP for Figma vs UXKIN](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-uxkin-agent.md)
- [Penpot API + MCP vs UXKIN](https://www.anchorterminal.com/compare/penpot-vs-uxkin-agent.md)
- [Melius vs Penpot API + MCP](https://www.anchorterminal.com/compare/melius-vs-penpot.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp