Framelink MCP for Figma vs UX Pilot MCP server

Framelink MCP for Figma 68

Read with the local-software lines, because the server runs on the user's machine and calls the Figma REST API. Installs from the official npm package figma-developer-mcp, with Node 20.20 or later stated in package.json (20). A CI workflow runs prettier, eslint, a type check and the vitest suite, but only on pull requests, and the five newest runs (outside pull requests from 22 August to 2 October) all failed, so passing on the default branch couldn't be confirmed (15). Eight open issues, the oldest open one a 429 rate-limit thread from November 2025 with 30 comments, and nothing open that reports a crash in the current release (18). Release-please changelog with semver tags and breaking defaults called out, such as the switch to tree output in 0.13.0 (15). Version 0.13.2, below 1.0 and not declared stable (0). 20 + 15 + 18 + 15 + 0 = 68.

UX Pilot MCP server 15

No status page found (0). No history (5). No limits found (0). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Framelink MCP for Figma 87

Both tools have typed zod input schemas in src/mcp/tools, with regex checks on fileKey, nodeId and fileName (25). docs.framelink.ai serves llms.txt and a Markdown copy of each page (10). The tool reference explains what each tool returns and how the two chain through imageDownloadArguments, and the depth parameter says not to use it unless the user asks. The get_figma_data description itself is one line and says nothing about when not to call it (14 of 20). Required fields and patterns are typed, and fileName must end in .png, .svg or .gif, with no enum for output format at call time (13 of 15). Config and request examples in the docs, a documented Error fetching file: prefix and purpose-built 403 and 429 messages, but no list of error cases (10 of 15). Semver releases and a public changelog (15). 25 + 10 + 14 + 13 + 10 + 15 = 87.

UX Pilot MCP server 45

Schemas not read without sign-in (15 of 25). No llms.txt read (0). Tools grouped by job (find, organise, delete, import, review, React), with a help tool that maps old names to new calls (14 of 20). Inputs not verifiable (5 of 15). A tool that returns any action's fields with an example (8 of 15). Registry 3.0.0 on 4 November; no changelog (3 of 15). 15 + 0 + 14 + 5 + 8 + 3 = 45.

Framelink MCP for Figma 60

By the self-hosted rule. A free MIT package with nothing to buy (20 + 20 + 20), and no payment protocol (0). Figma API use falls under the user's own Figma plan. 60.

UX Pilot MCP server 20

No machine payment protocol (0). Pricing behind script, not read (0). Free tier (20). A person signs up (0). 0 + 0 + 20 + 0 = 20.

Framelink MCP for Figma 83

Two compact tools (25). Output is sized by nodeId and depth, and the default tree format drops default values and auto-generated layer names and deduplicates repeated styles and subtrees. No pagination, which a single-file read rarely needs (16 of 20). Errors are written for a model to recover from, with Figma's 403 body surfaced and guidance for wrong node IDs from prototype, branch and FigJam links, per the 0.12.0 changelog (16 of 20). get_figma_data carries readOnlyHint and download_figma_images openWorldHint, with no destructiveHint on the tool that writes files and no note on overwriting (14 of 20). Only fileKey is required and one npx line starts it, but there is no SDK, which a two-tool local server doesn't need (12 of 15). 25 + 16 + 16 + 14 + 12 = 83.

UX Pilot MCP server 46

Tool count not published; grouped actions (10). Search by keyword and list calls (10 of 20). No documented errors (3 of 20). 'Nothing is deleted' by the organise tools, and deletes run only once the user confirms (15 of 20). OAuth or a key, no SDKs (8 of 15). 10 + 10 + 3 + 15 + 8 = 46.

Framelink MCP for Figma 47

MIT licence in the repository and on npm (30). No privacy policy or terms on framelink.ai or the docs. Design data goes from Figma to the local model client, and the docs describe what telemetry sends, but there is no data statement to agree with (8 of 30). No deprecation policy. Breaking defaults are called out in the changelog (5 of 20). Telemetry to PostHog (us.i.posthog.com) has been on by default since 0.10.0 on 10 April 2026. The configuration page discloses it with three ways to opt out, while the README doesn't mention it, and an open issue of 16 April 2026 reports that error_message can include file keys and node IDs, which the source's redaction (credentials only) doesn't cover (14 of 20). 30 + 8 + 5 + 14 = 57.

UX Pilot MCP server 22

Terms and privacy render with script and weren't readable (0). Data handling not read (0). A tool that maps old tool names to new calls eased the 3.0 change, no dates (5 of 20). Subprocessors not found (0). 0 + 0 + 5 + 0 = 5.

Framelink MCP for Figma 55

The credential is the user's own Figma token. Figma personal access tokens are scoped and revocable, and the docs say file_content:read is the one scope the server needs. OAuth tokens are accepted but not refreshed, and the token is passed in the client config's args or env, not a URL (25 of 30). The server only reads Figma. Its one write is image files, confined to --image-dir, and --skip-image-downloads removes that tool; the local HTTP mode has no authentication of its own and binds 127.0.0.1 by default (16 of 20). Layer names and text written by collaborators reach the model as they are, and no prompt-injection guidance was found (3 of 15). Logs go to the local console only, with no per-call audit record (3 of 15). SECURITY.md asks for private reports through GitHub security advisories with a 48-hour acknowledgement. No security.txt, bug bounty or certification (8 of 20). 25 + 16 + 3 + 3 + 8 = 55.

UX Pilot MCP server 39

OAuth or a bearer key; scopes not published (20 of 30). Organise tools never delete, and deletes need confirmation (14 of 20). Imported AI output and comments are third-party text; no injection guidance (3 of 15). No audit log (0). No security programme found (2 of 20). 20 + 14 + 3 + 0 + 2 = 39.