# figsnap-mcp The Figma file you have open, as MCP tools. Extract, edit, and keep a saved set. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.2.0 - **Author:** io.github.arimunandar - **License:** Unknown - **npm:** figsnap-mcp - **Source:** https://github.com/arimunandar/figsnap-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-04T02:34:01.468Z - **Version scanned:** 0.2.0 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `figma_get_selection` — The layers the designer has selected on the canvas right now, with their ids, names, types and sizes. Start here when the request says "this", "the selected fra - `figma_get_tree` — The top-level layers of the page the designer is looking at. Increase depth to walk further down, but note that a deep page is thousands of rows: prefer figma_g - `figma_get_children` — The direct children of one node, by id. The cheap way to explore a page a branch at a time. - `figma_extract` — The full extraction of one node: HTML measured against what Figma draws, byte-exact figmaCss, a React component, plain CSS and CSS modules. Images are inlined a - `figma_export_png` — Renders one node and returns the picture itself, so a model that can see gets to look at the design rather than read a description of it. Nothing is stored anyw - `figma_resolve_url` — Turns one or more Figma links into the nodes they name, without exporting anything. - `figma_list_saved` — The nodes the designer curated in the panel, by folder. A shortlist of what matters in this file, which is usually a better starting point than the whole page. - `figma_saved` — Read and change the designer’s shortlist of nodes in this file, and the folders it is grouped into. One action argument: - `figma_list_library` — The components, styles and variables this file has, with the ids the other tools need. Read this before "make it match our button" or "use our brand colour" — i - `figma_select` — Selects one or more layers and scrolls the canvas to them, so the designer is looking at whatever you are talking about. Use it before describing a node you fou - `figma_set_fill` — Replaces a node’s fills with one solid colour, and answers with the colour read back off the node — so a write that did not land is visible without a screenshot - `figma_set_stroke` — Replaces a node’s strokes with one solid colour, and optionally sets the stroke weight. Pass remove: true to take the stroke off entirely. Borders in Figma are - `figma_set_text` — Replaces the text of one TEXT node. The font is loaded first; a layer whose font is missing from this machine is refused rather than silently retyped in a subst - `figma_set_auto_layout` — Turns auto layout on for a frame and sets its direction, spacing, padding and alignment. Pass mode "NONE" to turn it off. Only the properties you name are chang - `figma_create_frame` — Creates an empty frame, on the current page or inside a parent you name. Returns the new node’s id so the next call can fill it. - `figma_create_text` — Creates a TEXT layer with the words you give it. The font is loaded before anything is typed, and a font this machine does not have is refused rather than subst - `figma_create_rectangle` — Creates a rectangle. The workhorse shape: dividers, bars, backgrounds, placeholders. Omit the fill for an empty one. - `figma_create_ellipse` — Creates an ellipse. Equal width and height give a circle — an avatar, a dot, a radio button. - `figma_create_svg` — Turns SVG markup into real Figma vectors — not an image, but editable paths in a frame. This is how to add an icon, a logo or any shape the other create tools c - `figma_create_instance` — Creates an instance of a component in this file. Get the id from figma_list_library. Naming a variant set places its default variant. Prefer this over drawing a - `figma_clone_node` — Copies a node, with everything inside it, into the same parent or one you name. The cheapest way to make a second row, card or list item that matches the first - `figma_move_node` — Moves a node into another parent, or to a different position among its siblings. Index 0 is the back of the canvas and the top of a layer list; leaving it out p - `figma_delete_node` — Removes a node and everything inside it. One undo step, so the designer can take it back with a single Cmd-Z — but say what you are deleting before you do it. - `figma_set_bounds` — Sets position and size. Position is ignored inside an auto-layout frame, where the parent decides it — use figma_set_layout_sizing and the parent’s spacing ther - `figma_set_corner_radius` — Sets one radius for every corner, or each corner on its own. - `figma_set_node_name` — Renames a layer. Layer names are what the generated code turns into class names, so tidying them is a real change and not cosmetic. - `figma_set_visibility` — Sets opacity, visibility and lock. Hidden layers are skipped by extraction, which is often the point. - `figma_set_effects` — Replaces a node’s effects with the list you give. An empty list clears them. Elevation in most design systems is a drop shadow, so this is what "make it look ra - `figma_set_text_style` — Font, size, line height, letter spacing, alignment and colour, on a TEXT layer. Only what you name is changed. Prefer figma_apply_style where the file has a tex - `figma_set_layout_sizing` — How a child behaves inside an auto-layout frame: HUG shrinks to its contents, FILL stretches to the parent, FIXED keeps its size. This, not figma_set_bounds, is - `figma_apply_style` — Applies a paint, text or effect style from this file by id, from figma_list_library. The right way to make something "match": the layer follows the style afterw - `figma_bind_variable` — Binds a variable from this file to a property, so the value follows the token rather than being a copy of it. Use "fill" or "stroke" for a colour variable; for - `figma_save_version` - `figma_find_nodes` - `figma_pages` - `figma_component_properties` - `figma_group` - `figma_insert_image` - `figma_set_instance_properties` - `figma_ios_spec` ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"figsnap\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"figsnap-mcp\"\n ],\n \"env\": {\n \"FIGSNAP_MCP_TOKEN\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `FIGSNAP_MCP_TOKEN` — Figsnap Mcp Token (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 53, ceiling 53 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/figsnap-mcp - Install plan: https://forgeregistry.com/api/v1/packages/figsnap-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/figsnap-mcp - HTML page: https://forgeregistry.com/registry/figsnap-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.