Figma Mcp Bridge (maxisoft) MCP Server
@maxisoft/figma-mcp-bridge
npm
v0.12.1
Published by @maxisoft — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server that bridges Figma plugin data to AI tools without hitting API rate limits
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 81
Each tool and what it can reach — statically extracted from the published source.
get_dev_jsonreads sensitive datalist_filesreads sensitive dataanalyze_node_against_designno sensitive capabilityapply_aria_labelsno sensitive capabilityapply_design_systemno sensitive capabilityapply_style_presetno sensitive capabilitybatch_mutationno sensitive capabilitybulk_renameno sensitive capabilitybulk_swap_textno sensitive capabilitycreate_componentno sensitive capability
Show 71 more tools ↓
create_design_token_aliasno sensitive capabilitycreate_effect_styleno sensitive capabilitycreate_frameno sensitive capabilitycreate_grid_styleno sensitive capabilitycreate_imageno sensitive capabilitycreate_instanceno sensitive capabilitycreate_paint_styleno sensitive capabilitycreate_shapeno sensitive capabilitycreate_styles_tableno sensitive capabilitycreate_textno sensitive capabilitycreate_text_styleno sensitive capabilitycreate_variableno sensitive capabilitycreate_variable_collectionno sensitive capabilitydelete_nodesno sensitive capabilitydiff_layoutsno sensitive capabilityduplicate_nodesno sensitive capabilityexport_design_tokensno sensitive capabilityexport_icon_spriteno sensitive capabilityextract_design_systemno sensitive capabilityfigma_inspectno sensitive capabilityfind_nodes_by_variableno sensitive capabilitygenerate_codeno sensitive capabilitygenerate_component_from_descriptionno sensitive capabilityget_component_variantsno sensitive capabilityget_constraintsno sensitive capabilityget_design_contextno sensitive capabilityget_dev_cssno sensitive capabilityget_dev_htmlno sensitive capabilityget_dev_imageno sensitive capabilityget_dev_svgno sensitive capabilityget_documentno sensitive capabilityget_imageno sensitive capabilityget_layout_measurementsno sensitive capabilityget_metadatano sensitive capabilityget_nodeno sensitive capabilityget_node_metadatano sensitive capabilityget_screenshotno sensitive capabilityget_selectionno sensitive capabilityget_selection_chainno sensitive capabilityget_set_property_valueno sensitive capabilityget_stylesno sensitive capabilityget_variable_defsno sensitive capabilitygo_to_nodeno sensitive capabilityimport_design_tokensno sensitive capabilityinspect_nodeno sensitive capabilityinspect_variablesno sensitive capabilitylint_stylesno sensitive capabilitylist_componentsno sensitive capabilitymanage_manifestsno sensitive capabilitymanage_snapshotsno sensitive capabilitynormalize_layersno sensitive capabilitynormalize_spacingno sensitive capabilityreparent_nodesno sensitive capabilitysave_node_jsonno sensitive capabilitysave_screenshotsno sensitive capabilityset_constraintsno sensitive capabilityset_effectsno sensitive capabilityset_gradient_fillno sensitive capabilityset_instance_propertiesno sensitive capabilityset_node_metadatano sensitive capabilityset_node_propertiesno sensitive capabilityset_node_visibilityno sensitive capabilityset_strokeno sensitive capabilityset_text_contentno sensitive capabilityset_text_propertiesno sensitive capabilityset_z_index_strategyno sensitive capabilityspec_importno sensitive capabilitystorybook_importno sensitive capabilityswitch_themeno sensitive capabilityupdate_component_instancesno sensitive capabilityvisualize_layoutno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (81 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.12.1 latest |
A 96/100 | 0 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @maxisoft/figma-mcp-bridge --onlineOther implementations of Figma Mcp Bridge 4
Independent packages implementing the same tool, scanned with the same engine. Compare all 5 side by side →
MCP server enabling Claude to read and manipulate Figma documents via WebSocket bridge
MCP server that bridges Figma plugin data to AI tools without hitting API rate limits
MCP server for programmatic Figma design modification - 70+ tools for AI-powered design
F-MCP ATezer: MCP server and Figma plugin bridge for Claude/Cursor. No REST token required.
More in Design & Media
Turn designs into shipped parts: quote 3D printing, CNC, and decals, then check out.
Aleph's official SiliconFlow media-generation MCP server (image / video / TTS)
MCP server for image generation using Google Gemini AI
Ambience AI MCP Server - Generate images, videos, and audio through Model Context Protocol
MCP server exposing every endpoint of the AstroWay Calculation API as tools — natal, synastry, transits, Vedic dashas, Tarot, Numerology, Human Design, AI horoscopes — for Claude Desktop, Cursor and any MCP-compatible AI agent.
Audio-guide and trip-planning tools for 1,100+ cities from Audiala. Free, no API key.