.vscode — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .vscode (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create designed Figma Slides from a prompt — using your own LLM API key (BYOK).
Type "Make an 8-slide product intro" in the plugin, and a polished, multi-layout deck appears in your open Figma Slides file — 39 layouts, 17 design systems, charts, images, tables, and more. Everything runs inside the plugin: no server, no account, and your API key never leaves your machine.
create_deck data formatThe default mode is BYOK — a single Figma Slides plugin, no backend:
OpenAI) with your key, asking it to design the deck and return it as create_deck JSON (structure, layouts, colors).
You can also paste a `create_deck` JSON directly to build an exact deck without calling any LLM (see Direct JSON), or drive it from an IDE assistant via the bundled MCP server (see IDE / MCP mode) — useful when you'd rather use a Copilot/Claude subscription than per-token API billing.
The API key is stored locally via Figma's clientStorage (this machine only) and is sent only to the provider you choose.The plugin loads from local files (manifest.json → code.js + ui.html), so build it once after cloning:
git clone https://github.com/Rikuto-des/slide-mcp.git
cd slide-mcp
npm install && npm run build # builds the plugin → code.jscode.jsandnode_modules/are git-ignored, so you build after cloning.
You only import once. After code changes you just re-run it (a manifest.json change needs a re-import — see Updating).
In the plugin panel:
provider). Get one:
Example topic:
自社プロダクトの紹介を8枚で。表紙、課題、解決策、主要機能3つ、実績の数値、料金、まとめ。
For very large decks (e.g. all 39 layouts) prefer a strong model — output can be long. See examples/ for ready-made prompts.
Open "JSON直貼り" in the panel and paste a create_deck JSON ({ "slides": [ ... ] }) to build an exact deck with no API call — handy for reproducible decks or testing every layout. Example: examples/all-layouts.json renders all 39 layouts, one per slide.
BYOK bills per token against your own API key. If you'd rather drive the plugin from an IDE assistant you already pay for (GitHub Copilot, or Claude Code/Desktop), use the bundled MCP server instead — the assistant calls the create_deck tool and the plugin builds the slides. The plugin itself never touches your subscription, so this stays within each tool's own terms.
Copilot / Claude ──stdio──▶ slide-mcp-server (MCP + WS bridge) ──WS──▶ this plugin.vscode/mcp.json, which runs thepublished server via npx (npx -y slide-mcp-server@latest). In VS Code, start the `slide-mcp` server from the MCP list (Copilot Agent mode).
to ws://localhost:3055 and flips to 接続済み.
Figma runs on your local machine, so the plugin must reach the bridge inside the Codespace. Use GitHub's authenticated, private port forward — no public exposure:
0.0.0.0 (set in .vscode/mcp.json viaSLIDE_MCP_HOST=0.0.0.0). Start it from the Copilot MCP list.
browser-only):
gh codespace ports forward 3055:3055 -c <codespace-name>
# optional one-word alias in ~/.zshrc:
# alias slidetunnel='gh codespace ports forward 3055:3055 -c <codespace-name>'The port stays Private (GitHub-authenticated) — it is not made public.
ws://localhost:3055 now tunnels to the Codespace. Press 接続.Run the server in one place only. Don't also start a local slide-mcp-server while the tunnel is up — two servers fighting for port 3055 is the usual cause of "connected but nothing happens".You can set the look in three places (most specific wins):
Click one; it becomes the default whenever a deck doesn't specify a theme. Your choice is remembered across sessions.
theme.preset (e.g. "theme": { "preset": "ocean" }).slide.theme.preset on a single slide (e.g. one darksection inside a light deck).
create_deck data formatThis is the JSON the LLM produces — and what you can paste into JSON直貼り:
{
"replace": true, // optional: delete existing slides first
"theme": { // optional; omit to use the panel default
"preset": "light", // one of the 17 systems (see below)
"accent": "#2563eb", // optional per-field color overrides:
"background": "#ffffff",
"titleColor": "#0f172a",
"bodyColor": "#334155",
"secondaryColor": "#64748b",
"surfaceColor": "#f1f5f9",
"font": "Inter", // preferred font family (best-effort)
"pageNumbers": true // footer page numbers (default true)
},
"slides": [
{
"layout": "content", // optional; auto-detected if omitted
"kicker": "string", // small eyebrow label above the title
"title": "string",
"subtitle": "string",
"body": "string", // paragraph; for statement/quote/code it's the message/code
"bullets": ["string", "..."],
"items": [ // structured rows (charts, cards, steps, …)
{ "title": "", "value": "", "label": "", "desc": "", "bullets": ["..."], "image": "https://…" }
],
"image": "https://…", // for image-right/left, hero, gallery, team
"table": { "headers": ["A","B"], "rows": [["1","2"],["3","4"]] },
"notes": "string", // speaker notes (stored as plugin data)
"background": "#0B1021", // per-slide background (hex or a name)
"theme": { "preset": "dark" } // per-slide design-system override
}
]
}Omit layout to auto-detect: a title-only slide becomes cover (first slide) or section; anything with body/bullets/items becomes content.
| layout | shows | main fields |
|---|---|---|
cover | title slide with a side color panel | kicker, title, subtitle |
cover-bold | full-bleed accent bg, centered title | kicker, title, subtitle |
cover-minimal | editorial whitespace, left-aligned + rule | kicker, title, subtitle |
cover-split | 50/50 accent panel + title | kicker, title, subtitle |
section | divider with a big ghost number | kicker, title, subtitle |
closing | closing / thank-you slide | kicker, title, subtitle |
content | title + numbered bullets | kicker, title, subtitle, body, bullets[] |
two-col | bullets in two columns | kicker, title, bullets[] |
checklist | ✓ checklist | kicker, title, bullets[] |
agenda | numbered table of contents | title, bullets[] |
split | term / definition rows | title, items[].title + items[].desc |
quadrant | 2×2 matrix of four cards | title, items[].title/desc (4) |
statement | one big quote / takeaway | body, subtitle |
quote | designed pull-quote + author | body, subtitle |
callout | highlighted message box | body, subtitle |
stats | 2–4 big numbers | title, items[].value/label/desc |
big-number | one huge KPI | kicker, items[0].value/label/desc |
gauge | single circular % gauge + label | title, items[0].value/label/desc |
bars | horizontal bar chart | title, items[].label/value |
columns | vertical column chart | title, items[].label/value |
progress | percent progress bars | title, items[].label/value (0–100) |
donut | donut / pie chart + legend | title, items[].label/value |
line | line chart | title, items[].label/value |
funnel | funnel | title, items[].label/value |
pyramid | hierarchy pyramid | title, items[].label (+value) |
steps | numbered process row | title, items[].title/desc |
roadmap | horizontal phased roadmap | title, items[].title/desc (3–5) |
timeline | vertical timeline | title, items[].title/desc |
compare | two cards side by side | title, items[0..1].title + bullets[] |
cards | 2–4 feature cards | title, items[].title/desc |
table | data table (zebra rows) | title, table.headers[], table.rows[][] |
split-mix | text left + image/chart right | title, bullets/body + image OR items[] |
team | profile cards with avatars | title, items[].image/title/desc |
testimonial | quote + avatar + name/role | body, image, subtitle, items[0].desc |
image-right | text left, image right | kicker, title, bullets[], image |
image-left | image left, text right | kicker, title, body, image |
hero | full-bleed image + overlaid title | kicker, title, subtitle, image |
gallery | grid of images with captions | title, items[].image/title |
code | code on a dark panel (monospace) | title, body (the code; newlines kept) |
Notes:
bars, columns, progress, donut, line, funnel, pyramid,gauge) read a number out of items[].value (e.g. "68%", "1,200").
cover (side panel), cover-bold (full accent, centered),cover-minimal (editorial), cover-split (50/50).
https PNG / JPEG / GIF URL (max 4096 px). A bad/slow URLfalls back to a plain placeholder after ~7 s.
theme.preset)17 systems, each a 6-color palette (some with a preferred font):
light (default), sky, ocean, emerald, forest, warm,sunset, rose, plum, indigo, mono, paper (serif)
dark, midnight, graphite, carbon, royalSee Choosing a design system for how to select one.
has credit. The exact provider message is shown in the panel.
direct browser request. Anthropic supports direct calls; if Gemini or OpenAI is blocked in your environment, switch providers or open an issue.
cut off because the deck was too long. Ask for fewer slides or use a stronger model (Opus / Sonnet / GPT‑4o / Gemini Pro).
out (~7 s).
(the plugin auto-prefers it for CJK and falls back to Inter). Override with theme.font.
npm run build, then re-run the pluginin Figma (Plugins → Development → slide-mcp). Re-running reloads code.js + ui.html from disk.
Import plugin from manifest…). A re-run is not enough for manifest changes.
manifest.json Figma plugin manifest (entry: code.js, ui: ui.html)
code.ts Plugin main thread — layout engine (build → code.js)
ui.html Plugin UI — BYOK panel + JSON-paste + IDE/MCP connect
tsconfig.json Plugin TS config (target es2017 — required by Figma)
.vscode/mcp.json VS Code MCP server config (for the IDE/MCP path)
server/ MCP server + WebSocket bridge (optional — IDE/MCP mode)
src/index.ts MCP server (stdio) + WS bridge; generate.mjs CLI
examples/ Ready-made prompts + create_deck JSON (incl. all-layouts.json)
assets/community/ Figma Community publishing assetsclientStorage) and sentonly to the provider you pick. The plugin has no backend and collects nothing.
manifest.json allows * so the plugin can reach the threeprovider APIs and fetch user-supplied image URLs (any host).
notes are stored on the slide via setSharedPluginData("slide_mcp", "notes").
rejects newer syntax. Don't raise the target.
by, or endorsed by Figma or Anthropic. "Figma" is a trademark of Figma, Inc., used here only descriptively to say what this tool works with.
npm run watch # rebuild code.ts → code.js on saveAfter changing the plugin, re-run it from Figma's Plugins → Development menu.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.