hooks-8f3fbd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks-8f3fbd (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Figma MCP Express hero: the fast lane for AI agents into Figma
Fast, quota-free, stable Figma automation for coding agents. figma-mcp-express lets Claude Code, Codex, and other local agents read, edit, migrate, audit, screenshot, and prototype inside the real Figma Desktop file. It is built for serious design-system work: batch edits, multi-file routing, large-file reads, visible multi-agent activity, and prototype wiring without burning through official Figma MCP tool-call quotas.
Use it when screenshots and comments are not enough. The agent can inspect actual nodes, components, variables, styles, frames, prototype reactions, and connected files, then make targeted changes in the file designers already use.
Multiple AI agents building screens live in Figma
Follow AI agents live as they fix issues, edit layouts, and design screens directly in Figma.
vkhanhqui/figma-mcp-go@fe6cd768 (the upstream fork baseline), the default tools/list drops from 73 tools / 12,214 o200k_base tokens to 21 tools / 3,283 tokens (73.1% smaller) — less context burned before the agent does any work.Plugin install is the shortest path.
Claude Code
claude plugin marketplace add sunhome243/figma-mcp-express
claude plugin install figma-mcp-express@figma-mcp-expressCodex
codex plugin marketplace add sunhome243/figma-mcp-express
codex plugin add figma-mcp-express@figma-mcp-expressplugin.zip or build from source.Plugins -> Development -> Import plugin from manifest....manifest.json from the unzipped plugin folder or from this repo's plugin/ directory.Plugins -> Development -> Figma MCP Express.fetch_library_catalog is the main REST-only exception and requires FIGMA_TOKEN.import_component_by_key can use them.<details> <summary>Build from source</summary>
For other MCP clients, or if you want to modify the server:
git clone https://github.com/sunhome243/figma-mcp-express.git
cd figma-mcp-express
make buildThis produces bin/figma-mcp-express and plugin/dist/.
Add it to your .mcp.json:
{
"mcpServers": {
"figma-mcp-express": {
"command": "/absolute/path/to/bin/figma-mcp-express",
"args": ["--port", "1994"]
}
}
}Restart your MCP client after building. </details>
<details> <summary>Advanced environment variables</summary>
FIGMA_TOKENMost workflows do not need a token. Live read/write tools talk directly to Figma Desktop through the plugin.
You only need FIGMA_TOKEN for REST-backed library catalog lookups such as fetch_library_catalog.
Account Settings -> Personal access tokensIf you installed from the marketplace, set it in your shell profile:
echo 'export FIGMA_TOKEN=your_token_here' >> ~/.zshrc
source ~/.zshrcIf you built from source, you can either export it in your shell or place it in a local .env file:
cat <<'EOF' > .env
FIGMA_TOKEN=your_token_here
EOFShell environment variables take precedence over .env.
| Variable | Default | Description |
|---|---|---|
FIGMA_TOKEN | - | Required only for fetch_library_catalog. |
FIGMA_MCP_TOOL_PROFILE | core | core keeps the compact default tool surface. full restores the legacy compatibility/debugging surface. |
FIGMA_MCP_TOOL_SCHEMA_MODE | compact | compact trims tools/list descriptions to reduce MCP context tokens. Use verbose for full in-schema guidance. |
FIGMA_MCP_BATCH_MAX_OPS | 200 | Maximum top-level batch.ops entries accepted before plugin execution. |
FIGMA_MCP_BATCH_MAX_BYTES | 2097152 | Maximum encoded batch.ops payload size in bytes before plugin execution. |
FIGMA_MCP_SPILL_BYTES | 25000 | Response size threshold. Larger responses spill to .figma-mcp-cache/. |
FIGMA_MCP_TIMEOUT | 120 | Inactivity ceiling in seconds for lightweight ops. Resets on each progress heartbeat. |
FIGMA_MCP_READ_TIMEOUT | 600 | Inactivity ceiling in seconds for heavy reads and batch. Resets on each progress heartbeat. |
FIGMA_MCP_STALL_THRESHOLD | 45 | Seconds an op may hold a channel's serial slot with no progress before a new call on that channel is fast-rejected. |
</details>
Built on vkhanhqui/figma-mcp-go (MIT). The original established the core idea: skip the REST API for live file work and talk directly to Figma Desktop over WebSocket.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.