GLips/Figma-Context-MCP

At a glance

What to fix first

9 issues, most severe first. Each one points to the exact code, with the recommended fix and a prompt you can paste into your coding agent.

1. 1CriticalOAuth 2.1 + PKCE Correctness (MCP Authorization)
   mcp-server (MCP server) · ATR-M0005
   Remote StreamableHTTP transport is registered and reachable; the server's default listener host is 127.0.0.1 (loopback), so it is not publicly exposed by default, but the host is operator-configurable (FRAMELINK_HOST/--host) and a non-loopback bind remains a fully supported deployment mode. No OAuth 2.1/PKCE/authorization-server-metadata exists anywhere in the codebase; the HTTP transport instead accepts a raw Figma Personal Access Token or OAuth bearer token as the caller's credential and forwards it to the upstream Figma API -- this is upstream-credential forwarding, not MCP resource-server token validation, and does not satisfy the rule's PKCE/authorization-server requirements for a remote transport. Per the rule's own applicability guidance, a remote-capable transport lacking OAuth 2.1/PKCE support is the VULNERABLE condition regardless of the operator's chosen default bind address.

   Show more
   src/server.ts:129–166 ↗

   export async function startHttpServer(
     host: string,
     port: number,
     baseAuth: FigmaAuthOptions,
     serverOptions: Omit<CreateServerOptions, "transport">,
   ): Promise<Server> {
     ...
     const handlePost = async (req: Request, res: Response) => {
       Logger.log("Received StreamableHTTP request");
       const requestKey = getRequestApiKey(req);
       const requestBearerToken = getRequestBearerToken(req);
       const auth = resolveRequestAuth(baseAuth, requestKey, requestBearerToken);
       ...
         const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
   …

   Show 2 more locations

   src/server.ts:235–246 ↗

   function getRequestApiKey(req: Request): string | undefined {
     const value = req.headers["x-figma-token"];
     if (Array.isArray(value)) return value[0]?.trim() || undefined;
     return value?.trim() || undefined;
   }
   
   function getRequestBearerToken(req: Request): string | undefined {
     const value = req.headers.authorization;
     const header = Array.isArray(value) ? value[0] : value;
     const match = header?.match(/^Bearer\s+(.+)$/i);
     return match?.[1]?.trim() || undefined;
   }

   src/bin.ts:54–64 ↗

   stdio: {
         type: Boolean,
         description: "Run in stdio transport mode for MCP clients",
       },
       noTelemetry: {
         type: Boolean,
         description: "Disable usage telemetry (telemetry is on by default)",
       },
     },
     commands: [fetchCommand],
   });

   +1 more location in the finding JSON

   Recommended fix

   Implement OAuth 2.1 with PKCE for the HTTP/StreamableHTTP transport per the MCP Authorization spec: publish protected-resource metadata, require PKCE + exact redirect-URI match, scope tokens narrowly, and avoid treating a raw Figma PAT/bearer token as the MCP session credential.

   Create fix promptCopy finding JSON
2. 2CriticalNo Authentication or Authorization Checks (General)
   mcp-server (MCP server) · ATR-M0010
   No authn/authz gate sits between the HTTP listener and MCP tool dispatch. requireGlobalCredentials (the only credential-presence check in the codebase) is invoked only for stdio mode; HTTP mode explicitly skips it. In HTTP mode, any caller that reaches the listener and omits X-Figma-Token/Authorization is silently served using the server's own globally-configured Figma credential (shared ambient identity) and can invoke both tools -- one of which writes files to the host disk and both of which spend the operator's Figma API credential -- with no credential of its own.

   Show more
   src/server.ts:141–153 ↗

   const handlePost = async (req: Request, res: Response) => {
       Logger.log("Received StreamableHTTP request");
       const requestKey = getRequestApiKey(req);
       const requestBearerToken = getRequestBearerToken(req);
       const auth = resolveRequestAuth(baseAuth, requestKey, requestBearerToken);
       const requestSecrets = [requestKey, requestBearerToken].filter(
         (secret): secret is string => !!secret,
       );
       await telemetry.withRequestSecrets(requestSecrets, async () => {
         const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
         const mcpServer = createServer(auth, { ...serverOptions, transport: "http" });

   Show 2 more locations

   src/server.ts:211–233 ↗

   function resolveRequestAuth(
     baseAuth: FigmaAuthOptions,
     requestKey: string | undefined,
     requestBearerToken: string | undefined,
   ): FigmaAuthOptions {
     if (requestKey) {
       return { figmaApiKey: requestKey, figmaOAuthToken: "", useOAuth: false };
     }
     if (requestBearerToken) {
       return { figmaApiKey: "", figmaOAuthToken: requestBearerToken, useOAuth: true };
     }
     return baseAuth;
   }

   src/config.ts:125–137 ↗

   /**
    * Fail fast when global credentials are required but missing. HTTP mode skips
    * this check so it can accept per-request `X-Figma-Token` headers; ...
    */
   export function requireGlobalCredentials(auth: FigmaAuthOptions): void {
     if (auth.figmaApiKey || auth.figmaOAuthToken) return;
     throw new UsageError(
       "Either FIGMA_API_KEY or FIGMA_OAUTH_TOKEN is required (via CLI argument or .env file)",
     );
   }

   +1 more location in the finding JSON

   Recommended fix

   Require every HTTP request to present its own MCP-level credential before dispatching to any tool; do not fall back to a shared, globally-configured Figma credential for callers who present nothing.

   Create fix promptCopy finding JSON
3. 3CriticalOAuth Proxy Per-Client Consent (Confused Deputy Defense)
   mcp-server (MCP server) · ATR-M0011
   This server is not an OAuth proxy: it does not forward an MCP-client's authorization request to a distinct upstream IdP on that client's behalf, has no dynamic MCP-client-registration endpoint, and mints no 'bridge' authorization codes. However, in HTTP mode, a request that omits the X-Figma-Token/Authorization headers falls back to the server's own globally-configured Figma credential (resolveRequestAuth returns baseAuth, src/server.ts) rather than being rejected. get_figma_data takes a caller-supplied fileKey, fetches that file under the server's ambient Figma credential via FigmaService, and returns the resulting design content to the caller -- so any caller that can reach the HTTP listener without presenting its own credential can read Figma files authorized to the server's own token, selecting which file to read via the fileKey parameter, without the caller having been authorized against that target itself. This is a general confused-deputy condition (ambient-credential use for a caller-selected target without caller-specific authorization) rather than the OAuth-proxy bridge-code scenario the rule's title emphasizes, but the rule's broader clause covering ambient-credential misuse for caller-selected targets applies. Exposure is conditional on global Figma credentials being configured and the HTTP listener being reachable by an untrusted caller; the default loopback bind and the option to supply a caller-specific token both reduce, but do not eliminate, this exposure.

   Show more
   src/server.ts:141–145 ↗

     const handlePost = async (req: Request, res: Response) => {
       Logger.log("Received StreamableHTTP request");
       const requestKey = getRequestApiKey(req);
       const requestBearerToken = getRequestBearerToken(req);
       const auth = resolveRequestAuth(baseAuth, requestKey, requestBearerToken);

   Show 2 more locations

   src/server.ts:224–233 ↗

     if (requestBearerToken) {
       return {
         figmaApiKey: "",
         figmaOAuthToken: requestBearerToken,
         useOAuth: true,
       };
     }
   
     return baseAuth;
   }

   src/mcp/index.ts:88–93 ↗

       (params: GetFigmaDataParams, extra: ToolExtra) =>
         getFigmaDataTool.handler(
           params,
           figmaService,
           options.outputFormat,
           options.transport,

   +6 more locations in the finding JSON

   Recommended fix

   Require every HTTP request to present and use its own caller-supplied Figma credential for tool calls that access caller-selected targets; do not fall back to a shared, globally-configured Figma credential when a caller presents no credential of its own, or otherwise gate such a fallback behind an explicit operator opt-in with reduced trust applied to the resulting ambient-credential session.

   Create fix promptCopy finding JSON
4. 4HighMissing or Inadequate Input Validation
   Repository-wide · ATR-C0008
   Both MCP tools define zod schemas that validate types and filename syntax, but the download_figma_images nodes array parameter has no cardinality maximum (.max()/length cap). A caller can submit many entries referencing the same gifRef under distinct valid filenames, bypassing fill-URL deduplication since deduplication keys on the fill reference while each filename still starts an independent, concurrently-dispatched download. This inadequately bounded input allows a single tool call to drive an unbounded number of concurrent downloads, risking file-descriptor, connection, and disk exhaustion; schema-level type/filename validation and path containment do not bound this fan-out, and Figma's own API throttling does not cap the number of distinct resolved fill URLs a single call can request.

   Show more
   src/mcp/tools/download-figma-images-tool.ts:73–83 ↗

       })
       .array()
       .describe("The nodes to fetch as images"),
     pngScale: z
       .number()
       .positive()
       .optional()
       .default(2)
       .describe(
         "Export scale for PNG images. Optional, defaults to 2 if not specified. Affects PNG images only.",
       ),

   Show 2 more locations

   src/mcp/index.ts:100–112 ↗

     if (!options.skipImageDownloads) {
       server.registerTool(
         downloadFigmaImagesTool.name,
         {
           title: "Download Figma Images",
           description: downloadFigmaImagesTool.getDescription(options.imageDir),
           inputSchema: downloadFigmaImagesTool.parametersSchema,
           annotations: { openWorldHint: true },
         },
         (params: DownloadImagesParams, extra: ToolExtra) =>
           downloadFigmaImagesTool.handler(
             params,
             figmaService,

   src/services/download-figma-images.ts:112–117 ↗

         if (node.gifRef) {
           // GIF fills are always unique downloads (animated, no dedup needed).
           const downloadIndex = downloadItems.length;
           downloadItems.push({ ...downloadItem, gifRef: node.gifRef });
           downloadToRequests.set(downloadIndex, [finalFileName]);
         } else if (node.imageRef) {

   +3 more locations in the finding JSON

   Recommended fix

   Add a maximum array-length (.max()) to the nodes schema in download_figma_images, deduplicate requested downloads by resolved fill/render URL (not only by the stored imageRef/nodeId key) before dispatching, and bound overall concurrent download count independent of the number of distinct requested filenames.

   Create fix promptCopy finding JSON
5. 5HighCORS / Origin / Host Validation (DNS Rebinding Defense)
   mcp-server (MCP server) · ATR-M0003
   The HTTP app is built via the MCP SDK's createMcpExpressApp({ host }), which for the server's default host value (127.0.0.1) automatically installs Host-header validation middleware restricting accepted Host headers to 'localhost'/'127.0.0.1'/'[::1]' -- a real code-level DNS-rebinding defense for that default configuration. Host is operator-configurable via FRAMELINK_HOST/--host, and when set to a non-loopback value, createMcpExpressApp receives no explicit allowedHosts option and the SDK does not apply any Host allowlist for that configuration (it only logs a console warning); this codebase adds no compensating Origin-header validation of its own before dispatch. In that supported non-loopback configuration, neither tool is a pure function of caller input: a request that omits the X-Figma-Token/Authorization headers inherits the server's own configured Figma credential, and the tools fetch and return that credential's design data. A same-origin DNS-rebound request reaching the listener in this configuration can therefore reach tool dispatch and obtain ambient-credentialed data without the SDK's loopback-only Host defense applying. The default loopback configuration remains mitigated by the SDK's automatic Host validation; the supported non-loopback configuration is not.

   Show more
   src/config.ts:150–151 ↗

     const port = resolve(flags.port, envInt("FRAMELINK_PORT", "PORT"), 3333);
     const host = resolve(flags.host, envStr("FRAMELINK_HOST"), "127.0.0.1");

   Show 2 more locations

   src/server.ts:139–145 ↗

     const app = createMcpExpressApp({ host });
   
     const handlePost = async (req: Request, res: Response) => {
       Logger.log("Received StreamableHTTP request");
       const requestKey = getRequestApiKey(req);
       const requestBearerToken = getRequestBearerToken(req);
       const auth = resolveRequestAuth(baseAuth, requestKey, requestBearerToken);

   src/server.ts:173–180 ↗

     // Serving StreamableHTTP at /sse lets existing client configs keep working —
     // modern MCP clients probe with a POST before falling back to SSE.
     for (const path of ["/mcp", "/sse"]) {
       app.post(path, handlePost);
       app.get(path, handleMethodNotAllowed);
       app.delete(path, handleMethodNotAllowed);
     }
   

   +3 more locations in the finding JSON

   Recommended fix

   When FRAMELINK_HOST/--host is configured to a non-loopback value, explicitly pass an allowedHosts option (or implement Origin-header validation) to createMcpExpressApp so the DNS-rebinding defense continues to apply outside the SDK's automatic loopback-only default, rather than relying on the operator to self-restrict or on the console warning alone.

   Create fix promptCopy finding JSON

What’s inside

BlueRock found 1 component in this repository. Each is checked against the rules for its type.

function registerTools(
  server: McpServer,
  figmaService: FigmaService,
  options: RegisterToolsOptions,
): void {
  server.registerTool(
    getFigmaDataTool.name,
    {
      title: "Get Figma Data",
      description: getFigmaDataTool.description,
      inputSchema: getFigmaDataTool.parametersSchema,
      annotations: { readOnlyHint: true },
    },
    (params: GetFigmaDataParams, extra: ToolExtra) =>
…

permissions:
  contents: write
  pull-requests: write
  id-token: write # Required for npm OIDC trusted publishing

jobs:
  release-please:
    if: ${{ github.repository_owner == 'GLips' }}
    runs-on: ubuntu-latest

export function resolveLocalPath(
  rawPath: string,
  baseDir: string,
  pathImpl: PathImpl = path,
): ResolveLocalPathResult {
  ...
  const base = pathImpl.resolve(baseDir);
  const candidate = pathImpl.isAbsolute(normalized)
    ? pathImpl.resolve(normalized)
    : pathImpl.resolve(base, normalized);

  if (!isWithin(base, candidate, pathImpl)) {
    return { ok: false, reason: "outside_image_dir" };
  }
…

fileName: z
  .string()
  .regex(
    /^[a-zA-Z0-9_.-]+\.(png|svg|gif)$/,
    "File names must contain only letters, numbers, underscores, dots, or hyphens, and end with .png, .svg, or .gif.",
  )

const port = resolve(flags.port, envInt("FRAMELINK_PORT", "PORT"), 3333);
  const host = resolve(flags.host, envStr("FRAMELINK_HOST"), "127.0.0.1");

export async function startHttpServer(
  host: string,
  port: number,
  baseAuth: FigmaAuthOptions,
  serverOptions: Omit<CreateServerOptions, "transport">,
): Promise<Server> {
  ...
  const app = createMcpExpressApp({ host });
  const handlePost = async (req: Request, res: Response) => { ... };
  const handleMethodNotAllowed = (_req: Request, res: Response) => {
    res.status(405).set("Allow", "POST").send("Method Not Allowed");
  };
  for (const path of ["/mcp", "/sse"]) {
    app.post(path, handlePost);
…

server.registerTool(
    getFigmaDataTool.name,
    { ... },
    ...
  );

  if (!options.skipImageDownloads) {
    server.registerTool(
      downloadFigmaImagesTool.name,
      { ... },

export const getFigmaDataTool = {
  name: "get_figma_data",
  description:
    "Get comprehensive Figma file data including layout, content, visuals, and component information",

function getDescription(imageDir?: string) {
  const baseDir = imageDir ?? process.cwd();
  return `Download SVG and PNG images used in a Figma file based on the IDs of image or icon nodes. Images will be saved relative to the server's image directory: ${baseDir}`;
}

Repository-wide rules

Checked once for the whole repository: dependencies, secrets, inputs, networking, CI and more. 4 of 15 flagged.

export function resolveLocalPath(
  rawPath: string,
  baseDir: string,
  pathImpl: PathImpl = path,
): ResolveLocalPathResult {
  ...
  if (!isWithin(base, candidate, pathImpl)) {
    return { ok: false, reason: "outside_image_dir" };
  }
  return { ok: true, resolvedPath: candidate };
}
export function isWithin(base: string, candidate: string, pathImpl: PathImpl = path): boolean {
  const rel = pathImpl.relative(base, candidate);
  return rel === "" || (!rel.startsWith("..") && !pathImpl.isAbsolute(rel));
…

const { fileKey, nodes, localPath, pngScale } = parametersSchema.parse(params);
const baseDir = imageDir ?? process.cwd();
const resolution = resolveLocalPath(localPath, baseDir);
if (!resolution.ok) {
  ...
  return { isError: true, content: [{ type: "text" as const, text: details.userMessage }] };
}
const resolvedPath = resolution.resolvedPath;

export async function downloadFigmaImage(
  fileName: string,
  localPath: string,
  imageUrl: string,
): Promise<string> {
  try {
    if (!fs.existsSync(localPath)) {
      fs.mkdirSync(localPath, { recursive: true });
    }
    const fullPath = path.resolve(path.join(localPath, fileName));
    if (!isWithin(localPath, fullPath)) {
      tagError(new Error(`File path escapes target directory: ${fileName}`), {
        category: "invalid_input",
      });
…

child = spawn("tsx", ["src/bin.ts", `--figma-api-key=test-key`, `--port=${TEST_PORT}`], {

{
  "name": "figma-developer-mcp",
  "version": "0.13.2",
  "mcpName": "io.github.GLips/Figma-Context-MCP",
  "description": "Give your coding agent access to your Figma data. Implement designs in any framework in one-shot.",

export class FigmaService {
  private readonly apiKey: string;
  private readonly oauthToken: string;
  private readonly useOAuth: boolean;
  private readonly baseUrl = "https://api.figma.com/v1";

const fillRef = gifRef ?? imageRef;
            const imageUrl = fillRef ? fillUrls[fillRef] : undefined;
            return imageUrl
              ? downloadAndProcessImage(

import yaml from "js-yaml";
export function dumpYaml(value: unknown): string {
  return yaml.dump(value, {
    noRefs: true,
    lineWidth: -1,
    noCompatMode: true,
    schema: yaml.JSON_SCHEMA,
  });
}

const text = await response.text();
const rawSize = Buffer.byteLength(text, "utf8");
const data = JSON.parse(text) as T;
return { data, rawSize };

- name: Update server.json version
  run: |
    VERSION="${{ steps.release.outputs.major }}.${{ steps.release.outputs.minor }}.${{ steps.release.outputs.patch }}"
    jq --arg v "$VERSION" '.version = $v | .packages[0].version = $v' server.json > server.tmp && mv server.tmp server.json
  if: ${{ steps.release.outputs.release_created }}

on:
  pull_request:
    branches:
      - main
jobs:
  ci:
    ...
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup
      - name: Scan for hidden characters
        run: node scripts/scan-hidden-chars.mjs
      - name: Check formatting
        run: pnpm prettier --check "src/**/*.ts"

let redactionSecrets: string[] = [];
const requestSecrets = new AsyncLocalStorage<readonly string[]>();
export function withRequestSecrets<T>(
  secrets: readonly string[],
  fn: () => Promise<T>,
): Promise<T> {
  const filtered = secrets.filter(Boolean);
  if (filtered.length === 0) return fn();
  return requestSecrets.run(filtered, fn);
}

private getAuthHeaders(): Record<string, string> {
    if (this.useOAuth) {
      Logger.log("Using OAuth Bearer token for authentication");
      return { Authorization: `Bearer ${this.oauthToken}` };
    }
    ...
    Logger.log("Using Personal Access Token for authentication");
    return { "X-Figma-Token": this.apiKey };

const MARKDOWN_ESCAPE_CHARS = /[\\*_~[\](){}]/g;
function escapeMarkdown(text: string): string {
  return text.replace(MARKDOWN_ESCAPE_CHARS, "\\$&").replace(/[\n\u2029]/g, "\\n");
}

} catch (error) {
      const meta = getErrorMeta(error);
      if (meta.http_status === 429) {
        throw new Error(buildRateLimitMessage(error), { cause: error });
      }

(absence) -- `find . -iname "Dockerfile*" -o -iname "docker-compose*"` returns no results anywhere in the repository (excluding node_modules, which is also absent from this checkout).