For context: Figma has two MCPs. The local "dev" MCP that works through the Desktop app, and the remote MCP that requires a connection to Figma. Companies need to be whitelisted to use the remote MCP, which is the only one that allows agents edit access to Figma documents.
I only found out about Figma's limitation when I was trying to add the remote MCP server to GitHub Copilot Desktop and kept running into errors. Turns out they whitelisted GitHub Copilot CLI but not the Desktop app and had put a pause on enabling any more vendors. Eventually someone (not sure which side) got it working.
Kind of strange to limit edit access only to the Remote MCP when their competitors like Pen[1] and Paper[2] allow any local agent to edit.
To speak more broadly, Figma is in a really tough spot right now. I see more and more designers in my circle saying they are skipping design tools entirely to prototype in code or ship directly in their product's code base. Honestly I find myself doing the same.
Figma's main value used to be in providing designers a canvas to iterate and explore ideas since the majority of designers did not code, but AI has completely changed that.
I fear Figma's reluctance to integrate with all the popular AI tools might actually accelerate their decline. AI provides so much value, that I would rather base my software purchasing decisions around what is compatible with my AI of choice rather than what AI is compatible with Figma.
I found figma’s remote MCP to be a poor fit for iOS development (it sets tokens on fire and gives Claude the details as React+Tailwind) and got much better results by having Claude build a set of “lens” tools around their REST API (“give me all of the fonts”, “give me the layout dimensions”, “give me the colors”, etc).
The key to making it token efficient was allowing Claude to invent its own plaintext markup format for the lens output.
I do security review for my company. I suspect this is a means of containing OAuth redirect vulnerabilities. We basically needed to do the same thing with our MCP server.
The security problem is two fold: (1) companies want control over where their data goes. Figma allowing any MCP creates problems (2) open redirects can create phishing issues. If your using Pi, you’re probably thinking of this. Most users aren’t.
For us, we decided to do an allowlist pattern because it was a reasonable tradeoff. The solution is allowing per-tenant client configuration, but that comes with its own set of issues (dev time, support, maintenance, etc). When nearly all of the money is flowing through a handful of well-known MCPs there’s little reason to out effort into supporting every MCP.
Even if you’re whitelisted you get only 6 accesses a day on a standard account, have to pay for a dev account to get 200/day which still isn’t great.
For my Figma needs, having Codex do computer use seems just as good as their mcp. I can tell it, “go download the assets for what I need and take a few screenshots for reference”.
What happens if someone sends requests that look like to be OpenCode, but from Pi? What is stopping people from doing it? And how these measures are going to benefit Figma? I don't get it.
As someone making my own harness, this makes me sad. Pi is a big inspiration and one of the best open source harnesses, but there are many others. dsh, opencode, hermes, etc. MCP is such a thin layer to implement for any harness, this just seems arbitrary.
Funny enough, I saw some tweet earlier today about their company trying to get past the legal hurdles with getting figma mcp to work and ended up bluntly giving up. Wonder if this is related.
This was always a possibility, when my team dug into the concentration of MCP server usage a year ago we found that the top 10 servers had half of all GitHub stars (the Figma server was in 10th at the time).
Figma has been absolute dog shit about opening up to mcp usage. We have been trying to include them in an internal tool we are building, but that would require a service account, which they refuse to offer.
We're talking about client request headers, right? Why even bother with such a thing? Malicious users will just spoof those, you're only going to annoy legitimate users.
Welcome to where this was inevitably all going to go eventually. The entirety of commercial personal computing is going this direction: locking down APIs to make sure you’re not only doing what the company wants, but also the way the company wants. Mobile phones provide countless examples already; applying those examples to LLM world isn’t far fetched - and Anthropic already started down the road of “any old agent isn’t OUR agent” months ago.
> Open MCP basically kills your product in my opinion, you can't charge for any feature the LLM can do itself.
For products for which this is true resorting to whitelisting clients simply accelerates your obsolescence by creating a temporary market for products that are MCP, and open agent, friendly.
Another thing they do that I find equally frustrating is their MCP can do things you cannot do via API so you are forced to use theirs and cannot implement your own
I think we'll see more of this. Of course SAAS companies like Figma, and soon Adobe and ... will see that their tools are still useful. And they are useful to LLMs like they are useful to humans.
The obvious play to "extract value" from that is to restrict access to bots and offer LLM integration themselves, for a fee.
"User agent" but do users run LLMs behind their agents on their hardware? No, it's run in an AI datacenter. They can easily make a deal to route that without involving user's machine, or they can route this via user's machine but attach a signature. Of course both parties must agree on that, but technically there's nothing stopping them
Soon they might require a vendor specific api key to access it and that requires support from the big players (anthropic,openai). They’re laying down the “framework” now.
I only found out about Figma's limitation when I was trying to add the remote MCP server to GitHub Copilot Desktop and kept running into errors. Turns out they whitelisted GitHub Copilot CLI but not the Desktop app and had put a pause on enabling any more vendors. Eventually someone (not sure which side) got it working.
Kind of strange to limit edit access only to the Remote MCP when their competitors like Pen[1] and Paper[2] allow any local agent to edit.
[1] https://www.pen.dev/
[2] https://paper.design/
Figma's main value used to be in providing designers a canvas to iterate and explore ideas since the majority of designers did not code, but AI has completely changed that.
I fear Figma's reluctance to integrate with all the popular AI tools might actually accelerate their decline. AI provides so much value, that I would rather base my software purchasing decisions around what is compatible with my AI of choice rather than what AI is compatible with Figma.
The key to making it token efficient was allowing Claude to invent its own plaintext markup format for the lens output.
https://developers.figma.com/docs/rest-api/file-endpoints/#g...
https://developers.figma.com/docs/rest-api/file-node-types/
Seems read-only, which means we're stuck with the MCP for updating Figma files... unless you've found a workaround there too?
> on the figma mcp, we've had an email thread going on for 8 months trying to get it setup in opencode
> they seem very concerned with the labs competing with them
> finally got unblocked after i sent this email and it'll be rolled out in a week or so
The email:
> looking through the legal stuff the amount of things in there seems pretty crazy
> this is just an mcp server, there are thousands of them. we're not going to treat figma like its special
> we've been talking about this for this entire year, i don't think this makes much sense and i don't want my team burning more time on this
> once again, for a simple mcp server
— https://www.threads.com/@thdxr/post/Dd7LN-ylLQW
The security problem is two fold: (1) companies want control over where their data goes. Figma allowing any MCP creates problems (2) open redirects can create phishing issues. If your using Pi, you’re probably thinking of this. Most users aren’t.
For us, we decided to do an allowlist pattern because it was a reasonable tradeoff. The solution is allowing per-tenant client configuration, but that comes with its own set of issues (dev time, support, maintenance, etc). When nearly all of the money is flowing through a handful of well-known MCPs there’s little reason to out effort into supporting every MCP.
For my Figma needs, having Codex do computer use seems just as good as their mcp. I can tell it, “go download the assets for what I need and take a few screenshots for reference”.
https://www.oreilly.com/radar/mcp-in-practice/
MCP is only as useful as the servers people use are open.
It's probably good news for users and open source though, why would you pay for something if a free tool with an MCP can do it.
For products for which this is true resorting to whitelisting clients simply accelerates your obsolescence by creating a temporary market for products that are MCP, and open agent, friendly.
The obvious play to "extract value" from that is to restrict access to bots and offer LLM integration themselves, for a fee.