Figma.op: App instructions) — covering files, nodes, rendered images, comments, projects, components, styles, webhooks, variables, dev resources and library analytics. The 46 Figma operations are grouped into 13 entity tools, each driven by an action argument. The MCP server runs in the tenant app-instance context: it resolves the installing workspace’s own credentials and authorizes the calling agent against that workspace’s allowlist. Authentication is per-user and supports several modes:
- Per-user OAuth2 — central client (
oauthCentral, recommended) — one Figma OAuth application is registered once by the platform maintainer; every end user signs in with their own Figma account. Nothing to register per workspace: each one just installs the app and clicks Connect. - Per-user OAuth2 — tenant client (
oauth) — paste your own Figma OAuth client ID/secret in the connector config app. Each user signs in with their own account against your client (authorization-code + PKCE flow). - Direct access token (
accessToken) — a caller-managed Figma token (e.g. a Personal Access Token), used as-is with no exchange.
Design Files
Collaboration
Per-user auth
Who is this for?
This connector is used by three different roles. Jump to the section that matches yours — each one is self-contained.Agent builder
Platform admin
Workspace builder
Prerequisites
- A Figma account.
-
For the OAuth modes — a Figma OAuth application created at Figma > Developers > My apps (
https://www.figma.com/developers/apps); copy its Client ID and Client Secret. The platform maintainer registers one app for the central mode; a workspace can also register its own for the tenant mode. -
For the access-token mode — a Personal Access Token created at Figma > Settings > Security > Personal access tokens (
https://www.figma.com/developers/api#access-tokens) with the scopes the operations you call require. -
The default OAuth scopes requested are:
Add
file_variables:read/file_variables:write(variables),library_analytics:read(library analytics) ororg:activity_log_read(activity logs, Enterprise) when your agents need those endpoints. -
Base URL:
https://api.figma.com— paths already include/v1or/v2.
403 if your account or token is not entitled.Platform admin (Governance) — one-time platform setup
Platform admin (Governance) — one-time platform setup
<api-url> is your environment’s API URL (https://api.studio.prisme.ai/v2 on production).1. Configure the connector
Register the OAuth application at Figma
https://www.figma.com/developers/apps and create a new app. Set the single authorized redirect URI (callback URL) to the core workspace callback:https://api.studio.prisme.ai/v2/workspaces/slug:figma/webhooks/oauthCallback on production). Add the scopes listed in Prerequisites. Save and copy the Client ID and Client Secret (the secret is shown only once).Enter the credentials through the configuration app
figma workspace and launch its Configuration app — <studio>/apps/figma (e.g. https://studio.prisme.ai/apps/figma). Loaded from the core workspace, the app shows the maintainer view (org owner / editor / admin only); paste the Client ID and Client Secret there and Save — the app stores them in the core workspace’s secrets for you. Do not edit Studio’s raw Secrets by hand. These credentials stay in the figma workspace and are never exposed to tenants or end users; token exchange is proxied through the core centralTokenExchange webhook so the client secret never leaves the core workspace.Tell workspaces to use the central client
oauthCentral in the connector configuration app (no client id/secret to enter on their side). Their users then just click Connect.(Optional) Publish to the Capabilities catalog
2. Declare the capability in AI Governance
As an alternative to (or in addition to) the catalog button, you can declare Figma as a named capability in AI Governance. Agent builders then enable that capability on their agents instead of pasting a raw MCP endpoint.Open AI Governance > Capabilities
Point it at the MCP endpoint
agent_id in the scope is what lets the connector identify and authorize the calling agent.Make it available to agent builders
Smoke-test
oauthCentral, trigger any tool (e.g. users with action: "getMe"). The user is prompted to connect once (Figma sign-in); subsequent calls reuse the stored token transparently and refresh it automatically.- Agent builder (Agent Factory)
- Workspace builder (DSUL)
Agent builder
Goal: let an agent you build in Agent Factory use Figma through MCP tools.agent_id that Agent Factory injects through the capability Scope, and that agent must appear in the connector’s authorized-agents allowlist (managed in the configuration app). The Figma access token itself is resolved server-side from the configured auth mode.There are two ways to wire it up. Pick based on how much isolation you need.Option A — Enable the shared capability from the catalog
The fastest path: a Platform admin has already published a Figma capability to the Capabilities catalog (see the Platform admin setup accordion above — the Add to catalog button, or §2), so you just pick it from the catalog.Open your agent in Agent Factory
Add the Figma capability
context_id,agent_id,user_id) are already wired by the admin — nothing to paste, and the shared instance accepts every agent, so there is no allowlist step on your side.Connect a Figma account
connect_url to Figma’s authorization page. After sign-in the per-user token is stored and reused on subsequent calls.Option B — Run it from your own workspace (recommended)
For production agents, install the connector in your own workspace and point the agent at that workspace’s MCP endpoint.Install and configure the connector in your workspace
Allowlist your agent
Add the MCP capability to your agent
agent_id is what lets the connector identify and authorize your agent — without it, every call is rejected with an explicit “agent could not be identified” message. This Scope is separate from the Figma OAuth scopes.Connect a Figma account
Brief the agent in its system prompt
Whichever option you pick, wiring the capability is not enough — the agent must know the connector exists and when to reach for it. Add a short paragraph to the agent’s system prompt. Copy-pasteable starter:agent_id.*:read scopes (current_user:read file_content:read file_metadata:read file_versions:read file_comments:read projects:read) and exposes no write operation. Write-capable scopes (e.g. file_variables:write) are never obtained unless you explicitly add them to the Scopes field in the configuration app. No action is needed to keep this connector least-privilege.Available Tools
Each tool is an entity. Pass theaction argument to select the operation, plus the parameters that operation needs.Output Formats
Every tool accepts anoutputFormat parameter that controls the MCP response shape:verbose(default) — human-readable text for LLM consumptionstructured— machine-readable JSON instructuredContentboth— both text and structured content
Tool Details
files
Read document data for a file. Theaction selects what to return.comments
List, create and delete comments and reactions on a file.images
Render nodes as images, or fetch the download links of a file’s image fills.webhooks
Manage Figma v2 webhooks subscribing to file and library events.components
Browse published components and component sets at file or team level.Error Handling
Common Issues
“This agent is not authorized to use this connector” — The calling agent is not in the allowlist. Open the configuration app → Authorized agents → tick this agent (id is shown in the error) or enable Allow all agents, and Save. The Install capability button does this for you. “The calling agent could not be identified” — The MCP capability Scope does not declareagent_id, so Agent Factory never injects the agent identity. Set the Scope to context_id,agent_id,user_id on the capability (this is separate from the Figma OAuth scopes), then allow the agent in the config app.
“Figma is not connected for this user” — No per-user OAuth token is stored for the caller. Open the configuration app (OAuth mode) and click Connect, or use the agent’s connect flow.
“Figma token refresh failed … must reconnect” — The stored refresh token was rejected by Figma (revoked / expired). The connection is dropped automatically; the user must reconnect from the config app.
“Figma OAuth is not configured” — Neither a tenant OAuth client nor the central platform client is available. Set the OAuth client ID/secret in the config app (tenant mode), or ask the platform maintainer to provision the central OAuth client from the core workspace’s config app.
Activity logs require OAuth — getActivityLogs (the activityLogs tool) only accepts an OAuth bearer token with org:activity_log_read; a plain access token without that scope is rejected. This endpoint is Enterprise-only.
No token revocation — Figma has no token-revocation endpoint, so disconnecting deletes the stored tokens on Prisme.ai’s side rather than revoking them at Figma.