figma-mcp-server

Security Findings (124)

• HighAS-002

  ⚠️Excessive Permissions ×14

  tool declares network permission

  FIGMA_CREATE_A_WEBHOOKFIGMA_CREATE_DEV_RESOURCESFIGMA_DISCOVER_FIGMA_RESOURCESFIGMA_DOWNLOAD_FIGMA_IMAGESFIGMA_GET_FILES_IN_A_PROJECTFIGMA_GET_IMAGE_FILLSFIGMA_GET_LOCAL_VARIABLESFIGMA_GET_WEBHOOK_REQUESTSFIGMA_RENDER_IMAGES_OF_FILE_NODESFIGMA_UPDATE_A_WEBHOOKFIGMA_UPDATE_DEV_RESOURCES

  tool declares exec permission

  FIGMA_CREATE_A_WEBHOOKFIGMA_CREATE_MODIFY_DELETE_VARIABLESFIGMA_UPDATE_A_WEBHOOK

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• HighAS-010

  🔑Insecure Secret Handling ×2

  input parameter "tokens" appears to accept a secret or credential

  FIGMA_DESIGN_TOKENS_TO_TAILWIND

  input parameter "plugin_payment_token" appears to accept a secret or credential

  FIGMA_GET_PAYMENTS

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

• MediumAS-002

  ⚠️Excessive Permissions ×37

  tool declares fs permission

  FIGMA_ADD_A_COMMENT_TO_A_FILEFIGMA_ADD_A_REACTION_TO_A_COMMENTFIGMA_CREATE_A_WEBHOOKFIGMA_CREATE_DEV_RESOURCESFIGMA_CREATE_MODIFY_DELETE_VARIABLESFIGMA_DELETE_A_COMMENTFIGMA_DELETE_A_REACTIONFIGMA_DELETE_A_WEBHOOKFIGMA_DELETE_DEV_RESOURCEFIGMA_DETECT_BACKGROUNDFIGMA_DISCOVER_FIGMA_RESOURCESFIGMA_DOWNLOAD_FIGMA_IMAGESFIGMA_EXTRACT_DESIGN_TOKENSFIGMA_EXTRACT_PROTOTYPE_INTERACTIONSFIGMA_GET_COMMENTS_IN_A_FILEFIGMA_GET_COMPONENTFIGMA_GET_DEV_RESOURCESFIGMA_GET_FILE_COMPONENTSFIGMA_GET_FILE_COMPONENT_SETSFIGMA_GET_FILE_JSONFIGMA_GET_FILES_IN_A_PROJECTFIGMA_GET_FILE_STYLESFIGMA_GET_IMAGE_FILLSFIGMA_GET_LIBRARY_ANALYTICS_COMPONENT_ACTION_DATAFIGMA_GET_LIBRARY_ANALYTICS_COMPONENT_USAGE_DATAFIGMA_GET_LIBRARY_ANALYTICS_STYLE_ACTION_DATAFIGMA_GET_LIBRARY_ANALYTICS_STYLE_USAGE_DATAFIGMA_GET_LIBRARY_ANALYTICS_VARIABLE_ACTION_DATAFIGMA_GET_LIBRARY_ANALYTICS_VARIABLE_USAGE_DATAFIGMA_GET_LOCAL_VARIABLESFIGMA_GET_PAYMENTSFIGMA_GET_PUBLISHED_VARIABLESFIGMA_GET_REACTIONS_FOR_A_COMMENTFIGMA_GET_VERSIONS_OF_A_FILEFIGMA_RENDER_IMAGES_OF_FILE_NODESFIGMA_UPDATE_A_WEBHOOKFIGMA_UPDATE_DEV_RESOURCES

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-002

  ⚠️Excessive Permissions ×7

  tool declares http permission

  FIGMA_CREATE_A_WEBHOOKFIGMA_DELETE_A_WEBHOOKFIGMA_GET_A_WEBHOOKFIGMA_GET_TEAM_WEBHOOKSFIGMA_GET_WEBHOOK_REQUESTSFIGMA_UPDATE_A_WEBHOOK

  input schema exposes 11 properties (threshold: 10)

  FIGMA_RENDER_IMAGES_OF_FILE_NODES

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×15

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  FIGMA_CREATE_A_WEBHOOKFIGMA_CREATE_DEV_RESOURCESFIGMA_CREATE_MODIFY_DELETE_VARIABLESFIGMA_DELETE_A_WEBHOOKFIGMA_DISCOVER_FIGMA_RESOURCESFIGMA_DOWNLOAD_FIGMA_IMAGESFIGMA_GET_A_WEBHOOKFIGMA_GET_FILES_IN_A_PROJECTFIGMA_GET_IMAGE_FILLSFIGMA_GET_LOCAL_VARIABLESFIGMA_GET_TEAM_WEBHOOKSFIGMA_GET_WEBHOOK_REQUESTSFIGMA_RENDER_IMAGES_OF_FILE_NODESFIGMA_UPDATE_A_WEBHOOKFIGMA_UPDATE_DEV_RESOURCES

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×49

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  FIGMA_ADD_A_COMMENT_TO_A_FILEFIGMA_ADD_A_REACTION_TO_A_COMMENTFIGMA_CREATE_A_WEBHOOKFIGMA_CREATE_DEV_RESOURCESFIGMA_CREATE_MODIFY_DELETE_VARIABLESFIGMA_DELETE_A_COMMENTFIGMA_DELETE_A_REACTIONFIGMA_DELETE_A_WEBHOOKFIGMA_DELETE_DEV_RESOURCEFIGMA_DESIGN_TOKENS_TO_TAILWINDFIGMA_DETECT_BACKGROUNDFIGMA_DISCOVER_FIGMA_RESOURCESFIGMA_DOWNLOAD_FIGMA_IMAGESFIGMA_EXTRACT_DESIGN_TOKENSFIGMA_EXTRACT_PROTOTYPE_INTERACTIONSFIGMA_GET_ACTIVITY_LOGSFIGMA_GET_A_WEBHOOKFIGMA_GET_COMMENTS_IN_A_FILEFIGMA_GET_COMPONENTFIGMA_GET_COMPONENT_SETFIGMA_GET_CURRENT_USERFIGMA_GET_DEV_RESOURCESFIGMA_GET_FILE_COMPONENTSFIGMA_GET_FILE_COMPONENT_SETSFIGMA_GET_FILE_JSONFIGMA_GET_FILES_IN_A_PROJECTFIGMA_GET_FILE_STYLESFIGMA_GET_IMAGE_FILLSFIGMA_GET_LIBRARY_ANALYTICS_COMPONENT_ACTION_DATAFIGMA_GET_LIBRARY_ANALYTICS_COMPONENT_USAGE_DATAFIGMA_GET_LIBRARY_ANALYTICS_STYLE_ACTION_DATAFIGMA_GET_LIBRARY_ANALYTICS_STYLE_USAGE_DATAFIGMA_GET_LIBRARY_ANALYTICS_VARIABLE_ACTION_DATAFIGMA_GET_LIBRARY_ANALYTICS_VARIABLE_USAGE_DATAFIGMA_GET_LOCAL_VARIABLESFIGMA_GET_PAYMENTSFIGMA_GET_PROJECTS_IN_A_TEAMFIGMA_GET_PUBLISHED_VARIABLESFIGMA_GET_REACTIONS_FOR_A_COMMENTFIGMA_GET_STYLEFIGMA_GET_TEAM_COMPONENTSFIGMA_GET_TEAM_COMPONENT_SETSFIGMA_GET_TEAM_STYLESFIGMA_GET_TEAM_WEBHOOKSFIGMA_GET_VERSIONS_OF_A_FILEFIGMA_GET_WEBHOOK_REQUESTSFIGMA_RENDER_IMAGES_OF_FILE_NODESFIGMA_UPDATE_A_WEBHOOKFIGMA_UPDATE_DEV_RESOURCES

  Fix: Review and remediate the identified issue.