How do AI agents use Figma through Open Connector?

Your user connects Figma once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Figma tools to your agent over MCP or a typed API, with credentials injected server-side on each call.

Is this a Figma MCP server?

Yes. Open Connector can serve Figma as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Figma actions with credentials injected server-side.

Where do Figma credentials live?

In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Figma integration

Figma integration for AI agents.

Figma integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Figma tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.

View source on GitHub All integrations →

What your agents can do

Real Figma actions, managed and audited.

Your user connects Figma once; your agent can then read and manage Figma files, comments, components, styles, variables, webhooks, and dev resources — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.

1
Your user grants Figma access once (OAuth) — the token lands in the vault.
2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
3
Every routed call appends a hash-chained audit record — nothing leaves your infra.

Tools & triggers

Supported Figma tools.

50 tools are generated from the published Figma catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.

Showing 50 tools. All published catalog entries are included in this page's server-rendered HTML.

Delete a comment: Deletes a specific comment. Only the person who made the comment is allowed to delete it.; Comments
Delete a reaction: Deletes a specific comment reaction. Only the person who made the reaction is allowed to delete it.; Comment Reactions
Delete dev resource: Delete a dev resource from a file; Dev Resources
Delete a webhook: Deletes the specified webhook. This operation cannot be reversed.; Webhooks
Get activity logs: Returns a list of activity log events; Activity Logs
Get daily AI credit usage: Returns per-user, per-day AI credit usage for the plan associated with the calling token. This endpoint requires a plan access token with the `org:ai_metering_usage_read` scope.; AI Usage
Get reactions for a comment: Gets a paginated list of reactions left on the comment.; Comment Reactions
Get comments in a file: Gets a list of comments left on the file.; Comments
Get component: Get metadata on a component by key.; Components
Get component set: Get metadata on a published component set by key.; Component Sets
Get dev resources: Get dev resources in a file; Dev Resources
Get developer logs: Returns a list of developer log entries for REST API and MCP server requests made within the organization. This endpoint requires a plan access token with the `org:developer_log_read` scope.; Developer Logs
Get file JSON: Returns the document identified by `file_key` as a JSON object. The file key can be parsed from any Figma file url: `https://www.figma.com/file/{file_key}/{title}`. The `document` property contains a node of type `DOCUMENT`. The `components` property contains a mapping from node IDs to component metadata. This is to help you determine which components each instance comes from.; Files
Get file component sets: Get a list of published component sets within a file library.; Component Sets
Get file components: Get a list of published components within a file library.; Components
Get file metadata: Get file metadata; Files
Get file JSON for specific nodes: Returns the nodes referenced to by `ids` as a JSON object. The nodes are retrieved from the Figma file referenced to by `file_key`. The node ID and file key can be parsed from any Figma node url: `https://www.figma.com/file/{file_key}/{title}?node-id={id}` The `name`, `lastModified`, `thumbnailUrl`, `editorType`, and `version` attributes are all metadata of the specified file. The `linkAccess` field describes the file link share permission level. There are 5 types of permissions a shared link can have: `"inherit"`, `"view"`, `"edit"`, `"org_view"`, and `"org_edit"`. `"inherit"` is the default permission applied to files created in a team project, and will inherit the project's permissions. `"org_view"` and `"org_edit"` restrict the link to org users. The `document` attribute contains a Node of type `DOCUMENT`. The `components` key contains a mapping from node IDs to component metadata. This is to help you determine which components each instance comes from. By default, no vector data is returned. To return vector data, pass the geometry=paths parameter to the endpoint. Each node can also inherit properties from applicable styles. The styles key contains a mapping from style IDs to style metadata. Important: the nodes map may contain values that are `null`. This may be due to the node id not existing within the specified file.; Files
Get file styles: Get a list of published styles within a file library.; Styles
Get versions of a file: This endpoint fetches the version history of a file, allowing you to see the progression of a file over time. You can then use this information to render a specific version of the file, via another endpoint.; Files
Get image fills: Returns download links for all images present in image fills in a document. Image fills are how Figma represents any user supplied images. When you drag an image into Figma, we create a rectangle with a single fill that represents the image, and the user is able to transform the rectangle (and properties on the fill) as they wish. This endpoint returns a mapping from image references to the URLs at which the images may be download. Image URLs will expire after no more than 14 days. Image references are located in the output of the GET files endpoint under the `imageRef` attribute in a `Paint`.; Files
Render images of file nodes: Renders images from a file. If no error occurs, `"images"` will be populated with a map from node IDs to URLs of the rendered images, and `"status"` will be omitted. The image assets will expire after 30 days. Images up to 32 megapixels can be exported. Any images that are larger will be scaled down. Important: the image map may contain values that are `null`. This indicates that rendering of that specific node has failed. This may be due to the node id not existing, or other reasons such has the node having no renderable components. It is guaranteed that any node that was requested for rendering will be represented in this map whether or not the render succeeded. To render multiple images from the same file, use the `ids` query parameter to specify multiple node ids. ``` GET /v1/images/:key?ids=1:2,1:3,1:4 ```; Files
Get library analytics component action data.: Returns a list of library analytics component actions data broken down by the requested dimension.; Library Analytics
Get library analytics component usage data.: Returns a list of library analytics component usage data broken down by the requested dimension.; Library Analytics
Get library analytics style action data.: Returns a list of library analytics style actions data broken down by the requested dimension.; Library Analytics
Get library analytics style usage data.: Returns a list of library analytics style usage data broken down by the requested dimension.; Library Analytics
Get library analytics variable action data.: Returns a list of library analytics variable actions data broken down by the requested dimension.; Library Analytics
Get library analytics variable usage data.: Returns a list of library analytics variable usage data broken down by the requested dimension.; Library Analytics
Get local variables: **This API is available to full members of Enterprise orgs.** The `GET /v1/files/:file_key/variables/local` endpoint lets you enumerate local variables created in the file and remote variables used in the file. Remote variables are referenced by their `subscribed_id`. As a part of the Variables related API additions, the `GET /v1/files/:file_key` endpoint now returns a `boundVariables` property, containing the `variableId` of the bound variable. The `GET /v1/files/:file_key/variables/local` endpoint can be used to get the full variable or variable collection object. Note that `GET /v1/files/:file_key/variables/published` does not return modes. Instead, you will need to use the `GET /v1/files/:file_key/variables/local` endpoint, in the same file, to examine the mode values.; Variables
Get current user: Returns the user information for the currently authenticated user.; Users
Get oEmbed data: Returns oEmbed data for a Figma file or published Make site URL, following the [oEmbed specification](https://oembed.com/).; oEmbed
Get payments: There are two methods to query for a user's payment information on a plugin, widget, or Community file. The first method, using plugin payment tokens, is typically used when making queries from a plugin's or widget's code. The second method, providing a user ID and resource ID, is typically used when making queries from anywhere else. Note that you can only query for resources that you own. In most cases, this means that you can only query resources that you originally created.; Payments
Get files in a project: Get a list of all the Files within the specified project.; Projects
Get project metadata: Get project metadata; Projects
Get published variables: **This API is available to full members of Enterprise orgs.** The `GET /v1/files/:file_key/variables/published` endpoint returns the variables that are published from the given file. The response for this endpoint contains some key differences compared to the `GET /v1/files/:file_key/variables/local` endpoint: - Each variable and variable collection contains a `subscribed_id`. - Modes are omitted for published variable collections Published variables have two ids: an id that is assigned in the file where it is created (`id`), and an id that is used by subscribing files (`subscribed_id`). The `id` and `key` are stable over the lifetime of the variable. The `subscribed_id` changes every time the variable is modified and published. The same is true for variable collections. The `updatedAt` fields are ISO 8601 timestamps that indicate the last time that a change to a variable was published. For variable collections, this timestamp will change any time a variable in the collection is changed.; Variables
Get style: Get metadata on a style by key.; Styles
Get team component sets: Get a paginated list of published component sets within a team library.; Component Sets
Get team components: Get a paginated list of published components within a team library.; Components
Get projects in a team: You can use this endpoint to get a list of all the Projects within the specified team. This will only return projects visible to the authenticated user or owner of the developer token. Note: it is not currently possible to programmatically obtain the team id of a user just from a token. To obtain a team id, navigate to a team page of a team you are a part of. The team id will be present in the URL after the word team and before your team name.; Projects
Get team styles: Get a paginated list of published styles within a team library.; Styles
[Deprecated] Get team webhooks: Returns all webhooks registered under the specified team.; Webhooks
Get a webhook: Get a webhook by ID.; Webhooks
Get webhook requests: Returns all webhook requests sent within the last week. Useful for debugging.; Webhooks
Get webhooks by context or plan: Returns a list of webhooks corresponding to the context or plan provided, if they exist. For plan, the webhooks for all contexts that you have access to will be returned, and theresponse is paginated; Webhooks
Add a comment to a file: Posts a new comment on the file.; Comments
Add a reaction to a comment: Posts a new comment reaction on a file comment.; Comment Reactions
Create dev resources: Bulk create dev resources across multiple files. Dev resources that are successfully created will show up in the links_created array in the response. If there are any dev resources that cannot be created, you may still get a 200 response. These resources will show up in the errors array. Some reasons a dev resource cannot be created include: - Resource points to a `file_key` that cannot be found. - The node already has the maximum of 10 dev resources. - Another dev resource for the node has the same url.; Dev Resources
Create/modify/delete variables: **This API is available to full members of Enterprise orgs with Editor seats.** The `POST /v1/files/:file_key/variables` endpoint lets you bulk create, update, and delete variables and variable collections. The request body supports the following 4 top-level arrays. Changes from these arrays will be applied in the below order, and within each array, by array order. - **variableCollections**: For creating, updating, and deleting variable collections - **variableModes**: For creating, updating, and deleting modes within variable collections - Each collection can have a maximum of 40 modes - Mode names cannot be longer than 40 characters - **variables**: For creating, updating, and deleting variables - Each collection can have a maximum of 5000 variables - Variable names must be unique within a collection and cannot contain certain special characters such as `.{}` - **variableModeValues**: For setting a variable value under a specific mode. - When setting aliases, a variable cannot be aliased to itself or form an alias cycle Temporary ids can be used to reference an object later in the same POST request body. They can be used at create time in the `id` property of variable collections, modes, variables, and in the `initialModeId` property of variable collections. They are scoped to a single request body, and must be unique within the body. The mapping of temporary ids to real ids is returned in the response. This endpoint has the following key behaviors: - The request body must be 4MB or less. - Must include an `action` property for collections, modes, and variables to tell the API whether to create, update, or delete the object. - When creating a collection, mode, or variable, you can include a temporary `id` that can be referenced in dependent objects in the same request. For example, you can create a new collection with the id `"my_new_collection"`. You can then set `variableCollectionId` to `"my_new_collection"` in new modes or variables. Temporary ids must be unique in the request body. - New collections always come with one mode. You can reference this mode by setting `initialModeId` to a temporary id in the request body. This is useful if you want to set values for variables in the mode in the `variableModeValues` array. - The `tempIdToRealId` array returns a mapping of the temporary ids in the request, to the real ids of the newly created objects. - When adding new modes or variables, default variable values will be applied, consistent with what happens in the UI. - Everything to be created, updated, and deleted in the request body is treated as one atomic operation. If there is any validation failure, you will get a 400 status code response, and no changes will be persisted. - You will not be able to update remote variables or variable collections. You can only update variables in the file where they were originally created.; Variables
Create a webhook: Create a new webhook which will call the specified endpoint when the event triggers. By default, this webhook will automatically send a PING event to the endpoint when it is created. If this behavior is not desired, you can create the webhook and set the status to PAUSED and reactivate it later.; Webhooks
Update dev resources: Bulk update dev resources across multiple files. Ids for dev resources that are successfully updated will show up in the `links_updated` array in the response. If there are any dev resources that cannot be updated, you may still get a 200 response. These resources will show up in the `errors` array.; Dev Resources
Update a webhook: Update a webhook by ID.; Webhooks

FAQ

Figma integration, answered

How do AI agents use Figma through Open Connector?: Your user connects Figma once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Figma tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
Is this a Figma MCP server?: Yes. Open Connector can serve Figma as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Figma actions with credentials injected server-side.
Where do Figma credentials live?: In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Give your agents Figma — keep the keys.

Open source, self-hostable, with Figma credentials that never leave your infrastructure. Run it from source today.

View source on GitHub How the MCP gateway works →