figmanage
Provides tools for managing a Figma workspace, including seats, teams, permissions, billing, offboarding, cleanup, file/project management, comments, exports, and user groups.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@figmanagefind inactive paid seats and estimate potential savings"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
figmanage
Let agents manage your Figma workspace. Seats, teams, permissions, billing, offboarding, cleanup -- handled in conversation instead of clicking through admin panels.
Every Figma MCP is design-to-code. figmanage is the management layer: 102 tools that let agents operate on the workspace itself. Works with Claude Code, Cursor, OpenClaw, or as a standalone CLI.
examples
workspace management (admins)
"which paid seats haven't been active in 30 days? how much would we save?"
"offboard sarah@company.com -- show me everything she owns, then transfer it
to jake and remove her from the org"
"set up a new hire: invite alex@company.com to Design and Engineering as an editor"
"create a user group called Platform Design and add the three designers"
"run a quarterly design ops report for the org"everyday design work (everyone)
"clean up the Mobile App project -- find stale files and archive dead branches"
"what are the unresolved comments across the Platform project?"
"export all the icons from the Design System file as SVGs"
"move the Q4 files into the Archive project"
"share the Homepage mockup with alex@company.com and set link access to view-only"
"summarize the Brand Guidelines file -- pages, components, styles"Related MCP server: figma-pilot
install
# Claude Code
claude mcp add figmanage -- npx -y figmanage
# Cursor / OpenClaw / other MCP clients
{
"mcpServers": {
"figmanage": {
"command": "npx",
"args": ["-y", "figmanage"]
}
}
}On first run, figmanage walks you through setup in the conversation -- extracts your Chrome session cookie, asks you to create a PAT, stores credentials locally. No env vars, no JSON editing.
Also works as a CLI:
npm install -g figmanage
figmanage loginhow it works
Figma's public REST API covers design files but nothing on the management side -- no seats, no teams, no permissions, no billing. figmanage uses both APIs:
API | Auth | What it covers |
Internal | Session cookie | Seats, teams, permissions, billing, user groups, org admin, search |
Public | Personal Access Token | Files, comments, export, components, versions, webhooks, variables |
Both together unlock all 102 tools. Cookie-only or PAT-only works but limits available tools.
Admin auto-detection. At startup, figmanage checks whether you're an org admin. Admins see all 102 tools. Non-admins see 68 -- everything except org management, seat changes, billing, user groups, and offboarding. No configuration needed.
Toolset presets. Use FIGMA_TOOLSETS to expose only specific tool groups:
Preset | What's included |
| navigate, reading, comments, export |
| navigate, org, permissions, analytics, teams, libraries |
| navigate, reading, comments, export, components, versions |
| everything (default) |
CLI
Commands use a noun-verb pattern: figmanage <group> <action>.
figmanage org seat-optimization # find inactive paid seats
figmanage org offboard sarah@co.com # audit what a user owns
figmanage org offboard sarah@co.com --execute \
--transfer-to jake@co.com # soft offboard
figmanage org offboard sarah@co.com --execute \
--transfer-to jake@co.com --remove-from-org # hard offboard (permanent)
figmanage org onboard alex@co.com --teams 123,456 \
--role editor --seat full --confirm # set up a new hire
figmanage org quarterly-report # org-wide design ops snapshot
figmanage org members --search danny # find org members
figmanage permissions audit --scope team --id 789 # audit a team's permissions
figmanage branches cleanup 573408414 # find stale branchesAll commands output JSON when piped or when --json is passed. Run figmanage <group> --help for subcommands.
setup
Log into figma.com in Chrome, then:
figmanage login # extract cookie, create PAT, store credentials
figmanage whoami # verify auth
figmanage logout # clear credentialsCredentials stored at ~/.config/figmanage/ with 0o600 permissions.
Env vars (FIGMA_PAT, FIGMA_AUTH_COOKIE, etc.) override the config file. HTTP transport available via --mcp --http <port>.
tool reference
The tables below show MCP tool names (snake_case). CLI equivalents use kebab-case: list_recent_files becomes figmanage navigate list-recent-files.
navigate (10)
Tool | Auth | Description |
| either | Validate PAT and cookie authentication |
| cookie | List available Figma workspaces |
| cookie | Switch active workspace for this session |
| cookie | List teams in your org |
| either | List projects in a team |
| either | List files in a project |
| cookie | Recently viewed/edited files |
| cookie | Search files across the workspace |
| either | File metadata: name, project, team, link access |
| cookie | Favorited files (broken -- Figma BigInt bug) |
files (10)
Tool | Auth | Description |
| cookie | Create design, whiteboard, slides, or sites file |
| cookie | Rename a file |
| cookie | Move files between projects (batch) |
| cookie | Copy a file |
| cookie | Move files to trash (batch) |
| cookie | Restore files from trash (batch) |
| cookie | Add/remove from favorites |
| cookie | Set link sharing level |
| pat | Pages, components, styles, comment counts |
| either | Find old files, optionally trash (dry run default) |
projects (8)
Tool | Auth | Description |
| cookie | Create a project in a team |
| cookie | Rename a project |
| cookie | Move a project to another team |
| cookie | Move a project to trash |
| cookie | Restore a project from trash |
| cookie | Set or update project description |
| cookie | Batch-move files into a project |
| cookie | Create multiple projects from a plan |
permissions (8)
Tool | Auth | Description |
| cookie | List who has access with roles |
| cookie | Change a user's access level |
| cookie | Invite someone by email |
| cookie | Remove someone's access |
| cookie | List pending access requests |
| cookie | Accept an access request |
| cookie | Decline an access request |
| cookie | Team/project access audit with oversharing flags |
org (24, admin-only)
Tool | Auth | Description |
| cookie | Org admins with permission levels |
| cookie | All teams with member and project counts |
| cookie | Seat breakdown by type and activity |
| cookie | Team members with roles and activity |
| cookie | All org members with seats and activity |
| cookie | Per-seat pricing |
| cookie | Change a user's seat type |
| cookie | Invoice history and billing status |
| cookie | Open and upcoming invoices |
| cookie | Paid invoices / payment history |
| cookie | Domain config and SSO/SAML |
| cookie | AI credit usage (resolves plan from team) |
| cookie | Trigger CSV export of all members |
| cookie | Org audit log with email filtering and pagination |
| cookie | Create a user group |
| cookie | Delete user groups |
| cookie | Add members to a user group by email |
| cookie | Remove members from a user group |
| cookie | Permanently remove a member from the org |
| cookie | Org snapshot: teams, seats, billing |
| cookie | Inactive seat detection with cost analysis |
| cookie | Audit + execute user departure (soft or hard) |
| cookie | Batch invite to teams, share files, set seat |
| cookie | Seat utilization, billing, teams, library adoption |
teams (5, admin-only)
Tool | Auth | Description |
| cookie | Create a team |
| cookie | Rename a team |
| cookie | Delete a team |
| cookie | Add a member by email |
| cookie | Remove a member |
analytics (2, admin-only)
Tool | Auth | Description |
| cookie | Team-level library adoption metrics |
| cookie | Per-file component usage |
comments (9)
Tool | Auth | Description |
| pat | Comments with thread structure |
| pat | Post a comment |
| pat | Delete a comment |
| cookie | Resolve or unresolve a comment thread |
| cookie | Edit the text of an existing comment |
| pat | Emoji reactions on a comment |
| pat | Add an emoji reaction |
| pat | Remove an emoji reaction |
| pat | Unresolved comments across a project |
versions (2)
Tool | Auth | Description |
| pat | Version history |
| cookie | Create a named version checkpoint |
branches (4)
Tool | Auth | Description |
| either | List branches of a file |
| cookie | Create a branch |
| cookie | Archive a branch |
| either | Stale branch detection with optional archival |
reading (2)
Tool | Auth | Description |
| pat | Read file as a node tree with depth control |
| pat | Read specific nodes by ID |
export (2)
Tool | Auth | Description |
| pat | Export as PNG, SVG, PDF, or JPG |
| pat | URLs for all images used as fills |
components (7)
Tool | Auth | Description |
| pat | Components published from a file |
| pat | Styles in a file |
| pat | Published components across a team |
| pat | Published styles across a team |
| pat | Dev resources (links, annotations) on a file |
| pat | Attach a dev resource to a node |
| pat | Remove a dev resource |
webhooks (5)
Tool | Auth | Description |
| pat | List webhooks for a team |
| pat | Create a webhook subscription |
| pat | Update a webhook |
| pat | Delete a webhook |
| pat | Delivery history (last 7 days) |
variables (3, Enterprise)
Tool | Auth | Description |
| pat | Local variables and collections |
| pat | Published variables from a library |
| pat | Bulk create, update, or delete variables |
libraries (1)
Tool | Auth | Description |
| cookie | Design system libraries with sharing info |
security
All ID parameters validated against /^[\w.:-]+$/. Rate limit retries restricted to safe HTTP methods -- mutations never retried. Billing responses strip PII. Destructive operations default to dry-run mode. Org removal requires explicit double-confirmation. Config file stored with 0o600 permissions.
known limitations
list_favorites: Figma BigInt overflow bug on their server.
favorite_fileworks fine.Branch merging / version restore: Require Figma's multiplayer protocol, no REST endpoint.
Cookie expiry: ~30 days. Run
figmanage login --refreshto renew.Windows cookies: Best-effort DPAPI extraction. Falls back to PAT-only.
Variables: Enterprise-gated scopes.
User groups: Write-only (create, delete, add/remove members). No list endpoint -- Figma renders the page server-side.
development
git clone https://github.com/dannykeane/figmanage.git
cd figmanage
npm install
npm run build
npm testThree-layer architecture: operations hold all business logic, tools and CLI are thin wrappers.
src/
index.ts Entry: --setup, --mcp, or CLI mode
mcp.ts MCP server setup, admin detection, toolset presets
setup.ts Cross-platform Chrome cookie extraction
auth/ AuthConfig from env vars and config file
clients/ Axios clients for internal (cookie) and public (PAT) APIs
operations/ Shared business logic (19 modules)
tools/ MCP tool wrappers (thin, call operations)
cli/ CLI Commander wrappers (thin, call operations)
types/figma.ts Shared types including Toolset unionlicense
MIT
Available Tools
4 toolssetup_extract_cookiesA
Extract Figma session cookies from Chrome. On macOS this triggers a Keychain prompt. IMPORTANT: Before calling, confirm the user is logged into figma.com in Chrome and knows a system prompt may appear.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It discloses a non-obvious side effect: macOS triggers a Keychain prompt. It also warns that a system prompt may appear, which is valuable behavioral context beyond the tool's basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The first states the action; the second delivers the critical warning and prerequisite. Every word earns its place and the most important caveat is highlighted with 'IMPORTANT'.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema, the description is complete: it states what is extracted, where from, and the user-facing side effect and prerequisite. No additional context is needed for an agent to safely invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter schema to elaborate on. The baseline for 0 parameters is 4; the description instead clarifies preconditions, which is appropriate given there is nothing else to document.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Extract') with a clear resource ('Figma session cookies from Chrome'). It unambiguously distinguishes this tool from sibling setup tools like status, select_account, and save_pat.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear usage instructions: confirm the user is logged into figma.com in Chrome and warn about a system prompt. It does not explicitly mention alternatives, but the given precondition is directly actionable and sufficient for this setup context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
setup_save_patA
Validate and save a Figma Personal Access Token. Completes setup and activates all tools.
| Name | Required | Description | Default |
|---|---|---|---|
| pat | Yes | Figma Personal Access Token (starts with figd_) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It does disclose that the action is to validate and save the token and that completing setup activates tools, but it omits details such as error handling on invalid tokens, side effects like overwriting existing tokens, or any persistence behavior. This is basic transparency but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no fluff: the first states the primary action, the second conveys the intended effect. Every word earns its place, and it is front-loaded with the main verb.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema, no annotations), the description covers the essential behavior: what it does (validates and saves) and why it matters (completes setup and activates tools). It could be more explicit about side effects or idempotency, but for a low-complexity tool this is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (the single parameter is described as 'Figma Personal Access Token (starts with figd_)'), so the baseline is 3. The tool description adds context about validating and saving but does not add parameter-specific semantics beyond what the schema already provides. No gap to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (validate and save) and the resource (Figma Personal Access Token), and distinguishes it from siblings by noting it 'completes setup and activates all tools'. This is specific and unambiguous, leaving no doubt about the tool's core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied through the phrase 'Completes setup and activates all tools', suggesting it is the final step in the setup flow, but no explicit guidance is given on when to use it versus alternatives like setup_extract_cookies or setup_select_account. There is no mention of when not to use it or preconditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
setup_select_accountA
Select a Figma account and validate the session. Call after setup_extract_cookies.
| Name | Required | Description | Default |
|---|---|---|---|
| account_index | Yes | Account number from the list returned by setup_extract_cookies |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It hints at session validation but doesn't specify what 'validate' means, failure modes, or side effects. It's adequate for a simple setup step but lacks detail on what gets modified or checked.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the action and resource. It's concise and includes the key usage hint without extra fluff. Slightly more detail on validation could help, but it's appropriately sized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with full schema coverage and no output schema, the description covers core usage. However, it doesn't mention expected outcomes, error handling, or what happens if the session is invalid, leaving some gaps for a tool that validates something.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description for account_index. The description adds little beyond the schema, but since the schema is already explicit and the tool has only one parameter, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool selects a Figma account and validates the session, with a specific verb-resource pair. It distinguishes from siblings by naming setup_extract_cookies as a prerequisite, though it doesn't explicitly contrast with other setup tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The instruction to call after setup_extract_cookies provides clear sequencing context, implying this tool depends on prior cookie extraction. It doesn't mention when not to use it or alternatives, but the dependency guidance is useful for correct invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
setup_statusA
Check figmanage authentication status and get setup instructions. Always call this before using any other tool.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only status check but does not explicitly confirm that it makes no changes, nor does it describe what happens if authentication is missing or what the output structure is. While the name and context suggest safety, the description itself lacks explicit behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The first sentence states the purpose, and the second provides a clear usage directive. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given low complexity (0 params, no output schema) and clear sibling tools, the description adequately explains what the tool does and when to use it. However, it could have elaborated on the expected output or the nature of the status check, but for a simple tool this is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and the schema accurately reflects this (100% coverage). The description does not need to add parameter details. Per the baseline rule for 0 parameters, a score of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Check' and the resource 'figmanage authentication status', and adds the secondary purpose of 'get setup instructions'. This is specific and distinguishes it from siblings like setup_extract_cookies and setup_select_account, which handle different aspects of the setup process.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides a usage rule: 'Always call this before using any other tool.' This directly tells the agent when to use this tool and establishes a clear ordering prerequisite, going beyond implied guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v1.4.2- First observed
setup_extract_cookies - First observed
setup_save_pat - First observed
setup_select_account - First observed
setup_status
TDQS
Scored across 4 tools
Each tool covers a distinct setup step or authentication method: status, cookie extraction, account selection, and PAT storage. The descriptions and stated sequencing make it unlikely an agent would confuse them.
All tools share the setup_ prefix and mostly follow a setup_verb_noun pattern. setup_status is the one minor deviation, since status is a noun rather than a verb.
Four tools is a reasonable count for an onboarding and authentication workflow. It is slightly on the low side for a server named figmanage, but each tool fills a necessary setup role.
The setup flow itself is covered end to end, but the server exposes no actual Figma management, file, or project tools. After setup is complete, there is no way for an agent to perform real work, which is a significant gap for a server called figmanage.
Maintenance
Related MCP Connectors
The Figma MCP server brings Figma design context directly into your AI workflow.
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
MCP server for building and testing AI agents with multi-model experimentation and insights.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceAn MCP (Multi-Agent Conversation Protocol) Server that enables interaction with the Figma REST API, auto-generated using AG2's MCP builder.1-
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to create, modify, and manage Figma designs through natural language commands via a specialized MCP server and plugin bridge. It supports a wide range of operations including element creation, property modification, component management, and accessibility checks.4 npm105MIT
- AlicenseNot gradedqualityDmaintenanceMCP server that connects AI clients to Figma, enabling real-time reading, creation, and modification of designs using natural language.MIT
- FlicenseNot gradedqualityDmaintenanceAn MCP server that provides write access to Figma through the Plugin API, enabling AI agents to create, modify, and manage Figma designs programmatically.23-