Skip to main content
Glama
dannykeane

figmanage

by dannykeane

figmanage

Let agents manage your Figma workspace. Seats, teams, permissions, billing, offboarding, cleanup -- handled in conversation instead of clicking through admin panels.

Every Figma MCP is design-to-code. figmanage is the management layer: 102 tools that let agents operate on the workspace itself. Works with Claude Code, Cursor, OpenClaw, or as a standalone CLI.

npm downloads tests license MCP

examples

workspace management (admins)

"which paid seats haven't been active in 30 days? how much would we save?"

"offboard sarah@company.com -- show me everything she owns, then transfer it
 to jake and remove her from the org"

"set up a new hire: invite alex@company.com to Design and Engineering as an editor"

"create a user group called Platform Design and add the three designers"

"run a quarterly design ops report for the org"

everyday design work (everyone)

"clean up the Mobile App project -- find stale files and archive dead branches"

"what are the unresolved comments across the Platform project?"

"export all the icons from the Design System file as SVGs"

"move the Q4 files into the Archive project"

"share the Homepage mockup with alex@company.com and set link access to view-only"

"summarize the Brand Guidelines file -- pages, components, styles"

Related MCP server: figma-pilot

install

# Claude Code
claude mcp add figmanage -- npx -y figmanage

# Cursor / OpenClaw / other MCP clients
{
  "mcpServers": {
    "figmanage": {
      "command": "npx",
      "args": ["-y", "figmanage"]
    }
  }
}

On first run, figmanage walks you through setup in the conversation -- extracts your Chrome session cookie, asks you to create a PAT, stores credentials locally. No env vars, no JSON editing.

Also works as a CLI:

npm install -g figmanage
figmanage login

how it works

Figma's public REST API covers design files but nothing on the management side -- no seats, no teams, no permissions, no billing. figmanage uses both APIs:

API

Auth

What it covers

Internal

Session cookie

Seats, teams, permissions, billing, user groups, org admin, search

Public

Personal Access Token

Files, comments, export, components, versions, webhooks, variables

Both together unlock all 102 tools. Cookie-only or PAT-only works but limits available tools.

Admin auto-detection. At startup, figmanage checks whether you're an org admin. Admins see all 102 tools. Non-admins see 68 -- everything except org management, seat changes, billing, user groups, and offboarding. No configuration needed.

Toolset presets. Use FIGMA_TOOLSETS to expose only specific tool groups:

Preset

What's included

starter

navigate, reading, comments, export

admin

navigate, org, permissions, analytics, teams, libraries

readonly

navigate, reading, comments, export, components, versions

full

everything (default)

CLI

Commands use a noun-verb pattern: figmanage <group> <action>.

figmanage org seat-optimization                    # find inactive paid seats
figmanage org offboard sarah@co.com                # audit what a user owns
figmanage org offboard sarah@co.com --execute \
  --transfer-to jake@co.com                        # soft offboard
figmanage org offboard sarah@co.com --execute \
  --transfer-to jake@co.com --remove-from-org      # hard offboard (permanent)
figmanage org onboard alex@co.com --teams 123,456 \
  --role editor --seat full --confirm              # set up a new hire
figmanage org quarterly-report                     # org-wide design ops snapshot
figmanage org members --search danny               # find org members
figmanage permissions audit --scope team --id 789  # audit a team's permissions
figmanage branches cleanup 573408414               # find stale branches

All commands output JSON when piped or when --json is passed. Run figmanage <group> --help for subcommands.

setup

Log into figma.com in Chrome, then:

figmanage login     # extract cookie, create PAT, store credentials
figmanage whoami    # verify auth
figmanage logout    # clear credentials

Credentials stored at ~/.config/figmanage/ with 0o600 permissions.

Env vars (FIGMA_PAT, FIGMA_AUTH_COOKIE, etc.) override the config file. HTTP transport available via --mcp --http <port>.

tool reference

The tables below show MCP tool names (snake_case). CLI equivalents use kebab-case: list_recent_files becomes figmanage navigate list-recent-files.

navigate (10)

Tool

Auth

Description

check_auth

either

Validate PAT and cookie authentication

list_orgs

cookie

List available Figma workspaces

switch_org

cookie

Switch active workspace for this session

list_teams

cookie

List teams in your org

list_projects

either

List projects in a team

list_files

either

List files in a project

list_recent_files

cookie

Recently viewed/edited files

search

cookie

Search files across the workspace

get_file_info

either

File metadata: name, project, team, link access

list_favorites

cookie

Favorited files (broken -- Figma BigInt bug)

files (10)

Tool

Auth

Description

create_file

cookie

Create design, whiteboard, slides, or sites file

rename_file

cookie

Rename a file

move_files

cookie

Move files between projects (batch)

duplicate_file

cookie

Copy a file

trash_files

cookie

Move files to trash (batch)

restore_files

cookie

Restore files from trash (batch)

favorite_file

cookie

Add/remove from favorites

set_link_access

cookie

Set link sharing level

file_summary

pat

Pages, components, styles, comment counts

cleanup_stale_files

either

Find old files, optionally trash (dry run default)

projects (8)

Tool

Auth

Description

create_project

cookie

Create a project in a team

rename_project

cookie

Rename a project

move_project

cookie

Move a project to another team

trash_project

cookie

Move a project to trash

restore_project

cookie

Restore a project from trash

set_project_description

cookie

Set or update project description

organize_project

cookie

Batch-move files into a project

setup_project_structure

cookie

Create multiple projects from a plan

permissions (8)

Tool

Auth

Description

get_permissions

cookie

List who has access with roles

set_permissions

cookie

Change a user's access level

share

cookie

Invite someone by email

revoke_access

cookie

Remove someone's access

list_role_requests

cookie

List pending access requests

approve_role_request

cookie

Accept an access request

deny_role_request

cookie

Decline an access request

permission_audit

cookie

Team/project access audit with oversharing flags

org (24, admin-only)

Tool

Auth

Description

list_admins

cookie

Org admins with permission levels

list_org_teams

cookie

All teams with member and project counts

seat_usage

cookie

Seat breakdown by type and activity

list_team_members

cookie

Team members with roles and activity

list_org_members

cookie

All org members with seats and activity

contract_rates

cookie

Per-seat pricing

change_seat

cookie

Change a user's seat type

billing_overview

cookie

Invoice history and billing status

list_invoices

cookie

Open and upcoming invoices

list_payments

cookie

Paid invoices / payment history

org_domains

cookie

Domain config and SSO/SAML

ai_credit_usage

cookie

AI credit usage (resolves plan from team)

export_members

cookie

Trigger CSV export of all members

activity_log

cookie

Org audit log with email filtering and pagination

create_user_group

cookie

Create a user group

delete_user_groups

cookie

Delete user groups

add_user_group_members

cookie

Add members to a user group by email

remove_user_group_members

cookie

Remove members from a user group

remove_org_member

cookie

Permanently remove a member from the org

workspace_overview

cookie

Org snapshot: teams, seats, billing

seat_optimization

cookie

Inactive seat detection with cost analysis

offboard_user

cookie

Audit + execute user departure (soft or hard)

onboard_user

cookie

Batch invite to teams, share files, set seat

quarterly_design_ops_report

cookie

Seat utilization, billing, teams, library adoption

teams (5, admin-only)

Tool

Auth

Description

create_team

cookie

Create a team

rename_team

cookie

Rename a team

delete_team

cookie

Delete a team

add_team_member

cookie

Add a member by email

remove_team_member

cookie

Remove a member

analytics (2, admin-only)

Tool

Auth

Description

library_usage

cookie

Team-level library adoption metrics

component_usage

cookie

Per-file component usage

comments (9)

Tool

Auth

Description

list_comments

pat

Comments with thread structure

post_comment

pat

Post a comment

delete_comment

pat

Delete a comment

resolve_comment

cookie

Resolve or unresolve a comment thread

edit_comment

cookie

Edit the text of an existing comment

list_comment_reactions

pat

Emoji reactions on a comment

add_comment_reaction

pat

Add an emoji reaction

remove_comment_reaction

pat

Remove an emoji reaction

open_comments

pat

Unresolved comments across a project

versions (2)

Tool

Auth

Description

list_versions

pat

Version history

create_version

cookie

Create a named version checkpoint

branches (4)

Tool

Auth

Description

list_branches

either

List branches of a file

create_branch

cookie

Create a branch

delete_branch

cookie

Archive a branch

branch_cleanup

either

Stale branch detection with optional archival

reading (2)

Tool

Auth

Description

get_file

pat

Read file as a node tree with depth control

get_nodes

pat

Read specific nodes by ID

export (2)

Tool

Auth

Description

export_nodes

pat

Export as PNG, SVG, PDF, or JPG

get_image_fills

pat

URLs for all images used as fills

components (7)

Tool

Auth

Description

list_file_components

pat

Components published from a file

list_file_styles

pat

Styles in a file

list_team_components

pat

Published components across a team

list_team_styles

pat

Published styles across a team

list_dev_resources

pat

Dev resources (links, annotations) on a file

create_dev_resource

pat

Attach a dev resource to a node

delete_dev_resource

pat

Remove a dev resource

webhooks (5)

Tool

Auth

Description

list_webhooks

pat

List webhooks for a team

create_webhook

pat

Create a webhook subscription

update_webhook

pat

Update a webhook

delete_webhook

pat

Delete a webhook

webhook_requests

pat

Delivery history (last 7 days)

variables (3, Enterprise)

Tool

Auth

Description

list_local_variables

pat

Local variables and collections

list_published_variables

pat

Published variables from a library

update_variables

pat

Bulk create, update, or delete variables

libraries (1)

Tool

Auth

Description

list_org_libraries

cookie

Design system libraries with sharing info

security

All ID parameters validated against /^[\w.:-]+$/. Rate limit retries restricted to safe HTTP methods -- mutations never retried. Billing responses strip PII. Destructive operations default to dry-run mode. Org removal requires explicit double-confirmation. Config file stored with 0o600 permissions.

known limitations

  • list_favorites: Figma BigInt overflow bug on their server. favorite_file works fine.

  • Branch merging / version restore: Require Figma's multiplayer protocol, no REST endpoint.

  • Cookie expiry: ~30 days. Run figmanage login --refresh to renew.

  • Windows cookies: Best-effort DPAPI extraction. Falls back to PAT-only.

  • Variables: Enterprise-gated scopes.

  • User groups: Write-only (create, delete, add/remove members). No list endpoint -- Figma renders the page server-side.

development

git clone https://github.com/dannykeane/figmanage.git
cd figmanage
npm install
npm run build
npm test

Three-layer architecture: operations hold all business logic, tools and CLI are thin wrappers.

src/
  index.ts            Entry: --setup, --mcp, or CLI mode
  mcp.ts              MCP server setup, admin detection, toolset presets
  setup.ts            Cross-platform Chrome cookie extraction
  auth/               AuthConfig from env vars and config file
  clients/            Axios clients for internal (cookie) and public (PAT) APIs
  operations/         Shared business logic (19 modules)
  tools/              MCP tool wrappers (thin, call operations)
  cli/                CLI Commander wrappers (thin, call operations)
  types/figma.ts      Shared types including Toolset union

license

MIT

Available Tools

4 tools
setup_extract_cookiesA

Extract Figma session cookies from Chrome. On macOS this triggers a Keychain prompt. IMPORTANT: Before calling, confirm the user is logged into figma.com in Chrome and knows a system prompt may appear.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses a non-obvious side effect: macOS triggers a Keychain prompt. It also warns that a system prompt may appear, which is valuable behavioral context beyond the tool's basic function.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The first states the action; the second delivers the critical warning and prerequisite. Every word earns its place and the most important caveat is highlighted with 'IMPORTANT'.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no output schema, the description is complete: it states what is extracted, where from, and the user-facing side effect and prerequisite. No additional context is needed for an agent to safely invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is no parameter schema to elaborate on. The baseline for 0 parameters is 4; the description instead clarifies preconditions, which is appropriate given there is nothing else to document.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Extract') with a clear resource ('Figma session cookies from Chrome'). It unambiguously distinguishes this tool from sibling setup tools like status, select_account, and save_pat.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear usage instructions: confirm the user is logged into figma.com in Chrome and warn about a system prompt. It does not explicitly mention alternatives, but the given precondition is directly actionable and sufficient for this setup context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

setup_save_patA

Validate and save a Figma Personal Access Token. Completes setup and activates all tools.

ParametersJSON Schema
NameRequiredDescriptionDefault
patYesFigma Personal Access Token (starts with figd_)

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It does disclose that the action is to validate and save the token and that completing setup activates tools, but it omits details such as error handling on invalid tokens, side effects like overwriting existing tokens, or any persistence behavior. This is basic transparency but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no fluff: the first states the primary action, the second conveys the intended effect. Every word earns its place, and it is front-loaded with the main verb.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema, no annotations), the description covers the essential behavior: what it does (validates and saves) and why it matters (completes setup and activates tools). It could be more explicit about side effects or idempotency, but for a low-complexity tool this is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (the single parameter is described as 'Figma Personal Access Token (starts with figd_)'), so the baseline is 3. The tool description adds context about validating and saving but does not add parameter-specific semantics beyond what the schema already provides. No gap to compensate for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (validate and save) and the resource (Figma Personal Access Token), and distinguishes it from siblings by noting it 'completes setup and activates all tools'. This is specific and unambiguous, leaving no doubt about the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied through the phrase 'Completes setup and activates all tools', suggesting it is the final step in the setup flow, but no explicit guidance is given on when to use it versus alternatives like setup_extract_cookies or setup_select_account. There is no mention of when not to use it or preconditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

setup_select_accountA

Select a Figma account and validate the session. Call after setup_extract_cookies.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_indexYesAccount number from the list returned by setup_extract_cookies

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It hints at session validation but doesn't specify what 'validate' means, failure modes, or side effects. It's adequate for a simple setup step but lacks detail on what gets modified or checked.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, front-loaded with the action and resource. It's concise and includes the key usage hint without extra fluff. Slightly more detail on validation could help, but it's appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with full schema coverage and no output schema, the description covers core usage. However, it doesn't mention expected outcomes, error handling, or what happens if the session is invalid, leaving some gaps for a tool that validates something.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear description for account_index. The description adds little beyond the schema, but since the schema is already explicit and the tool has only one parameter, a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool selects a Figma account and validates the session, with a specific verb-resource pair. It distinguishes from siblings by naming setup_extract_cookies as a prerequisite, though it doesn't explicitly contrast with other setup tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The instruction to call after setup_extract_cookies provides clear sequencing context, implying this tool depends on prior cookie extraction. It doesn't mention when not to use it or alternatives, but the dependency guidance is useful for correct invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

setup_statusA

Check figmanage authentication status and get setup instructions. Always call this before using any other tool.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read-only status check but does not explicitly confirm that it makes no changes, nor does it describe what happens if authentication is missing or what the output structure is. While the name and context suggest safety, the description itself lacks explicit behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler. The first sentence states the purpose, and the second provides a clear usage directive. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given low complexity (0 params, no output schema) and clear sibling tools, the description adequately explains what the tool does and when to use it. However, it could have elaborated on the expected output or the nature of the status check, but for a simple tool this is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, and the schema accurately reflects this (100% coverage). The description does not need to add parameter details. Per the baseline rule for 0 parameters, a score of 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Check' and the resource 'figmanage authentication status', and adds the secondary purpose of 'get setup instructions'. This is specific and distinguishes it from siblings like setup_extract_cookies and setup_select_account, which handle different aspects of the setup process.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides a usage rule: 'Always call this before using any other tool.' This directly tells the agent when to use this tool and establishes a clear ordering prerequisite, going beyond implied guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv1.4.2
    • First observedsetup_extract_cookies
    • First observedsetup_save_pat
    • First observedsetup_select_account
    • First observedsetup_status

TDQS

A3.9/5.0

Scored across 4 tools

Disambiguation5/5

Each tool covers a distinct setup step or authentication method: status, cookie extraction, account selection, and PAT storage. The descriptions and stated sequencing make it unlikely an agent would confuse them.

Naming Consistency4/5

All tools share the setup_ prefix and mostly follow a setup_verb_noun pattern. setup_status is the one minor deviation, since status is a noun rather than a verb.

Tool Count4/5

Four tools is a reasonable count for an onboarding and authentication workflow. It is slightly on the low side for a server named figmanage, but each tool fills a necessary setup role.

Completeness2/5

The setup flow itself is covered end to end, but the server exposes no actual Figma management, file, or project tools. After setup is complete, there is no way for an agent to perform real work, which is a significant gap for a server called figmanage.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to create, modify, and manage Figma designs through natural language commands via a specialized MCP server and plugin bridge. It supports a wide range of operations including element creation, property modification, component management, and accessibility checks.
    4 npm
    105
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    MCP server that connects AI clients to Figma, enabling real-time reading, creation, and modification of designs using natural language.
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that provides write access to Figma through the Plugin API, enabling AI agents to create, modify, and manage Figma designs programmatically.
    23
    -