figma-developer-mcp

npm / sealed 2026-06-16 / No. 0fed4f49

Does figma-developer-mcp MCP work in Claude Code and Cursor? Throne executed figma-developer-mcp mcp in a single-use Firecracker microVM and replayed both recorded client behaviours. Compatibility verdict: inconclusive. Is figma-developer-mcp mcp safe? Static security scan: 1 finding(s) to review under security ruleset v1. The full per-step results, security findings, scan date, and evidence hash are below.

re-scan this server gate it in your CI

> throne registry figma-developer-mcp sealed

This target couldn't be started as an MCP servernever completed an MCP handshake, this target may not be an MCP server, or may need a manual build / non-Node runtime

receiptsealed evidence

scan id: 0fed4f49d5d14ec2b12e8291734c2bb8
target: figma-developer-mcp
sealed at: 2026-06-16 21:11:47Z
evidence hash: sha256:b22734b985da1d8239a0bde88305196f4d4bcc53ba8178ef2bfed7c2b88d337b

01connectFAIL1.5s

RuntimeError: connect failed: McpError: Connection closed

02discoverSKIPPED0ms

not run, connect failed

03validate_schemasSKIPPED0ms

not run, connect failed

04smoke_test_toolsSKIPPED0ms

not run, connect failed

05error_handlingSKIPPED0ms

not run, connect failed

06streamingSKIPPED0ms

not run, connect failed

07resource_lifecycleSKIPPED0ms

not run, connect failed

08concurrent_callsSKIPPED0ms

not run, connect failed

09reconnectSKIPPED0ms

not run, connect failed

01connectFAIL1.6s

RuntimeError: connect failed: McpError: Connection closed

02discoverSKIPPED0ms

not run, connect failed

03validate_schemasSKIPPED0ms

not run, connect failed

04smoke_test_toolsSKIPPED0ms

not run, connect failed

05error_handlingSKIPPED0ms

not run, connect failed

06streamingSKIPPED0ms

not run, connect failed

07resource_lifecycleSKIPPED0ms

not run, connect failed

08concurrent_callsSKIPPED0ms

not run, connect failed

09reconnectSKIPPED0ms

not run, connect failed

chatgpt desktop calibratingemulation profile pending real-traffic captureCOMING SOON

SECURITY: REVIEW / 1 finding(s) / review recommended

LOWTHR-NET-05 / Hardcoded outbound endpoints

5 non-local endpoint host(s) referenced in code, verify each is expected for this server's purpose: api.figma.com (package/dist/chunk-BHCBIRJY.js:14), developers.figma.com (package/dist/chunk-BHCBIRJY.js:14), proxy (package/dist/bin.js:2), us.i.posthog.com (package/dist/chunk-BHCBIRJY.js:1), www.framelink.ai (package/dist/chunk-BHCBIRJY.js:11)

package/dist/bin.js:2

VERDICT: INCONCLUSIVESANDBOXED RUN, submitted server executed in a disposable microVM, compatibility not assessable: the server process ran but never completed an MCP handshake, this target may not be an MCP server, or may need a manual build / non-Node runtime / security: review, 1 finding(s), 0 highsealed by THRONE / No. 0fed4f49 / 2026-06-16

scopeattestation tuple

target: figma-developer-mcp npm
engine: sandboxed
claude code: calibration: partial recorded=9,spec=0,assumed=9
cursor: calibration: partial recorded=11,spec=0,assumed=7
chatgpt desktop: calibration: unavailable recorded=0,spec=2,assumed=16
steps exercised: 18 of 18
test suite: v1.0.0
security ruleset: v1.0.0
sealed at: 2026-06-16 21:11:47Z
evidence hash: sha256:b22734b985da1d8239a0bde88305196f4d4bcc53ba8178ef2bfed7c2b88d337b
valid until: 2026-09-14

executed in a disposable microVM, created for this scan and destroyed after it. nothing outlives a run.

maintainer of this server? challenge this record: hello@usethrone.dev. tell us what we got wrong and we re-run it in the open.

this page renders the stored record of a real run. nothing on it is asserted without the execution that proved it.