Figma-Context-MCP

GLips/Figma-Context-MCP

This MCP server connects AI coding agents to the Figma REST API to fetch simplified design metadata and download image assets. Its biggest risks are default-enabled telemetry that can send error messages containing file keys or local paths to PostHog, and an unauthenticated HTTP server mode when run without the --stdio flag.

What it can reach

Network

Makes HTTPS requests to api.figma.com and Figma asset CDNs, sends usage and error telemetry to us.i.posthog.com by default, and can listen on a local or network HTTP port (default 127.0.0.1:3333) when not in stdio mode.

Files

Reads environment variables from a .env file, writes downloaded .png, .svg, and .gif images inside the configured image directory (defaults to the current working directory), and writes debug logs to ./logs in development mode.

Secrets

Reads FIGMA_API_KEY and FIGMA_OAUTH_TOKEN from CLI flags, environment variables, .env files, or incoming HTTP request headers.

Findings

1. MediumTelemetry is enabled by default and transmits error messages and GeoIP data to PostHog

   src/telemetry/client.ts:115

   The server enables PostHog analytics by default with GeoIP resolution turned on (disableGeoip: false). Although configured API tokens are scrubbed, captured error messages (up to 2,000 characters) can include Figma file keys, node IDs, upstream HTTP error bodies, and rejected local filesystem paths supplied by the agent.

   Fix: Disable telemetry by default (opt-in rather than opt-out), or strip file keys, node IDs, response bodies, and local paths from telemetry error payloads before sending. Users can disable telemetry with --no-telemetry, FRAMELINK_TELEMETRY=off, or DO_NOT_TRACK=1.

2. MediumHTTP server mode lacks client authentication when using server-configured Figma credentials

   src/server.ts:145

   When started without --stdio, the server runs an HTTP listener (defaulting to 127.0.0.1:3333, or any interface passed via --host / FRAMELINK_HOST) and falls back to the server's global Figma credentials if a request does not supply its own token. Any local process on the machine—or any network client if bound to a non-loopback address—can call the MCP endpoints to read private Figma files or download images to disk using the owner's credentials.

   Fix: Require a bearer token or shared secret on incoming HTTP requests when global credentials are used, or refrain from falling back to global credentials in HTTP mode unless explicitly enabled.

3. LowPath containment check for image downloads is lexical and does not resolve symlinks

   src/utils/local-path.ts:69

   The resolveLocalPath function verifies that the destination directory for download_figma_images stays within the allowed image directory using lexical path resolution (path.resolve and path.relative). If a symlink inside the image directory points to an external directory on the filesystem, a prompt-injected agent could write .png, .svg, or .gif files outside the intended root through the symlink.

   Fix: Resolve the real path of the base directory and the deepest existing ancestor of the target path using fs.realpathSync before checking containment.