io.github.rudraptpsingh/figbridge

Bridge Figma to local AI workflows for code, tokens, and handoff assets.

Source

Official Registry

Updated

2026-06-10

// securityCaution

Requires keys· FIGBRIDGE_PORT
Runs locally
Official / curated
Open source
Community-trusted

Summary

The material presents this as a local Figma MCP bridge with no declared remote endpoints, and it benefits from official registry listing, open-source availability, and recent maintenance, suggesting relatively low overall risk. Caution is still warranted because it can execute locally as an MCP tool and the documentation is sparse with no README, limiting audit visibility.

CredentialsLow risk

It only declares FIGBRIDGE_PORT, which appears to be a local port configuration rather than a sensitive API key or access token; based on the provided material, there is no clear credential leakage or abuse risk.

Network egressLow risk

The material lists no remote endpoints and describes it as a 'local bridge'; there is no evidence that user data is sent to external services or unknown hosts.

Code executionCaution

The system checks explicitly mark it as executes-code, meaning it runs code/processes locally; this is a normal MCP capability and warrants caution with least-privilege execution, but the material does not show requests for system privileges beyond its stated purpose.

Data accessCaution

As a Figma bridge, the description mentions HTML, CSS, Tailwind, tokens, and agent handoff bundles, implying it may handle design-related local data; however, the material does not specify exact read/write scope, and no clear overbroad access is evident.

Supply chainCaution

Positive factors include official registry origin, an auditable open-source repository, and updates within the last year; however, the missing README, undeclared license, and very low community adoption (0 stars) leave supply-chain transparency and maturity only moderate, so reviewing source and dependencies before installation is advisable.

Recommendations

Review the GitHub source, package manifest, and lockfiles before installation to confirm it only listens on a local port and has no hidden outbound connections.
Run it with least privilege and restrict the local files/project directories it can access.
If network activity appears during use, log it with a firewall or proxy and verify the destinations.
Prefer testing it in an isolated development environment before using it on production design assets.

Audited by: gpt-5.4 · 2026-06-17

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "io.github.rudraptpsingh/figbridge" MCP server from askskill:
Run: claude mcp add 'io-github-rudraptpsingh-figbridge' -- npx -y figbridge-mcp