Borrowing it
Nothing to install: this file belongs to hadi21k/figma-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/hadi21k/figma-mcp/main/CLAUDE.mdgit clone --depth 1 https://github.com/hadi21k/figma-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/hadi21k/figma-mcp/claude-md)<a href="https://agentmods.dev/instructions/hadi21k/figma-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/hadi21k/figma-mcp/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/hadi21k/figma-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/hadi21k/figma-mcp/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.02896 | $0.02896 |
| Opus 5 | $0.01448 | $0.01448 |
| Sonnet 5 | $0.00579 | $0.00579 |
| Haiku 4.5 | $0.00290 | $0.00290 |
Grade A, and why
figma-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Build & Test Commands
npm run build # TypeScript compile (src/shared + src/mcp-server + src/websocket-server → dist/)
npm run build:all # Same as build (alias)
npm test # Run all tests (vitest)
npm run test:watch # Watch mode
npm run test:coverage # Coverage report (80% threshold on lines/funcs/branches/stmts)
npx vitest run tests/mcp-server/tools.test.ts # Single test file
npm run socket # Start WebSocket bridge (production)
npm run dev:socket # Start bridge with auto-reload (tsx watch)
Architecture
Three processes connected in a chain:
Claude ←stdio→ MCP Server ←WebSocket→ Bridge (127.0.0.1:9001) ←WebSocket→ Figma Plugin
MCP Server (src/mcp-server/index.ts): Uses McpServer from @modelcontextprotocol/sdk/server/mcp.js. Tool registration loops over TOOL_REGISTRY from tools/index.ts. WebSocket client logic lives in ws-client.ts. On tool call, sends a COMMAND over WebSocket and awaits a RESPONSE matched by requestId. Some tools are server-side only (intercepted before sendCommand) — see "Server-side Tools" below.
WebSocket Bridge (src/websocket-server/index.ts): Accepts exactly two client roles — MCP client (identified by ?role=mcp-client query param) and Figma plugin (identified by sending REGISTER as first message). Config in config.ts, validation in validation.ts. Routes COMMANDs from MCP→plugin and RESPONSEs from plugin→MCP.
Figma Plugin (src/figma-plugin/): Runs in Figma Desktop. code.js is the sandbox with figma.* API access. ui.html is a hidden iframe that holds the WebSocket connection. They communicate via figma.ui.postMessage/figma.ui.onmessage. Plugin is plain JavaScript (no build step needed).
Directory Structure
src/
├── shared/ Wire protocol & constants (single source of truth)
│ ├── index.ts Barrel re-export
│ ├── protocol.ts ErrorCode, message types, WireMessage
│ ├── constants.ts COMMAND_NAMES, REQUEST_ID_PATTERN, defaults, LOG_LEVELS
│ └── logger/ Structured logging & metrics module
│ ├── index.ts Barrel re-export
│ ├── logger.ts createLogger() factory (pino-based), LogConfig
│ ├── metrics.ts MetricsCollector class (counters, histograms)
│ └── redact.ts Sensitive field redaction paths
│
├── mcp-server/
│ ├── index.ts Server setup + startup
│ ├── ws-client.ts WebSocket client (connect, reconnect, sendCommand)
│ ├── request-tracker.ts Promise-based request/response tracking
│ └── tools/ Tool schemas split by category
│ ├── index.ts Barrel: merges partial registries → TOOL_REGISTRY
│ ├── shared-schemas.ts NodeId, RGBAColor, Fill, Typography, etc.
│ ├── read-tools.ts get_document_info, get_selection, get_node
│ ├── create-tools.ts create_frame, create_rectangle, create_ellipse, create_text, create_line, create_polygon
│ ├── modify-tools.ts set_auto_layout, update_text, update_node, add_shadow
│ ├── organize-tools.ts group_nodes, delete_node, create_component, clone_node, reorder_node
│ ├── viewport-tools.ts zoom_to_node
│ ├── style-tools.ts set_fill, set_stroke, set_corner_radius, set_effects
│ ├── layout-tools.ts set_node_layout_properties
│ ├── component-tools.ts create_component_instance, get_local_components, list_available_fonts
│ ├── style-system-tools.ts create_paint_style, create_text_style, get_local_styles, apply_style
│ ├── image-tools.ts set_image_fill, set_image_from_url, set_image_from_path
│ ├── export-tools.ts export_node
│ ├── typography-tools.ts set_text_decoration, set_text_case, set_text_list
│ ├── constraint-tools.ts set_constraints, set_layout_grids
│ ├── batch-tools.ts batch_create, batch_update
│ ├── vector-tools.ts create_vector, create_boolean_operation
│ ├── page-tools.ts create_page, create_section
│ ├── traversal-tools.ts find_nodes
│ ├── variable-tools.ts create_variable_collection, create_variable, bind_variable
│ ├── workflow-tools.ts flatten_node, ungroup_nodes, set_selection, set_current_page, create_effect_style, get_variables
│ ├── design-system-tools.ts combine_as_variants, detach_instance, swap_component, import_component_by_key
│ ├── manipulation-tools.ts set_rotation, set_blend_mode, lock_node
│ └── extra-shape-tools.ts create_star, create_svg_node, notify
│
├── websocket-server/
│ ├── index.ts FigmaBridge class + entry point
│ ├── config.ts BridgeConfig interface + loadConfig()
│ └── validation.ts ProtocolError + parseAndValidate()
│
└── figma-plugin/ Plain JS, no build step
├── code.js Plugin sandbox (figma.* API)
├── ui.html Hidden iframe (WebSocket connection)
└── manifest.json Figma plugin manifest
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 204 lines · 2,896 tokens per session scan A 04028f549406
figma-mcp CLAUDE.md is an instructions file published in the GitHub repository hadi21k/figma-mcp (2 stars, last pushed 1mo ago), licensed MIT. It adds 2,896 tokens to every session, about $0.0145 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.