Figma Dev Mode MCP Server — agentic threat model

Not certain from the listing — The server itself does not bundle a foundation model, but the downstream AI coding tools consuming its data are vulnerable to prompt injection or adversarial design structures that could manipulate code generation.

Exposes local Figma design data, variables, and tokens. The primary risk is unauthorized data exfiltration of proprietary design assets or sensitive design tokens if the consuming agent is compromised or malicious.

Integrates as an MCP tool. Risks include insecure tool integration where a downstream agent misinterprets the read-only design data or is tricked into sending the design context to unauthorized external endpoints.

Runs locally against the Figma desktop app. The primary infrastructure threat is local port exposure or unauthorized local processes querying the MCP server to extract active Figma selection data without user consent.

Not certain from the listing — There is no mention of built-in logging, auditing, or guardrails to monitor which local processes or agents are querying the Figma Dev Mode server or what design data is being extracted.

Relies on Figma's local session and API permissions. Lacks explicit fine-grained authorization controls within the MCP server itself to restrict which design files or frames the local agent is permitted to read.

Designed to feed context directly into AI coding agents. A compromised downstream agent in the ecosystem could abuse this trust relationship to silently harvest design tokens and proprietary UI layouts.