Figma restricts MCP access to whitelisted clients, excluding Pi

147 pointsposted 5 hours ago
by thdr
(twitter.com)

86 Comments

miguel-muniz

4 hours ago

For context: Figma has two MCPs. The local "dev" MCP that works through the Desktop app, and the remote MCP that requires a connection to Figma. Companies need to be whitelisted to use the remote MCP, which is the only one that allows agents edit access to Figma documents.

I only found out about Figma's limitation when I was trying to add the remote MCP server to GitHub Copilot Desktop and kept running into errors. Turns out they whitelisted GitHub Copilot CLI but not the Desktop app and had put a pause on enabling any more vendors. Eventually someone (not sure which side) got it working.

Kind of strange to limit edit access only to the Remote MCP when their competitors like Pen[1] and Paper[2] allow any local agent to edit.

[1] https://www.pen.dev/

[2] https://paper.design/

miguel-muniz

4 hours ago

To speak more broadly, Figma is in a really tough spot right now. I see more and more designers in my circle saying they are skipping design tools entirely to prototype in code or ship directly in their product's code base. Honestly I find myself doing the same.

Figma's main value used to be in providing designers a canvas to iterate and explore ideas since the majority of designers did not code, but AI has completely changed that.

I fear Figma's reluctance to integrate with all the popular AI tools might actually accelerate their decline. AI provides so much value, that I would rather base my software purchasing decisions around what is compatible with my AI of choice rather than pick an AI that is compatible with Figma.

sergiotapia

30 minutes ago

I've had good success in my org with Paper. Non-technical people can just jam and explore ideas without worrying about Figma or whatever tools UI/UX tools. Vibes all the way down.

oh_no

3 hours ago

yeah it's 100% the wrong move for them to make, I think there is probably a lot of value in AI driving Figma, and if I can't do that, Figma will fall out of the ecosystem.

miguel-muniz

3 hours ago

They have their own agent built into Figma, which of course uses credits which you must pay Figma for.

dataviz1000

2 hours ago

Everyone is in a really tough spot.

The AI companies focused most their effort on writing software and continue to do so. Software, SaaS, and software engineers are the first to be disrupted.

> but AI has completely changed that.

Exactly. However, it is because AI is focused on solving writing software first which is the step to solving everything else.

varispeed

3 hours ago

The poor value proposition of Figma is that nobody even bothers to vibe code a competitor. It's useless.

timcobb

40 minutes ago

You just described Claude Design?

locallost

3 hours ago

I think it's really interesting how these areas are merging, and I'm not sure who goes. Designers or "coders". Probably both depending on the context. The expectations though from every field seems to be that they'll be the last man standing. My best guess is, management has the worst cards.

I am 100% in agreement that companies that try to shut down access to agents will be replaced. It's just the future for a lot of work and workflows. In a way it's an opportunity for someone.

TeMPOraL

3 hours ago

> I think it's really interesting how these areas are merging, and I'm not sure who goes. Designers or "coders".

Neither of them, not yet. What will go away is the products currently used by these groups.

It's happening in software development, too. In the past 3 months, I used an IDE for maybe few hours total. 99% of my technical work is now easier and better done through agentic chat interface.

miguel-muniz

2 hours ago

I struggled with this myself, the reality is that AI can automate the work of everyone in the traditional product team trio (pm, design, dev).

The way I have made peace with it in my mind is at the end of the day, I am the expert in UI/UX. There are many product teams I've joined that have operated without a designer and you can tell (bless their souls). Component libraries, templates, articles, video courses, and etc. have all existed throughout this time so it's not like they've been operating completely blind to design and UX. I don't think AI would be different. Sure it may raise the floor a little, but in the end someone needs to evaluate the output and hold responsibility for the UI/UX.

It was an uncomfortable idea to come to terms with though, I like many other designers spent a decade getting good at Figma. Figma and design almost felt intertwined for a moment, but designers have a long history of having their craft disrupted by new technology. Decades ago designers were cutting and pasting paper, then moved to digital publishing; and in product design we've gone through software such as Photoshop, Fireworks, Sketch, and Figma, just to name a few. Design has survived all this and will continue to survive in the future.

I think the same applies to the other disciplines. Sure I could have AI spin up a backend, but I don't really have the expertise to understand whether what it is doing is good or full of security vulnerabilities.

I don't know in the future if we will create a new path for product builders, individuals who are knowledgeable in all aspects of product management, software engineering, and product design. I also don't know if teams will have as much need for individuals with the efficiency gains from AI.

TeMPOraL

3 hours ago

They're realizing what most product companies aren't yet (at least not openly): AI subsumes products.

Most companies seem to still be in denial about it, and hope that if they add some more AI into their product, or do it just right, it will make sense. But it won't. AI is destined to sit on the outside, and products to be reduced into a bag of tools for AI to call.

Taking away write access from AI tools outside their contractual control is an expected knee-jerk reaction, but it'll probably just hasten the product's slide into irrelevancy by ceding ground to competition (that will ultimately share the same fate, too, but is still in denial about it).

miguel-muniz

2 hours ago

I imagine every CEO breaks out in night sweats thinking of the Chegg stock chart. I don't envy them, these are hard waters to navigate and many of us are still blind as to where we are going. Seems like the new moat is just the data each company holds, I guess they're holding onto it for dear life

amoorthy

2 hours ago

This is the crux of the issue. I think for infrequent use cases (question/answer) an MCP with tool-calls to some product makes sense.

But for frequent use cases - something you do daily or weekly perhaps - then a native interface still has merit. i.e. I don't think AI subsumes the product in this case.

TeMPOraL

2 hours ago

But it does. Even for daily use, you probably need only a fraction of the interface - but even if you need it all, the tool is usually only part of your work.

You need other programs to do other parts of the same work - design in Figma, code in VS Code, collaboration in Google/Microsoft office suite, shitposting (er, well-being and psychological hygiene at work) in Slack, etc. AI sitting on the outside is able to operate all of them, combining their capabilities for you, to do what you want and how you want it. AI sitting inside a single product is limited only to the surface of that product, and is limited to capabilities the vendor wants.

amoorthy

2 hours ago

That's a very good point. I wonder if AI within a product sometimes is substantially better than AI outside the product for a particular task. Because AI in the product is configured thoughtfully to do a great job at that task. So if quality is a requirement then AI in the product may still have merit?

TeMPOraL

an hour ago

That variant of "AI in the product" can still be viewed as a tool call for the general AI on the outside, and my point still stands. That AI / tool can be very much a commercial offering you pay for, but that's much less business than product vendors are used to today.

While Figma could probably survive that way for some time, most software products can't, because they don't have anything special in them.

--

Fundamentally, a product is our industry's "unit of billable good/service". It's composed of a number of "operations" that are more or less closely related to each other, that someone grouped together into a larger whole with a User Interface, and slapped a brand on, so it can be sold.

From user's POV, that UI is something standing in between the user and the problem they want solved. Sometimes it's what they need, other times - not quite. From vendor's POV, UI is the mechanism of control over what users can and cannot do, and a prime sales/marketing channel, because the audience is captive.

Now, the AI sitting on the outside, operating on the functionality under UI, and composing it with functionality of other applications, gives users a superior meta-application, solving their own problem (and AI is not restricted to chat UI - there just hasn't been that much work done yet on ad-hoc, problem/user-specific UIs).

For users, that's a win - the AI may not be perfect mode of interaction (can get close with custom UIs), but it does not obstruct them. For vendors, that's a disaster, because it destroys coherence of a product, reducing it to a bag of tool calls, with zero branding and no control/upsell surface.

That's what I mean by AI subsuming products, and it being a mortal threat to most of the software companies today.

amoorthy

44 minutes ago

Makes sense what you say. Sounds like you've thought a lot about this. If you write a post somewhere I bet others on HN and beyond would fancy a discussion as it's very much a topical issue now.

tomjen3

an hour ago

I don't see that. I would want a special tool for something that does not display well as text, like a 3D scene.

I imagine I also want a specialized tool for, say, reviewing 3D models before printing them. And they would definitely like addresses to be shown in a navigable map.

But that type of interface already exist (and has been #killedbygoogle) - its Google Wave.

TeMPOraL

5 minutes ago

Today, LLMs can vibe you that interface on the fly.

"I need an interface like ${this specific product} for my 3D scenes, but I also need to review each 3D model, which I normally do in ${that specialized tool}, and I'd love to have the two in one UI, well integrated, so I can ${description of your process}. Make it so."

Put that in Antigravity/Claude Code/Codex/whatever harness backed by a decent model, and good chances are, you'll have exactly what you wanted in less than half an hour.

cellularmitosis

4 hours ago

I found figma’s remote MCP to be a poor fit for iOS development (it sets tokens on fire and gives Claude the details as React+Tailwind) and got much better results by having Claude build a set of “lens” tools around their REST API (“give me all of the fonts”, “give me the layout dimensions”, “give me the colors”, etc).

The key to making it token efficient was allowing Claude to invent its own plaintext markup format for the lens output.

JimDabell

4 hours ago

OpenCode seems to have been given the run-around as well:

> on the figma mcp, we've had an email thread going on for 8 months trying to get it setup in opencode

> they seem very concerned with the labs competing with them

> finally got unblocked after i sent this email and it'll be rolled out in a week or so

The email:

> looking through the legal stuff the amount of things in there seems pretty crazy

> this is just an mcp server, there are thousands of them. we're not going to treat figma like its special

> we've been talking about this for this entire year, i don't think this makes much sense and i don't want my team burning more time on this

> once again, for a simple mcp server

— https://www.threads.com/@thdxr/post/Dd7LN-ylLQW

ig0r0

4 hours ago

I like how Pi released an updated with a new oauth client name field for mcp where I just wrote Codex and Figma mcp works now.

Tade0

40 minutes ago

I was wondering what kind of client name they were talking about.

It's really silly that this was the only means of blocking access. I expected them to have, I don't know, some sort of cryptographic signature or something.

An additional JWT with a long expiry time would even work here, anything.

TeMPOraL

11 minutes ago

Ironically, it's exactly the kind of "security" I imagine current Claude models would work around as a matter of course, with barely a note left for the user to know the agent hit a speed bump when operating the MCP.

SkyPuncher

4 hours ago

I do security review for my company. I suspect this is a means of containing OAuth redirect vulnerabilities. We basically needed to do the same thing with our MCP server.

The security problem is two fold: (1) companies want control over where their data goes. Figma allowing any MCP creates problems (2) open redirects can create phishing issues. If your using Pi, you’re probably thinking of this. Most users aren’t.

For us, we decided to do an allowlist pattern because it was a reasonable tradeoff. The solution is allowing per-tenant client configuration, but that comes with its own set of issues (dev time, support, maintenance, etc). When nearly all of the money is flowing through a handful of well-known MCPs there’s little reason to out effort into supporting every MCP.

TeMPOraL

7 minutes ago

> companies want control over where their data goes

That's the age-old problem that's the root of this debacle, too. Both the companies and the users want control over a shared resource, and each side has a different opinion on where the border lies :).

(In practice, as a user, that's why my mind reads the phrase "OAuth redirect vulnerabilities" as a feature of a product, not a bug.)

dbuxton

2 hours ago

It’s not a very good way of doing that though. Rather than constraining the callback url to pre-registered partners, you just need to enter “Claude Code” as your product name and it lets you in.

htrp

an hour ago

you're not being sarcastic here?

pjm331

an hour ago

callback urls are all localhost, there’s no domain to whitelist, just client names

hparadiz

3 hours ago

We need OIDC tokens generated at the SSO placed on the dev environment upon user authentication and then have those OIDCs reusable among multiple mcps. People don't wanna login to 10 different mcps every morning.

thefourthchime

an hour ago

Funny timing. Just yesterday I threw Opus 5.5 at excalidraw.com and told it to diagram the architecture of the software I'm working on.

It did an amazing job.

thoughtpeddler

29 minutes ago

Interesting. How do you operate the integration?

thdr

5 hours ago

https://nitter.meowing.monster/GayaniFigma/status/2105295629...

king_geedorah

3 hours ago

Seeing Anubis deployed on a site whose existence is largely predicated on twitter putting up roadblocks to anonymous access is rather amusing.

qlte

an hour ago

Nitter instances are a scarce resource provided by the community, and they want to make sure they're available for actual users and not bogged down by AI scrapers looping through URLs. Not sure why that would be amusing particularly since Anubis doesn't require any kind of account...

Dylan16807

an hour ago

Anubis at low difficulty isn't a roadblock to humans and it doesn't affect anonymity at all. Seems reasonable to me. Their mission isn't to help with mass requests.

jjcm

3 hours ago

Dylan Field has shared some thoughts on this: https://x.com/zoink/status/2105369960008855914?s=46&t=bwJTI_...

jdgoesmarching

an hour ago

If you’re whining about how another company gets away with user-hostile behavior that you’re emulating, you’ve lost the plot.

miguel-muniz

an hour ago

Figma does allow any agent to connect to their desktop MCP though, they just limit the desktop MCP to read only access. Not sure how that fits into his argument.

Jcampuzano2

18 minutes ago

I replied to it there, but his reply is either intentionally obtuse or he entirely missed the point.

I'm unfortunately inclined to think its the first because a reply as such from anybody who thought about this for even a minute would realize his reply has literally nothing to do with the original issue.

sneezychl

41 minutes ago

I've been using OpenPencil as a drop-in replacement for Figma and it works fine for my needs. These days there are open source alternatives just as good as commercial solutions if you're willing to get your hands dirty and self host.

WhitneyLand

4 hours ago

Even if you’re whitelisted you get only 6 accesses a day on a standard account, have to pay for a dev account to get 200/day which still isn’t great.

For my Figma needs, having Codex do computer use seems just as good as their mcp. I can tell it, “go download the assets for what I need and take a few screenshots for reference”.

miguel-muniz

3 hours ago

Dev seats always felt like a ripoff IMO. They are just nickel and diming enterprise orgs for features that should just be free. Especially now when AI makes Figma's own code generation useless.

I couldn't believe it when file annotations are only visible to users with design and dev seats. Like my PMs will never be able to read the annotations. I stopped using that feature entirely after that, and just stuck to pasting in FigJam sticky notes instead.

hadi77ir

4 hours ago

What happens if someone sends requests that look like to be OpenCode, but from Pi? What is stopping people from doing it? And how these measures are going to benefit Figma? I don't get it.

Phemist

4 hours ago

I guess this is in violation of the ToS on your account and can get your account closed? At least, that's how I imagine it would work.

anandchowdhary

3 hours ago

Slack does the same thing:

> Get started using the Slack MCP server by setting up a connection with an available partner

https://slack.com/help/articles/48855576908307-Guide-to-Mode...

thefourthchime

an hour ago

You can run the Slack app in a container and let an agent control it. It's not elegant, but it works.

dbuxton

2 hours ago

You can install the mcp by creating an api app without being a partner.

TeMPOraL

3 hours ago

Another company desperately trying to enshittify their integrations as they realize AI agents are a mortal threat to their entire business.

srulyrosenblat

4 hours ago

This was always a possibility, when my team dug into the concentration of MCP server usage a year ago we found that the top 10 servers had half of all GitHub stars (the Figma server was in 10th at the time).

https://www.oreilly.com/radar/mcp-in-practice/

MCP is only as useful as the servers people use are open.

allan_s

3 hours ago

Shameless plug,

I created an opensource unofficial mcp/skill/cli here git@github.com:allan-simon/figma-kiwi-protocol.git

Its based on a reverse engineering of the kiwi protocol and it works for read/write , comments etc. and it does not require anything except a cookie session ( I usually automate this part by having a isolated chrome with CDP activated)

I created sometimes ago because I had to work with some customers who didnt want to pay for a full seat for my account so the official mcp was not possible at all.

mcbuilder

4 hours ago

As someone making my own harness, this makes me sad. Pi is a big inspiration and one of the best open source harnesses, but there are many others. dsh, opencode, hermes, etc. MCP is such a thin layer to implement for any harness, this just seems arbitrary.

rirze

4 hours ago

Funny enough, I saw some tweet earlier today about their company trying to get past the legal hurdles with getting figma mcp to work and ended up bluntly giving up. Wonder if this is related.

alex7o

5 hours ago

That is very old, I use a figma CLI patched to look like Claude code so I can use it for everything

linuxftw

5 hours ago

We're talking about client request headers, right? Why even bother with such a thing? Malicious users will just spoof those, you're only going to annoy legitimate users.

randbyte

4 hours ago

This is naive. With extreme prevalence of vibe coding it’s a matter of time before someone turns their local app into an mcp proxy.

happyPersonR

4 hours ago

Penpot has an mcp… might be time to take a look.

godwinson__4-8

3 hours ago

Open MCP access should become a legal imperative.

Better consumer choice, less companies stifling competition.

Tell your Congressperson! An easy way to frame it: why should I have to cross check Amazon or eBay or Walmart or w/e stupid janky frontend myself and find the best price/product? Why isn't it good for the economy if any agent harness can interface with such data as a consumer right?

The question is no different here. But most people don't know what figma is (it will probably not exist in 10 years anyway). However if we focus on the big abusers of platform economics, then the benefits we accrue from highlighting the tensions with consumers at those entities will simply flow downstream into the wider economy.

An economy that is more transparent is also a necessary precursor to robust UBI. When a company like Figma makes this move, the correct read should be they are buying into a playbook bent on depriving all of us of a more equitable future - one of the few optimistic possibilities for the highly contested future we are rapidly approaching.

thehappypm

4 hours ago

Why is this a global config — shouldn’t this be configurable per customer?

tomaskafka

an hour ago

Figma, now that’s a name I didn’t hear for a long time. I have memories of working in it for hours a day, it was some tool from the covid era, right?

sparkling

4 hours ago

We need to fake User-Agent now for our MCP clients? Could have just sticked to plain old HTTP then ;)

pjm331

5 hours ago

Another thing they do that I find equally frustrating is their MCP can do things you cannot do via API so you are forced to use theirs and cannot implement your own

dyllon

5 hours ago

Frankly, “whitelisting” clients is against the spirit of MCP.

klardotsh

4 hours ago

Welcome to where this was inevitably all going to go eventually. The entirety of commercial personal computing is going this direction: locking down APIs to make sure you’re not only doing what the company wants, but also the way the company wants. Mobile phones provide countless examples already; applying those examples to LLM world isn’t far fetched - and Anthropic already started down the road of “any old agent isn’t OUR agent” months ago.

recursive

4 hours ago

Spam is against the spirit of email.

chpatrick

4 hours ago

Open MCP basically kills your product in my opinion, you can't charge for any feature the LLM can do itself.

It's probably good news for users and open source though, why would you pay for something if a free tool with an MCP can do it.

fidotron

4 hours ago

> Open MCP basically kills your product in my opinion, you can't charge for any feature the LLM can do itself.

For products for which this is true resorting to whitelisting clients simply accelerates your obsolescence by creating a temporary market for products that are MCP, and open agent, friendly.

gitowiec

2 hours ago

Figma srigma, who cares, they still in business?

RobertDeNiro

4 hours ago

Figma has been absolute dog shit about opening up to mcp usage. We have been trying to include them in an internal tool we are building, but that would require a service account, which they refuse to offer.

triyambakam

4 hours ago

I've seen other apps do this as well e.g. Cal.com

spwa4

4 hours ago

I think we'll see more of this. Of course SAAS companies like Figma, and soon Adobe and ... will see that their tools are still useful. And they are useful to LLMs like they are useful to humans.

The obvious play to "extract value" from that is to restrict access to bots and offer LLM integration themselves, for a fee.

thenewnewguy

4 hours ago

How does restricting the MCP ""user agent"" to only claude and codex and whatever enable Figma to extract value?

Perz1val

4 hours ago

"User agent" but do users run LLMs behind their agents on their hardware? No, it's run in an AI datacenter. They can easily make a deal to route that without involving user's machine, or they can route this via user's machine but attach a signature. Of course both parties must agree on that, but technically there's nothing stopping them

spwa4

3 hours ago

No, you only get to use the Adobe LLM, which you pay adobe from. And yes, it runs remotely so they can charge you per-use.

adithyassekhar

4 hours ago

Soon they might require a vendor specific api key to access it and that requires support from the big players (anthropic,openai). They’re laying down the “framework” now.

xnx

3 hours ago

Best to migrate off of Figma rather than get locked into further enshitification.

cosmotic

4 hours ago

Allow-listed would be a more accurate and more inclusive term.