
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@kazuph/figma
Advanced tools
AI-optimized Figma CLI with clean YAML output and hierarchical depth control
AI-optimized Figma CLI with clean YAML output and hierarchical depth control
AI-Optimized Output
Hierarchical Depth Control
--depthPipeline-Friendly
yq, jq, and other CLI toolsImage Downloads
MCP Server Integration
# Quick try with npx
npx @kazuph/figma get-data <fileKey> <nodeId> --depth 1
# Setup auth first
npx @kazuph/figma auth
# Then explore your designs
npx @kazuph/figma get-data <fileKey> <nodeId> | yq '.nodes[0].name'
npm install -g @kazuph/figma
# Interactive setup
figma auth
# Show current credentials
figma auth --show
Get your Figma API key from Figma Developer Settings.
# Basic usage
figma get-data <fileKey> <nodeId>
# Hierarchical exploration (recommended for AI)
figma get-data <fileKey> <nodeId> --depth 1 # Limit to 1 level deep
figma get-data <fileKey> <nodeId> --depth 2 # Limit to 2 levels deep
# JSON output
figma get-data <fileKey> <nodeId> --format json
When using the Figma MCP server tools, you can use these parameters:
// For Claude Code users (default) - returns resource URI
{
"fileKey": "your-figma-file-key",
"nodeId": "optional-node-id",
"depth": 2
}
// For Claude Desktop users - returns data directly
{
"fileKey": "your-figma-file-key",
"nodeId": "optional-node-id",
"direct": true // Add this for Claude Desktop
}
📝 Note: Claude Desktop users should add "direct": true to receive data directly instead of resource URIs, since Claude Desktop cannot access @figma resource references.
# Get screen name
figma get-data <fileKey> <nodeId> | yq '.nodes[0].name'
# Get all text content
figma get-data <fileKey> <nodeId> | yq '.. | select(has("text")) | .text' | head -10
# List all colors used
figma get-data <fileKey> <nodeId> | yq '.. | select(has("fills")) | .fills[]' | sort | uniq
# Find buttons by name pattern
figma get-data <fileKey> <nodeId> | yq '.. | select(.name? | test("(?i)button")) | .name'
# Count total elements
figma get-data <fileKey> <nodeId> | yq '[.. | select(has("name"))] | length'
# List all component types used
figma get-data <fileKey> <nodeId> | yq '[.. | select(has("type")) | .type] | unique'
# Download as SVG (default when no extension)
figma download-images <fileKey> ~/Downloads --nodes '[{"nodeId":"123:456","fileName":"button"}]'
# saves as button.svg
# Download as PNG (specify .png extension)
figma download-images <fileKey> ~/Downloads --nodes '[{"nodeId":"123:456","fileName":"button.png"}]'
# saves as button.png
# Download multiple images
figma download-images <fileKey> ~/Downloads --nodes '[
{"nodeId":"123:456","fileName":"icon"},
{"nodeId":"123:457","fileName":"photo.png"},
{"nodeId":"123:458","fileName":"logo.svg"}
]'
# Start MCP server
figma mcp
# HTTP mode (alternative)
figma mcp --port 3000
Add to your Claude Desktop MCP configuration:
{
"mcpServers": {
"figma": {
"command": "npx",
"args": ["-y", "@kazuph/figma", "mcp"],
"env": {
"FIGMA_API_KEY": "your-figma-api-key-here"
}
}
}
}
Important: Client detection is now based on MCP specification's
clientInforather than environment variables. Claude Desktop clients receive data directly in tool responses, while other clients receive resource URIs. The server automatically detects the client type during the MCP initialization handshake.
For large Figma files, you may encounter MCP response size limits. To increase the response size limits, add these environment variables to your Claude Desktop configuration:
{
"mcpServers": {
"figma": {
"command": "npx",
"args": ["-y", "@kazuph/figma", "mcp"],
"env": {
"FIGMA_API_KEY": "your-figma-api-key-here",
"MAX_MCP_OUTPUT_TOKENS": "80000",
"CLAUDE_CODE_MAX_OUTPUT_TOKENS": "80000"
}
}
}
}
These environment variables increase the maximum response size from the default limits, allowing larger Figma file data to be processed without truncation.
Get layout information from a Figma file with AI-optimized clean YAML output.
figma get-data <fileKey> [nodeId] [options]
Available options:
-D, --depth <number> - How many levels deep to traverse the node tree (Figma API parameter)--format <yaml|json> - Output format (default: yaml)--verbose - Enable verbose loggingDownload SVG and PNG images from a Figma file. Format determined by fileName extension (.svg/.png), defaults to .svg.
figma download-images <fileKey> <localPath> [options]
Available options:
--nodes <json> - JSON string of nodes to download (array of {nodeId, fileName, imageRef?})--png-scale <number> - Export scale for PNG images (default: 2)--svg-outline-text - Whether to outline text in SVG exports (default: true)--svg-include-id - Whether to include IDs in SVG exports (default: false)--svg-simplify-stroke - Whether to simplify strokes in SVG exports (default: true)Setup Figma authentication.
figma auth [options]
Available options:
--show - Show current credentials--remove - Remove saved credentialsStart MCP server for integration with Claude Desktop.
figma mcp [options]
Available options:
--stdio - Run in stdio mode for MCP integration (default: true)--port <number> - Port for HTTP server mode (alternative to stdio)The CLI outputs clean, hierarchical YAML/JSON:
file:
name: "Your Design File"
lastModified: "2025-01-01T00:00:00Z"
nodes:
- id: "123:456"
name: "Button"
type: "INSTANCE"
fills: ["#FF0000"]
layout:
dimensions:
width: 100
height: 40
children: [...]
components: {...}
componentSets: {...}
Unlike other Figma tools, this CLI is specifically designed for modern AI workflows:
yq, jq, and shell scriptsMIT EOF < /dev/null
FAQs
AI-optimized Figma CLI with clean YAML output and hierarchical depth control
The npm package @kazuph/figma receives a total of 11 weekly downloads. As such, @kazuph/figma popularity was classified as not popular.
We found that @kazuph/figma demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.