
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@sahajamit/figma-cli
Advanced tools
CLI for Figma — read designs, export images, extract tokens. Works with any AI agent.
A lightweight Node.js CLI for the Figma REST API. Read designs, export images, browse components, extract design tokens — all from your terminal.
Built as a faster, leaner alternative to MCP servers for letting AI agents (like Claude Code, Cursor, Copilot) interact with Figma designs.
📦 npm: https://www.npmjs.com/package/@sahajamit/figma-cli
npm install -g @sahajamit/figma-cli
Then jump to Quick Start to set your token and verify, or skim Why We Built This and Beyond Plain Metadata first.
The official Figma MCP server is a great piece of work — but in many organizations, MCP servers not on a central registry are blocked for security reasons, and Figma's MCP is increasingly tied to paid Dev Mode. Even when those barriers don't apply, MCP comes with its own overhead:
Token overhead. Every MCP call includes the full tool schema in the conversation context. With dozens of tools, that's thousands of tokens spent just describing what's available — before any actual work happens. On long conversations, this adds up fast.
Server lifecycle. MCP requires a running server process. You need to start it, keep it alive, handle crashes, manage configuration. It's another moving part in your development setup.
Cold start latency. The MCP server has to initialize, load dependencies, and establish a connection before the first call. That's seconds added to every fresh session.
All-or-nothing tool loading. MCP sends every tool definition to the agent upfront. Even if you only need to export a frame as PNG, the agent sees every Figma tool and has to reason about which one to use. This dilutes focus and wastes context.
figma takes a different approach: it's a plain CLI binary that AI agents invoke directly via shell commands. Combined with skill files (markdown files that teach the agent how to use each command), this gives you:
| MCP Server | CLI + Skills | |
|---|---|---|
| Token cost | ~3,000+ tokens for tool schemas per turn | ~200 tokens per skill file, loaded on demand |
| Setup | Start server process, configure transport | Set FIGMA_TOKEN, npm install -g, figma install --skills |
| Latency | Server init + JSON-RPC overhead | Direct process spawn (~50ms) |
| Tool selection | Agent picks from all tools at once | Agent reads relevant skill file only |
| Security | Needs MCP registry approval | Just a CLI binary, no server |
| Debugging | Inspect MCP messages | Run the same CLI command in your terminal |
The key insight: an agent doesn't need a protocol to call a CLI. It just runs a shell command and reads the output. Skill files teach it the command syntax and output schema — no runtime overhead, no server process, no token bloat.
MCP still makes sense when:
For the common case — a developer using an AI agent to read designs, export visuals, and pull design tokens — the CLI is simpler and cheaper.
Most "Figma to text" tools just return the document JSON and stop there. figma does two things differently that turn out to matter a lot for AI workflows:
A frame's metadata is rarely enough. A Hero Section frame with width/height and a list of children doesn't tell an agent what the section actually looks like — what the visual hierarchy is, what the call-to-action says, what colors carry the brand.
figma treats rendered visuals as first-class output:
figma images export calls the Figma image-export endpoint, downloads the temporary S3 URLs, and writes PNG / SVG / JPG / PDF files locally — in one command.So a question like "build a React component that matches the hero on this design" doesn't fail because the agent only saw frameName: "Hero" and a bounding box.
# Agent flow (this is what the skill file tells the agent to do)
figma files frames ABC123xyz --json # find the frame
figma images export ABC123xyz --ids 1:2 --format png --output-dir . # render it
# → agent reads ./1-2.png with vision, then writes the component
Designers store color, spacing, typography, and shadow values in styles and variables. A code-generating agent that has to guess these values from screenshots will get them wrong. figma tokens export traverses the document tree and emits a W3C Design Tokens Community Group JSON document:
| Token type | Source | Output shape |
|---|---|---|
| Colors | FILL styles + solid paints | { value: "#3b82f6", type: "color" } |
| Spacing | Auto-layout padding values | { value: 16, type: "spacing" } |
| Sizes | Frame dimensions | { value: 1440, type: "dimension" } |
| Typography | TEXT styles | { value: { fontFamily, fontSize, fontWeight, lineHeight } } |
| Shadows | Drop / inner shadow effects | { value: "0px 4px 6px 0px #0000001a" } |
Agents can pipe this straight into Style Dictionary, Tailwind config, CSS custom properties, or any design-token-aware build pipeline:
figma tokens export ABC123xyz --json > tokens.json
# → agent feeds tokens.json into the next step of the build
For Figma's own native variables (color/spacing tokens defined inside Figma rather than inferred from styles), use figma variables list <key> — it requires the file_variables:read scope on your token.
npm install -g @sahajamit/figma-cli
Or run without installing:
npx @sahajamit/figma-cli --help
export FIGMA_TOKEN=your_personal_access_token
Generate a token at Figma → Settings → Personal Access Tokens. Free to create — no paid plan required.
The file key is the ID in any Figma file URL: https://www.figma.com/design/ABC123xyz/My-Design. Node IDs (like 1:2) come from Figma's "Copy link" or figma files get.
figma install --skills # Install skill files for Claude Code, Cursor, Copilot
This installs three skill files that teach AI agents how to use figma:
figma — parent skill (routing + overview)figma-files — file, image, comment, version, and project commandsfigma-design — component, style, variable, and design-token commandsAgents load only the relevant skill file, keeping token usage minimal.
Skill files are not auto-installed on
npm install. You opt in by runningfigma install --skills. To remove them later:figma uninstall --skills.
figma me
figma files frames ABC123xyz
| Command | Purpose |
|---|---|
figma files get <key> | File structure and metadata |
figma files nodes <key> --ids ... | Specific nodes by ID |
figma files frames <key> | List all frames |
figma images export <key> --ids ... | Export as PNG / SVG / JPG / PDF |
| Command | Purpose |
|---|---|
figma components list <key> | List components in a file |
figma components search <key> -q ... | Search components by name |
figma components team <team-id> | Published team components |
figma styles list <key> | List styles in a file |
figma styles team <team-id> | Published team styles |
figma variables list <key> | Local variables (native Figma tokens) |
figma tokens export <key> | Extract W3C design tokens |
| Command | Purpose |
|---|---|
figma me | Current user info (verify token) |
figma comments list <key> | List comments |
figma comments add <key> <msg> | Add a comment (the only write op) |
figma versions list <key> | Version history |
figma projects list <team-id> | Team projects |
figma projects files <project-id> | Files in a project |
Run figma <command> --help for full options on any command. Detailed examples and JSON output schemas are in docs/COMMANDS.md and the skill files shipped with the package.
The CLI has two output modes:
| Mode | When | Format |
|---|---|---|
| Human | stdout is a terminal (TTY) | Colored tables and formatted text |
| JSON | stdout is piped (non-TTY) | Structured JSON |
This means agents automatically get JSON without any flags:
# Agent runs this — gets JSON because stdout is piped
result=$(figma files get ABC123xyz --depth 1)
# Human runs the same command — gets a colored table
figma files get ABC123xyz --depth 1
# Force JSON in terminal
figma files get ABC123xyz --depth 1 --json
The flow is two steps under the hood, but figma images export does both in one command:
/v1/images/<key>) to get temporary, pre-signed S3 URLs for each requested node.1:2) are replaced with hyphens (1-2) in the filename.| Flag | Default | Description |
|---|---|---|
--ids <ids> | (required) | Comma-separated node IDs |
-f, --format <fmt> | png | png, svg, jpg, or pdf |
-s, --scale <n> | 1 | Scale factor (0.01 to 4) |
-o, --output-dir <dir> | . | Output directory |
# 4× scale PNG of a single hero frame
figma images export ABC123xyz --ids 1:2 --format png --scale 4 --output-dir ./renders
# Multiple frames as SVG
figma images export ABC123xyz --ids 1:2,3:4,5:6 --format svg
The pre-signed URLs Figma returns expire after ~14 days. The CLI downloads them immediately, so you don't need to worry about it for normal usage.
| Variable | Required | Description |
|---|---|---|
FIGMA_TOKEN | Yes | Personal access token sent as the X-Figma-Token header |
Generate at Figma → Settings → Personal Access Tokens. The token needs:
file_content:read (default scope) — for everything except variablesfile_variables:read (separate scope) — only required for figma variables listThe token is read once at startup and never logged, never put in URLs, never persisted.
Install skill files so AI agents know how to use figma:
figma install --skills # Install for Claude Code, Cursor, Copilot
figma uninstall --skills # Remove skill files
This installs three modular skill files:
| Skill | Scope | Installed to |
|---|---|---|
figma | Routing + overview | ~/.claude/skills/figma/SKILL.md |
figma-files | File, image, comment, version, project commands | ~/.claude/skills/figma-files/SKILL.md |
figma-design | Component, style, variable, token commands | ~/.claude/skills/figma-design/SKILL.md |
The same files are installed under ~/.cursor/rules/ (if Cursor is set up) and ~/.copilot/skills/. Run from a git repo root to also append to .github/copilot-instructions.md.
Agents load only the relevant skill (files vs. design system) on demand, not all commands at once.
figma-files skillfigma files get ABC123xyz --depth 1 --jsonThis is typically 5-10× cheaper in tokens than the equivalent MCP flow, because:
# 1. Get file overview
figma files get ABC123xyz --depth 1 --json
# 2. List all frames
figma files frames ABC123xyz --json
# 3. Export the hero section as PNG for visual reference
figma images export ABC123xyz --ids 1:2 --format png --output-dir ./design --json
# 4. Get the node details for code generation
figma files nodes ABC123xyz --ids 1:2 --json
# 5. Extract design tokens
figma tokens export ABC123xyz --json > tokens.json
comments add.file_variables:read scope on your token.To build from source, run smoke tests, or add new commands, see docs/DEVELOPMENT.md. Architecture and design notes live in docs/ARCHITECTURE.md, and the full per-command reference is in docs/COMMANDS.md.
Bug reports and feature requests are welcome at GitHub Issues.
MIT — see LICENSE.
src/tokens/extract.ts is ported from figma-mcp-free.FAQs
CLI for Figma — read designs, export images, extract tokens. Works with any AI agent.
The npm package @sahajamit/figma-cli receives a total of 20 weekly downloads. As such, @sahajamit/figma-cli popularity was classified as not popular.
We found that @sahajamit/figma-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.