
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
genable-mcp
Advanced tools
Write-side MCP server for Figma — build, edit, restructure, and search Figma designs from Claude Code, Cursor, Cline, or any MCP client. Complements Figma's official MCP (which is read-only). 42 tools covering tree creation (JSX), variables/tokens, compon
The write-side MCP server for Figma. Build, edit, restructure, and search Figma designs from Claude Code, Cursor, Cline, or any MCP-compatible client.
Figma's official MCP is read-only — perfect for code generation.
genable-mcpis the complement: 42 write-side tools so an LLM can actually build and edit your designs.
Figma's official MCP is excellent for reading designs (get_design_context, code generation). But it's mostly read-only — there's no first-class way to write to the canvas, navigate across pages, or run plugin-API code from your MCP client.
genable-mcp fills that gap. It exposes 42 tools focused on the write side:
jsx), vector primitives (create_vector)set_text, set_fill, set_layout, set_stroke, edit)create_variable, bind_variable, set_variable_mode, etc.)create_component, add_component_prop, create_instance)switch_page (officially the painful gap)find_nodes, inspect, describe, find_references, discover_propsget_screenshot returns PNG as MCP image content for vision-capable modelsskill / style / guideline readers built into the pluginsession_note scratchpad, subtask delegation, ask_user interactive pauseWe recommend pairing with Figma's official MCP. They cover read-for-codegen; we cover write-and-edit. The two MCPs together give an LLM full read+write access to a Figma file.
Is this an alternative to Figma's official MCP?
No — it's a complement. Use both. Official MCP for "read this design → give me code". genable-mcp for "build / edit / restructure this design".
What MCP clients does it work with? Any client that supports STDIO MCP servers: Claude Code, Claude Desktop, Cursor, Cline, Continue, Zed, and others.
Does it need a Figma plugin?
Yes. The plugin runs inside Figma desktop and is the only way to actually call figma.* API. genable-mcp is the bridge between your MCP client (outside Figma) and the plugin (inside Figma).
How is this different from "Figma to code" plugins?
Those plugins are one-shot exporters (Figma → React/Vue/HTML). genable-mcp is bidirectional and interactive — your AI agent can read, edit, verify visually, and iterate inside Figma.
Can it build a full design from a prompt?
Yes. The jsx tool accepts JSX-like markup and creates an entire subtree atomically. Pair with bind_variable for token-driven designs.
Is it free? Yes. MIT license. The MCP server is free; the Genable plugin in Figma Community is free.
MCP client (Claude Code / Cursor / etc.)
↓ stdio JSON-RPC
genable-mcp (this package, Node.js)
↓ WebSocket :3458
Genable plugin (running inside Figma)
↓ Figma Plugin API
Figma file
The plugin runs in your Figma desktop app. genable-mcp is the bridge that lets external MCP clients call into it.
You need both halves working together:
ws://localhost:3458 in networkAccess.allowedDomains. Plugin versions older than v1.0.1 (the marketplace-version pre-May-2026) cannot reach this MCP server because Figma's CSP blocks the localhost connection. If your plugin was installed before May 2026, re-open it from Figma Community to get the update.genable-mcp ≥ 0.2.0) configured in your MCP client. Older 0.1.x snapshots ship a slightly older tool list — bump to 0.2.0 to get the current 42-tool surface.Search "Genable" in the Figma Community and install. Open it once in any file — it auto-connects to localhost:3458.
(One-time. Plugin keeps connecting silently after the first run.)
genable-mcp to your MCP client config// .mcp.json (project) or ~/.claude.json (global)
{
"mcpServers": {
"genable": {
"command": "npx",
"args": ["-y", "genable-mcp"]
}
}
}
Same idea — configure a STDIO server with command: npx, args: ["-y", "genable-mcp"].
In your MCP client, ask: "List the pages in my Figma file." If the plugin is running, you'll see the page roster.
{
"mcpServers": {
"figma": { /* official, read */ },
"genable": {
"command": "npx",
"args": ["-y", "genable-mcp"]
}
}
}
Rule of thumb:
| Env var | Default | Purpose |
|---|---|---|
MCP_WS_PORT | 3458 | Port the WebSocket relay listens on |
RELAY_SECRET | (empty) | If set, plugin must send matching secret in identify handshake. Use when sharing a host between multiple users. |
Each tool's full description (parameters, examples, sandbox limits) is exposed via ListTools in the MCP protocol — your client surfaces them automatically. Below is a one-line index.
jsx — Build a complete subtree with JSX-like markup. Single-call atomicity.create_vector — Create vector primitives from SVG path data.inspect — Read a node with selectable property facets (layout, paint, typography, etc.).describe — Lint-style summary of a subtree.find_nodes — Search by name/type within current page.discover_props — Unique property values across a subtree.find_references — Reverse lookup: who binds this variable?get_selection — User's current Figma selection.edit — Generic property updates on existing nodes.set_text, set_fill, set_stroke, set_layout — Single-intent setters (font load + fallback included).replace_props — Bulk find/replace of property values across a subtree.delete_node, move_node, clone_node — Tree mutations.create_component, combine_components — Promote nodes to components.add_component_prop, list_component_props — Variant / boolean / instance-swap props.create_instance — Instantiate a component.list_variables — Inventory of collections + variables in the file.create_collection, ensure_collection — Token collections (idempotent ensure).create_variable, ensure_variable, set_variable_value, set_variable_mode — Variable lifecycle.bind_variable — Bind a variable to a node property.skill, style, guideline, help — Curated design knowledge baked into the plugin.switch_page — Switch active page by ID or name. Returns the full page roster.get_screenshot — Export a node as PNG, embedded as MCP image content.ask_user — Pause and ask the user a question (interactive client only).subtask — Delegate a sub-prompt to a focused agent.session_note — Scratchpad for the agent to record findings across a session.read_plugin_data, write_plugin_data — Persist key/value metadata on nodes via Figma's plugin-data API.MCP_WS_PORTS=3458,3459,…fills arrays, stale node IDs after reload). High-level tools wrap most of these; the js escape hatch description lists the rest.MIT.
Source + issues: github.com/muse40007/figma-ai-generator-dogfood (subdir tools/mcp-server).
FAQs
Write-side MCP server for Figma — build, edit, restructure, and search Figma designs from Claude Code, Cursor, Cline, or any MCP client. Your agent is the LLM, so no Figma-plugin API key is needed. Complements Figma's official MCP (which is read-only). 39
The npm package genable-mcp receives a total of 17 weekly downloads. As such, genable-mcp popularity was classified as not popular.
We found that genable-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.