- Reliability 7/20
- This repository is a usage guide, not the server's source code; the actual MCP service runs on Figma's hosted remote endpoint (https://mcp.figma.com/mcp). There is no test suite or CI workflow in the repo to verify that declared tools (get_design_context, get_variable_defs, etc.) match real behavior. The tool descriptions in the README are internally consistent and server.json validates against the schema, but per the static calibration rule, reliability cannot exceed 12 without real CI plus committed tests covering key paths — scored 7 to reflect a plausible-but-unverifiable happy path.
- Security and permissions 12/20
- The service requires account-level auth (e.g., OAuth) to reach a user's Figma account; no plaintext secrets or tokens appear in any example, so there is no red-line violation. Rate limits are disclosed, showing some awareness of resource boundaries. However, the 'write to canvas' feature can directly create/modify Figma file content — a side-effecting operation — and the guide does not describe any protocol-level confirmation step or permission scoping for it. Least-privilege and data-flow disclosure (design data moving between client and Figma's servers) are incomplete, so this is capped at 12 rather than full marks.
- Maintenance 14/20
- The repo is officially maintained by Figma, is not archived, has only 7 open issues relative to a large star count, and the manifest version (2.2.90) suggests an actively, frequently iterated backend service with clear ownership. However, the license is unknown and no explicit security-response channel is documented in the repo, preventing a top score.
- Documentation 17/20
- The README is thorough, covering setup for VS Code, Cursor, Claude Code, and Gemini CLI with concrete config examples, prompting best practices, and custom rule templates, and it clearly discloses rate limits and pricing/cost information (free during beta, potentially paid later). It also links out to official developer docs for the full tool list. Gaps: authoritative tool parameter documentation lives outside the repo, and some features (e.g., web-to-design generation) are explicitly marked as still rolling out, so it falls short of a perfect score.
- Setup experience 14/20
- Clear, step-by-step connection instructions and config examples are provided for multiple mainstream clients (VS Code mcp.json, Cursor settings, Claude Code CLI, Gemini CLI), and since this is a remote HTTP service, no complex local runtime is required. Per the static calibration rule, setup is capped at 15 without executable verification evidence (real CI and tests), and some steps depend on external conditions like account plan/seat type, so it is scored 14.