figmanage

Let agents manage your Figma workspace. Seats, teams, permissions, billing, offboarding, cleanup -- handled in conversation instead of clicking through admin panels.

Every Figma MCP is design-to-code. figmanage is the management layer: 102 tools that let agents operate on the workspace itself. Works with Claude Code, Cursor, OpenClaw, or as a standalone CLI.

examples

workspace management (admins)

"which paid seats haven't been active in 30 days? how much would we save?"

"offboard sarah@company.com -- show me everything she owns, then transfer it
 to jake and remove her from the org"

"set up a new hire: invite alex@company.com to Design and Engineering as an editor"

"create a user group called Platform Design and add the three designers"

"run a quarterly design ops report for the org"

everyday design work (everyone)

"clean up the Mobile App project -- find stale files and archive dead branches"

"what are the unresolved comments across the Platform project?"

"export all the icons from the Design System file as SVGs"

"move the Q4 files into the Archive project"

"share the Homepage mockup with alex@company.com and set link access to view-only"

"summarize the Brand Guidelines file -- pages, components, styles"

install

# Claude Code
claude mcp add figmanage -- npx -y figmanage

# Cursor / OpenClaw / other MCP clients
{
  "mcpServers": {
    "figmanage": {
      "command": "npx",
      "args": ["-y", "figmanage"]
    }
  }
}

On first run, figmanage walks you through setup in the conversation -- extracts your Chrome session cookie, asks you to create a PAT, stores credentials locally. No env vars, no JSON editing.

Also works as a CLI:

npm install -g figmanage
figmanage login

how it works

Figma's public REST API covers design files but nothing on the management side -- no seats, no teams, no permissions, no billing. figmanage uses both APIs:

Both together unlock all 102 tools. Cookie-only or PAT-only works but limits available tools.

Admin auto-detection. At startup, figmanage checks whether you're an org admin. Admins see all 102 tools. Non-admins see 68 -- everything except org management, seat changes, billing, user groups, and offboarding. No configuration needed.

Toolset presets. Use FIGMA_TOOLSETS to expose only specific tool groups:

CLI

Commands use a noun-verb pattern: figmanage <group> <action>.

figmanage org seat-optimization                    # find inactive paid seats
figmanage org offboard sarah@co.com                # audit what a user owns
figmanage org offboard sarah@co.com --execute \
  --transfer-to jake@co.com                        # soft offboard
figmanage org offboard sarah@co.com --execute \
  --transfer-to jake@co.com --remove-from-org      # hard offboard (permanent)
figmanage org onboard alex@co.com --teams 123,456 \
  --role editor --seat full --confirm              # set up a new hire
figmanage org quarterly-report                     # org-wide design ops snapshot
figmanage org members --search danny               # find org members
figmanage permissions audit --scope team --id 789  # audit a team's permissions
figmanage branches cleanup 573408414               # find stale branches

All commands output JSON when piped or when --json is passed. Run figmanage <group> --help for subcommands.

setup

Log into figma.com in Chrome, then:

figmanage login     # extract cookie, create PAT, store credentials
figmanage whoami    # verify auth
figmanage logout    # clear credentials

Credentials stored at ~/.config/figmanage/ with 0o600 permissions.

Env vars (FIGMA_PAT, FIGMA_AUTH_COOKIE, etc.) override the config file. HTTP transport available via --mcp --http <port>.

tool reference

security

All ID parameters validated against /^[\w.:-]+$/. Rate limit retries restricted to safe HTTP methods -- mutations never retried. Billing responses strip PII. Destructive operations default to dry-run mode. Org removal requires explicit double-confirmation. Config file stored with 0o600 permissions.

known limitations

• list_favorites: Figma BigInt overflow bug on their server. favorite_file works fine.
• Branch merging / version restore: Require Figma's multiplayer protocol, no REST endpoint.
• Cookie expiry: ~30 days. Run figmanage login --refresh to renew.
• Windows cookies: Best-effort DPAPI extraction. Falls back to PAT-only.
• Variables: Enterprise-gated scopes.
• User groups: Write-only (create, delete, add/remove members). No list endpoint -- Figma renders the page server-side.

development

git clone https://github.com/dannykeane/figmanage.git
cd figmanage
npm install
npm run build
npm test

Three-layer architecture: operations hold all business logic, tools and CLI are thin wrappers.

src/
  index.ts            Entry: --setup, --mcp, or CLI mode
  mcp.ts              MCP server setup, admin detection, toolset presets
  setup.ts            Cross-platform Chrome cookie extraction
  auth/               AuthConfig from env vars and config file
  clients/            Axios clients for internal (cookie) and public (PAT) APIs
  operations/         Shared business logic (19 modules)
  tools/              MCP tool wrappers (thin, call operations)
  cli/                CLI Commander wrappers (thin, call operations)
  types/figma.ts      Shared types including Toolset union

license

MIT