figma-smart-image-mcp

The server implements robust security measures including in-memory storage of Figma tokens per session (cleaned after 1 hour), strict file permissions (0o600 for token file, 0o700 for directory), and a rate limiter (100 req/min per IP). The use of 'undici' for network requests and 'sharp' for image processing are standard and generally secure libraries. File system operations for output ('./out/figma/') are expected for its functionality; while the 'out_dir' parameter could theoretically be a vector for directory traversal if maliciously crafted, standard path resolution helps mitigate typical risks. No 'eval' or obvious obfuscation detected. The multi-tenant token handling stores tokens in memory only, enhancing security for public deployments.