figma-console-mcp

The `figma_execute` tool allows arbitrary JavaScript code execution within the powerful Figma Plugin API context, presenting a significant risk if the AI is compromised or misused. The default configuration for Puppeteer (`src/core/config.ts`) uses the `--no-sandbox` argument, which is explicitly warned against for untrusted environments. While OAuth is implemented for Cloudflare mode, local mode relies on a direct Figma Desktop connection, which requires specific manual setup. The 'Desktop Bridge' plugin, a core component, has `networkAccess: allowedDomains: ["none"]`, which is a good security practice for the plugin itself by preventing external network requests. Overall, running this project requires a high degree of trust in the AI's generated code and a securely configured local execution environment.