figma_mcp_server_actor

The server securely handles Figma Personal Access Tokens (PATs) and provides placeholders for OAuth 2.0. Input parameters for API calls are validated (e.g., `enum` for formats). The core functionality involves calling predefined JavaScript functions (tool handlers) rather than arbitrary code execution, mitigating direct injection risks. Broad CORS `Access-Control-Allow-Origin: *` is set, which is standard for a public API but should be considered when embedding in restricted environments. Overall, no critical security vulnerabilities like `eval` or hardcoded secrets were found in the provided code.