Figma-Context-MCP

The server requires a Figma API key (personal access token or OAuth token) which must be securely provided by the user, not hardcoded. The `download_figma_images` tool downloads files from URLs provided by the Figma API; while generally safe, downloading from external sources always carries a theoretical risk if Figma's CDN could be compromised or the URLs maliciously altered. The `saveFigmaData` and `downloadFigmaImage` functions write to user-specified local paths, which could be exploited if a malicious `savePath`/`localPath` is provided to overwrite critical system files (though this assumes a malicious AI client or user input). The `fetchWithRetry` function's `curl` fallback constructs a command string with potentially user-derived URLs, but in practice, these URLs originate from the trusted Figma API and headers are server-configured, minimizing direct command injection risk from external malicious input.