figma-console-mcp 1.45.0 → 1.45.1

package/README.md

@@ -8,7 +8,7 @@
 
 > **Your design system as an API.** A design-system-focused Model Context Protocol server for Figma. It works in both directions (Figma ⇄ code), **writes to Figma**, and runs **deterministic checks** for design-code parity, accessibility, and design-system health. It hands the AI exact tokens, variants, bindings, and states as structured data rather than prescribing a framework or house style, so generated code follows your team's own stack and conventions.
 
-> **🆕 Motion tools and motion tokens, code layers, plus a shared local server, comment threads and security updates (latest v1.45.0):** animate layers with Figma Motion presets, custom animation styles or keyframes, bind easing and duration to Timing and Easing tokens, sync motion tokens to and from code, export animations as MP4, GIF or WebM, and find code layers in a file (v1.45.0). set `FIGMA_MCP_HTTP_PORT` and several local MCP clients can share one server and its Figma connection over Streamable HTTP, loopback only (v1.44.0). The MCP SDK and zod are upgraded to clear seven security advisories, with no change to how tools behave (v1.43.0). Commands fail fast instead of piling up behind a plugin stuck on a timed-out script, and a new server no longer shuts down one a thread is using (v1.42.1). `figma_get_comments` returns compact comment threads with node, thread and date filters and paging, so a busy file no longer floods the conversation (v1.42.0). Cloud Mode sign-in is hardened: each session uses only its own Figma token, authorization codes are single-use and bound to the client that asked for them, and the accessibility scanner no longer runs scripts from the HTML it checks. Two data-loss fixes: `figma_import_tokens` refuses an import that read no token files (it used to plan deleting every variable) and `replace` only deletes inside the collections you import; arranging a component set no longer deletes the other arranged sets on the page. Token export and import read variables live, so renames show up immediately. Abandoned servers exit on Windows, batch-created variables accept aliases, and the Slots tools take `fileKey`. v1.41.1–v1.41.5 make component-set analysis report real variant differences, including changes inside nested layers (an icon swap, a token on a nested vector), the variant's own background and opacity, auto-layout, gradients, corner radius, typography and swapped tokens, stop component loading from timing out on large files, and fix variable paging. Re-import the plugin for the component fixes. [See what's new →](CHANGELOG.md#1450---2026-10-28)
+> **🆕 Motion tools, motion tokens and code layers (v1.45.0, latest v1.45.1):** animate layers with Figma Motion presets, custom animation styles or keyframes, bind easing and duration to Timing and Easing tokens, sync motion tokens to and from code, export animations as MP4, GIF or WebM, and find code layers in a file. Recent releases added a shared local server over HTTP (`FIGMA_MCP_HTTP_PORT`, v1.44.0), MCP SDK and zod upgrades that clear seven security advisories (v1.43.0), and compact comment threads with filters and paging (v1.42.0). [See what's new →](CHANGELOG.md#1451---2026-10-29)
 
 ## What is this?
 
@@ -412,7 +412,7 @@ When you first use design system tools:
 - `figma_reload_plugin` - Reload current page
 
 ### Visual Debugging
-- `figma_take_screenshot` - Capture UI screenshots
+- `figma_take_screenshot` - Export an image of a page or node (Desktop Bridge first, REST fallback)
 - `figma_capture_screenshot` - Render a node from the plugin runtime, reflecting changes that haven't reached the REST API yet
 
 ### 👁️ Real-Time Awareness (Local Mode only)
@@ -920,9 +920,10 @@ The two servers are complementary, and both can run in the same MCP client.
 
 ## 🛤️ Roadmap
 
-**Current Status:** v1.45.0 (Stable) - Production-ready. Latest: Motion tools — apply, read, remove and export Figma Motion animations, manage custom animation styles, write Timing and Easing variables from token files, and find code layers (server-only). On top of v1.44.2's Cloud sign-in requests `library_assets:read`, so component lookups by key work over OAuth (server-only). On top of v1.44.1's Cloud Mode accepting personal access tokens without the Current user scope, 403 errors name the missing scope, and setup guides for Codex, Gemini CLI and Antigravity (server-only). On top of v1.44.0's opt-in Streamable HTTP endpoint for Local Mode (`FIGMA_MCP_HTTP_PORT`, loopback only, optional bearer token) so several local clients share one server and its Figma connection (server-only). On top of v1.43.0's `@modelcontextprotocol/sdk` 1.32.1 and `zod` 4 clear all seven production security advisories, with tool behavior unchanged and Gemini-safe schemas (server-only). On top of v1.42.1's commands to a plugin stuck on a timed-out script fail fast with a busy message instead of queuing behind it, port-exhaustion eviction ends the least recently used server instead of the oldest, and `figma_execute` accepts up to a 300 s timeout (server-only). On top of v1.42.0's `figma_get_comments` returning compact threads (root + replies, newest activity first) with `node_id`, `thread_id` and `since` filters and `limit`/`offset` paging, 30 threads by default; summary counts are per thread (server-only, PR #139). On top of v1.41.5's component-set analysis reporting gradient/image/paint-opacity, corner radius, typography and label text, swapped spacing tokens, nested layer geometry and vector shape changes (re-import the plugin). On top of v1.41.4's variant background/stroke and auto-layout changes. On top of v1.41.3's component-set analysis reporting changes inside nested layers (instance swaps, nested token changes, opacity on the variant itself) and no longer reports a layer hidden in every variant as a change (re-import the plugin). On top of v1.41.2's design-system summary and `figma_get_token_values` report the file's tokens (they always reported 0) (server-only). On top of v1.41.1's component-set analysis reports real variant differences (Figma's default variant, size and layer changes), component loading no longer times out on large files (throttled plugin timers), relevance-ranked component search, and `figma_get_variables` paging that works with `format: "full"` (re-import the plugin for the component fixes). On top of v1.41.0's Cloud Mode sign-in hardening (per-session tokens on `/sse`, single-use authorization codes bound to client, redirect URI and PKCE, a consent page for unrecognized destinations), a script-execution fix in the accessibility scanner, `figma_import_tokens` refusing empty imports and scoping `replace` deletes to imported collections, `figma_arrange_component_set` no longer deleting other arranged sets, live variable reads for token export/import, Windows orphan-server exit (PR #140), and `fileKey` for the Slots tools (PR #112) (server-only, no plugin re-import). On top of v1.40.9's composed colors (a color variable set to another color at an opacity, "grey/900 at 50%") export and import with the link to the primitive intact — `color-mix()` in CSS/Tailwind v4, `rgba()` in SCSS, an alpha modifier in Tokens Studio, the resolved color plus the composition in DTCG — where the export previously failed or wrote `[object Object]` (server-only, no plugin re-import). On top of v1.40.8's min/max width and height survive every way of extracting a component as JSON — the design system kit, the reconstruction format and `figma_get_file_data` now carry them, design-code parity compares them, and the reconstruction format returns real geometry again instead of 50×50 placeholders when the plugin is connected (server-only, no plugin re-import). On top of v1.40.7's clearer Color Tokens table in generated docs — layers revealed by a boolean property are printed once under that property, and stroke/fill rows name the nested instance they belong to (server-only, no plugin re-import). On top of v1.40.6's overrides in extended variable collections are visible (previously reported as nonexistent), and a third round of generated-doc fidelity fixes — radius tokens read per corner, boolean props compared in Design-Code Parity, source links pinned to a commit, hidden layers linked to the property that shows them (server-only, no plugin re-import). On top of v1.40.5's clean dependency audit for the npm package — Worker-only dependencies (`@cloudflare/puppeteer`, which pulled in a high-severity `extract-zip` advisory with no upstream fix, and `agents`) no longer install for npm users, so `npm install figma-console-mcp` audits at 0 vulnerabilities and is 64 MB instead of 173 MB; the server also reports its real version to MCP clients instead of `0.1.0` (server-only, no plugin re-import). On top of v1.40.4's fixes found by live-testing v1.40.3 on hard production components — tools given a `fileUrl` now read variables, descriptions and annotations from THAT file rather than whichever file is active (previously every token name could vanish, or on an id collision come from the wrong file; `figma_get_component` could return a different component), a tool result over 16 MB no longer disconnects the server, anatomy labels sizing by the layout's real axes, and the icon/typography/anatomy output stays readable on large components (server-only, no plugin re-import). On top of v1.40.3's fidelity fixes for generated component docs on harder components — hidden layers are labeled instead of documented as rendered, one-sided borders report the weight that actually renders, typography and layer structure are compared across every variant instead of read from the first, gradients/shadows/opacity are no longer silently dropped, truncated trees say so, and `SLOT` properties are listed (server-only, no plugin re-import). On top of v1.40.2's data-loss fix for `figma_export_tokens` — with a different file active in Figma than intended, an export could replace a real token file with an empty one (or with another file's tokens) and report success; exports now refuse to write when a requested collection is missing, when the export is empty, when the target was generated from a different Figma file, or when overwriting would destroy tokens the export doesn't manage, and `strategy: "merge"` — documented as preserving code-only tokens but never implemented — is now a genuinely safe default (server-only, no plugin re-import). On top of v1.40.1's accuracy fixes for generated component docs across variants — a descendant's fill (typically an icon's) could be documented as a variant's Background, Color Token headings kept only a property literally named `Variant`, spacing was read from the first variant alone, and icons were only detected by layer name — plus `figma_export_tokens` accepting a file path as `outputPath` instead of failing with a raw `EEXIST` or silently creating a directory (server-only, no plugin re-import). On top of v1.40.0's design system extraction from production codebases — seven Local-Mode `figma_ds_*` tools that scan one or more apps (framework/styling/vendor detection, usage-ranked component inventory classified vendored/wrapped/pure-vendor/bespoke, variant inference from real call sites, duplicate detection, and an architecture pass separating UI-kit specializations from the missing generic primitives), mine the de-facto styling into DTCG tokens with per-token provenance (multi-mode CSS custom properties, SCSS, Tailwind config, shadcn HSL triples, utility-class frequency mining valued from the app's own theme), scaffold the design-system package with showcase docs pages, wire a fresh Storybook workshop to the app's real theme layers and fonts, deep-extract components for porting with CSF3 story scaffolds, verify with deterministic fidelity evals, and persist porting progress across sessions — the extracted tokens import straight into Figma variables via `figma_import_tokens`. On top of v1.39.1's fix for a plugin-update banner that could never be cleared — an older server instance nagging a newer plugin to re-import, which only ever installs the same or a newer plugin. On top of v1.39.0's multi-file execution — `figma_execute_across_files` runs one script against several Desktop Bridge-connected files concurrently (four files x 2s of work in ~3s, not ~8s), and `figma_execute` takes an optional `fileKey` to target a single file without moving the active file or releasing target lock; targeting must be explicit (`fileKeys` or `allFiles: true`), so nothing fans out to files you did not name. From community PR #107 by @Wolfr. Ships with a relay fix: `handleResult()` in the plugin's ui.html rebuilt each response field by field and silently dropped `resultAnalysis` and `fileContext`, so the `resultAnalysis.warning` check that `figma_execute`'s own description tells callers to perform has never been possible (re-import `manifest.json` for those two fields; everything else works without it). On top of v1.38.2's connection-stability fix — the server's own orphan reaper was terminating healthy MCP servers because its liveness probe used an IPv4 literal while the server binds the IPv6 loopback, which turned every kill-safety gate into a rubber stamp; this was the cause of recurring "Server disconnected" errors across all MCP clients. Alongside v1.38.1's fix for the shared-library variable tools, which had silently reported zero collections since v1.29.0 and reported failed imports as successes. On top of v1.38.0's ongoing component changelogs in generated docs — `figma_generate_component_doc` takes an opt-in `history` parameter that pulls per-component **design history** from Figma version history (each version diffed and scoped to that component, so renames, added properties, and token bindings show up as rows) alongside **code history** from `git log` on the component's source files, rendered as a `## History` section with design, code, and release-note tables. Prefers labeled versions, falls back to auto-saves when a file has none, and is off by default so existing calls are unchanged (server-only, no plugin re-import). On top of v1.37.x's design-system health audit for every client — `figma_audit_design_system_report` runs the dashboard's deterministic six-category scoring engine and returns the report as data with per-finding remediation, live-first fileKey-verified data (source disclosed), chunked per-category drill-down, and a 5-minute cache (server-only, no plugin re-import). On top of v1.36.0's target lock for multi-file parallel work — — `figma_navigate` takes a `lock: true` flag that pins the active file so an AI agent can work in one file while you work in another without commands routing to the wrong file. On top of v1.35.0's Figma Slots write support — create, inspect, populate, and reset Slots (GA at Config 2026) via 5 new tools (`figma_create_slot`, `figma_get_slots`, `figma_append_to_slot`, `figma_reset_slot`, `figma_add_slot_property`), live-validated against the GA Plugin API and based on community PR #77. On top of v1.34.0's Bidirectional Token Sync v2 + DTCG 2025.10 — `figma_import_tokens` applies the complete diff plan (creates missing collections/variables, applies renames, writes real `VARIABLE_ALIAS` references, and deletes only under explicit `replace`), `figma_export_tokens` speaks the DTCG 2025.10 dialect on request (legacy default byte-identical), variable scopes/codeSyntax round-trip via `$extensions`, `figma_setup_design_tokens` accepts alias values via DTCG brace references, and `figma_create_component_set` builds a full variant set from an axes matrix in one call. On top of the v1.33.x line: version-handshake fix (re-import banner only fires when plugin files actually changed), security dependency sweep, and the v1.33.0 connection UX overhaul (honest status pill derived from live connection state, `/health` auto-discovery with self-healing reconnect) + a 33-fix full-codebase audit (lossless DTCG multi-mode round-trips, cross-collection alias resolution, branch-URL correctness across REST tools, cache-poisoning and CSWSH fixes, bridge-first screenshots). Built on WCAG-accurate accessibility auditing (line height below 1.5× is no longer mis-flagged as a failure; readability hints decoupled from conformance checks and scoped to multi-line text; code-side WCAG 1.4.12 check), a self-healing Desktop Bridge connection (zombie-process reaper + auto-reconnect watchdog — fixes the recurring "not connected until restart" bug), native variable binding on fills/strokes + typography control in the write tools, shared-library inspection (key-based component resolution + library variable read/import without Enterprise plan), 10-format token export pipeline (DTCG, CSS, Tailwind v4, Tailwind v3, SCSS, TS module, JSON flat/nested, Style Dictionary v3, Tokens Studio), bidirectional Figma↔code token sync, version history & time-series awareness, FigJam + Slides support, Cloud Write Relay, Design System Kit, WebSocket-only connectivity, smart multi-file tracking, **127 tools** (Local) / **102 tools** (Cloud) / read-only subset (Remote), Comments API, cross-MCP identity disambiguation, and MCP Apps.
+**Current Status:** v1.45.1 (Stable) - Production-ready. Latest: `figma_get_code_layers` no longer hangs on a file in a background window, and the tool docs were audited against every tool's real parameters (server-only). On top of v1.45.0's Motion tools — apply, read, remove and export Figma Motion animations, manage custom animation styles, write Timing and Easing variables from token files, and find code layers (server-only). On top of v1.44.2's Cloud sign-in requests `library_assets:read`, so component lookups by key work over OAuth (server-only). On top of v1.44.1's Cloud Mode accepting personal access tokens without the Current user scope, 403 errors name the missing scope, and setup guides for Codex, Gemini CLI and Antigravity (server-only). On top of v1.44.0's opt-in Streamable HTTP endpoint for Local Mode (`FIGMA_MCP_HTTP_PORT`, loopback only, optional bearer token) so several local clients share one server and its Figma connection (server-only). On top of v1.43.0's `@modelcontextprotocol/sdk` 1.32.1 and `zod` 4 clear all seven production security advisories, with tool behavior unchanged and Gemini-safe schemas (server-only). On top of v1.42.1's commands to a plugin stuck on a timed-out script fail fast with a busy message instead of queuing behind it, port-exhaustion eviction ends the least recently used server instead of the oldest, and `figma_execute` accepts up to a 300 s timeout (server-only). On top of v1.42.0's `figma_get_comments` returning compact threads (root + replies, newest activity first) with `node_id`, `thread_id` and `since` filters and `limit`/`offset` paging, 30 threads by default; summary counts are per thread (server-only, PR #139). On top of v1.41.5's component-set analysis reporting gradient/image/paint-opacity, corner radius, typography and label text, swapped spacing tokens, nested layer geometry and vector shape changes (re-import the plugin). On top of v1.41.4's variant background/stroke and auto-layout changes. On top of v1.41.3's component-set analysis reporting changes inside nested layers (instance swaps, nested token changes, opacity on the variant itself) and no longer reports a layer hidden in every variant as a change (re-import the plugin). On top of v1.41.2's design-system summary and `figma_get_token_values` report the file's tokens (they always reported 0) (server-only). On top of v1.41.1's component-set analysis reports real variant differences (Figma's default variant, size and layer changes), component loading no longer times out on large files (throttled plugin timers), relevance-ranked component search, and `figma_get_variables` paging that works with `format: "full"` (re-import the plugin for the component fixes). On top of v1.41.0's Cloud Mode sign-in hardening (per-session tokens on `/sse`, single-use authorization codes bound to client, redirect URI and PKCE, a consent page for unrecognized destinations), a script-execution fix in the accessibility scanner, `figma_import_tokens` refusing empty imports and scoping `replace` deletes to imported collections, `figma_arrange_component_set` no longer deleting other arranged sets, live variable reads for token export/import, Windows orphan-server exit (PR #140), and `fileKey` for the Slots tools (PR #112) (server-only, no plugin re-import). On top of v1.40.9's composed colors (a color variable set to another color at an opacity, "grey/900 at 50%") export and import with the link to the primitive intact — `color-mix()` in CSS/Tailwind v4, `rgba()` in SCSS, an alpha modifier in Tokens Studio, the resolved color plus the composition in DTCG — where the export previously failed or wrote `[object Object]` (server-only, no plugin re-import). On top of v1.40.8's min/max width and height survive every way of extracting a component as JSON — the design system kit, the reconstruction format and `figma_get_file_data` now carry them, design-code parity compares them, and the reconstruction format returns real geometry again instead of 50×50 placeholders when the plugin is connected (server-only, no plugin re-import). On top of v1.40.7's clearer Color Tokens table in generated docs — layers revealed by a boolean property are printed once under that property, and stroke/fill rows name the nested instance they belong to (server-only, no plugin re-import). On top of v1.40.6's overrides in extended variable collections are visible (previously reported as nonexistent), and a third round of generated-doc fidelity fixes — radius tokens read per corner, boolean props compared in Design-Code Parity, source links pinned to a commit, hidden layers linked to the property that shows them (server-only, no plugin re-import). On top of v1.40.5's clean dependency audit for the npm package — Worker-only dependencies (`@cloudflare/puppeteer`, which pulled in a high-severity `extract-zip` advisory with no upstream fix, and `agents`) no longer install for npm users, so `npm install figma-console-mcp` audits at 0 vulnerabilities and is 64 MB instead of 173 MB; the server also reports its real version to MCP clients instead of `0.1.0` (server-only, no plugin re-import). On top of v1.40.4's fixes found by live-testing v1.40.3 on hard production components — tools given a `fileUrl` now read variables, descriptions and annotations from THAT file rather than whichever file is active (previously every token name could vanish, or on an id collision come from the wrong file; `figma_get_component` could return a different component), a tool result over 16 MB no longer disconnects the server, anatomy labels sizing by the layout's real axes, and the icon/typography/anatomy output stays readable on large components (server-only, no plugin re-import). On top of v1.40.3's fidelity fixes for generated component docs on harder components — hidden layers are labeled instead of documented as rendered, one-sided borders report the weight that actually renders, typography and layer structure are compared across every variant instead of read from the first, gradients/shadows/opacity are no longer silently dropped, truncated trees say so, and `SLOT` properties are listed (server-only, no plugin re-import). On top of v1.40.2's data-loss fix for `figma_export_tokens` — with a different file active in Figma than intended, an export could replace a real token file with an empty one (or with another file's tokens) and report success; exports now refuse to write when a requested collection is missing, when the export is empty, when the target was generated from a different Figma file, or when overwriting would destroy tokens the export doesn't manage, and `strategy: "merge"` — documented as preserving code-only tokens but never implemented — is now a genuinely safe default (server-only, no plugin re-import). On top of v1.40.1's accuracy fixes for generated component docs across variants — a descendant's fill (typically an icon's) could be documented as a variant's Background, Color Token headings kept only a property literally named `Variant`, spacing was read from the first variant alone, and icons were only detected by layer name — plus `figma_export_tokens` accepting a file path as `outputPath` instead of failing with a raw `EEXIST` or silently creating a directory (server-only, no plugin re-import). On top of v1.40.0's design system extraction from production codebases — seven Local-Mode `figma_ds_*` tools that scan one or more apps (framework/styling/vendor detection, usage-ranked component inventory classified vendored/wrapped/pure-vendor/bespoke, variant inference from real call sites, duplicate detection, and an architecture pass separating UI-kit specializations from the missing generic primitives), mine the de-facto styling into DTCG tokens with per-token provenance (multi-mode CSS custom properties, SCSS, Tailwind config, shadcn HSL triples, utility-class frequency mining valued from the app's own theme), scaffold the design-system package with showcase docs pages, wire a fresh Storybook workshop to the app's real theme layers and fonts, deep-extract components for porting with CSF3 story scaffolds, verify with deterministic fidelity evals, and persist porting progress across sessions — the extracted tokens import straight into Figma variables via `figma_import_tokens`. On top of v1.39.1's fix for a plugin-update banner that could never be cleared — an older server instance nagging a newer plugin to re-import, which only ever installs the same or a newer plugin. On top of v1.39.0's multi-file execution — `figma_execute_across_files` runs one script against several Desktop Bridge-connected files concurrently (four files x 2s of work in ~3s, not ~8s), and `figma_execute` takes an optional `fileKey` to target a single file without moving the active file or releasing target lock; targeting must be explicit (`fileKeys` or `allFiles: true`), so nothing fans out to files you did not name. From community PR #107 by @Wolfr. Ships with a relay fix: `handleResult()` in the plugin's ui.html rebuilt each response field by field and silently dropped `resultAnalysis` and `fileContext`, so the `resultAnalysis.warning` check that `figma_execute`'s own description tells callers to perform has never been possible (re-import `manifest.json` for those two fields; everything else works without it). On top of v1.38.2's connection-stability fix — the server's own orphan reaper was terminating healthy MCP servers because its liveness probe used an IPv4 literal while the server binds the IPv6 loopback, which turned every kill-safety gate into a rubber stamp; this was the cause of recurring "Server disconnected" errors across all MCP clients. Alongside v1.38.1's fix for the shared-library variable tools, which had silently reported zero collections since v1.29.0 and reported failed imports as successes. On top of v1.38.0's ongoing component changelogs in generated docs — `figma_generate_component_doc` takes an opt-in `history` parameter that pulls per-component **design history** from Figma version history (each version diffed and scoped to that component, so renames, added properties, and token bindings show up as rows) alongside **code history** from `git log` on the component's source files, rendered as a `## History` section with design, code, and release-note tables. Prefers labeled versions, falls back to auto-saves when a file has none, and is off by default so existing calls are unchanged (server-only, no plugin re-import). On top of v1.37.x's design-system health audit for every client — `figma_audit_design_system_report` runs the dashboard's deterministic six-category scoring engine and returns the report as data with per-finding remediation, live-first fileKey-verified data (source disclosed), chunked per-category drill-down, and a 5-minute cache (server-only, no plugin re-import). On top of v1.36.0's target lock for multi-file parallel work — — `figma_navigate` takes a `lock: true` flag that pins the active file so an AI agent can work in one file while you work in another without commands routing to the wrong file. On top of v1.35.0's Figma Slots write support — create, inspect, populate, and reset Slots (GA at Config 2026) via 5 new tools (`figma_create_slot`, `figma_get_slots`, `figma_append_to_slot`, `figma_reset_slot`, `figma_add_slot_property`), live-validated against the GA Plugin API and based on community PR #77. On top of v1.34.0's Bidirectional Token Sync v2 + DTCG 2025.10 — `figma_import_tokens` applies the complete diff plan (creates missing collections/variables, applies renames, writes real `VARIABLE_ALIAS` references, and deletes only under explicit `replace`), `figma_export_tokens` speaks the DTCG 2025.10 dialect on request (legacy default byte-identical), variable scopes/codeSyntax round-trip via `$extensions`, `figma_setup_design_tokens` accepts alias values via DTCG brace references, and `figma_create_component_set` builds a full variant set from an axes matrix in one call. On top of the v1.33.x line: version-handshake fix (re-import banner only fires when plugin files actually changed), security dependency sweep, and the v1.33.0 connection UX overhaul (honest status pill derived from live connection state, `/health` auto-discovery with self-healing reconnect) + a 33-fix full-codebase audit (lossless DTCG multi-mode round-trips, cross-collection alias resolution, branch-URL correctness across REST tools, cache-poisoning and CSWSH fixes, bridge-first screenshots). Built on WCAG-accurate accessibility auditing (line height below 1.5× is no longer mis-flagged as a failure; readability hints decoupled from conformance checks and scoped to multi-line text; code-side WCAG 1.4.12 check), a self-healing Desktop Bridge connection (zombie-process reaper + auto-reconnect watchdog — fixes the recurring "not connected until restart" bug), native variable binding on fills/strokes + typography control in the write tools, shared-library inspection (key-based component resolution + library variable read/import without Enterprise plan), 10-format token export pipeline (DTCG, CSS, Tailwind v4, Tailwind v3, SCSS, TS module, JSON flat/nested, Style Dictionary v3, Tokens Studio), bidirectional Figma↔code token sync, version history & time-series awareness, FigJam + Slides support, Cloud Write Relay, Design System Kit, WebSocket-only connectivity, smart multi-file tracking, **127 tools** (Local) / **102 tools** (Cloud) / read-only subset (Remote), Comments API, cross-MCP identity disambiguation, and MCP Apps.
 
 **Recent Releases:**
+- [x] **v1.45.1** - `figma_get_code_layers` no longer hangs on background-window files (#149); tool docs audited against real parameters (#151). Server-only.
 - [x] **v1.45.0** - Motion tools (apply, read, remove, export MP4/GIF/WebM, custom animation styles), Timing/Easing token import and writes, easing export fix, and `figma_get_code_layers` (#147). Server-only.
 - [x] **v1.44.2** - Cloud sign-in requests `library_assets:read`; component lookups by key work over OAuth. Server-only.
 - [x] **v1.44.1** - Cloud Mode accepts PATs without `current_user:read`; 403s name the missing scope; complete token scopes and Codex/Gemini CLI/Antigravity setup. Server-only.

package/dist/core/code-layer-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-layer-tools.d.ts","sourceRoot":"","sources":["../../src/core/code-layer-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,eAAO,MAAM,sBAAsB,GAAI,OAAO,MAAM,GAAG,MAAM,EAAE,OAAO,MAAM,WAiB3E,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CA2BvG"}
+{"version":3,"file":"code-layer-tools.d.ts","sourceRoot":"","sources":["../../src/core/code-layer-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,eAAO,MAAM,sBAAsB,GAAI,OAAO,MAAM,GAAG,MAAM,EAAE,OAAO,MAAM,WAkC3E,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CA2BvG"}

package/dist/core/code-layer-tools.js

@@ -16,21 +16,38 @@ const limit = ${JSON.stringify(limit)};
 const pages = ${JSON.stringify(scope)} === 'file' ? figma.root.children : [figma.currentPage];
 const layers = [];
 let truncated = false;
+// Dev-resource and related-link lookups can never resolve while the file's
+// window is in the background, so each gets a short budget. After the first
+// one runs out, the rest are skipped instead of each waiting it out.
+let linksUnavailable = false;
+const withBudget = (p) => Promise.race([p, new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 3000))]);
+const links = async (fn) => {
+  if (linksUnavailable) return undefined;
+  try { return (await withBudget(fn())).map(r => ({ name: r.name, url: r.url })); }
+  catch (e) { if (e && e.message === 'timeout') linksUnavailable = true; return undefined; }
+};
 for (const page of pages) {
   if (page !== figma.currentPage) await page.loadAsync();
   for (const n of page.findAll(x => x.type === 'CODE_INSTANCE')) {
     if (layers.length >= limit) { truncated = true; break; }
     const item = { id: n.id, name: n.name, page: page.name, pageId: page.id, x: n.x, y: n.y, width: n.width, height: n.height, visible: n.visible, locked: n.locked, parent: n.parent ? { id: n.parent.id, type: n.parent.type } : null };
-    try { item.devResources = (await n.getDevResourcesAsync()).map(r => ({ name: r.name, url: r.url })); } catch (e) {}
-    try { item.relatedLinks = (await n.getRelatedLinksAsync()).map(r => ({ name: r.name, url: r.url })); } catch (e) {}
+    const devResources = await links(() => n.getDevResourcesAsync());
+    if (devResources) item.devResources = devResources;
+    const relatedLinks = await links(() => n.getRelatedLinksAsync());
+    if (relatedLinks) item.relatedLinks = relatedLinks;
     layers.push(item);
   }
   if (truncated) break;
 }
-return { scope: ${JSON.stringify(scope)}, count: layers.length, truncated, codeLayers: layers };
+const result = { scope: ${JSON.stringify(scope)}, count: layers.length, truncated, codeLayers: layers };
+if (linksUnavailable) {
+  result.linksUnavailable = true;
+  result.note = "Figma didn't return dev resources or related links in time. This happens when the file's window isn't the focused one. Bring it to the front and run again to include them.";
+}
+return result;
 `;
 export function registerCodeLayerTools(server, getDesktopConnector) {
-    server.tool("figma_get_code_layers", "Find code layers (Figma's React code layers, node type CODE_INSTANCE) on the current page or across the file, with position, size, page, and any dev resources or related links (e.g. the GitHub source). The Plugin API and REST API expose code layers as rendered layers only: their source and props can't be read or edited, and new code layers can't be created through them. Create or edit code layers in Figma, through a GitHub import, or with Figma's own MCP server (send_code_to_figma). Use figma_capture_screenshot with a code layer's id to see it. Requires Desktop Bridge.", {
+    server.tool("figma_get_code_layers", "Find code layers (Figma's React code layers, node type CODE_INSTANCE) on the current page or across the file, with position, size, page, and any dev resources or related links (e.g. the GitHub source). The Plugin API and REST API expose code layers as rendered layers only: their source and props can't be read or edited, and new code layers can't be created through them. Create or edit code layers in Figma, through a GitHub import, or with Figma's own MCP server (send_code_to_figma). Use figma_capture_screenshot with a code layer's id to see it. Figma only returns links while the file's window is focused; otherwise the result has linksUnavailable: true and omits them. Requires Desktop Bridge.", {
         scope: z.enum(["page", "file"]).optional().default("page").describe("Search the current page (default) or every page"),
         limit: z.number().int().min(1).max(500).optional().default(100),
         fileKey: z

package/dist/core/code-layer-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"code-layer-tools.js","sourceRoot":"","sources":["../../src/core/code-layer-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAsB,EAAE,KAAa,EAAE,EAAE,CAAC;gBACjE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBACrB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;;;;;;;;;;;;;kBAcnB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;CACtC,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,mBAAuC;IAChG,MAAM,CAAC,IAAI,CACV,uBAAuB,EACvB,ikBAAikB,EACjkB;QACC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;QACtH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAC/D,OAAO,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,sGAAsG,CAAC;KAClH,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClI,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,4BAA4B,CAAC,CAAC;YACrF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACxD,OAAO;gBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7H,OAAO,EAAE,IAAI;aACb,CAAC;QACH,CAAC;IACF,CAAC,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"code-layer-tools.js","sourceRoot":"","sources":["../../src/core/code-layer-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAsB,EAAE,KAAa,EAAE,EAAE,CAAC;gBACjE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBACrB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;0BA0BX,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;;;;;CAM9C,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,mBAAuC;IAChG,MAAM,CAAC,IAAI,CACV,uBAAuB,EACvB,8rBAA8rB,EAC9rB;QACC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;QACtH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAC/D,OAAO,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,sGAAsG,CAAC;KAClH,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClI,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,4BAA4B,CAAC,CAAC;YACrF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACxD,OAAO;gBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7H,OAAO,EAAE,IAAI;aACb,CAAC;QACH,CAAC;IACF,CAAC,CACD,CAAC;AACH,CAAC"}

package/dist/core/tokens-tools.js

@@ -36,7 +36,7 @@ const logger = createChildLogger({ component: "tokens-tools" });
  * on every exported token document. Kept in sync with package.json by
  * scripts/release.sh — see step 3 of the release flow.
  */
-const MCP_VERSION = "1.45.0";
+const MCP_VERSION = "1.45.1";
 const EXPORT_TOOL_DESCRIPTION = `Export Figma variables to design token files in your codebase. Bidirectional with figma_import_tokens — together they replace Style Dictionary and Tokens Studio's export pipeline for the popular styling methods.
 
 FULLY-IMPLEMENTED OUTPUT FORMATS:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "figma-console-mcp",
-	"version": "1.45.0",
+	"version": "1.45.1",
 	"description": "The most comprehensive MCP server for Figma — design tokens, variables, components, write tools, version history diff, accessibility audits, FigJam, Slides, and more. Local (WebSocket Desktop Bridge plugin) and Cloudflare Workers (paired + remote) modes.",
 	"type": "module",
 	"main": "dist/local.js",