HTML to Figma MCP & REST API

Start with the deployment boundary

This documentation describes the implemented self-hostable MCP/REST bridge, not a generally available hosted API or a service-level commitment. Operators must configure authentication, HTTPS, network restrictions and capacity for their own deployment.

The MCP adapter uses stdio and a server-side token. OAuth, a durable production queue, a centrally managed team inbox and a hosted SDK service are not included in this MVP. Verify the deployed server and plugin capabilities before building a workflow around them.

Pair with the intended Figma file

Open the plugin in the target Figma file. In the current workspace, open More, then MCP / API, and create a short-lived pairing code. Keep the plugin open while it receives and completes work.

Configure your trusted MCP host or server-side REST client with the operator's API base URL and producer token. Supply the pairing code when creating a job; never put the API token into webpage code, a public repository or an ordinary chat prompt.

Start with one small HTML import and query its status. A capture being ready is not proof that Figma has created the layers. Only a completed Figma import and accepted acknowledgement produces the terminal imported state.

Use the supported operations

The adapter exposes import_url, import_html and import_html_batch, with import status and cancellation tools. Selection export has separate creation, status, result and cancellation operations. list_capabilities reports the server's current boundaries.

Single HTML imports can carry Auto Layout and styles-mode choices. The atomic HTML-screen batch is a separate create-only v1 workflow with stricter settings and whole-batch completion semantics; it is not identical to the interactive URL queue.

URL requests must target permitted public resources. HTML inputs are validated and sanitized. An operator must still enforce network egress restrictions and protect credentials rather than treating input validation as the only security boundary.

Treat queued, imported and ready as different states

A job can remain queued when the paired plugin is offline, even if source capture has finished. Keep polling within the returned retention window and handle cancellation, expiry and failure explicitly.

Update-selected jobs bind the expected managed root and revision. If selection or content changes before delivery, a safe failure is preferable to updating an unintended frame. Start a new request only after resolving the previous job's state.

Selection export sends the chosen HTML/assets ZIP to the configured automation server after explicit pairing and a requested export job. This is a different data path from downloading a ZIP locally; use it only for content you intend to share with that service.

Before using it for team automation

Complete an end-to-end check against your exact deployment: pair, import, confirm the resulting Figma root, interrupt and recover a job, then export a permitted selection and inspect the ZIP.

Plan token rotation, operational logs, persistence, capacity and tenant isolation before exposing a deployment to other users. The repository's local and fixture tests are not a blanket verification of your production setup.