New Member

Solved

Figma's approach breaks the core promise of MCP

42 replies
7256 views

The Figma MCP server fails to authenticate when using opencode, returning a 403 Forbidden error.

To Reproduce
1. Configure Figma MCP in opencode.json:

{
"mcp": {
"figma": {
"type": "remote",
"url": "https://mcp.figma.com/mcp",
"enabled": true,
"oauth": {}
}
}
}

2. Run: opencode mcp auth figma

3. Error received: HTTP 403: Invalid OAuth error response: SyntaxError: JSON Parse error:
Unexpected identifier "Forbidden". Raw body: Forbidden

Expected behavior
OAuth authentication should succeed, as it does with other MCP servers like Context7, Sentry, etc.

Root cause
According to Figma's documentation (https://help.figma.com/hc/en-us/articles/32132100833559), Figma only supports a pre-approved allowlist of MCP clients:
- Claude Code ✓
- Cursor ✓
- VS Code ✓
- Codex ✓
- etc.

OpenCode is not on this list, so Figma's authorization server rejects the OAuth flow.

Discussion

Figma's approach breaks the core promise of MCP - that any client should work with any server. This creates vendor lock-in and limits the ecosystem.

This appears to be an architectural issue with Figma's MCP implementation - they're treating MCP like a proprietary API rather than following the protocol's interoperability standard. Other MCP servers (Context7, Atlassian, AWS, Sentry, etc.) work fine with OpenCode.

Celyn_LSolution

Figmate

Hi everyone, thanks so much for your patience while waiting for this update.

I’m happy to share that OpenCode has now been added to the Figma MCP allowlist!

Please give authentication through the remote MCP server another try and let us know if you’re still running into any errors.

Thank you for sticking with us! 🙌

Show previous replies

Jordi_Parra

New Member

What is the status of this @Celyn_L?

Someone in the team says they are waiting for you: https://github.com/anomalyco/opencode/pull/32676#issuecomment-4982034764

As of now, the Figma Desktop MCP seems to be gone, and the web mcp still blocks Open Code. Is the desktop MCP still an option?

Is there any way or an ETA for using Figma in OpenCode? If this isn’t resolved, this is a good reason to give OpenPencil a try for personal work.

Celyn_L

Figmate

Hey @Jordi_Parra, thanks for following up and for sharing the additional context.

I’m checking in with the team about the current status of Desktop MCP support and using Figma with OpenCode. I’ll share any updates here once I hear back.

Jordi_Parra

New Member

The thing is that this self inflicted damage. I really wish you’d reconsider this approach. If you just didn’t block what clients can use the MCP, the problem is solved. I don’t understand why would you adopt a standard yet limit its use.

Hannes S

New Member

+1 In our organization, we are restricted to using OpenCode. The local MCP worked previously, but the remote MCP no longer does—why is the local option being disabled when remote is not supported? I kindly ask for OpenCode to be added promptly. Thank you very much.

Jordi_Parra

New Member

the local mcp is still there, but it seems to be intentionally hidden in the ui. If you do cmd+k and search for ‘enable mcp’, you can enable the local mcp.

I really hope Figma sorts this out and officially adds opencode or just opens the mcp to any tool as any other protocol would. Unfortunately, it looks like the long term plan is to make this a pay per use feature (it says so in the official documentation). It’ll be a pity if that’s where we land just to make more money when using a local mcp has no extra costs that would justify charging for this.

Hannes S

New Member

Thanks for the tip, worked for me (on Windows its "Strg + P")! :)

A bit unfortunate that the local MCP is hidden in the UI, but at least it’s still there - for now… I really hope Figma opens this up more and officially supports OpenCode. Making local MCP a pay-per-use feature would be a real shame.

Saso_Jakljevic

New Member

I was trying to use it with Mistral and it also does not seem to work as a Custom connector. I assume this is related?

Thomas Saint-Gérand

New Member

Yes, they decided to whitelists MCP clients for some reason 🤷 So unless they explicitly add Mistral, you can’t easily connect to it (you still can but you need to spoof an allowed client 🤫)

Rafa Gressler

New Member

Hi Figma team,

I'd like to request that OpenCode (https://opencode.ai) be added to the allowlist for the remote Figma MCP server (https://mcp.figma.com/mcp).

What I tried:
- OpenCode version: 1.19.0 (macOS, Apple Silicon)
- opencode.json: { "mcp": { "figma": { "type": "remote", "url": "https://mcp.figma.com/mcp" } } }
- Command: opencode mcp auth figma

What happens:
- The Figma login page opens and I authorize access.
- The callback returns to OpenCode with an error: "OAuth state mismatch" in the app, and "OAuth app with client id 7Rk6u7nL6bfrGw70u26hv7 doesn't exist" in the terminal.

Based on the forum thread, the remote server only accepts clients on its allowlist, and OpenCode is not on it. Other MCP clients that support Streamable HTTP and OAuth, such as Context7, Sentry, and Atlassian, work with OpenCode, so this is a specific block on Figma's side.

I'm a professional who builds websites and digital products for clients, and OpenCode is part of my daily workflow. Being able to read and write Figma files from it would be very useful. I'm happy to test any pre-release build or provide more logs if that helps your team.

Thank you.

Celyn_LSolution

Figmate

Hi everyone, thanks so much for your patience while waiting for this update.

I’m happy to share that OpenCode has now been added to the Figma MCP allowlist!

Please give authentication through the remote MCP server another try and let us know if you’re still running into any errors.

Thank you for sticking with us! 🙌

Thomas Saint-Gérand

New Member

Such a shame that the solution you went for was to add something to the allowlist instead of removing the allowlist though

Stein Olav Pettersen

New Participant

Great - will try it out 🙌

Arth_Shah

New Member

Could Conductor be added to the list as well?

József Miskolczy

New Member

Yes I do still run into the same issue. Is this change live everywhere?

HTTP 403: Invalid OAuth error response: SyntaxError: JSON Parse error: Unexpected identifier "Forbidden". Raw body: Forbidden

Sign up

Login with SSO

Login to the community

Login with SSO