Skip to main content

Figma's approach breaks the core promise of MCP

  • April 1, 2026
  • 8 replies
  • 724 views
Luc Awater

The Figma MCP server fails to authenticate when using opencode, returning a 403 Forbidden error.

 

To Reproduce
1. Configure Figma MCP in opencode.json:

{
  "mcp": {
    "figma": {
      "type": "remote",
      "url": "https://mcp.figma.com/mcp",
      "enabled": true,
      "oauth": {}
    }
  }
}


2. Run: opencode mcp auth figma


3. Error received: HTTP 403: Invalid OAuth error response: SyntaxError: JSON Parse error: 
Unexpected identifier "Forbidden". Raw body: Forbidden

 

Expected behavior
OAuth authentication should succeed, as it does with other MCP servers like Context7, Sentry, etc.

 

Root cause
According to Figma's documentation (https://help.figma.com/hc/en-us/articles/32132100833559), Figma only supports a pre-approved allowlist of MCP clients:
- Claude Code ✓
- Cursor ✓  
- VS Code ✓
- Codex ✓
- etc.

OpenCode is not on this list, so Figma's authorization server rejects the OAuth flow.

 

Discussion

Figma's approach breaks the core promise of MCP - that any client should work with any server. This creates vendor lock-in and limits the ecosystem.

This appears to be an architectural issue with Figma's MCP implementation - they're treating MCP like a proprietary API rather than following the protocol's interoperability standard. Other MCP servers (Context7, Atlassian, AWS, Sentry, etc.) work fine with OpenCode.

    8 replies

    Bryce_Driesenga

    +1 on this. It’s an open protocol. This is so ridiculous. 

      spfagetty
      • spfagetty
      • New Member
      • April 9, 2026

      Same here, this is not how MCP is supposed to work!
       

        unneqit
        • unneqit
        • New Member
        • April 16, 2026

        +1. Please Figma, do something. MCP is not supposed to be proprietary.

          AptumAndreas
          • AptumAndreas
          • New Member
          • April 20, 2026

          +1    Figma – Why this limitation??

            Stein Olav Pettersen

            +1 At least please add Opencode to the official whitelist

              Getty Hill
              • Getty Hill
              • New Member
              • May 1, 2026

              +1 please add opencode to the whitelist

              npt1601
              • npt1601
              • New Member
              • May 1, 2026

              +1 please add opencode to the whitelist

              Jaycee Lewis
              Figmate

              Hey! Great writeup ​@Luc Awater. And thanks to everyone who has left feedback so far.

              You nailed the diagnosis, and I'd love to help as this trips a lot of folks up.

              Our remote MCP server allowlists client_name during dynamic client registration, and right now, opencode isn't on that list. This was confirmed by our team on the forum—the mcp:connect scope is intentionally gated to supported clients while we're in beta. You can find the current list in the MCP catalog and our Guide to the Figma MCP server.

              On the current allowlist situation:

              • It's an intentional choice: This is how it’s being managed while the feature is in beta, and we hear you on the need for more progress (the spec for RFC 7591 DCR support) 

              How to get unblocked right now

              I know these alternatives might not be the exact "out of the box" experience you're looking for with opencode right now, but I want to make sure you have some resources to keep moving while we iterate:

              • Use the Figma Desktop MCP server: This runs locally via Dev Mode. It bypasses the OAuth issue and the allowlist entirely. It's likely your fastest path forward
              • Community server + PAT: You can use figma-developer-mcp with a FIGMA_API_KEY. Mehmet Baykar wrote a solid walkthrough for this specific configuration
              • Get opencode on the catalog: We'd love to have you! You can join the waitlist at figma.com/mcp-catalog. There's also an open issue on the opencode repo tracking community demand. Worth adding a 👍 if you have a sec

              Have fun building! — Jaycee

              Terms & ConditionsAccessibility statement