The recommended setup is the stdio one in the Quickstart, where your client launches the server for you. Run it as a standalone HTTP server instead when your client can’t launch local commands, or when several clients should share one server.
Start the server
Run the server without the --stdio flag:
The server prints its configuration, including which authentication method it picked up, then the addresses to connect to:
Leave it running while you use your client. Stop it with Ctrl+C.
Change the host or port
The server listens on 127.0.0.1:3333 by default. To use a different port, pass --port or set FRAMELINK_PORT:
To listen on a different address, pass --host or set FRAMELINK_HOST. See Transport for details.
Keep the default 127.0.0.1 unless you need other machines to reach the server. Binding to 0.0.0.0 exposes it to your network, and anyone who can reach it can read Figma files using the token you started it with. On the default loopback address, the server also rejects requests whose Host header isn’t a localhost name, which guards against DNS rebinding from web pages.
Connect your client
Point your client at the /mcp endpoint. Most clients that support remote servers take a url in their MCP config:
In Claude Code, add it with:
If you changed the port, use that port in the URL.
The /sse endpoint
The server speaks Streamable HTTP. /sse serves the same Streamable HTTP transport as /mcp, so older configs that point at /sse keep working as long as the client supports Streamable HTTP. Clients that only speak the legacy SSE transport can’t connect: the server answers GET requests on both endpoints with 405 Method Not Allowed. New configs should use /mcp.
Provide the Figma token
There are two ways to give the HTTP server a Figma token.
At server start. Pass --figma-api-key or --figma-oauth-token, or set FIGMA_API_KEY or FIGMA_OAUTH_TOKEN in the environment or a .env file. Every client that connects uses this token, so the client config needs no token at all.
Per request. Clients can send their own token on each request, either as an X-Figma-Token header carrying a personal access token or as an Authorization: Bearer header carrying an OAuth token. A per-request token overrides the server’s token for that request. In HTTP mode the server can start with no token at all; it then reports Per-request X-Figma-Token header as its authentication method, and tool calls fail unless the request carries a token.
See Authentication for creating a token, Per-request token for the header details, and Configuration for every flag and environment variable.
Run from source
To run the server from a clone of the repository, for development or to test unreleased changes, follow the contributing guide. 
