Sunnysidefigma Context Mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/utils/common.ts, line 72

  fs.unlink(fullPath, () => {});

  src/utils/common.ts, line 84

  fs.unlink(fullPath, () => {});

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  figma-dev-plugin/code.js, line 1093

  const response = await fetch('http://localhost:3333/plugin/figma-dev-data', {

  figma-dev-plugin/code.js, line 1124

  const response = await fetch(`http://localhost:3333/plugin/assets/${nodeId}`, {

  figma-dev-plugin/code.js, line 1437

  const response = await fetch('http://localhost:3333/plugin/project-overview', {

  Show more

  src/figma-dev-bridge.ts, line 58

  const probe = await fetch(FIGMA_MCP_URL, {

  src/plugin-integration.ts, line 74

  // Allow requests with no origin (like mobile apps, plugins, or curl requests)

  src/tools/design-system-tracker.ts, line 438

  const response = await fetch(`http://localhost:3333/plugin/latest-dev-data`);

  src/tools/figma-codegen-tools.ts, line 153

  const pluginResponse = await fetch(`http://localhost:3333/plugin/latest-dev-data`).catch(() => null);

  src/tools/figma-codegen-tools.ts, line 191

  const overviewResponse = await fetch(`http://localhost:3333/plugin/latest-project-overview`).catch(() => null);

  src/tools/figma-codegen-tools.ts, line 240

  const response = await fetch(`http://localhost:3333/plugin/latest-dev-data`);

  src/tools/figma-codegen-tools.ts, line 288

  const response = await fetch(`http://localhost:3333/plugin/latest-dev-data`);

  src/utils/common.ts, line 41

  const response = await fetch(imageUrl, {

  src/utils/fetch-with-retry.ts, line 9

  const response = await fetch(url, options);

  src/utils/fetch-with-retry.ts, line 17

  `[fetchWithRetry] Initial fetch failed for ${url}: ${fetchError.message}. Likely a corporate proxy or SSL issue. Attempting curl fallback.`,

  src/utils/fetch-with-retry.ts, line 21

  const curlCommand = `curl -s -L ${curlHeaders.join(" ")} "${url}"`;

  src/utils/fetch-with-retry.ts, line 24

  // Fallback to curl for corporate networks that have proxies that sometimes block fetch

  src/utils/fetch-with-retry.ts, line 25

  Logger.log(`[fetchWithRetry] Executing curl command: ${curlCommand}`);

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/cli.ts, line 10

  // Load .env from the current working directory

  src/cli.ts, line 11

  config({ path: resolve(process.cwd(), ".env") });

  src/config.ts, line 100

  } else if (process.env.FIGMA_API_KEY) {

  Show more

  src/config.ts, line 47

  description: "Path to custom .env file to load environment variables from",

  src/config.ts, line 71

  envFilePath = resolve(process.cwd(), ".env");

  src/config.ts, line 75

  // Override anything auto-loaded from .env if a custom file is provided.

  src/config.ts, line 101

  auth.figmaApiKey = process.env.FIGMA_API_KEY;

  src/config.ts, line 110

  } else if (process.env.FIGMA_OAUTH_TOKEN) {

  src/config.ts, line 111

  auth.figmaOAuthToken = process.env.FIGMA_OAUTH_TOKEN;

  src/config.ts, line 137

  "Either FIGMA_API_KEY or FIGMA_OAUTH_TOKEN is required (via CLI argument or .env file)",

  src/tools/figma-codegen-tools.ts, line 167

  const figmaApiKey = process.env.FIGMA_API_KEY ?? "";

  src/tools/figma-codegen-tools.ts, line 168

  const figmaOAuthToken = process.env.FIGMA_OAUTH_TOKEN ?? "";

  .gitignore, line 9

  # Environment variables

  .gitignore, line 10

  .env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  pnpm-lock.yaml, line 1

  lockfileVersion: '9.0'

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit ba6da85fcff1. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen