MCP, MCP server
UI Design to Code
Use for UI screenshot, preview image, GPT Image mockup, Figma URL/node-id, Figma MCP node JSON, or Figma screenshot to code workflows.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 19427b82b261, unchanged since the check below.
PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
scripts/cleanup_artifacts.js, line 103
fs.rmSync(candidate.path, { recursive: true, force: true }); - SECRETS_PATH_DOTENV Low
Mentions a .env file.
scripts/configure_figma_token.js, line 111
config.mcpServers[serverName].env = config.mcpServers[serverName].env || {}; - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
scripts/configure_figma_token.js, line 112
config.mcpServers[serverName].env[envVar] = dryRun ? "<redacted>" : token;
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/cleanup_artifacts.js, line 103
fs.rmSync(candidate.path, { recursive: true, force: true });
scripts/compare_screenshots.js, line 125
fs.rmSync(bmpPath, { force: true });
scripts/install_mcp_client.js, line 333
fs.rmSync(filePath, { force: true });
Show more
scripts/install_mcp_client.js, line 336
else fs.rmSync(paths.packageRoot, { recursive: true, force: true });
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
bin/ui-design-to-code-mcp.js, line 41
const section = text.match(/\[mcp_servers\.ui_design_to_code\.env\]\n([\s\S]*?)(?=\n\[|$)/);
scripts/configure_figma_token.js, line 111
config.mcpServers[serverName].env = config.mcpServers[serverName].env || {};
scripts/configure_figma_token.js, line 112
config.mcpServers[serverName].env[envVar] = dryRun ? "<redacted>" : token;
Show more
scripts/configure_figma_token.js, line 122
const envSectionPattern = /\n?\[mcp_servers\.ui_design_to_code\.env\]\n(?:[^\n]*\n)*?(?=\n\[|$)/m;
scripts/configure_mcp_registry_token.js, line 14
token: process.env.MCP_REGISTRY_TOKEN || "",
scripts/figma_rest_api.js, line 63
const section = text.match(/\[mcp_servers\.ui_design_to_code\.env\]\n([\s\S]*?)(?=\n\[|$)/);
scripts/ui_design_to_code_mcp_server.js, line 840
const envSectionPattern = /\n?\[mcp_servers\.ui_design_to_code\.env\]\n(?:[^\n]*\n)*?(?=\n\[|$)/m;
.gitignore, line 6
.DS_Store
.gitignore, line 7
.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 19427b82b261. can delete files. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 19427b82b2616284735f2fde0526967ecd17a2bf
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.