frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Figma restricts MCP access to whitelisted clients, excluding Pi

https://twitter.com/GayaniFigma/status/2105295629941350454
57•thdr•1h ago

Comments

thdr•1h ago
https://nitter.meowing.monster/GayaniFigma/status/2105295629...
dyllon•56m ago
Frankly, “whitelisting” clients is against the spirit of MCP.
klardotsh•38m ago
Welcome to where this was inevitably all going to go eventually. The entirety of commercial personal computing is going this direction: locking down APIs to make sure you’re not only doing what the company wants, but also the way the company wants. Mobile phones provide countless examples already; applying those examples to LLM world isn’t far fetched - and Anthropic already started down the road of “any old agent isn’t OUR agent” months ago.
chpatrick•33m ago
Open MCP basically kills your product in my opinion, you can't charge for any feature the LLM can do itself.

It's probably good news for users and open source though, why would you pay for something if a free tool with an MCP can do it.

fidotron•26m ago
> Open MCP basically kills your product in my opinion, you can't charge for any feature the LLM can do itself.

For products for which this is true resorting to whitelisting clients simply accelerates your obsolescence by creating a temporary market for products that are MCP, and open agent, friendly.

fg137•29m ago
MCP creator said the same thing: https://twitter.com/dsp_/status/2105316536852320279
recursive•17m ago
Spam is against the spirit of email.
pjm331•55m ago
Another thing they do that I find equally frustrating is their MCP can do things you cannot do via API so you are forced to use theirs and cannot implement your own
alex7o•53m ago
That is very old, I use a figma CLI patched to look like Claude code so I can use it for everything
linuxftw•45m ago
We're talking about client request headers, right? Why even bother with such a thing? Malicious users will just spoof those, you're only going to annoy legitimate users.
miguel-muniz•40m ago
For context: Figma has two MCPs. The local "dev" MCP that works through the Desktop app, and the remote MCP that requires a connection to Figma. Companies need to be whitelisted to use the remote MCP, which is the only one that allows agents edit access to Figma documents.

I only found out about Figma's limitation when I was trying to add the remote MCP server to GitHub Copilot Desktop and kept running into errors. Turns out they whitelisted GitHub Copilot CLI but not the Desktop app and had put a pause on enabling any more vendors. Eventually someone (not sure which side) got it working.

Kind of strange to limit edit access only to the Remote MCP when their competitors like Pen[1] and Paper[2] allow any local agent to edit.

[1] https://www.pen.dev/

[2] https://paper.design/

cellularmitosis•13m ago
I found figma’s remote MCP to be a poor fit for iOS development (it sets tokens on fire and gives Claude the details as React+Tailwind) and got much better results by having Claude build a set of “lens” tools around their REST API (“give me all of the fonts”, “give me the layout dimensions”, “give me the colors”, etc).

The key to making it token efficient was allowing Claude to invent its own plaintext markup format for the lens output.

srulyrosenblat•38m ago
This was always a possibility, when my team dug into the concentration of MCP server usage a year ago we found that the top 10 servers had half of all GitHub stars (the Figma server was in 10th at the time).

https://www.oreilly.com/radar/mcp-in-practice/

MCP is only as useful as the servers people use are open.

spwa4•33m ago
I think we'll see more of this. Of course SAAS companies like Figma, and soon Adobe and ... will see that their tools are still useful. And they are useful to LLMs like they are useful to humans.

The obvious play to "extract value" from that is to restrict access to bots and offer LLM integration themselves, for a fee.

thenewnewguy•24m ago
How does restricting the MCP ""user agent"" to only claude and codex and whatever enable Figma to extract value?
adithyassekhar•20m ago
Soon they might require a vendor specific api key to access it and that requires support from the big players (anthropic,openai). They’re laying down the “framework” now.
sparkling•26m ago
We need to fake User-Agent now for our MCP clients? Could have just sticked to plain old HTTP then ;)
rirze•21m ago
Funny enough, I saw some tweet earlier today about their company trying to get past the legal hurdles with getting figma mcp to work and ended up bluntly giving up. Wonder if this is related.
cosmotic•20m ago
Allow-listed would be a more accurate and more inclusive term.
happyPersonR•17m ago
Penpot has an mcp… might be time to take a look.
mcbuilder•16m ago
As someone making my own harness, this makes me sad. Pi is a big inspiration and one of the best open source harnesses, but there are many others. dsh, opencode, hermes, etc. MCP is such a thin layer to implement for any harness, this just seems arbitrary.
triyambakam•16m ago
I've seen other apps do this as well e.g. Cal.com
JimDabell•15m ago
OpenCode seems to have been given the run-around as well:

> on the figma mcp, we've had an email thread going on for 8 months trying to get it setup in opencode

> they seem very concerned with the labs competing with them

> finally got unblocked after i sent this email and it'll be rolled out in a week or so

The email:

> looking through the legal stuff the amount of things in there seems pretty crazy

> this is just an mcp server, there are thousands of them. we're not going to treat figma like its special

> we've been talking about this for this entire year, i don't think this makes much sense and i don't want my team burning more time on this

> once again, for a simple mcp server

— https://www.threads.com/@thdxr/post/Dd7LN-ylLQW

StreetComplete on iOS is now in public beta

https://github.com/streetcomplete/StreetComplete/issues/5421
358•Snowly•5h ago•72 comments

RIP, vector database

https://turbopuffer.com/blog/rip-vector-database
23•razin•21m ago•0 comments

How to speed up the Rust compiler in September 2026

https://nnethercote.github.io/2026/09/30/how-to-speed-up-the-rust-compiler-in-september-2026.html
143•trickypr•3h ago•70 comments

OpenID Foundation: Identity Management for Agentic AI [pdf] (2025)

https://openid.net/wp-content/uploads/2025/10/Identity-Management-for-Agentic-AI.pdf
29•cgeier•1h ago•6 comments

RacketCon Is Saturday

https://con.racket-lang.org/
32•spdegabrielle•1h ago•12 comments

Polyedergarten: Garden of Paper Polyhedron Models

https://www.polyedergarten.de/e_index.htm
17•isaacimagine•1h ago•1 comments

Cloudflare K2: serverless event streams

https://blog.cloudflare.com/cloudflare-k2-streams/
46•elffjs•2h ago•8 comments

Google breaks promise to provide 10 years of updates to Chromebooks

https://www.osnews.com/story/146052/google-breaks-promise-to-provide-10-years-of-updates-to-chrom...
309•speckx•3h ago•132 comments

GPT-Synopsys: Frontier Intelligence to Revolutionize Chip Design

https://news.synopsys.com/2026-09-30-OpenAI-and-Synopsys-Announce-GPT-Synopsys-Frontier-Intellige...
120•giuliomagnifico•6h ago•66 comments

OpenDLSS: A Vulkan Reimplementation of Nvidia's DLSS 5 Neural Rendering Network

https://github.com/maanHimself/OpenDLSS-NR
202•sagacity•1d ago•97 comments

Gemini 4 Argon

https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/
1568•bradleyg223•20h ago•1038 comments

Figma restricts MCP access to whitelisted clients, excluding Pi

https://twitter.com/GayaniFigma/status/2105295629941350454
58•thdr•1h ago•24 comments

Meta Uses A.I. Data Centers to Avoid Billions in Federal Taxes

https://www.nytimes.com/2026/09/30/technology/meta-ai-data-centers-taxes.html
203•gmays•3h ago•153 comments

Red Hat Being Phased Out of Existence (Like Many Other Companies IBM Bought)

https://techrights.org/n/2026/10/01/Red_Hat_Being_Phased_Out_of_Existence_Like_Many_Other_Compani...
33•amcclure•50m ago•16 comments

FTC is investigating OpenAI, Anthropic and other AI companies over product risks

https://www.cnbc.com/2026/09/30/ftc-ai-probe-openai-anthropic.html
124•dgellow•3h ago•74 comments

Cops Can Bypass iPhone's Automatic Reboot to Get into Locked Phones

https://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey/
80•speckx•1h ago•54 comments

Book of Shapes – Collection of minimal, generative and customizable SVG-patterns

https://bookofshapes.com/
188•eustoria•2d ago•14 comments

The top secret URSALA, RAQUEL, and FARRAH satellites (2025)

https://www.thespacereview.com/article/4951/1
279•Bluestein•18h ago•142 comments

Truemetrics (YC S23) Is Hiring a GTM Founder's Associate

https://www.ycombinator.com/companies/truemetrics/jobs/THLEzXI-gtm-founder-s-associate
1•truemetricsIngo•6h ago

Adding Floating-Point Decimals for Fun and Profit

https://blog.vero.site/post/float
44•ibobev•2d ago•21 comments

Before pixels: Modular industrial dashboards

https://unsung.aresluna.org/before-pixels-modular-industrial-dashboards/
249•leephillips•21h ago•46 comments

Micron CEO Says Memory Supply Will Be Much Tighter in 2027 and 2028 Than in 2026

https://www.techpowerup.com/353296/micron-ceo-says-memory-supply-will-be-much-tighter-in-2027-and...
181•speckx•3h ago•208 comments

Why the Bronze Age Collapsed

https://www.worksinprogress.news/p/why-really-caused-the-bronze-age
343•AnodicElegy•2d ago•231 comments

Los Alamos bets on ENIAC: Nuclear Monte Carlo simulations, 1947–1948 (2014) [pdf]

https://www.tomandmaria.com/Tom/Writing/LosAlamosBetsOnENIAC.pdf
44•nill0•1d ago•1 comments

A brief history of the Bloomberg terminal

https://spectrum.ieee.org/bloomberg-terminal
352•rbanffy•1d ago•150 comments

Surprisingly complex waves reveal the brain's inner workings

https://www.quantamagazine.org/surprisingly-complex-waves-reveal-the-brains-inner-workings-20260930/
232•ibobev•21h ago•92 comments

Launch HN: Magnitude (YC S25) – Self-optimizing inference engine for agents

https://github.com/magnitudedev/magnitude
182•anerli•22h ago•88 comments

Halfspace experimental IDE for solid modeling with distance fields

https://www.mattkeeter.com/projects/halfspace/
171•luu•20h ago•10 comments

5x faster Edge Functions: V8 isolates to Firecracker MicroVMs

https://www.netlify.com/blog/edge-functions-firecracker-microvms/
210•jbott•22h ago•90 comments

An AI sovereign wealth fund isn't progressive – it's techno-imperialism

https://www.ft.com/content/bc178357-793b-45d8-ae3b-d5929159c243
68•Anon84•3h ago•42 comments