DSH Figma Bridge

Setup and usage — the page the Figma Community listing points at.

This plugin gives a program on your own computer read and write access to the Figma file you have open. It does nothing by itself: it waits for that program to ask for something, then acts on the real layer tree.

The plugin is half of a pair. It needs a local app to talk to. Without one it shows an explicit offline message and changes nothing — it never fails silently. Set up the local app first, then run the plugin.

1. What it is good for

Bulk edits that are tedious by hand: unify spacing, rename layers, re-parent a subtree.
Checking a file the way a linter would: read the layer tree as data, and find things that are invisible on screen — such as hard-coded colours where a variable already holds the same value.
Driving the canvas from a script, a CI job, or an agent you configured yourself.

2. Install the local app

You need Node.js 22 or newer (nodejs.org) and pnpm. Then, in a terminal:

git clone https://github.com/izt-pixel/dsh-figma.git
cd dsh-figma
pnpm install
pnpm build

Start it in the foreground:

pnpm serve:standalone

Leave that terminal open. It serves the local endpoint the plugin talks to: http://localhost:8790.

3. Install the plugin in Figma

Open any file in the Figma desktop app.
Menu Plugins → Development → Import plugin from manifest…
Choose packages/plugin/manifest.json inside the folder you cloned.
Run Plugins → Development → DSH Figma Bridge.

The panel should read connected, with a green dot. It also shows a build id — a short hash of the plugin build — which is how you confirm the version Figma is running matches the one you built.

4. What the local app can ask for

Six capabilities, each a single request and response. The local app exposes them over MCP (Model Context Protocol) on stdio, which is convenient for editor integrations — but the protocol is not the point: anything that can talk to http://localhost:8790 directly can drive the canvas the same way.

Capability	What it does	Changes the file?
`status`	Link state, file, page, current selection	no
`ping`	Round-trip latency	no
`describe`	Read the canvas as structured JSON, including auto-layout and variable bindings	no
`screenshot`	Export nodes as images	no
`apply`	Batch create / update / move / rename / delete	yes
`tokens`	List, audit, bind, create and delete design variables	yes

Three things worth knowing

One apply call is one undo step. A whole screen built in a single call rolls back with one ⌘Z, not forty.
Unknown property names are rejected, not ignored. A typo fails loudly instead of leaving you believing you set something you did not set.
Reads and writes share one vocabulary. describe reports auto-layout in Figma's own terms, so what a caller reads is what it can write back.

Check the link without Figma

curl http://localhost:8790/figma/health

It prints the plugin instances currently connected and the file each one is attached to. When nothing is connected the local app still answers, which is how you tell "app not running" apart from "app running, plugin not running".

Troubleshooting

Symptom	Cause	Fix
Panel says `offline`, `health` unreachable	The local app is not running	Start it: `pnpm serve:standalone`
Panel says `offline` but `health` works	Port mismatch, or Figma blocked the request	Align the port in three places: the panel's Port field, `FIGMA_BRIDGE_PORT`, and `allowedDomains` in the plugin manifest
Several plugin instances reported at once	The plugin is open in more than one Figma tab	Close it everywhere except the file you are working in
A request seems to do nothing	The app is attached to a different file or page	Ask for `status` and check the file and page it names

Privacy

The plugin's only network access is http://localhost:8790 — a program on your own machine. There is no server operated by the plugin's author, no analytics, and no telemetry. Your file's contents go to the local app you run, and from there only to whatever client you chose to connect. Full text: privacy policy.

Security notes

The local app binds loopback addresses only (127.0.0.1 and ::1), so it is not reachable from your local network or the internet.
Any process on your own machine can reach that port. Treat it as you would any local developer server, and do not leave it running with an untrusted client attached.