Figma Context MCP
by GLips
Give your coding agent access to your Figma data. Implement designs in any framework in one-shot.
Runs on your computer★ 16,165MITUpdated 5 months ago
Install
Crabcrop
Overview
Description from the maker (original English)
Sign and explain crabcrop image URLs, fetch processed-image metadata, and purge cached results.
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi0 of 1 passedChecked from public information; code not scanned yet
- UsageiNot measured yet★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs on your computer
- Transport: stdio
- Category: Design, images & audio
- You need to fill in: CRABCROP_SECRET
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 0 of 1 passed
- Runs on your computer with your user’s permissions (files, network, apps).
- You fill in yourself:
CRABCROP_BASE,CRABCROP_SECRET
Values marked secret are keys to your account. Never share them or paste them into a chat.
You need
- npmNode.js installed (for the npx command)
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"crabcrop": {
"command": "npx",
"args": [
"-y",
"@crabcrop/mcp"
],
"env": {
"CRABCROP_BASE": "your-value",
"CRABCROP_SECRET": "your-value"
}
}
}
}Run this in your terminal
claude mcp add crabcrop --env CRABCROP_BASE=your-value --env CRABCROP_SECRET=your-value -- npx -y @crabcrop/mcpFill in the empty values before running it.
Or copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"crabcrop": {
"command": "npx",
"args": [
"-y",
"@crabcrop/mcp"
],
"env": {
"CRABCROP_BASE": "your-value",
"CRABCROP_SECRET": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"crabcrop": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@crabcrop/mcp"
],
"env": {
"CRABCROP_BASE": "your-value",
"CRABCROP_SECRET": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
Values you fill in
CRABCROP_BASEenvBase URL of the crabcrop server the tools act on (for example https://images.example.com).- The server's signing secret, used by sign_url and purge_result. Keep it in the environment, not in tool arguments.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
Runs on your computer; the tool list appears in your AI app after you install it.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026
- ! Caution
Maker matches the repo
The publisher (crabcrop) is not the repo owner (dayvson); someone else may have listed it
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- – Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
- – Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
- … Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints
Compared with others in Design, images & audioi
- More stars than 0% of the other 2184 servers in this category
- Published to the registry more recently than 71% of the other 2184 servers in this category
- Basic checks equal to or better than 35% of the other 2184 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is Crabcrop safe?
It passed 0 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
You need to fill in: CRABCROP_SECRET
Does it run on my computer or in the cloud?
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
Is it still maintained?
The GitHub repo last changed –, and the latest version (0.1.0) reached the registry 13 days ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
What can I use instead?
In the same category: Figma Context MCP, Claude Real Video, Figma MCP Server
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Claude Real Video
by HUANGCHIHHUNGLeo
Let any LLM watch a video locally — and search everything it has ever watched.
Runs on your computer★ 2,284MITUpdated 2 months ago
Install
Figma MCP Server
by figma
Figma’s official server gives AI your design data so it can turn designs into code or describe them accurately. Connects to Figma’s cloud.
Runs in the cloud★ 2,152Updated 13 months ago
Install
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
crabcrop
Website · Documentation · Playground
Blazing fast, on-demand images.
crabcrop is a Rust-built, lightning-fast on-demand image API supporting all major formats in and out, with over 50 filters and AI features like background removal. It resizes, crops, converts, and filters your images straight from a signed URL. One binary, no pre-generated thumbnails, no build step: the URL is the API.
Everything an image pipeline does, in one signed URL: resize, crop, adjust, shape, overlay, and encode, chained in the order written, plus background removal, studio mode, smart face-safe crops, redaction, and content provenance. Ask for JSON instead of an image and the meta endpoint describes the picture: dimensions, detections, OCR text, and more.
crabcrop is for sites and apps that serve the same images at many sizes and want signed, cacheable image URLs in front of an origin image store.
Install
Shell installer (macOS and Linux):
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/dayvson/crabcrop/releases/latest/download/crabcrop-installer.sh | shDocker: the base image, and the AI variant with background removal and face detection on board:
docker pull ghcr.io/dayvson/crabcrop:0.9.9docker pull ghcr.io/dayvson/crabcrop-ai:0.9.9 docker run -e CRABCROP_SECRET=your-secret-change-me -p 3000:3000 ghcr.io/dayvson/crabcrop:0.9.9
A secret of at least 16 bytes is the only required configuration; the server will not start without one. By default the loader fetches public sources and refuses sources that resolve to private addresses, and an allowlist names any exceptions. See Configuration.
Release binaries: prebuilt tarballs for macOS and Linux, on x86_64 and arm64, are on the releases page.
crates.io: cargo install crabcrop builds the current release from source; the prerequisites are in Deployment.
Quickstart
1. Start the server. For local development, also allow unsigned URLs:
CRABCROP_SECRET=local-dev-secret CRABCROP_ALLOW_UNSAFE=1 cargo run --releasecrabcrop listening on port 3000
2. Request an image. This resizes a source photo to 300x200:
curl "http://localhost:3000/unsafe/300x200/https://example.com/photo.jpg" --output photo.jpgReplace example.com/photo.jpg with the URL of an image you control. You get back a 300x200 JPEG.
3. Sign your URLs in production. Drop CRABCROP_ALLOW_UNSAFE and put an HMAC signature in the first path segment:
curl "http://localhost:3000/9e24ae8bf61c0d40cb6f1ca9f9e1d3e771f6c8bc8b8ab7270e6d15458d4c14ab/300x200/https://example.com/photo.jpg" --output photo.jpgThat signature is HMAC-SHA256 of 300x200/https://example.com/photo.jpg under the secret from step 1. The SDKs and the crabcrop sign command compute it for you; the full signing rules are in URL grammar and signing.
How requests work
Every image request has three parts:
GET /<signature>/<operations>/<source-url>The signature is an HMAC-SHA256 (hex) of everything after it, or the literal unsafe on a server that allows it. Operations are zero or more segments, applied in path order. The source is a full URL, a bucket or file locator, or a short root: reference the server expands against origins it keeps to itself.
A signed URL names a transformation of a source locator, not the source's contents: the cache key is built from the operations and the locator, so if the image at a source changes, a purged entry re-renders the new image under the same URL. Because successful responses carry a one year immutable cache lifetime, a source that must stay fixed under its URL should be versioned or immutable itself (a content hash in the source path is the usual way). A render is cached under the canonical form of its operations, so equivalent spellings share one entry. A preset: segment names an operation string held on the server, so templates stay short and the transformation menu stays operator controlled.
One URL, decoded
https://img.example.com/<signature>/crop:1200x630:smart/filters:format(webp):quality(80)/https://example.com/photo.jpgSmart-crops the photo to the 1200x630 social card size, keeping the subject and any detected faces whole, then encodes it as WebP at quality 80. Sign it with the TypeScript or Python SDK, the crabcrop-url Rust crate, the CLI, or plain curl: same inputs, same URL.
Send Accept: application/json with the same URL and the answer is the render's meta document instead of its bytes: dimensions, format, byte size, and provenance, with richer annotations as opt-ins.
Features
- All major formats, in and out. JPEG, PNG, WebP, GIF, AVIF, and JPEG XL, in and out. HEIC and HEIF decode only; SVG decodes, sanitized and rasterized. Name no format and the Accept header decides: AVIF first, then JPEG XL, then WebP. An explicit
format(...)always wins. - More than photos. The source can be one frame of a video, one page of a PDF, an object in S3 or GCS, a local file, or a short
root:reference. Originals can also arrive through the signed upload endpoint, off by default. - 51 filters, one chain. Resize, crop, fit-in, and pad are their own path segments. The 51 filters chain inside one
filters:segment, everything running in the order written. - Smart crop, face safe. The crop window finds the subject, and keeps detected faces whole instead of clipping them at the edge.
- Studio mode. The listing shot in one filter: cut out, backdrop, contact shadow, margin. Or
studio(scene)reframes the photo on its subject and corrects the light and color. - Background removal. Your ONNX model, in process. The subject stays, the background becomes real alpha.
- AI upscale. Super-resolution from a model you supply rebuilds detail instead of stretching pixels, and it never falls back to a plain resize.
- Object removal. Name a rectangle and an inpainting model fills it in from the surrounding pixels. Everything outside the rectangle comes back bit-identical.
- Face detection and redaction. Blur or pixelate faces, or every detected object of a class, following the object's silhouette when a segmentation model is configured. Redaction never guesses: a detection failure fails the request.
- Metadata that describes the picture. JSON meta for every render: dimensions, format, byte size, provenance. Richer answers are opt-ins with their own model sets: CLIP tags and alt text, detections, moderation verdicts, embeddings, an aesthetic score.
- Reads the text in the picture. Opt a meta request in and the answer reads the picture: the text lines in reading order, each with its box and a confidence score. The annotation never touches the image bytes.
- Provenance, checked and signed. Meta reports the C2PA Content Credentials a source carries: manifest present, whether it validates, who signed it. With your own certificate, outputs are signed as served, the source recorded as an ingredient, so the chain survives the transform.
- Sealed URLs. For links that stay public but unreadable: the whole recipe, operations and source, encrypted into one opaque token in the signature slot. Only the server opens it. The readable form stays the default.
- Presets and purge. Server-side preset names keep templates short. Purge one result, or a whole preset group, with signatures from their own subkey.
- URLs that explain themselves. Put
explain/in front of any signed URL and the server reports on it instead of serving the image. - Sources on your terms. The loader fetches only what your policy allows: host allowlists, private address blocking, the source policy re-checked on every redirect hop, and fixed fetch and decode bounds, so a small file cannot expand into gigabytes.
Documentation
This README is the front door. The full reference lives on the website and in this repo's docs folder:
- Full documentation: every operation with examples and interactive demos, section by section.
- Playground: build, sign, preview, and debug URLs in the browser. The secret never leaves the page.
- The reference, in this repo:
- URL grammar and signing: request anatomy, signing, sealed and expiring URLs, source images and source roots.
- Operations: resize, fit-in, pad, the crop family, focal forms, debug view, presets.
- Filters: the pixel filters, encoding directives, watermark, overlay, text, the AI filters, and studio mode.
- Media sources: format negotiation, video output, video frames, PDF pages.
- Meta and provenance: meta responses and C2PA verification and signing.
- Responses and errors: response headers, the cache tiers, color management, the fallback image, and the error table.
- Endpoints and CLI: health, metrics, purge, uploads, self-explaining URLs, cache groups, and the command line verbs.
- Configuration: every environment variable, server-wide default operations, rotating the secret.
- AI features: the model-backed features and declared detectors.
- Clients and SDKs: the Rust crate, the TypeScript and Python SDKs, framework loaders, the WordPress plugin, and the MCP server.
- Deployment: platform recipes, CDN guides, and production notes.
SDKs and integrations
Build and sign URLs from code: @crabcrop/url for TypeScript, crabcrop_url for Python, and the crabcrop-url Rust crate, all running the same spec test vectors, so client and server cannot drift. Loaders and integrations cover Next.js, Nuxt, Hydrogen, Astro, and SvelteKit, plus a WordPress plugin. For coding agents, a first-party MCP server exposes signing, explaining, meta, and purge over the same surface. Details in Clients and SDKs.
The server binary doubles as its own operator CLI: crabcrop sign, explain, meta, purge, seal, upload, and convert-thumbor run against a server (or offline, for the grammar-only verbs) with the same configuration conventions.
Migrating from another service: guides for Thumbor, imgproxy, Cloudinary, imgix, Cloudflare Images, ImageKit, and Gumlet.
Deployment
Every recipe runs the same server, configured entirely through the environment. Release images are published to GHCR as ghcr.io/dayvson/crabcrop, with the AI variant at ghcr.io/dayvson/crabcrop-ai. Recipes ship for Kubernetes (Helm and Kustomize), ECS Fargate, Cloud Run, Container Apps, Docker Compose, and a binary on a VM, plus CDN guides for Cloudflare, CloudFront, Fastly, BunnyCDN, and Akamai. See Deployment.
Development
cargo build --lockedbash scripts/test_all.sh
Security
Found a security vulnerability? Please report it privately: see SECURITY.md. Please do not open a public issue, pull request, or discussion for security problems.
License
MIT. See LICENSE.