The Protocol Is Open. The Catalog Is Not.

The knock that returns 403

Point an unlisted coding agent at https://mcp.figma.com/mcp and the conversation ends before any tool name appears. Dynamic client registration comes back HTTP 403 Forbidden. There is no token fallback on the remote path. There is no DIY OAuth app that can mint the mcp:connect scope. Your own Figma developer-portal credentials do not help.

Figma's own developer docs say it in one line: only clients listed in the Figma MCP Catalog can connect to the remote server. Everyone else joins a waitlist. Named regulars include Claude Code, Cursor, VS Code, Codex, and a growing roster of IDE agents. The protocol is open. The guest list is not.

When Pi hit the bouncer

In late September the maintainers of pi-mcp-adapter merged a blunt fix. Figma's remote server only accepts OAuth clients on its allowlist. Registration for Pi was refused. The PR does not pretend the remote path will reopen on a schedule. It makes the working path the easy one: if the Figma desktop app is installed, offer Figma (desktop) and write http://127.0.0.1:3845/mcp.

That local server skips the OAuth gate. It also skips the full remote tool surface. Write-to-canvas, Code Connect depth, and several Make resources stay on the catalog path. The community is not "breaking" Figma. It is walking around a locked front door into a smaller side entrance.

Hacker News put the story on the front page as "Figma restricts MCP access to whitelisted clients, excluding Pi" (about 189 points, 100+ comments). The split in the thread was predictable. Half said MCP was supposed to be open, so this must be a violation. The other half read the authorization spec and shrugged.

Spec-compliant, and that is the problem

The uncomfortable finding, laid out cleanly by Fervor AI, is that Figma is not violating Model Context Protocol. The protocol tells an agent how to knock. It never promised every door would open. Allowlists, reputation checks, and domain-age gates are all in the design space the auth docs leave to the server.

So "we support MCP" from a SaaS vendor increasingly means "we support MCP from our approved client list," not "any agent that speaks the wire format can attach." Gateways learn this the hard way. MCP Manager's Figma guide states the remote URL will fail with Invalid scope: mcp:connect and tells operators to use the desktop server instead. A gateway cannot bluff its way onto someone else's catalog.

Catalog membership is the new distribution

Watch what vendors celebrate. JetBrains posted that Junie, its AI coding agent, is featured as an official partner in the Figma MCP Catalog. The applause is not about implementing JSON-RPC correctly. It is about being on the list that makes OAuth complete before the browser tab even feels useful.

Call the pattern what it is: a Guest List Protocol. The open standard becomes the hallway. The catalog becomes the velvet rope. Design-to-code context (frames, variables, Code Connect, canvas write) is the room behind the rope. If your internal harness, boutique agent, or experimental client is not on the list, your "Figma MCP integration" is a 403 with good documentation.

Earlier this month GitHub showed a different MCP pressure point when it cut a large tool surface roughly in half and barely moved token cost. That was inventory design. Figma's move is identity design. Same protocol family, different choke point: who is allowed to hold the socket, not how many tools hang off it.

The side doors are already open

Builders are not waiting politely. Three escape hatches keep showing up on X and in adapter changelogs:

• Desktop local MCP at 127.0.0.1:3845 when a Dev or Full seat is present. Fewer tools. No allowlist. Real enough for many read paths.
• REST and plugin bridges that never asked the remote MCP for permission in the first place.
• Design-as-code outside Figma - HTML/CSS canvases in the repo, agents that never need mcp.figma.com. Competitors that let any local agent edit are part of the same gravity well HN commenters named out loud.

Figma staff have said the mcp:connect gate is intentional while the remote server is still treated as a controlled surface. Whether the waitlist thaws is a business question, not a protocol question. Until it does, "catalog or localhost" is the actual architecture diagram.

What to check before you bet a workflow

If design-to-code is on your critical path this quarter, do the boring inventory first:

1. Which MCP clients does the team actually run day to day?
2. Are those clients on the live Figma catalog page, with the access mode you need (remote write vs local read)?
3. If not, is desktop MCP acceptable, or do you need REST/plugin, or should the canvas leave Figma?

Do not build a custom harness against the remote URL and assume Dynamic Client Registration will save you. It will not. The 403 arrives before the browser handshake feels real.

MCP won the wire. The guest list is winning the room. Your next integration decision is not "does it speak MCP?" It is "whose list are we on, and what happens when we are not?"