MCP Server for AI Agents

Connect Claude Code, Cursor or any MCP client to your design system. Live tokens on every generation, a lint tool for generated code, and how to run it as admin.

Overview

Flash serves every design system as an MCP server, so Claude Code and Cursor read your current tokens instead of a rules file that has gone stale.

Agents read the published version of a system. Drafts stay in the editor until someone presses Publish; nothing needs re-sending after that.

Connect

Server URL: https://flashdsm.com/api/v1/mcp. Clients sign in through Flash (OAuth with dynamic client registration): pick one design system, then read only or read + propose. No token goes in a config file.

Claude (web and desktop)

  1. Settings, Connectors, Add custom connector.
  2. Paste https://flashdsm.com/api/v1/mcp and click Add. Leave the OAuth fields empty.
  3. Click Connect. Flash opens: sign in, pick one design system, choose read only or read + propose.

Claude Code

  1. Add the server, then run /mcp in the session and sign in.
claude mcp add --transport http flash https://flashdsm.com/api/v1/mcp

Cursor and VS Code

  1. Put this in ~/.cursor/mcp.json, or .mcp.json at the project root. The first call opens Flash sign-in in the browser.
  2. In Cursor you can install the flash-genome plugin instead (github.com/itay1313/flash-cursor-plugin). It carries the same URL.
{
  "mcpServers": {
    "flash": {
      "url": "https://flashdsm.com/api/v1/mcp"
    }
  }
}

In the Figma agent

Figma's agent and Figma Make can hold Flash as a custom connector. The agent reads your design system and builds the file's variables the way the Flash plugin does.

  1. In a Figma design file, open the agent, then Add context > Connectors > Manage > Created by you > Create.
  2. MCP server URL: https://flashdsm.com/api/v1/mcp. Name: Flash. Leave Advanced settings empty; authentication is OAuth.
  3. Click Connect, sign in to Flash, pick one design system, choose read only or read + propose, and Allow.
  4. Ask the agent: Read flash://figma/playbook.md, then build this system's variables and text styles in this file.

Changes from the file come back to Flash as a proposal under Sync > Review; nothing is applied until a person approves it. Requires a paid Figma plan with a Full seat.

Tools

  • get_design_system: The canonical FlashAtomicDocument v2: foundations, semantics, components (with bindings on token auth), modules, and relations. Includes revision for sync.
  • get_revision (genome_id): Only the live revision and when it last changed. Genome asks every fifteen seconds whether Flash moved, so your repo follows each edit with no Publish. It answers the codebase linked to the system: a token with write access, naming the system.
  • get_tokens: Every token in the published version as JSON (v2 foundations + semantics, or the legacy sanitized bundle). Includes the live revision to send back as base_revision.
  • get_kit: The same system as a markdown reference, values plus usage rules. Cheaper to load once into context than to re-read token JSON on every turn.
  • list_components: The names of the components this system defines.
  • get_component (name): Everything the system records for one component, looked up by name. Token auth includes variant/state bindings; share links omit bindings.
  • search_components (query): Search components by name or description (case-insensitive).
  • list_modules: Every module, with its part count, the components it is built from, and how many token bindings it carries.
  • get_module (module): One module by id or name: its parts in order, each resolved to its component, and its bindings.
  • get_relations (token?): With a token: what it aliases, what aliases it, and what binds to it directly. Without one: every alias edge, binding and module part.
  • get_impact (token): What breaks if a token changes: every token that resolves through it, and the components and modules that end up using it. Worth calling before an agent edits a token.
  • get_agent_rules: A short markdown rules block for this system: which components exist, which tokens to use instead of raw values, and the connect config. Paste it into CLAUDE.md, .cursorrules or a system prompt.
  • list_design_systems: Design systems accessible to the MCP token owner (id, name, revision, editor URL).
  • create_design_system: Create a new v2 design system from a code scan payload or uploaded document. Deterministic — no AI. Needs read + propose.
  • sync_from_figma (file_key, access_token?): Pull Figma variables into a pending change set for human review. Does not auto-apply. Needs read + propose.
  • get_figma_variable_plan (collection?, cursor?, page_size?): What the Figma plugin would write for this system, as data: collections, modes, variable paths, values, aliases and code syntax, paged per collection. For an agent with canvas access (the Figma agent, or use_figma from Claude Code) to build the same file the plugin builds. Read flash://figma/playbook.md first.
  • get_figma_text_styles: The text styles the plugin would create, each with the variables to bind size, weight, line height and family to.
  • get_figma_sync_status (file_key?): Where the Figma file stands against the system: current revision and spec hash, the last recorded Figma write, how many revisions behind, and pending proposals with the review URL.
  • push_figma_variables (collections[], styles[]?, file_name?, file_key?, mode_name?, dark_mode_name?, light_mode_name?): The Figma file's local variable collections and styles, proposed to this system as one change set for human review. Same payload the plugin's Push sends; nothing is applied until someone approves it in Flash. Needs read + propose.
  • record_figma_sync (spec_hash, revision, file_name?, file_key?, variables_written?, styles_written?, warnings?): Records that an agent wrote this system's variables into a Figma file, so the Sync page and get_figma_sync_status show the file as current. Needs read + propose.
  • propose_change_set (base_revision, changes[{section, name, value}], source_label?): Token value edits from a linked repo, proposed as one change set for human review. Nothing is applied, and a push against an older revision is refused. Genome's push_to_web calls it. Needs read + propose.
  • propose_code_scan (scan{tokens, files[{path, text}], workspaceRoot}): A local code scan proposed into this system as one change set for human review. Scanned values update tokens with the same name and new names are added; nothing is deleted and aliases are left alone. Genome's scan_workspace calls it with merge. Needs read + propose.
  • apply_code_scan (scan{tokens, files[{path, text}], workspaceRoot}, codebase?): What the code changed since the last scan, applied with no review card. Genome's watcher calls it a couple of seconds after you save. Only tokens whose code value changed come in, a token changed in Flash since keeps Flash's value, nothing is deleted, and the editor says what changed with Undo. Needs read + propose.
  • record_pull (codebase_id, published_version_id, items[]): Genome reports which items it just wrote into a repo, against the published version it pulled. That is how Sync knows which codebase holds which release. Needs read + propose.
  • check_violations (code, language): Lints a snippet of CSS, JSX or HTML against your system and returns the hardcoded colors and spacing that should have been tokens, each with the token to use instead. Worth telling your agent to run this before it calls a task done.
  • suggest_token (value): Takes one raw value like #3b82f6 or 12px and answers with the token for it, or the nearest token and how far off it is.
  • propose_token (section, name, value, reason): Files a proposal for a token the system is missing, so the agent asks instead of inventing a value. It lands in your Review queue and nothing changes until you accept it. Needs read + propose.

What it will not do

  • It never changes a system on its own. Write tools file a proposal or record an event, and a person accepts proposals in Flash. Nothing is deleted over MCP.
  • It cannot read your repo. Code reaches Flash only as a snippet passed to check_violations.
  • It is stateless HTTP and rate limited to 120 calls a minute per IP address.

When it breaks

  • 404 on the /mcp/<slug> URL. The live sync link is off, or the slug is stale. Sync tab, Agents, enable the link. Disabling it kills every slug URL by design.
  • 401 Invalid or revoked MCP access token. The token was revoked, or it was pasted with a character missing. Mint a new one. A bad token is never quietly downgraded to public access, which is the point.
  • 401 on the first call, and no sign-in window. The client reached /api/v1/mcp without credentials and does not do OAuth. Use a client that signs in (Claude, Claude Code, Cursor, VS Code), add an access token header, or use the slug URL.
  • 405 on connect. The client is trying to open an SSE stream with GET. Flash speaks stateless streamable HTTP. Pass --transport http, or url in mcp.json rather than a command.
  • propose_token is missing from the tool list. The connection is read-only: a share slug, or an OAuth sign-in where read only was picked. Disconnect and sign in again, choosing read + propose, or use an access token. Write tools are never listed on a connection that cannot use them.
  • The agent still writes the old value. Agents read the published version, and the change is still a draft. Press Publish in the editor. The next tool call has the new value; nothing needs re-sending.
  • Too many MCP requests. More than 120 calls in a minute from one IP address. Usually a retry loop. Ask the agent to call get_kit once instead of get_tokens per file.
  • check_violations comes back clean on obviously wrong code. Only hex token values can be compared. Read indexed_colors in the result. Zero means nothing was there to compare against, not that the snippet is fine.