Foreword

In the plugin ecosystem of DeepSeek Harness, tool calls often bring external data directly into the model context. If you want an agent to view Figma designs before writing frontend code, handing the complete Figma JSON directly to the model may introduce risks such as context inflation, uncontrollable node scale, and credential exposure.

FrameEvidence addresses this issue by providing a read-only Figma REST design evidence plugin: it only returns bounded node trees or temporary render URLs for single nodes, does not write to Figma, and does not expose the Figma PAT to the model.

What is this

FrameEvidence is an MIT-licensed plugin maintained by fieldnote-ops, positioned as a bounded, read-only Figma REST design evidence plugin for DeepSeek Harness.

It targets scenarios where agents need to access limited Figma design information before implementation, with the core goal of controlling the scale of Figma data entering the model context and constraining credential access boundaries.

Core Features

FrameEvidence v0.1 provides two main tools:

  • figma_inspect: Returns a bounded Figma node tree with implementation details, rather than dumping the complete Figma JSON schema into the model context.
  • figma_render: Returns temporary PNG, JPG, SVG, or PDF render URLs for a single node.

Its access and data boundaries are as follows:

  • Read-only access: Initiates REST requests only to https://api.figma.com/v1, refuses redirects, and does not write to Figma.
  • Credential boundary: The Figma PAT is read from host environment variables, not accepted as model tool parameters, and not returned in tool or probe outputs.
  • Context boundary: The original API response has a byte limit; node tree depth and node count are restricted before reaching the model.
  • Rate pressure: Successful reads are cached in memory to reduce Figma REST rate limit pressure.
  • Variable boundary: The Figma Variables REST API is Enterprise-only, so v0.1 retains bound variable IDs but does not fetch variable values.

Installation and Enablement

First, confirm that the runtime environment meets the Node version requirements:

Node ^22.19.0 || >=24.0.0

The plugin also depends on the following peer packages:

@deepseek-ai/cordis ^4.0.1
@deepseek-ai/dsh-tools >=0.1.0-rc.6 <0.2.0
@deepseek-ai/schemastery ^3.18.1

Install to the DSH Web profile:

dsh plugin --profile web add github:fieldnote-ops/frameevidence#97f67c9a049a26c9e8b38e7e764d2572897a6429

The command above pins to a public commit. If you later need to include real Figma tokens or design files in the workflow, it is recommended to pin to a reviewed commit instead of using main directly.

The plugin runs with the permissions of the current dsh process. Before installation, it is recommended to check the source code, license, dependency manifest, and tool invocation surface to confirm that the read-only boundaries meet your security requirements.

Typical Usage

  1. Install the plugin to the Web profile:
dsh plugin --profile web add github:fieldnote-ops/frameevidence#97f67c9a049a26c9e8b38e7e764d2572897a6429
  1. Create a Figma PAT. Grant only file_content:read permission. Figma PATs expire after a maximum of 90 days, so it is recommended to choose a shorter validity period and revoke them after the probe is no longer needed.

To avoid the PAT entering shell history, you can read the environment variable interactively:

printf 'Figma PAT: '
IFS= read -r -s FIGMA_ACCESS_TOKEN
printf '\n'
export FIGMA_ACCESS_TOKEN
npx @deepseek-ai/dsh web

  1. After starting the Web profile, provide the agent with a Figma file URL or node URL, and ensure the account owning the token has access to the resource. Then, instruct it to inspect the design before implementation, rather than generating code directly.

  2. If you want to perform the optional live API probe, you need to clone the repository first, then run:

npm ci --ignore-scripts --registry=https://registry.npmjs.org

Then inject the PAT and the Figma node URL you want to probe:

printf 'Figma PAT: '
IFS= read -r -s FIGMA_ACCESS_TOKEN
printf '\nFigma node URL: '
IFS= read -r FRAMEEVIDENCE_URL
export FIGMA_ACCESS_TOKEN FRAMEEVIDENCE_URL
npm run live:smoke
unset FIGMA_ACCESS_TOKEN FRAMEEVIDENCE_URL

This probe is opt-in and will not execute automatically.

  1. For local development checks, you can run:
npm install
npm run check

Suitable Scenarios and Notes

FrameEvidence is suitable for the following development workflows:

  • You need to read Figma node information in DSH for design reference before generating frontend code.
  • You want to control the scale of the node tree returned to the model, avoiding the complete Figma JSON entering the context.
  • You want the plugin to access the Figma REST API in a read-only manner, without writing to Figma.
  • You want the Figma PAT to come only from host environment variables, not entering model tool parameters or tool outputs.

Pay special attention to:

  • This plugin is a read-only design and does not write to Figma.
  • Requests are sent only to https://api.figma.com/v1, and redirects are refused.
  • The PNG, JPG, SVG, or PDF URLs returned by figma_render are temporary URLs and should not be used as persistent storage.
  • Figma REST rate limits depend on the seat and plan.
  • The Figma Variables REST API is Enterprise-only. v0.1 retains bound variable IDs but does not fetch variable values.
  • The optional live API probe has not been executed against real Figma files.
  • Marketplace acceptance status is not yet verified; there are currently no independent user adoption, purchase validation, or income records.
  • This project is an independent open-source project and has no affiliation, sponsorship, or endorsement relationship with Figma, Inc. or DeepSeek.
  • The DSH Community Directory is an independent site and should not be understood as an official app store.

Conclusion

The value of FrameEvidence lies in organizing Figma design information into bounded evidence that is more suitable for agents to use: read-only, with context limits, and without credential leakage, providing two basic tools: figma_inspect and figma_render.

Directory page:

https://www.skillhub.cn/plugins/fieldnote-ops/frameevidence

GitHub:

https://github.com/fieldnote-ops/frameevidence