Figma

When a pull request or its linked issue links to a Figma design, MergeHarbor reads the linked frames as text so the review can check the UI change against the design.

What it does in reviews

• Finds the designs a pull request refers to. Figma links (figma.com/design/…, /file/… and /proto/…, including branches) in the pull request title and description, and in the issues it links to. Only linked files are read.
• Reads the linked frame as text. For a link with a node-id, MergeHarbor reads that frame: its layer names, the text in it, and its Dev Mode annotations. It adds the file’s unresolved comments on that frame (the message only, never who wrote it) and the frame’s Dev Mode resources. For a link to a whole file, it lists the file’s pages and top-level frames.
• Uses it as review context. The design text is given to the review alongside the issue, so comments can point out copy, states or components that differ from the design. Text that looks like a secret is redacted first. No extra model call is made.

What is read and what is never read

• Read: the frames behind the links, as text, and their unresolved comments and Dev Mode resources.
• Never read: images, exports or thumbnails, files nobody linked, other files, projects or teams, and the names of comment authors. MergeHarbor never lists or searches your Figma workspace and never writes to Figma.

Design text is cached for a short time (10 minutes by default), deleted within 24 hours, and never written to logs. If an administrator turns on Keep linked documents in the knowledge base, text that issue triage reads is kept for the days they choose (1–365) after last use instead.

Connect

1. In the console, open Integrations and choose Connect on Figma (under Design). You need the settings.manage permission.
2. Sign in to Figma and allow access. MergeHarbor asks only for current_user:read, file_content:read, file_comments:read and file_dev_resources:read.
3. Choose Test connection.

With a personal access token instead. In Figma, open Settings → Security → Personal access tokens and create a token with read-only access to file content, comments and Dev resources. On the Figma card, choose Use a personal access token and paste it. The token acts as you, so MergeHarbor can read the files you can open.

Per-repository settings

In Settings, you can limit the integration to some repositories. Reviews of other repositories never read Figma.

Limits

• At most 3 Figma links are read per review.
• Text only: no images are read or sent to a model.
• The design text counts toward the review’s overall context limit for linked documents.

Disconnect

Open the integration in Integrations and choose Disconnect. MergeHarbor deletes its tokens and cached text. Then remove MergeHarbor (or delete the personal access token) in Figma under Settings → Security.

Self-hosted installations

Create an OAuth app in Figma (step by step in docs/OAUTH_APPS.md, “Figma connections”): add the callback URL {PUBLIC_URL}/integrations/connect/figma/callback and the scopes current_user:read, file_content:read, file_comments:read and file_dev_resources:read, then set FIGMA_OAUTH_CLIENT_ID and FIGMA_OAUTH_CLIENT_SECRET. Without the app, Figma connects with a personal access token only.