docs: record why Figma MCP is blocked in the CI rail but works on the box - #33
Open
mcarter-astronautdev wants to merge 1 commit into
Open
docs: record why Figma MCP is blocked in the CI rail but works on the box#33mcarter-astronautdev wants to merge 1 commit into
mcarter-astronautdev wants to merge 1 commit into
Conversation
Separates two environments that fail for different reasons, and records why the implementer rail is the one that cannot have it. The box: a headless `claude -p` is not credential-less. It cannot complete a first-time OAuth consent, but it reuses one already completed. Verified — mcp__figma__whoami against the remote server returned a real identity and seat, headless, no personal access token. The production box gets Figma a second way, as a claude.ai account connector on the agents' account, which is why its prefix is mcp__claude_ai_Figma__ and why driver-bonsai-mcp/pipeline/triage.job.env deliberately withholds CLAUDE_CODE_OAUTH_TOKEN. Adding a local ~/.claude.json entry there would grant nothing and fail silently. The CI rail: account connectors are gated on the user:mcp_servers OAuth scope, and `claude setup-token` is inference-only by design — the docs state that CLAUDE_CODE_OAUTH_TOKEN "can only make model requests, so it can't ... fetch claude.ai connectors." The ANTHROPIC_API_KEY fallback is excluded by a separate precedence rule. A fresh runner also has no credential store, and the remaining path (explicit --mcp-config) needs a static credential Figma will not issue. Design->code is already solved by capturing Figma context into the issue body at triage, which orchestrator.md implements; this doc is the fleet-side record of why claude.yml carries no Figma wiring.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docs/figma-mcp-in-ci.md. Docs only — no reusable changes, no tag, no wave.Closes out the "add Figma MCP to
--allowedToolsinclaude.yml" to-do as not doable, and records why so it isn't re-researched.Why it can't be done
Three findings, each verified against primary sources rather than inferred:
claude -prun can't complete a first-time OAuth consent, but it reuses one already completed. Confirmed by callingmcp__figma__whoamiagainst the remote server headlessly — real identity and seat returned, no personal access token anywhere. This is why the box works.user:mcp_serversOAuth scope, andclaude setup-tokenis inference-only by design. The docs say it outright:CLAUDE_CODE_OAUTH_TOKEN"can only make model requests, so it can't ... fetch claude.ai connectors." TheANTHROPIC_API_KEYfallback is excluded by a separate precedence rule. Both ofclaude.yml's auth paths are therefore closed.--mcp-configentry needs a static token.mcp.figma.comis OAuth-only; Figma Support has said PAT auth "cannot be enabled" — a refusal, not a gap. Plan Access Tokens authenticate against the REST API only.Also notes that
--allowedToolsonly permits a tool and never provides one —mcp__github_inline_comment__*works only because the action bundles that server and prefix-checks the allow-list to decide whether to install it.What the doc is careful about
mcp__claude_ai_Figma__, notmcp__figma__. Adding a local~/.claude.jsonentry there would grant nothing and fail silently — the 2026-07-09→15 outage shape. The doc says don't.driver-bonsai-mcp/pipeline/triage.job.envwithholdsCLAUDE_CODE_OAUTH_TOKENdeliberately for exactly the reason in finding 2. Worth not "tidying" later.orchestrator.md. This doc is just the fleet-side record of whyclaude.ymlcarries no Figma wiring.Why
claude.ymlis untouchedEditing it puts all 23 repo@branch pairs out of content parity and turns
tools/fleet-pin-audit.sh --stalered fleet-wide until a re-copy wave — a real wave for a comment. The doc suggests letting a one-line caveat ride along with the next edit that needs a wave anyway (the queued canonical-blockquote re-copy +DRIVER_AGENTS_REFbump).Re-open tripwire
Only if Figma ships non-interactive auth for
mcp.figma.com. The doc records the exact wiring for that day — inline JSON only (a file path is silently dropped when the action contributes its own inline config), read tools only, and thelint.ymlquote gate moving 4 → 6.