Framer MCP Server: Setup, Tools & Real Limits
Framer now offers an official agent route, while true MCP connections remain third-party—here is how to choose, connect, and contain the risk.
Framer MCP can let an AI agent inspect and change a real Framer project, including CMS entries, canvas nodes, styles, code files, redirects, and publishing state. But the name is misleading: Framer’s recommended connection is now its official Agent CLI, not an official MCP server, while actual MCP endpoints come from third-party marketplace plugins.
Table of contents
- What Framer MCP actually is
- What exists today
- Setup
- Tools you get
- Permissions and blast radius
- Real limits
- When not to use Framer MCP
What Framer MCP actually is
Framer MCP is best understood as an agent-to-project control layer, not a new Framer editor. It translates a request such as “update every outdated plan price from this JSON file” into reads and writes against project data, then returns structured results.
The useful work is concrete: edit CMS items, inspect page structure, replace repeated copy, update styles, manage redirects, work with code files, and prepare a publish. Framer’s External Agents documentation confirms access to canvas structure, CMS, assets, localization, exports, metadata, and publishing operations. See MCP capabilities to distinguish tools, resources, and prompts.
Our view: use an agent for deterministic, reviewable batches. “Import these 80 records and match on slug” has inputs and a testable result; “make the site look premium” invites subjective edits that are difficult to audit.
What exists today
There is an official Framer agent connection, but there is no first-party Framer MCP server to install. Framer says its native Agent works without manual MCP setup; products branded as Framer MCP are third-party bridges.
| Route | Maintainer | Framer must stay open? | Best fit | Main trade-off |
|---|---|---|---|---|
| Framer Agent CLI | Framer | No | Supported external-agent workflows | Uses agent skills/local tools, not an MCP endpoint |
| Framer Server API | Framer | No | Scripts, jobs, or your own MCP adapter | Open beta and JavaScript-only today |
| Marketplace MCP plugin | Third party | Usually yes | A client that requires MCP | Extra operator and tunnel in the trust chain |
The official setup page names Claude Code, Codex, Cursor, Gemini CLI, and Windsurf, and says no separate MCP server is required. This is what we would choose first; it keeps support responsibility clear. Compare other integrations in our best MCP servers guide.
A community option exists in Framer’s marketplace. The MCP plugin listing describes a Cloudflare Worker, WebSocket tunnel, and plugin that must remain open, and labels itself unofficial. That suits experiments, but production users inherit the author’s security choices, timeout behavior, and release cadence. Browse official MCP servers if first-party ownership is mandatory.
Setup
For most users, install Framer’s Agent CLI and authorize one project at a time. Choose the community MCP route only when a standard MCP connection is a firm requirement.
Official Framer Agent route
The official path requires Node.js, a supported local coding agent, project access, and a project API key created during authorization. Framer documents one setup command, so there is no reason to invent an mcpServers block.
- Run
npx @framer/agent setupin a terminal. - Follow the generated instructions in your local agent.
- Give the agent a Framer project link.
- Complete browser authorization and add the API key when prompted.
- Start with an inspection request, not a write.
Framer’s connection guide confirms the command, browser approval, and API-key flow. Keep the key out of prompts, repositories, screenshots, and shared shell history. Framer documents project authorization, not selectable OAuth scopes, so do not assume scopes the UI does not show.
Community MCP route
Install the marketplace plugin, open it in the intended project, enable its optional session secret, and copy the exact server URL into your client. Configuration differs by client, and the vendor supplies a URL rather than a package command. Use the config generator only after you have that exact URL.
Do not copy generic JSON from an aggregator. The listing says the URL contains a user identifier and optional secret, only one plugin instance can connect per user, and requests have a five-second timeout. Guessed package names or local commands are therefore harmful.
Tools you get
The official route exposes operations based on Framer’s Agent CLI and Server API; agent-facing identifiers can change during beta. The names below are documented Framer API operations, not invented MCP aliases.
| Documented operation | What it does | Risk |
|---|---|---|
getNodesWithType | Finds canvas nodes of a given type | Read |
setAttributes | Changes supported properties on a node or item | Write |
getCodeFiles | Lists project code files | Read |
createCodeFile | Adds a code file to the project | Write |
getRedirects | Lists configured redirects | Read |
addRedirects | Adds redirect rules | Write |
getLocalizationGroups | Reads localization groups and sources | Read |
setLocalizationData | Updates localized values | Write |
These names appear in Framer’s Plugin API reference, whose surface underpins the Server API. A community server may combine several into higher-level tools; its marketplace page publishes capability labels, not a guaranteed protocol schema. Inspect the tools reported by your client after connection.
Permissions and blast radius
Start read-only in practice, even when the credential can write. Ask for an inventory and proposed diff, approve a narrow batch, then verify in Framer before publication.
Framer says plugins can do only what the current user can do, and unavailable methods return permission errors through its Permissions API. Use a dedicated integration account with access only to the required project and the lowest workable role. Do not reuse an owner’s credential.
A careless write can delete CMS items, corrupt slugs and references, change shared styles across pages, replace code components, reorder redirects, or publish unfinished changes. With a community plugin, its secret-bearing MCP URL and third-party Worker expand the trust boundary. Client approval prompts do little if a user accepts every call.
Our rule: export source data, name the target, cap the batch, request a dry-run summary, and separate “apply” from “publish.” Framer recommends plan-first review for bulk and publishing work in its external-agent workflow.
Real limits
The hardest limits are incomplete API coverage, non-transactional writes, context size, and beta behavior—not model intelligence. Plan for partial success instead of assuming an all-or-nothing edit.
Framer says external agents cannot change some settings such as project names and domains, assign overrides, or access analytics. The Server API offers only a JavaScript SDK and streaming WebSockets; the Server API FAQ warns that operations are non-transactional and may stop after some changes. Cold starts can delay the first command.
Large projects create a separate problem. A full canvas tree or hundreds of CMS records may exceed the model’s useful context even if Framer returns them. Query by collection, page, slug, status, or node type; paginate batches; summarize between calls; and retain IDs instead of returning entire documents repeatedly. Framer publishes no guarantee that one giant result will fit your model.
Rate-limit details are not public for the Agent beta, so back off on errors and avoid concurrent mass writes. The community plugin documents a five-second timeout and one open plugin instance per user. The Server API is free during open beta, but future pricing is undecided and expected to be usage-based with an allowance. This matters for scheduled high-volume syncs.
When not to use Framer MCP
Do not use Framer MCP for one-off visual exploration, a fixed repeatable integration, or a job outside Framer’s API surface. The right alternative is often simpler and easier to test.
Use Framer’s built-in Agent for interactive design and canvas refinement; Framer recommends working one section at a time. Use a plain Server API script for a scheduled CMS sync with known inputs, mappings, retries, and logs. An LLM adds cost and variability where ordinary code already knows the answer.
Avoid a community MCP tunnel for unattended production publishing unless you have reviewed its code, hosting, secret handling, recovery, and maintenance plan. Choose it when protocol compatibility is the requirement and keep a human at the publish boundary. Otherwise, we would take Framer’s official Agent path—or a small API script—over another abstraction layer.