Figma MCP 403 Forbidden: Why client_name allowlists fail

Figma’s remote MCP server returns HTTP 403 errors to unsupported clients because it allowlists the self-reported `client_name` submitted during OAuth Dynamic Client Registration, restricting the `mcp:connect` scope to selected tools while the service remains in beta. Although this policy is intended to limit access, particularly write-to-canvas capabilities, client names are not reliable identity credentials and can reportedly be spoofed simply by registering under an approved name, creating inconsistent access outcomes for otherwise identical clients. The issue has also produced a slow, non-self-service onboarding process involving waitlists, support requests, and partner approval. MCP’s newer Client ID Metadata Documents standard replaces Dynamic Client Registration as the preferred method and provides stronger verification for hosted applications using HTTPS redirects, but it cannot fully identify distributed desktop and CLI applications that use localhost redirects. The discussion argues that servers should use verifiable identifiers where possible, communicate scope restrictions clearly, separate read and write permissions, and let customer organizations define and audit which clients may receive higher-risk access.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.