Add a Figma connector

Proposal: Add a Figma connector to Junior. The intended workflows and scope still need definition.

Constraints

Figma's hosted MCP server (mcp.figma.com/mcp) accepts only clients in the Figma MCP catalog. New clients must join a waitlist. A connector must use the REST API until Junior is approved. This is the same approach the Datadog plugin takes with the Pup CLI.
Rate limits for Tier 1 endpoints (GET file, GET file nodes, GET image) are up to 20/month for View and Collab seats. Dev and Full seats get 10–20/min, depending on the plan. The docs do not say which seat tier applies to plan access tokens.

Add a junior-figma plugin that injects a deployment-level token as X-Figma-Token on api.figma.com. This is the same pattern as packages/junior-pagerduty/plugin.yaml.
Add a skill that calls the REST API for files, nodes, rendered images, and comments.
Use a Figma plan access token. It belongs to the org plan, not to a user. It supports read-only scopes, an allowlist of files, folders, and teams, and an expiry of up to 1 year. An org admin must create it.
Tradeoff: everyone who can talk to Junior can read what the token can read. Per-user Figma permissions do not apply.

Private OAuth apps work for users in the owning org and do not need a Figma review.
Junior's generic credentials: oauth-bearer + oauth manifest support covers most of the flow. Authorization goes to https://www.figma.com/oauth and token exchange to https://api.figma.com/v1/oauth/token, with token-auth-method: basic.
Gap: Figma refreshes tokens at a separate endpoint (https://api.figma.com/v1/oauth/refresh). packages/junior/src/chat/plugins/auth/oauth-bearer-broker.ts always refreshes at token-endpoint. Unless a provider-neutral refresh-endpoint manifest field is added, users must reconnect when access tokens expire, which is after 90 days by default.
Tradeoff: most users have View or Collab seats, so per-user Tier 1 limits (up to 20/month) would block normal use quickly.

via billy.

--