# Penpot MCP Server: an MCP server we run in production

Canonical: https://scalably.io/mcp/penpot-mcp-server
Source: https://github.com/zcube/penpot-mcp-server
Registry: not published to the MCP registry
Provenance: third-party server, pinned at 1.0.0, verified 2026-10-02.
Integrity: no independent hash is published for this third-party listing; the raw endpoint at https://scalably.io/mcp/penpot-mcp-server.md mirrors this representation byte for byte
This is the machine-readable representation of the page at the canonical URL. Same facts, denser format.

## Direct answer
Self-hosted Penpot design files for agents that produce layouts.

## Install
- Claude Code: `claude mcp add penpot -e PENPOT_ACCESS_TOKEN=your-value -e PENPOT_API_URL=your-value -- npx -y @zcubekr/penpot-mcp-server@1.0.0`
- Codex: `codex mcp add penpot --env PENPOT_ACCESS_TOKEN=your-value --env PENPOT_API_URL=your-value -- npx -y @zcubekr/penpot-mcp-server@1.0.0`
- Claude Desktop: not available for this server.

## Environment
| Variable | Required | Secret | Purpose |
|---|---|---|---|
| `PENPOT_ACCESS_TOKEN` | yes | yes | Penpot access token |
| `PENPOT_API_URL` | no | no | Penpot instance URL, defaults to https://design.penpot.app; we point it at our self-hosted instance |

## Tools
The vendor doesn't publish a fixed per-tool list for this server; the tool groups are described under Setup.

## Setup
- Install: `npm i -g @zcubekr/penpot-mcp-server@1.0.0`, then run `penpot-mcp-server` (stdio by default).
- `PENPOT_ACCESS_TOKEN` is required; the server exits without it. Create one in Penpot under Settings, Access Tokens.
- `PENPOT_API_URL` defaults to `https://design.penpot.app`. A self-hosted Penpot needs `enable-access-tokens` in `PENPOT_FLAGS`.
- `TRANSPORT=http` (optional `HTTP_PORT`) serves HTTP at `/mcp`. A Docker image is published as `ghcr.io/zcube/penpot-mcp-server`.

At 1.0.0 the code registers 81 tools in 16 groups: files, pages, shape query and update, shape creation (rectangle, circle, text, frame), components, teams and projects and members, share links, comments, media, fonts, webhooks, search, profile, file snapshots, libraries, and align/distribute. The README lists some tools that aren't in the code at this version (export, font upload and others marked planned), so trust the running server's `tools/list` over the README.


## Limits
- Every tool loads at once; there's no filter or read-only mode, and the set includes destructive tools (delete file, team, project). Scope the access token accordingly.
- Cloudflare restrictions on the public Penpot instance may block API access; the README recommends a self-hosted server. That's why we run it against our own instance.
- Export tools are a placeholder at 1.0.0.

Sources: @zcubekr/penpot-mcp-server 1.0.0 README, `dist/index.js` and `dist/tools/export-tools.js` (unpkg.com); npm metadata for the repository URL.


## Reliability
- CI: not applicable, this is a third-party project we do not control.
- Pinned at 1.0.0
- Verified 2026-10-02
- We run this server in production, pinned at the exact version, with the install command derived mechanically from that pin so it can be re-verified against the published package.

## Related
- Also in design: [Figma MCP](https://scalably.io/mcp/figma-mcp)
- Read more: [Claude Code MCP: how to add an MCP server](https://scalably.io/blog/claude-code-mcp)