## Figma MCP Setup (Remote / Local question)

The `figma_mcp` pass of the Step 3 loop opens with a mode question BEFORE any token is collected:

```
Figma MCP mode?

  [1] Remote  -  mcp.figma.com, OAuth token (figu_)  (recommended)
  [2] Local   -  @anthropic-ai/figma-mcp via npx, uses the Figma PAT
```

**Remote** (`figu_` OAuth token  -  generate it FOR the current user, never just point at docs):
- No OAuth app and no client_id/secret needed: Dynamic Client Registration against `api.figma.com/v1/oauth/mcp/register` + PKCE, the browser opens, the user clicks Allow, and the resulting access + refresh token pair is saved to the credential store under a name the user confirms. Map that entry to `keychainMapping.figma_mcp` (Token Save Flow Step D applies as usual).
- If `prefs.global.figmaMcp.remoteGeneratorScript` is set, run that script  -  it drives the whole flow end to end (registration, browser, keychain save) for the current user. Otherwise guide the flow inline.
- Renewal is silent afterwards via `$HOME/.claude/lib/figma-mcp-refresh.sh` (refresh token). Never echo token values.

**Local** (PAT-based):
- Validates the Figma PAT against the REST API, saves it to the credential store (reusing the `figma` mapping when present), and writes the `@anthropic-ai/figma-mcp` server block into Claude Code `settings.json` `mcpServers`:
```bash
# stdin sentinel keeps the value out of shell history
pbpaste | ~/.claude/scripts/keychain.py set "${USER}_Figma_Access_Token" -
pbcopy < /dev/null
# then: ~/.claude/settings.json -> mcpServers -> figma
```
- If `prefs.global.figmaMcp.localGeneratorScript` is set, run that script instead.

Choosing Remote does NOT skip the `figma` PAT pass (Tier 2 still uses the PAT); choosing Local leaves `keychainMapping.figma_mcp` null and Tier 1 unavailable until Remote is onboarded.