Open in vscode.dev Install

1. Principles

  1. Agents use the same tools as people. There is no AI-only API. An agent changes a design through ud, which runs commands of the one registry (SRS §3.4, ARC-001 §3) that the editor’s buttons run. Whatever an agent can do, a person can do in the editor, and the reverse (CMD-19). The editor’s own AI is one more client of ud (AI-11).
  2. The interface is the Figma MCP interface. ud and ud mcp offer the Figma MCP server’s tools under the same names and parameters (CMD-1), with use_figma running Plugin API JavaScript (CMD-10). Agents and skills written for Figma work here unchanged (CMD-9). Our own skills teach the same tools, plus the native ud_* tools where they are better.
  3. Every AI change is reviewable, undoable and signed. A use_figma call is one transaction and one undo step (CMD-12). AI panel turns run on a proposal and are applied only on Accept (AI-5 covers the panel); agents on the other surfaces write live, one undo step per call, and can opt into a proposal with ud mcp install --proposal auto (§6.5). Every event the agent causes carries by: "Claude" (or the agent’s own name) (CMD-29), so history, blame and ud diff show what the agent did.
  4. The agent can see its work. get_screenshot / ud render give pixel-identical images of any node (CMD-32, NFR-8). Skills require the agent to look before it reports.
  5. The user’s own accounts, no SoftForge servers. AI runs through the user’s Claude Code login or the user’s VS Code language models. SoftForge has no keys, proxies nothing and receives no design data (AI-13). With ud.ai.enabled: false every AI surface is gone; ud and ud mcp still work for agents the user runs on their own.
  6. Bounded and cancellable. Every run has time, turn and size limits; Cancel leaves the document as it was (AI-14): a proposal is dropped, a direct-mode turn is rolled back as one undo step.
  7. The panel runs on an allowlist. What the panel’s agent can do is the list of tools and registry commands the panel passes in (--allowedTools, ud mcp --allow), not the absence of a tool. Under --proposal, ud mcp refuses every command that writes files outside the document or reaches the network, whatever the list says (§11).