← MCP Security Catalog

Zeplin MCP Server 1.0.6

npm · @zeplin/mcp-server · latest release

Verified with no proven findings
Security result
4
Observed tools
36
Version rating
100
Change risk

Independent inventory

Observed 2026-08-17T10:12:24.065Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
download_layer_assetDownloads a specific visual asset (e.g., SVG icon, PNG image) for a given layer from Zeplin and saves it to a local path. Use this tool when an asset referenced in the design (obtained from `get_screen` or `get_component`) is missing from the codebase and needs to be fetched directly from Zeplin.
Input schema
{
  "type": "object",
  "properties": {
    "layerSourceId": {
      "type": "string",
      "description": "The unique source ID of the layer for which the asset should be downloaded. This ID is obtained from the `layers` array in the response of `get_screen` or `get_component` calls, from a `sourceId` or similar field associated with a specific layer that has exportable assets"
    },
    "localPath": {
      "type": "string",
      "description": "The absolute path to the directory where images/assets are stored in the project. If the directory does not exist, it will be created. The format of this path should respect the directory format of the operating system you are running on. Don't use any special character escaping in the path name either."
    },
    "assetType": {
      "type": "string",
      "enum": [
        "svg",
        "png",
        "pdf",
        "jpg"
      ],
      "description": "The desired format of the asset to download. Must be one of 'svg', 'png', 'jpg', or 'pdf'. Choose the format most suitable for the project's needs or as indicated by design specifications. If unsure, 'svg' is often preferred for vector graphics and 'png' for bitmaps."
    }
  },
  "required": [
    "layerSourceId",
    "localPath",
    "assetType"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
get_componentFetches detailed design specifications for a specific Zeplin component, including its properties, variants, layers, and associated design tokens. Use this when you need to understand the structure and styling of a single, reusable UI element from Zeplin.
Input schema
{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "format": "uri"
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
get_design_tokensDownload design tokens for a project or styleguide
Input schema
{
  "type": "object",
  "properties": {
    "resourceId": {
      "type": "string",
      "description": "The ID of the project or styleguide for which the design tokens should be downloaded."
    }
  },
  "required": [
    "resourceId"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
get_screenFetches detailed design data for a specific screen from Zeplin. This includes screen variants, layer information (structure, position, styling), annotations, and project-level design tokens. Use this to understand screen layout, content, and interactions for development or review.
Input schema
{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "format": "uri"
    },
    "includeVariants": {
      "type": "boolean",
      "default": true,
      "description": "Set to `true` (default) to retrieve all variants of the screen (e.g., different states or sizes). Set to `false` if only the specific screen version linked in the URL is needed, or to conserve tokens if variants are not relevant to the user's query. Fetching all variants provides a complete picture but uses more tokens."
    },
    "targetLayerName": {
      "type": "string",
      "description": "Optional. If the user's query refers to a specific named layer or element on the screen (e.g., 'the submit button', 'user profile image'), provide that layer's exact name here. This will focus the returned data on that specific layer and its children, making the response more concise and relevant. If omitted or the layer name is not found, data for all layers on the screen will be returned."
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Resources 0

Resource templates 0

Prompts 0

Changes from previous version

Compared with initial baseline using full_baseline.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: 117ef6f15e3d4d17516d0cd9235da7abc29ddbaac8f882d76c90f3fe555262f0

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.