---
title: "Penpot (MCP server, penpot-ai-kit, native design tokens) — AI capabilities"
description: "Penpot is the open-source design platform: MPL-2.0, self-hostable, and per its own llms.txt “a Digital Public Good, free to use, and self-hostable.” Its AI surface is…"
url: "https://state-of-ai-in-design-systems.netlify.app/platforms/penpot.md"
canonical: "https://state-of-ai-in-design-systems.netlify.app/platforms#penpot"
type: "platform-record"
json: "https://state-of-ai-in-design-systems.netlify.app/platforms/penpot.json"
id: "penpot"
capability_count: 8
design_systems_with_integration_records: 0
data_collected: "2026-07-26/28"
generated: "2026-07-31T22:56:11Z"
report: "State of AI in Design Systems — July 2026"
author: "Kaelig Deloumeau-Prigent"
license: "CC-BY-4.0"
citation: "Deloumeau-Prigent, K. (2026). State of AI in Design Systems. https://state-of-ai-in-design-systems.netlify.app/platforms/penpot.md"
---

> Snapshot of 2026-07-28. Every claim below links to the source URL it was taken from. Check the source before citing.

# Penpot (MCP server, penpot-ai-kit, native design tokens) — AI capabilities

8 capabilities recorded. 0 of the 20 design systems in this study carry an integration record for this platform.

- This record as JSON: https://state-of-ai-in-design-systems.netlify.app/platforms/penpot.json
- Platforms view: https://state-of-ai-in-design-systems.netlify.app/platforms.md

## Summary

Penpot is the open-source design platform: MPL-2.0, self-hostable, and per its own llms.txt “a Digital Public Good, free to use, and self-hostable.” Its AI surface is read-write by architecture. The official MCP server implements no canvas operations itself; it drives a dedicated Penpot MCP Plugin over WebSocket, and the model works by writing and executing code against the Penpot Plugin API. CONSUMPTION: @penpot/mcp on npm (`npx -y @penpot/mcp@latest`, streamable HTTP on port 4401 plus a legacy SSE endpoint), or a hosted remote endpoint at https:///mcp/stream keyed by a per-user MCP token — design.penpot.app on the SaaS, the same path on a self-hosted instance, so the whole agent-plus-design-tool loop can run on infrastructure you control. Four core tools (execute_code, high_level_overview, penpot_api_info, export_shape) plus import_image in local mode. On top of the server, penpot-ai-kit ships twelve first-party agent skills with a router, machine-readable autofix policies, eval fixtures and a .well-known/agent-skills discovery index. Native design tokens follow the W3C DTCG draft format with JSON import and export and a programmable tokens API. BUILDING: Penpot builds Penpot with agents. The monorepo’s AGENTS.md bans pushing and amending pushed commits, stops the agent until it has read the per-module Serena memories (55 files at the pinned commit), ships an OpenCode workbench, and mandates an `AI-assisted-by:` commit trailer. GAPS: llms-full.txt is a 506-byte stub ending “_No content sections available yet._”; help.penpot.app, where the substantive docs live, has no llms.txt (404), and the marketing /ai pages have no markdown twins; the hosted MCP is per-user, so there is nothing to connect to without an account; penpot-ai-kit declares CC BY 4.0 only in README prose with no LICENSE file, so GitHub reports no license; the earlier penpot-mcp repo is archived by README banner while its GitHub archived flag is unset (checked 2026-07-31); and the in-repo doc for the multi-user mode says that mode is “under development and not yet fully integrated.”

## Capabilities (8)

### Official MCP server (@penpot/mcp) — read-write, drives a plugin over WebSocket

Audience: both

The server communicates with a dedicated Penpot MCP Plugin over WebSocket, and the model carries out tasks by writing code against the Penpot Plugin API; execute_code’s tool description (in ExecuteCodeTool.ts) hands it a persistent `storage` object so it can build up a code library across calls. Installed locally with `npx -y @penpot/mcp@latest`, versioned in lockstep with Penpot releases (npm `latest` sat at 2.15.4 with 2.17.0 on the `next` dist-tag when checked, 2026-07-31). The earlier standalone penpot-mcp repository carries an archive banner dated 2026-02-03 pointing at the monorepo, though its GitHub archived flag is unset.

Link: https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/mcp/README.md

```markdown
creation of design elements.  The MCP server communicates with Penpot
via the dedicated **Penpot MCP Plugin**,
which connects to the MCP server via WebSocket.  
This enables the LLM to carry out tasks in the context of a design file by 
executing code that leverages the Penpot Plugin API.
The LLM is free to write and execute arbitrary code snippets
within the Penpot Plugin environment to accomplish its tasks.
```

Source: https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/mcp/README.md

### Four core tools, read from source: execute_code, high_level_overview, penpot_api_info, export_shape

Audience: both

The registration in PenpotMcpServer.ts matches the help-center docs exactly: four core tools, import_image added only when file-system access is enabled (local mode), and five more behind a devenv flag, including a CLJS REPL and a Taiga issue reader. penpot_api_info serves Plugin API documentation to the model on demand and high_level_overview returns static instructions on using the Penpot tools and API. The docs note that remote mode limits export_shape and drops local-path import_image.

Link: https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/mcp/packages/server/src/PenpotMcpServer.ts

```ts
    private initTools(): ToolInfo[] {
        const toolInstances: Tool<any>[] = [
            new ExecuteCodeTool(this),
            new HighLevelOverviewTool(this),
            new PenpotApiInfoTool(this, this.apiDocs),
            new ExportShapeTool(this),
        ];
        if (this.isFileSystemAccessEnabled()) {
            toolInstances.push(new ImportImageTool(this));
        }
```

Source: https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/mcp/packages/server/src/PenpotMcpServer.ts

### Hosted remote MCP per user, or local on port 4401

Audience: consumers

Remote MCP is enabled per account (Your account → Integrations → MCP Server) and served at https:///mcp/stream?userToken=: design.penpot.app on the hosted SaaS, the same path on a self-hosted instance. Local mode runs streamable HTTP at http://localhost:4401/mcp with a legacy SSE endpoint alongside; stdio-only clients go through the mcp-remote proxy. The in-repo doc for the multi-user mode says that mode is “under development and not yet fully integrated.”

Link: https://help.penpot.app/mcp/

```markdown
By default, the server runs on port 4401 and provides:

- **Modern Streamable HTTP endpoint**: `http://localhost:4401/mcp`
- **Legacy SSE endpoint**: `http://localhost:4401/sse`
```

Source: https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/mcp/README.md

### penpot-ai-kit: twelve agent skills with a router, autofix policies, evals and a lockfile

Audience: both

First-party skills package (namespace app.penpot.skills, v0.3.0) whose manifest says it is “Grounded in the real Penpot MCP surface (4 core tools, plus import_image in local mode).” Twelve skills cover screen building, component factories, token and accessibility audits, Figma migration, handoff docs and a router; the kit’s AGENTS.md tells the model to ignore instructions naming tools that do not exist. policies/modes.json codifies a human-approval boundary, evals/ ships golden tests for the kit’s own doctrine, skills.lock pins content by sha256, and .well-known/agent-skills/index.json implements the Agent Skills Discovery convention. License caveat: the README declares CC BY 4.0, but there is no LICENSE file and GitHub’s license detection reports none.

Link: https://raw.githubusercontent.com/penpot/penpot-ai-kit/a333fbbea692d95a724a14db38697c73f80e8300/README.md

```json
  "neverAutofix": [
    "any geometry change (position, size, layout)",
    "creating, deleting, or restructuring variants or components",
    "detach() on a component instance",
    "creating a new token (propose; human approves name/value/tier)",
    "deleting or renaming shared library assets",
    "any token swap that is a near-match rather than an exact equality"
  ],
  "rule": "Auto-fix is opt-in per change type, never per skill wholesale. When in doubt, downgrade to Apply-with-review."
```

Source: https://raw.githubusercontent.com/penpot/penpot-ai-kit/a333fbbea692d95a724a14db38697c73f80e8300/policies/modes.json

### llms.txt on both marketing domains; llms-full.txt is an empty stub

Audience: consumers

penpot.app/llms.txt and penpot.dev/llms.txt served byte-identical 2,710-byte indexes on 2026-07-31 (Product, AI Workflows, Ecosystem, Buyer Research, About, plus an Optional tail) whose AI Workflows section points at the /ai/mcp-server and /ai/ai-workflows pages. The index calls llms-full.txt the “Full content reference for AI systems”, but that file is a 506-byte stub whose last line reads “_No content sections available yet._” — a status-code sweep would score it as present. The docs site help.penpot.app, where the substantive MCP and tokens documentation lives, has no llms.txt at all (404 on 2026-07-31), and the marketing pages have no markdown twins and ignore Accept: text/markdown.

Link: https://penpot.dev/llms.txt

```markdown
# Penpot — Full Reference for AI Systems

> Penpot is the open-source design platform for teams building digital products at scale. It connects design, code, and AI workflows through open standards, self-hosting options, design systems capabilities, and open API integrations. Penpot is a Digital Public Good, free to use, and self-hostable.

Source: https://penpot.dev/llms.txt
Full reference: https://penpot.dev/llms-full.txt
Help Center: https://help.penpot.app/

_No content sections available yet._
```

Source: https://penpot.dev/llms-full.txt

### First-party agent docs: setup for four clients, a write-access warning, three prompting guides

Audience: consumers

help.penpot.app/mcp/ documents installing “the Penpot MCP server with any AI agent or LLM you trust”, with per-client setup for Cursor, Claude Code, VS Code/Copilot and Codex/OpenCode, and an explicit advisory that because agents “can read and modify your Penpot file structure (components, styles, tokens, pages, layers, etc.)” you can automate both creative and maintenance work. Three companion guides go past setup into practice: good prompting for design, structuring design files so agents can read them, and reducing LLM context-token spend (that last one is about token budgets, not design tokens).

Link: https://help.penpot.app/mcp/

### Native W3C DTCG design tokens with a programmable tokens API

Audience: both

Penpot’s design tokens “adhere to the Design Tokens Format Module and its definitions, a draft by the W3C DTCG”, with sets, themes, aliases, equations and JSON import and export (single file, multi-file with $themes.json/$metadata.json, or ZIP). The format work grew out of a partnership with Tokens Studio, documented from Tokens Studio’s side. The Plugin API exposes the same tokens programmatically: Library.tokens is a TokenCatalog with addSet and addTheme, and shapes take applyToken, so an agent driving the MCP server can create and apply real tokens instead of hardcoding values. The tokens user guide itself contains no AI prose and still said the plugins tokens API was “coming soon” on 2026-07-31, after it had shipped.

Link: https://help.penpot.app/user-guide/design-systems/design-tokens/

```ts
  /**
   * A catalog of Design Tokens in the library.
   *
   * See `TokenCatalog` type to see usage.
   */
  readonly tokens: TokenCatalog;
```

Source: https://raw.githubusercontent.com/penpot/penpot/5e5465a0fe8a18b4425247255f7899daa2aacd4e/plugins/libs/plugin-types/index.d.ts

### How Penpot builds Penpot: AGENTS.md contract, Serena memory graph, OpenCode workbench

Audience: builders

This is Penpot’s own team building Penpot, not a design-system team working inside it, so builders is the nearest audience label rather than an exact fit; it is recorded because it shows the platform vendor runs agent-native development. The monorepo’s root AGENTS.md is an operational contract: never push or amend pushed commits, never pipe test output through filters, and a hard stop until the agent has read the core Serena memory of every module it touches. The memory graph holds 55 memory files at the pinned commit, 52 of them in per-module folders; .opencode/ adds a permission-scoped commit subagent, two commands, a plugin registering penpot-psql and paren-repair tools, and 13 skills, five of them wired to those memories; and the commit-format memory mandates an `AI-assisted-by: model-name` trailer. CONTRIBUTING.md will not accept “AI-generated code without human review.” There is no CLAUDE.md, Cursor rule or Copilot instruction file anywhere in the tree; Penpot standardized on AGENTS.md.

Link: https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/AGENTS.md

```markdown
**STOP: Do not proceed until you have read the core memory of every affected module.**
Skipping this step is the #1 cause of incorrect or incomplete work.
```

Source: https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/AGENTS.md

## Adoption by design systems

No design system in the study documents Penpot support in its own materials, and the check was shallow: Ant Design’s resources page was fetched in full with zero Penpot mentions, Nord publishes no resources index (the /resources/ URL 404s) and its resources/support page, which does read to a plain fetch, has zero Penpot mentions, and the rest were not probed. The visible adoption runs in the other direction: Penpot’s own hub hosts community-authored libraries recreating well-known systems, including a “Material Design 3” library credited to an individual author rather than Google and an “Ant Design System (Free version)”, plus 116 plugins (the hub’s machine-readable listing, fetched 2026-07-31) including AI assistants (Penpot AVA controls the canvas through natural language against any OpenAI-compatible API) and design-token tooling (DTCG Token Import, Design Tokens Export & Deploy). Treat adoption by the study’s systems as undocumented rather than absent.

## Sources (18)

- https://penpot.dev/llms.txt

- https://penpot.dev/llms-full.txt

- https://penpot.dev/ai/mcp-server

- https://penpot.dev/ai/ai-workflows

- https://help.penpot.app/mcp/

- https://help.penpot.app/user-guide/design-systems/design-tokens/

- https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/mcp/README.md

- https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/mcp/packages/server/src/PenpotMcpServer.ts

- https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/AGENTS.md

- https://raw.githubusercontent.com/penpot/penpot-ai-kit/a333fbbea692d95a724a14db38697c73f80e8300/README.md

- https://raw.githubusercontent.com/penpot/penpot-ai-kit/a333fbbea692d95a724a14db38697c73f80e8300/skills.json

- https://raw.githubusercontent.com/penpot/penpot-ai-kit/a333fbbea692d95a724a14db38697c73f80e8300/policies/modes.json

- https://raw.githubusercontent.com/penpot/penpot/5e5465a0fe8a18b4425247255f7899daa2aacd4e/plugins/libs/plugin-types/index.d.ts

- https://registry.npmjs.org/@penpot%2fmcp

- https://penpot.app/penpothub/plugins

- https://tokens.studio/blog/tokens-studio-penpot-bringing-native-open-standard-design-tokens-to-everyone

- https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/LICENSE

- https://raw.githubusercontent.com/penpot/penpot/3fc5360df5491aee9870d0980a0338bf17d17bef/mcp/packages/server/src/tools/ExecuteCodeTool.ts

---

Generated 2026-07-31T22:56:11Z from the State of AI in Design Systems — July 2026 dataset. Index of every machine-readable file: https://state-of-ai-in-design-systems.netlify.app/llms.txt. JSON, SQLite and the MCP endpoint: https://state-of-ai-in-design-systems.netlify.app/ai.md. Kaelig Deloumeau-Prigent, CC BY 4.0.