diff --git a/src/kiro_crew/security/exfil.py b/src/kiro_crew/security/exfil.py
index 7636aa3afd5..9c2b8254cb1 100644
--- a/src/kiro_crew/security/exfil.py
+++ b/src/kiro_crew/security/exfil.py
@@ -285,7 +285,7 @@ def _oauth_url_payload_diagnostic(
         ("gitlab.com", "/oauth/authorize"),
         ("mcp.auth.mail.superhuman.com", "/oauth2/authorize"),
         ("mcp.linear.app", "/authorize"),
-        # Maintainer-verified 2026-09-01 via RFC 8414 metadata at
+        # Maintainer-verified via RFC 8414 metadata at
         # https://mcp.miro.com/.well-known/oauth-authorization-server
         # (authorization_endpoint: https://mcp.miro.com/authorize), matching the
         # reporter's independent RFC 8414 read in issue #7578. Not (yet) a
@@ -294,6 +294,14 @@ def _oauth_url_payload_diagnostic(
         ("mcp.miro.com", "/authorize"),
         ("mcp.notion.com", "/authorize"),
         ("vercel.com", "/oauth/authorize"),
+        # Figma's MCP authorization server (issuer https://api.figma.com) hosts
+        # its consent page on www.figma.com. Independently corroborated by the
+        # maintainer's operator via RFC 9728 protected-resource discovery on
+        # https://mcp.figma.com/mcp (authorization_servers -> api.figma.com)
+        # and its RFC 8414 metadata, which advertises
+        # authorization_endpoint https://www.figma.com/oauth/mcp — the consent
+        # host is the main web property by the provider's own design.
+        ("www.figma.com", "/oauth/mcp"),
     }
 )
 
diff --git a/test/oauth_url_corpus.py b/test/oauth_url_corpus.py
index d4cc012c3ed..648389a8735 100644
--- a/test/oauth_url_corpus.py
+++ b/test/oauth_url_corpus.py
@@ -182,6 +182,20 @@
         "&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
         "&code_challenge_method=S256",
     ),
+    # Figma MCP consent page (issuer api.figma.com, consent on www.figma.com;
+    # RFC 8414 metadata via RFC 9728 discovery on mcp.figma.com/mcp).
+    # developers.figma.com/docs/figma-mcp-server/
+    (
+        "figma-mcp",
+        "https://www.figma.com/oauth/mcp"
+        "?client_id=fig_abcDEF1234567890"
+        "&redirect_uri=http%3A%2F%2F127.0.0.1%3A55089%2Fcallback"
+        "&response_type=code"
+        "&scope=mcp%3Aconnect"
+        "&state=af0ifjsldkjZx9yW8vU"
+        "&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
+        "&code_challenge_method=S256",
+    ),
 ]
 
 # Consent URLs that the ACP banner-safety gate