penpot-audit-tokens — design-system governance auditor

1. Title + How it works

penpot-audit-tokens enforces token governance — a concern separate from accessibility. Every mutation goes through execute_code; validate visually with export_shape; read structure with penpotUtils.shapeStructure (full tool surface: shared/penpot-mcp-tool-reference.md). It collects every fill/stroke/spacing/radius value, compares against the active token system (penpotUtils.tokenOverview()), and reports hardcoded values, off-grid spacing, orphan/unresolved tokens, and duplicates — each with a suggested semantic-token swap.

2. The One Rule That Matters Most

Suggest, and only auto-swap exact equalities. The single safe auto-fix is replacing a raw value that is exactly equal to an existing token's resolved value with that token. Everything else (near-matches, off-grid rounding, new tokens) is a suggestion for review.

3. Penpot MCP Tool Reference

Full surface: shared/penpot-mcp-tool-reference.md. Key calls: execute_code with penpotUtils.analyzeDescendants (collect values) and penpotUtils.tokenOverview() / findTokenByName (the token system to compare against).