Canva REST APIs + MCP vs Pictify

Canva REST APIs + MCP 79

Atlassian Statuspage at canvastatus.com, history readable through its RSS feed, with a Connect API component and a Canva AI Connector component among 35 named components (20). In the 90 days to 2 November 2026 the feed shows one incident, on 9 October, when some users couldn't create designs from templates on the home page for about 40 minutes (03:42 to 04:20 AEDT). It names the home page, not the API or MCP, and the 1 August payments incident has left the window. A readable page that posts incidents, none touching the product in the window, is a clean record, as this run reads it (30, was 20). Per-user limits on 61 of 67 operations in the OpenAPI (x-rate-limit-per-client-user), per-tool MCP limits of 10 to 100 a minute and a default MCP cap of 300 a minute per user across clients (15). 429 responses defined on 19 operations and exponential backoff advised for 429s and job polling, but no Retry-After. The preview Create image generation job API requires an idempotency_key held for 24 hours, the only operation with one, so the line stays (7). No SLA found (0). Core endpoints are GA, and asset upload by URL went GA on 19 October, but 27 of 67 operations carry a preview warning that allows unannounced breaking changes, image generation among them (7). 20+30+15+7+0+7 = 79.

Pictify 45

Hosted lines, for the REST API. The home page links a status page at status.pictify.io, but its robots.txt disallows every path, so its components and history weren't read. Half for a page that exists (10 of 20) and no readable history (5). Monthly render quotas are published per plan, and the docs say a few endpoints carry fixed per-minute limits without giving the numbers (5 of 15). Retry guidance is explicit. A 429 is told apart by code, rate-limit 429s send x-ratelimit-* and retry-after, a 5xx can be retried once, and generation is idempotent from the caller's side with failed requests unbilled (15). No SLA found (0). The API isn't labelled beta (10). 10 + 5 + 5 + 15 + 0 + 10 = 45.

Canva REST APIs + MCP 83

Closed service under published terms (15). Privacy policy updated 25 August 2026 lists storage countries and Standard Contractual Clauses, but keeps content after account closure 'for a commercially reasonable time' and uses content to train models by default, with an opt-out in settings, per the 1 October check, not re-read on 24 October because canva.com's robots.txt disallows our fetcher (18). Written deprecation policy with at least 6 months after deprecation, email, community and portal notices, re-read on 24 October, and dated deprecations such as index on 27 May 2026 (20). Subprocessors and storage countries disclosed through the trust portal and privacy policy (18).

Pictify 52

The MCP server is MIT. The service is closed under terms of 18 July 2024 that name only Pictify.io (20 of 30). The privacy policy of the same date keeps data 'for as long as necessary' with no periods, names no processors and doesn't mention that the MCP server sends tool arguments, results and the account email to PostHog (6 of 30). The changelog records retirements, Workflows in September 2026 and MCP tools on 19 September, with no notice period or deprecation policy (5 of 20). MCP analytics are on by default and disclosed with an opt-out in the README only, and no subprocessors or data locations are listed (8 of 20). 20 + 6 + 5 + 8 = 39.

Canva REST APIs + MCP 63

OAuth 2.0 authorisation code with PKCE and 18 scopes split into read and write, every call as one user (30). Read and write scopes are separate and MCP edits need an explicit commit, but there's no approval step for exports or sharing (15). Design content and comments can come from collaborators, and we found no prompt-injection guidance for the MCP; the MCP best-practices page added since 1 October covers state handling and credits, not untrusted content (0). No per-call audit log found (0). security.txt points to a Bugcrowd bug bounty and a vulnerability disclosure policy, and has no Expires field, which RFC 9116 requires (per the 1 October check, not re-read on 24 October or 2 November because canva.com's robots.txt disallows our fetcher). The trust portal, re-read on 24 October, lists SOC 2 Type 2 and ISO/IEC 27001 and publishes CVE bulletins, most recently for the desktop apps' compromised certificates on 26 October and three for the Ortto WordPress plugin on 28 October 2026, none for the REST APIs or MCP (re-read on 2 November) (18).

Pictify 45

Prefixed API keys that can be rotated or revoked at once in the dashboard, with no scopes. The hosted MCP endpoint's metadata names api.pictify.io as authorisation server with one mcp:tools scope, not described in the docs (22 of 30). No read-only key or mode, and delete tools need no confirmation (5 of 20). The URL screenshot and render tools return images and URLs rather than page text, and an SSRF protection page documents how fetches are limited (10 of 15). A dashboard usage view and webhook events for renders, with no per-call audit log (5 of 15). No security.txt, disclosure policy, bug bounty or certification found; docs pages on key handling and SSRF only (3 of 20). 22 + 5 + 10 + 5 + 3 = 45.

Canva REST APIs + MCP 85

Newest changelog entry 28 October 2026 (30). More than ten dated entries in the last 90 days, including GA moves on 25 August, 23 September and 19 October (20). Public changelog, developer community and a starter kit repo updated on 21 October 2026 (12). MCP server listed in the official registry as com.canva.mcp/mcp, active, published 25 September 2026, re-read on 2 November (15). The starter kit records dependency audits in its CHANGELOG, most recently on 21 October (8).

Pictify 68

@pictify/mcp-server 2.0.0 published on 20 September 2026, 47 days before this check, with the changelog's newest entry dated September 2026 (20). Since 8 August, MCP versions 1.5.0 (8 August), 1.5.1 (11 August) and 2.0.0 (20 September), and changelog entries for August and September (20). GitHub issues weren't read, and the repository has one committer (5 of 25, unchecked). io.github.pictify-io/mcp is in the official MCP registry under the GitHub-verified namespace at 2.0.0, and official SDKs exist in four languages (15). CI builds and runs tests on push and pull requests (8 of 10). 20 + 20 + 5 + 15 + 8 = 68.

Canva REST APIs + MCP 59

46 MCP tools on 24 October and 2 November (33 on 1 October) with no toolsets or dynamic loading (5), and REST lists take a limit (5). Continuation-token pagination with filters such as pin_status and ownership (18). Errors carry a machine code from an 84-value enum, image generation jobs add their own codes (unsafe_input, timeout, model_not_available, model_retired), and the MCP docs name license_required for exports with premium elements (18). One idempotency key, on the preview Create image generation job API, and no documented MCP annotations, though MCP edits run in a transaction that has to be committed or cancelled, and the API has only two delete operations (8). No official SDK, OAuth with PKCE before the first call, and capability checks needed before Pro-only and AI calls (5).

Pictify 74

25 MCP tools in the 2.0.0 source (15 for 11 to 30), with no toolsets or read-only subset (15). List endpoints page with page and limit (16 of 20). Error bodies carry code slugs such as quota_exceeded, template_limit_reached and invalid_variable, and the docs say which are retryable (18 of 20). Generation is safe to retry and failed calls bill nothing, but the MCP source sets no readOnlyHint or destructiveHint, and the delete tools for templates and video templates run without a confirmation step (10 of 20). Official SDKs for Node.js, Python, Go and Ruby, sensible defaults such as 1200 x 630 PNG (15). 15 + 16 + 18 + 10 + 15 = 74.

Canva REST APIs + MCP 30

No x402, MPP or L402 (0). No API fee. What the API can do follows the user's Canva plan, whose prices are public per the 1 October check (canva.com's robots.txt disallows our fetcher on 24 October) (10). Canva Free reaches generation, editing, export and asset upload with no card, and the MCP tools page lists generate-image on all plans (20). Image generation, image transformation and design generation draw on the user's AI credit allowance. When it runs out, image generation returns 429 credit_quota_exceeded, and design generation has returned a 402 since 28 October. A person has to sign in and approve OAuth in a browser, and integrators register in the Developer Portal (0).

Pictify 40

No x402, MPP or L402 (0). Overage prices per render published without login, $0.02 on Basic, $0.01 on Pro and $0.005 on Business, with plan prices (20). Free plan of 50 renders a month, marked no card and no watermark (20). A person signs up and creates the key in the dashboard (0). 0 + 20 + 20 + 0 = 40.