Framer Server API vs Magic Patterns

Framer Server API 43

Per the 24 October check, not re-read on 4 November, Framer runs a Better Stack status page at framerstatus.com with App, Editor, API, Hosting, Sites, Website and Community components, and no component for Framer MCP (20). Its RSS feed showed three incidents in the 90 days to 24 October 2026, analytics collection degraded at a third-party provider for about 1 hour 15 minutes on 12 August, elevated errors in the AI tools for 1 hour 15 minutes on 22 September and the Editor unavailable for 39 minutes on 14 October, with the API component at 100 per cent over 30 days. Minor only. 25 October to 4 November is unread and gets no credit of its own (20 of 30, kept). No rate limits published for the Server API or Framer MCP (0). No 429 or retry guidance. The FAQ says the API 'is not in any way transactional' and scripts must handle partial failures themselves (3 of 15, partial kept). No SLA published. The Enterprise plan lists an 'Uptime guarantee' without published terms (0). The Server API is in open beta and Framer MCP is labelled preview on the pricing page (0 of 10). Framer's Acceptable Use Policy (version 2.0, effective 9 April 2026) bars robots and other automatic devices from accessing any content hosted by Framer, so framer.com hosts and framerstatus.com weren't re-read on 4 November and this note rests on the 24 October check.

Magic Patterns 75

Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a baseArtifactId and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.

Framer Server API 47

The Server API has no plain HTTP request. A script opens a WebSocket session through the SDK and calls Plugin API methods, and results are whole node or collection objects. Framer MCP gives MCP clients a Streamable HTTP route with no Node or local bridge, but its tool count and size weren't readable without signing in, so this line still reads the Server API (12 of 25). Node queries by type and CMS item access exist, but we found no documented page or field controls (10 of 20). No documented error codes, and a dropped connection can stop a run halfway (8 of 20). Calls aren't transactional, but @framer/agent puts every change on a branch, an MCP agent works on a branch when asked, and publish makes a preview before deploy promotes it. MCP tool annotations weren't readable (10 of 20). JavaScript and TypeScript only, Node 22 or later (7 of 15). Per the 24 October check, not re-read on 4 November (framer.com paused under its Acceptable Use Policy).

Magic Patterns 67

24 documented tools (15 for 11 to 30), plus 5 back for the read-only endpoint that registers only 12 (20 of 25). Message history pages by 10 and version history by 20 with skip, and file reads take a list of names (14 of 20). Documented status codes, a 402 that leaves reads working and non-blocking validationErrors on design-system writes (15 of 20). No idempotency keys; 409 conflict checks on design-system writes, and annotations couldn't be read on the closed server (10 of 20). create_design needs no parameter and makes a blank scaffold, but there is no official SDK (8 of 15). 20 + 14 + 15 + 10 + 8 = 67.

Framer Server API 69

No OpenAPI or REST contract. The Server API's contract is the TypeScript types in the framer-api SDK over a WebSocket (12 of 25). llms.txt at framer.com, re-read on 24 October (10). The Plugin API reference documents each method, and @framer/agent installs skills that tell coding agents how to use it (12 of 20). Typed TypeScript inputs with union types for node and field kinds (12 of 15). Quick-start examples and a REST-wrapper example on GitHub. No error reference found (8 of 15). A dated changelog with semver and breaking changes flagged, v4.1.0 on 4 August, v5.0.0 on 8 September and v5.1.0 on 24 September 2026, and a dated updates page that announced Framer MCP on 22 October (15). Framer doesn't publish Framer MCP's tool definitions and listing them needs an OAuth sign-in, so this score still reads the Server API. Per the 24 October check, not re-read on 4 November (framer.com paused under its Acceptable Use Policy).

Magic Patterns 84

The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback category is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.

Framer Server API 75

Closed service under published terms, version 1.8 effective 16 June 2026, whose definition of the Service excludes Framer APIs. framer-api is MIT on npm, and @framer/agent 0.0.47 declares no licence (18 of 30). Privacy statement version 1.7 of 12 June 2026 names Framer B.V., gives retention periods (transaction data 7 years, account data up to 2 years after closure) and links a DPA. Its AI line only covers training 'third-party general-purpose AI models' on personal data (22 of 30). Breaking changes are flagged by major version, such as the v4.0.0 package rename and v5.0.0 CMS array fields, with no deprecation policy or notice period. The External Agents page is now labelled legacy and stays supported 'while Framer MCP reaches feature parity', with no end date (8 of 20). Transfer countries are listed in the Trust Center per the privacy statement. We didn't confirm a subprocessor list (10 of 20). Per the 24 October check, not re-read on 4 November (framer.com paused under its Acceptable Use Policy).

Magic Patterns 60

Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.

Framer Server API 77

Per the 24 October check, not re-read on 4 November, Framer MCP was published on 22 October 2026, and Plugin API v5.1.0 and framer-api 5.1.0 on npm on 24 September (30). In the 90 days from 6 August, v5.0.0 (8 September), v5.1.0 (24 September), @framer/agent 0.0.47 (15 October, per the 24 October npm reading) and the Framer MCP release (22 October) are four dated entries; v4.1.0 (4 August) has left the window (20). Closed service with a public changelog, an updates page and a community forum. We didn't test support (10 of 15). Presence of Framer MCP in the official MCP registry wasn't established; the 24 October search used the registry's JSON API, which this check doesn't use (0). One official SDK, now at the Plugin API's version (10 of 15). framer-api 5.1.0 declares Node 22 or later and two runtime dependencies (7 of 10). Framer's Acceptable Use Policy (version 2.0, effective 9 April 2026) bars robots and other automatic devices from accessing any content hosted by Framer, so framer.com hosts and framerstatus.com weren't re-read on 4 November and this note rests on the 24 October check.

Magic Patterns 70

Changelog entry on 5 November 2026, the day before this check (30). Entries on twelve dates since 8 August, among them 23 September and 12 to 30 October (20). Closed service with a public changelog, email support within one to two business days, in-app chat and a Slack community. We didn't test them (12 of 15). Not in the official MCP registry (searches for magic-patterns and magicpatterns returned nothing of theirs). Official Claude connector, Cursor plugin and Codex plugin, and no SDKs (5 of 15). No public package or repository to check (3 of 10). 30 + 20 + 12 + 5 + 3 = 70.

Framer Server API 49

One Server API key per project, created under Site Settings, that can't reach other projects. We didn't find rotation or revocation documented for Server API keys. @framer/agent grants access per project in the browser and Framer says it can be revoked at any time. Framer MCP signs in with OAuth (authorization code with PKCE S256 and dynamic client registration, per its metadata), but publishes one scope, mcp:project, and acts with the account's permissions on every project it can reach, so it doesn't earn the 30 for scoped OAuth. Revoking an MCP grant isn't documented in the pages read (20 of 30). No read-only key or MCP mode. The key can publish and deploy directly. @framer/agent keeps changes on a branch until someone merges or publishes, and MCP changes stay unpublished until the person or the agent publishes (12 of 20). CMS content and code files come back as they are, mostly the customer's own, with no injection guidance (5 of 15). We found no API or MCP call log for operators (5 of 15). Per the 24 October check, framer.com's security.txt lists vulnerability-disclosure@framer.com and carries an expired Expires date of 1 August 2026. trust.framer.com redirects to a Vanta page whose robots.txt disallows crawlers, so certifications weren't checked. A disclosure address with no acknowledgement time, bounty or readable certification takes the run's settled 7 (7 of 20). Not re-read on 4 November (framer.com paused under its Acceptable Use Policy).

Magic Patterns 55

OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). x-mp-agent-name attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.