{ "data": { "a": { "slug": "framer", "name": "Framer Server API", "vendor": "Framer", "vendorUrl": "https://www.framer.com", "kind": "http-api", "category": "design", "summary": "Framer is a website builder with a design canvas.", "url": "https://www.anchorterminal.com/tools/framer", "markdownUrl": "https://www.anchorterminal.com/tools/framer.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/framer.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/framer.json", "license": "proprietary", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "framer-api" }, { "registry": "npm", "name": "@framer/agent" } ], "auth": "api-key", "authNotes": "One API key per project, created under Site Settings, General. Pass it with the project URL to `connect()`. `@framer/agent` instead asks the user to grant access to each project in the browser, and its changes land on a branch.", "pricing": "freemium", "pricingNotes": "The Server API is free during the open beta on all plans. Framer says it'll likely charge per use with a monthly free allowance, and estimates a full hour of processing at a few dollars. Site plans are Free, Basic $10 a month and Pro $30 a month billed yearly, with extra editors at $20 a month and custom Enterprise pricing (https://www.framer.com/pricing).", "priceSummary": "$10 / mo", "where": "local", "x402": { "level": "no", "evidence": "No payment support in the Server API docs.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 335756, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://www.framer.com/developers/server-api-introduction", "llmsTxt": "https://www.framer.com/llms.txt", "capabilities": [ "design.files", "design.components", "design.canvas", "design.code" ], "tags": [ "hosted", "freemium", "free-tier", "closed-source", "typescript", "llms-txt" ], "lastRelease": "2026-09-24", "graded": true, "anchor": { "graded": true, "score": 52.8, "grade": "D", "agentReady": false, "rank": 340, "ranked": true, "rankOf": 452, "categoryRank": 3, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 47, "maintenance": 77, "payments": 25, "reliability": 43, "schema": 69, "security": 50, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Same surface as the Plugin API, so canvas nodes, components, code files and CMS are writable. No REST endpoints and no official MCP server. You need Node 22 and the `framer-api` package.", "strengths": [ "Same surface as the Plugin API, so canvas nodes, components, code files and CMS are writable", "`@framer/agent` puts every agent change on a branch and limits it to the projects you connect", "Publish makes a preview deployment that a separate `deploy` promotes", "Free on every plan during the beta", "Dated changelog with breaking changes flagged by major version" ], "weaknesses": [ "No REST endpoints and no official MCP server. You need Node 22 and the `framer-api` package", "Open beta with no published rate limits, price or SLA", "Not transactional, so failures can leave partial edits", "API keys can publish and deploy directly, with no read-only option", "framer.com's security.txt expired on 1 August 2026" ], "agentNotes": [ "`connect(projectUrl, process.env.FRAMER_API_KEY)` then call Plugin API methods, and close the connection when done", "Publish creates a preview deployment. Promote it with `deploy()` only after checking it", "Keep batches small and idempotent, since a dropped connection can stop a run halfway", "For interactive work from a coding agent, `npx @framer/agent setup` is the supported route and keeps changes on a branch", "Check the changelog before upgrading. v5.0.0 changed CMS array fields and requires stable `id` values" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52.8 } ], "editorialScores": { "ergonomics": 47, "maintenance": 77, "payments": 25, "reliability": 43, "schema": 69, "security": 50, "transparency": 58 }, "provenanceScore": 95 }, "connect": { "install": "npm install framer-api", "claudeCode": "npx @framer/agent setup" }, "letme": { "capability": "https://letme.dev/design.files", "tool": "https://letme.dev/framer" }, "area": "design-diagrams", "unitPrices": [ { "item": "Basic site plan", "unit": "month", "usd": 10, "note": "billed yearly" }, { "item": "Pro site plan", "unit": "month", "usd": 30, "note": "billed yearly" }, { "item": "Additional editor", "unit": "seat-month", "usd": 20 } ], "provenance": { "legalEntity": "Framer B.V.", "domain": "framer.com", "domainRegistered": "1996-12-30", "domainNote": "framer.com was registered in 1996, long before Framer B.V. acquired it.", "endpointOnVendorDomain": true, "terms": "https://www.framer.com/legal/terms-of-service/", "privacy": "https://www.framer.com/legal/privacy-statement/", "statusPage": "https://www.framerstatus.com", "changelog": "https://www.framer.com/developers/changelog", "securityTxt": "expired", "checked": "2026-09-30", "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/framer.json", "live": { "slug": "framer", "vendorStatus": { "page": "https://www.framerstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-04T21:40:02.129843788Z" }, "versions": [ { "registry": "npm", "name": "@framer/agent", "version": "0.0.46", "seenAt": "2026-10-04T16:27:29.028092998Z" }, { "registry": "npm", "name": "framer-api", "version": "5.1.0", "seenAt": "2026-10-04T16:27:28.613277695Z" } ], "npmWeekly": 316906, "securityTxt": { "url": "https://framer.com/.well-known/security.txt", "state": "expired", "expires": "2026-08-01T16:00:00.000Z", "checkedAt": "2026-10-04T15:16:04.12404264Z" }, "llmsTxt": { "url": "https://www.framer.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:47.495003541Z" }, "domain": { "domain": "framer.com", "registered": "1996-12-30", "source": "https://rdap.verisign.com/com/v1/domain/framer.com", "checkedAt": "2026-10-04T13:07:02.946028331Z" }, "pages": [ { "url": "https://www.framer.com/developers/changelog", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:50:18.109422325Z", "changedAt": "2026-10-02T15:26:28.164682891Z", "fingerprint": "e2553f2566ae" }, { "url": "https://www.framer.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:50:24.141834577Z", "changedAt": "2026-10-02T15:26:34.414109448Z", "fingerprint": "ff75d1333b8f" }, { "url": "https://www.framer.com/legal/privacy-statement/", "kind": "privacy", "status": 304, "checkedAt": "2026-10-04T15:50:20.125354936Z", "changedAt": "2026-10-02T15:26:30.397286145Z", "fingerprint": "2593486cd293" }, { "url": "https://www.framer.com/legal/terms-of-service/", "kind": "terms", "status": 304, "checkedAt": "2026-10-04T15:50:22.150233422Z", "changedAt": "2026-10-02T15:26:32.456544039Z", "fingerprint": "787339a0cb7a" } ], "updatedAt": "2026-10-04T21:40:02.129843788Z" } }, "b": { "slug": "penpot", "name": "Penpot API + MCP", "vendor": "Penpot (Kaleidos)", "vendorUrl": "https://penpot.app", "kind": "http-api", "category": "design", "summary": "Open-source design and prototyping tool, used as SaaS at design.penpot.app or self-hosted.", "url": "https://www.anchorterminal.com/tools/penpot", "markdownUrl": "https://www.anchorterminal.com/tools/penpot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/penpot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/penpot.json", "repo": "https://github.com/penpot/penpot", "license": "MPL-2.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://design.penpot.app/api/rpc/command", "packages": [ { "registry": "npm", "name": "@penpot/mcp" } ], "auth": "pat", "authNotes": "Personal access tokens from account settings, sent as `Authorization: Token \u003ctoken\u003e`. The hosted MCP URL takes a separate MCP key in the `userToken` query parameter. The local MCP server (`npx @penpot/mcp@stable`) talks to the plugin over a WebSocket on localhost.", "pricing": "freemium", "pricingNotes": "Cloud Professional plan is free with unlimited files and team members. Unlimited $7 per editor a month, capped at $175 a month. Enterprise $25 per member a month, minimum $950 a month. Private server $50,000 a year. Self-hosting the community edition is free under MPL-2.0, and self-hosted Enterprise starts at $950 a month (https://penpot.app/pricing).", "priceSummary": "$7 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No payment support in the API or MCP docs.", "endpoints": [] }, "toolCount": 5, "popularity": { "githubStars": 60534, "npmWeekly": 1259, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://help.penpot.app/technical-guide/integration/", "openapi": "https://design.penpot.app/api/main/doc/openapi", "capabilities": [ "design.files", "design.components", "design.canvas", "design.comments", "design.code" ], "tags": [ "open-source", "self-hosted", "local", "hosted", "freemium", "free-tier", "no-card", "mcp", "openapi", "webhooks" ], "lastRelease": "2026-10-01", "graded": true, "anchor": { "graded": true, "score": 43.8, "grade": "E", "agentReady": false, "rank": 408, "ranked": true, "rankOf": 452, "categoryRank": 4, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 41, "maintenance": 76, "payments": 30, "reliability": 46, "schema": 66, "security": 33, "transparency": 69 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -5, "negativeNotes": [ "-3: 2026-05-19, three advisories published together, a critical pre-authenticated account takeover through team-invitation tokens (GHSA-4937-35vc-hqjj), an MCP REPL server bound to 0.0.0.0 with an unauthenticated /execute endpoint allowing remote code execution (GHSA-22qr-rp27-j9wm, high) and authenticated SSRF in remote image import (GHSA-35g2-w7f6-8v9h, high). Fixed and published, so the deduction is reduced (https://github.com/penpot/penpot/security).", "-1: 2026-02-16, arbitrary file read through the create-font-variant RPC endpoint (GHSA-xp3f-g8rq-9px2, high). Fixed and published (https://github.com/penpot/penpot/security).", "-1: 2.18.0 (2026-09-23) fixed MCP keys being usable as full API access tokens, while the documented hosted setup puts that key in a URL query string, and fixed the MCP REPL starting in multi-user mode on the main bind address. Fixed in the changelog with no advisory (https://github.com/penpot/penpot/blob/develop/CHANGES.md)." ], "verdict": "MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan. Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string.", "strengths": [ "MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan", "MCP `execute_code` reaches the whole plugin API, so an agent can create, move, restyle and delete shapes", "OpenAPI description served by every instance", "Five releases between 22 July and 1 October 2026, with issues labelled and milestoned within a day" ], "weaknesses": [ "Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string", "No annotations on MCP tools and no read-only mode", "Four advisories in 2026, including MCP REPL remote code execution", "The MCP server needs the Penpot plugin open in a browser tab, so it can't run headless", "No status page, published rate limits or webhook documentation" ], "agentNotes": [ "Call `get-profile` first to check the token, then `get-teams`, `get-projects` and `get-file` to walk down", "Ask for JSON with `Accept: application/json`, since some commands default to Transit", "Call `high_level_overview` and `penpot_api_info` before `execute_code`. They tell the model what the plugin API can do", "Keep the Penpot tab in the foreground. A backgrounded or frozen tab stalls MCP calls", "Give tokens an expiry. They carry full account access" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43.8 } ], "editorialScores": { "ergonomics": 41, "maintenance": 76, "payments": 30, "reliability": 46, "schema": 66, "security": 33, "transparency": 61 }, "provenanceScore": 76 }, "connect": { "http": "curl -H \"Authorization: Token $PENPOT_TOKEN\" https://design.penpot.app/api/rpc/command/get-profile", "claudeCode": "claude mcp add --transport http penpot \"https://design.penpot.app/mcp/stream?userToken=$PENPOT_MCP_KEY\"", "config": { "mcpServers": { "penpot": { "url": "https://design.penpot.app/mcp/stream?userToken=${PENPOT_MCP_KEY}" } } } }, "letme": { "capability": "https://letme.dev/design.files", "tool": "https://letme.dev/penpot" }, "area": "design-diagrams", "unitPrices": [ { "item": "Unlimited plan", "unit": "seat-month", "usd": 7, "note": "per editor, capped at $175 a month" }, { "item": "Enterprise plan", "unit": "seat-month", "usd": 25, "note": "minimum $950 a month" } ], "provenance": { "legalEntity": "Kaleidos Subsidiary SL", "domain": "penpot.app", "domainRegistered": "2020-05-26", "domainNote": "The site footer names KALEIDOS Subsidiary SL; Penpot is built by Kaleidos in Madrid.", "endpointOnVendorDomain": true, "terms": "https://penpot.app/terms", "privacy": "https://penpot.app/privacy", "statusPage": "", "changelog": "https://github.com/penpot/penpot/blob/develop/CHANGES.md", "securityTxt": "none", "checked": "2026-09-30", "score": 76 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/penpot.json", "live": { "slug": "penpot", "probe": { "target": "https://design.penpot.app/api/rpc/command", "method": "get", "lastAt": "2026-10-05T00:57:25.644402566Z", "lastOk": true, "lastStatus": 404, "lastMs": 49, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 62, "p95ms24h": 127, "samples24h": 272, "samples30d": 1113, "days": [ { "date": "2026-09-30", "probes": 35, "ok": 35 }, { "date": "2026-10-01", "probes": 276, "ok": 276 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 11, "ok": 11 } ] }, "versions": [ { "registry": "github", "name": "penpot/penpot", "version": "2.18.1", "released": "2026-10-01", "seenAt": "2026-10-04T16:36:28.006932933Z" }, { "registry": "npm", "name": "@penpot/mcp", "version": "2.15.4", "seenAt": "2026-10-04T16:36:27.156471232Z" } ], "githubStars": 60692, "npmWeekly": 1371, "securityTxt": { "url": "https://penpot.app/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:15:47.794701224Z" }, "domain": { "domain": "penpot.app", "registered": "2020-05-26", "source": "https://pubapi.registry.google/rdap/domain/penpot.app", "checkedAt": "2026-10-04T13:04:30.014939182Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/penpot/penpot/develop/CHANGES.md", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:47:51.411949949Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1fd9afe4e019" }, { "url": "https://penpot.app/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:46:39.612388012Z", "changedAt": "2026-10-02T15:22:53.103729165Z", "fingerprint": "8115f46015d2" }, { "url": "https://penpot.app/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:46:41.891573285Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1ca40b39e068" }, { "url": "https://penpot.app/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-04T15:46:43.78052384Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a9376c975871" } ], "updatedAt": "2026-10-05T00:57:25.644402566Z" } }, "summary": "Framer Server API has a score of 52.8 (D) against Penpot API + MCP's 43.8 (E). Both do design files. The largest gap is security \u0026 auth, 17 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/framer-vs-penpot", "json": "https://www.anchorterminal.com/compare/framer-vs-penpot.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/framer-vs-penpot.md", "slim": "https://www.anchorterminal.com/compare/framer-vs-penpot.min.md" }, "markdown": "Framer Server API has a score of 52.8 (D) against Penpot API + MCP's 43.8 (E). Both do design files. The largest gap is security \u0026 auth, 17 points.\n\n- Framer Server API: grade D, 52.8/100, rank #340 of 452. Markdown https://www.anchorterminal.com/tools/framer.md · JSON https://www.anchorterminal.com/api/v1/tools/framer.json\n- Penpot API + MCP: grade E, 43.8/100, rank #408 of 452. Markdown https://www.anchorterminal.com/tools/penpot.md · JSON https://www.anchorterminal.com/api/v1/tools/penpot.json\n\n## Which one, for what\n\nPick Framer Server API for agent ergonomics (+6), security \u0026 auth (+17), transparency \u0026 trust (+8).\n\nPick Penpot API + MCP for payments \u0026 pricing (+5).\n\n## Score by category\n\n| Category | Weight | Framer Server API | Penpot API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 43 | 46 | Penpot API + MCP +3 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 69 | 66 | Framer Server API +3 |\n| Agent ergonomics | 13% (16.2 this run) | 47 | 41 | Framer Server API +6 |\n| Security \u0026 auth | 14% (17.5 this run) | 50 | 33 | Framer Server API +17 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 30 | Penpot API + MCP +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 77 | 76 | Framer Server API +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 77 | 69 | Framer Server API +8 |\n| Negative events | ≤15 | 0 | -5 | |\n| **Total** | | **52.8 · D** | **43.8 · E** | |\n\n## Facts side by side\n\n| Fact | Framer Server API | Penpot API + MCP |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Framer | Penpot (Kaleidos) |\n| Hosted endpoint | no (local only) | `https://design.penpot.app/api/rpc/command` |\n| Transports | HTTP | HTTP, Streamable HTTP |\n| Auth | API key | Token |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | proprietary | MPL-2.0 |\n| Tools exposed | none | 5 |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-24 | 2026-10-01 |\n| Popularity | 336k npm/wk | 61k stars, 1.3k npm/wk |\n| Agent reviews | 3/5 (2) | 2.5/5 (2) |\n\n## Verdicts\n\n**Framer Server API.** Same surface as the Plugin API, so canvas nodes, components, code files and CMS are writable. No REST endpoints and no official MCP server. You need Node 22 and the `framer-api` package.\n\n**Penpot API + MCP.** MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan. Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string.\n\n## Before you call either\n\n### Framer Server API\n\n1. `connect(projectUrl, process.env.FRAMER_API_KEY)` then call Plugin API methods, and close the connection when done\n2. Publish creates a preview deployment. Promote it with `deploy()` only after checking it\n3. Keep batches small and idempotent, since a dropped connection can stop a run halfway\n4. For interactive work from a coding agent, `npx @framer/agent setup` is the supported route and keeps changes on a branch\n5. Check the changelog before upgrading. v5.0.0 changed CMS array fields and requires stable `id` values\n\n### Penpot API + MCP\n\n1. Call `get-profile` first to check the token, then `get-teams`, `get-projects` and `get-file` to walk down\n2. Ask for JSON with `Accept: application/json`, since some commands default to Transit\n3. Call `high_level_overview` and `penpot_api_info` before `execute_code`. They tell the model what the plugin API can do\n4. Keep the Penpot tab in the foreground. A backgrounded or frozen tab stalls MCP calls\n5. Give tokens an expiry. They carry full account access\n\n## Other comparisons with Framer Server API or Penpot API + MCP\n\n- [Figma API + MCP vs Framer Server API](https://www.anchorterminal.com/compare/figma-mcp-vs-framer.md)\n- [Figma API + MCP vs Penpot API + MCP](https://www.anchorterminal.com/compare/figma-mcp-vs-penpot.md)\n- [Framer Server API vs Miro API + MCP](https://www.anchorterminal.com/compare/framer-vs-miro.md)\n- [Miro API + MCP vs Penpot API + MCP](https://www.anchorterminal.com/compare/miro-vs-penpot.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-05", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Framer Server API vs Penpot API + MCP", "url": "" } ], "description": "Framer Server API has a score of 52.8 (D) against Penpot API + MCP's 43.8 (E). Both do design files. The largest gap is security \u0026 auth, 17 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Framer Server API D 52.8", "Penpot API + MCP E 43.8", "scores" ], "h1": "Framer Server API vs Penpot API + MCP", "image": "https://www.anchorterminal.com/assets/og/compare-framer-vs-penpot.png", "path": "/compare/framer-vs-penpot", "published": "2026-10-01", "section": "tools", "title": "Framer Server API vs Penpot API + MCP for AI agents, D 52.8 vs E 43.8", "toc": null, "updated": "2026-10-05", "url": "https://www.anchorterminal.com/compare/framer-vs-penpot" }, "tokens": { "markdown": 1250, "slim": 330 }, "version": 1 }