Kite vs Subframe

Kite 33

Hosted reading, for the platform and its remote MCP server. No public status page was found. None is linked from the docs or the footer, https://kite.new/status answers 404 and status.kite.new does not resolve (0). No readable incident history, so the floor (5). Limits are published with numbers on the account page, 200 agent actions a day on Free, reset at midnight UTC, unlimited on Pro; 60 new files an hour; 20 comments on one file every 10 minutes; 600 exported layers an hour; 20 keys; file caps of 400 MB and 250,000 layers. auth.md says registration and agent calls are rate-limited without a per-minute figure (12 of 15). 429 is documented in auth.md with 'back off' and no Retry-After, 401 with a refresh-once-then-rediscover rule, and the drawing guide says to edit layers in place rather than redraw; no idempotency key on any write and no safe-retry guidance for layer_draw, so a retried draw adds a second frame (6 of 15). No SLA. The terms (8 September 2026) say Kite is provided as is, uptime is not guaranteed and files may be lost (0). The hosted server carries no beta label and the registry entry is 1.0.0; the product launched on 6 October 2026 and the desktop apps are 0.1.16 (10). 0+5+12+6+0+10 = 33.

Subframe 19

Read with the hosted lines, because the surface an agent uses is the MCP server at mcp.subframe.com. No status page was found on the site, the docs or the footer (0 of 20). With no page there is no incident history to read (5 of 30). No rate limit is published in the docs or the skill files (0 of 15). No 429 or backoff guidance was found. The docs do say a background job that stops reporting for about 10 minutes is returned as error, and the CLI retries a failed request once (4 of 15). No SLA is published, and the terms say the service is not warranted to be uninterrupted (0 of 10). The MCP server carries no beta label, though the CLI's push-component command is marked experimental (10 of 10).

Kite 44

Closed service. The terms of use (8 September 2026) run to about 200 words on content, prohibited use, links, availability and changes and name no legal entity, address or governing law, so the contracting party is unknown (8 of 30). The privacy policy (14 October 2026) names eight services, says files are not read, trained on or sold, discloses masked session replays and error replays, gives the agent token's 7-day life renewable to 90 days (matching auth.md and the integration page), the 30-day purge of deleted pages and the one-month deletion of a closed account's files, and the Figma token's handling; no DPA and no retention period for logs beyond the providers' own (20 of 30). No deprecation policy or dated notices; the terms promise email or in-app notice of changes that matter and the changelog dates additions, not removals (4 of 20). Telemetry (PostHog, Sentry) is disclosed with what it excludes and no opt-out beyond product-news emails; service locations are given only for PostHog and Sentry (US) (10 of 20). 8+20+4+10 = 42.

Subframe 58

The service is closed under terms of service dated 22 January 2026. The CLI and @subframe/core are public and marked ISC in their package files, and the plugin MIT in its manifest, but the repository has no licence file (17 of 30). Terms, privacy policy (22 January 2026) and DPA (21 January 2026) agree with each other. The privacy policy gives no retention periods, and the terms say 'Unless Customer is notified otherwise, Customer Data is not used to train AI models', which leaves the default open to change by notice (15 of 30). No deprecation policy. A migration page explains the move to component directories, and three MCP tools were renamed with no notice found (4 of 20). The DPA links a sub-processor list held in a Google Sheet, which we did not read. The privacy policy names Google Analytics, PostHog, Segment and LogRocket, and the CLI's README discloses crash and usage reporting with DO_NOT_TRACK=1 as the opt-out (10 of 20).

Kite 78

Closed service with a dated changelog. The latest entry is 1 November 2026 (30). 15 dated entries between 6 October and 1 November 2026, including Pro on 18 October, Windows, shaders and website design systems on 23 October and the agent page, version, comment and export tools on 25 October (20). Support is hello@kite.new, a Support link in the docs, 'your feedback first in line' on Pro and dedicated support on Team; no community channel, forum or issue tracker, and the plugin repository has no issues (8 of 15). new.kite/kite 1.0.0 is in the official MCP registry under a DNS-verified namespace since 21 October 2026 (15). No packages to judge; the MIT plugin repository was pushed once on 7 October 2026 and the desktop apps update themselves (5 of 10). 30+20+8+15+5 = 78.

Subframe 65

The Claude Code plugin reached 1.0.30 on 8 October 2026 and @subframe/cli 1.212.0 on 5 October 2026 (30 of 30). The plugin version changed ten times between 13 July and 8 October, and the CLI had three versions on 5 October after none since 24 June (20 of 20). The repository has 13 issues in all. Seven are open, among them a Codex MCP install error from 30 March 2026 and a Claude Code plugin install error from 13 February 2026 with one and two comments, and three with none. Pull requests merge most days. The Slack community was not read (10 of 25). A search of the official MCP registry for 'subframe' returned no entry (0 of 15). A commit of 12 August 2026 fixed dependency vulnerabilities. The CLI has unit and end-to-end tests in the repository, and the only public workflow publishes the package (5 of 10).

Kite 62

MCP reading, since the MCP server is the only surface an outside agent reaches. No tool input schemas were read. The server card at /.well-known/mcp/server-card.json declares tools without listing them, and llms-full.txt describes every tool in prose with argument names in the skill, so typed inputs are the vendor's to show and were not seen (10 of 25). llms.txt, llms-full.txt, skill.md, auth.md and pricing.md are served as text and Markdown (10). Descriptions say what each tool does and when to use it, such as file_search over file_list when the user describes a file, layer_edit rather than redrawing, never base64 in HTML, never a picture of a design, guide_read's six topics, and the view-only rule (16 of 20). Inputs named in the docs are typed in prose, with enumerations for audience (link, restricted), export formats (svg, react, tailwind, html), sticky colours, shader bases and guide topics, and bounds for videos (100 MB) and fonts (4 MB), but the main write tool takes one HTML string and layer_edit a free CSS object (8 of 15). Worked HTML examples in skill.md, a prompt per client page, and auth.md's 401, 400 and 429 responses; no example tool call or response and no MCP error shape (8 of 15). A dated changelog with 15 entries from 6 October to 1 November 2026 that names agent-facing changes (page, version, comment and export tools on 25 October), server version 1.0.0; no versioned tool surface or deprecation policy (10 of 15). 10+10+16+8+8+10 = 62.

Subframe 54

The MCP server is closed and answers 401 without OAuth, so the tool definitions and their input schemas were not read. The docs list 46 tools by name and the public skill files give parameters for most of them (12 of 25, on that partial evidence). docs.subframe.com publishes llms.txt, a Markdown twin of each page and a docs MCP server (10 of 10). The design skill states for each tool what it is for and when another tool fits better, for example edit_page against design_page. The docs table gives one line a tool (15 of 20). Parameters are named in the skill (id, name or url, force, deleteChildPages, includeResolved), while the design tools take a free-text description (6 of 15). Ten example prompts and a troubleshooting section, with no list of error responses (7 of 15). The plugin and the CLI carry version numbers, with no changelog (4 of 15).

Kite 50

OAuth 2.1 with the authorization code flow, PKCE S256, dynamic registration of public clients, 7-day access tokens, 90-day refresh tokens that rotate on every use and revoke the connection if replayed, a revocation endpoint, bearer in the header only, and per-connection disconnect in Settings; one scope, pages, with the agent working under the user's full rights, and API keys that are per tool and revocable but unscoped (24 of 30). Least privilege comes from the file, not the token. A file shared view-only lets an agent read and comment but not draw, comment and download settings apply to agents, an agent cannot delete a file for good or touch the account, workspace or people, and each Mac-run request reaches only its file; no read-only mode on the hosted server and no confirmation for layer_remove, page_remove or version_restore (12 of 20). Comments, skills written by any editor, captured web pages and Figma pastes reach the model. The skill says a file's skills apply to that file only and never to sharing or people, and the Mac docs keep Agents Run Any Tool off by default because an agent reads comments and web pages and one could try to trick it; no guidance for the hosted server's own tools (8 of 15). Settings, Agents lists each connected app and key with when it connected and was last used, the board shows the agent's name while it works, and version history records agent saves; no per-call log for the operator (6 of 15). No security.txt (404), disclosure policy, bug bounty, SOC 2 or ISO 27001; SSO and SAML on Team (0 of 20). 24+12+8+6+0 = 50.

Subframe 44

The MCP server uses OAuth with dynamic client registration, PKCE and refresh tokens, and rejects static tokens. The authorisation server lists only identity scopes (openid, profile, email, phone, offline_access), so access follows the user's team role and not a scope. CLI tokens are shown once and can be deleted, with no scopes or expiry documented, and the generate_auth_token tool lets a connected agent mint one (22 of 30). Viewers get a read-only MCP server and read-only CLI access. Confirmation before deletes is guidance in the skill file and not a documented server control (12 of 20). list_comments, design documents and search_docs return text other people wrote, and no prompt-injection guidance was found (3 of 15). No audit log is documented. Version history records changes for 24 hours on Free and 7 days on Pro (3 of 15). No security.txt, disclosure policy, bug bounty or certification was found. The DPA's Annex 2 lists security measures and the docs cover Okta SSO (4 of 20).