Luma AI API vs Magic Hour MCP

Luma AI API 53

No public OpenAPI document is linked from the docs. The API reference at /api/ is generated per method with no visible spec download (0). docs.agents.lumalabs.ai/llms.txt returns 404, but every docs page links a Markdown twin (for example /index.md and /guides/pricing/index.md) (10). Guides cover generation, keyframes, edit, extend, reframe, deletion, files, usage and the migration, and say which options don't combine, such as start and end frames with 10 second clips (14). Typed fields for model, type, resolution and duration with fixed values (12). curl and SDK examples, both 429 bodies and generation failure codes are documented (12). Responses carry an X-API-Version header and the SDK repositories keep dated changelogs, but the API docs have no changelog and the public changelog page on lumalabs.ai was last updated in June 2025 (5). 0+10+14+12+12+5 = 53.

Magic Hour MCP 82

All 50 tools read from tools/list with JSON Schema inputs and 29 enums, built from Magic Hour's OpenAPI specification (25). llms.txt (10). Long descriptions with a get_workflow_guide tool for choosing between them (17 of 20). Typed inputs with enums and no free-form objects (15). Worked examples; error responses not documented (5 of 15). Dated changelog with entries on 3 to 5 November 2026 (10 of 15, product changelog rather than MCP versions). 25 + 10 + 17 + 15 + 5 + 10 = 82.

Luma AI API 47

Model reading. The latest dated API change found is SDK v0.5.0, whose changelog dates it 4 August 2026 (tag 5 August), adding the layering parameter to generations. That is more than 90 days before 4 November, so 10 (within 180 days). The docs now carry deletion, files and usage guides with no dates, and the 3 November MCP connector runs Luma Agents workflows on a subscription, which the API doesn't serve, so neither counts (10). Ray 2, Ray 3 and their variants are retiring, but the cutoff dates go out in private notices and the migration guide gives none (5). No API changelog. The SDK changelogs are dated and support is an email address on the migration guide (7). Official SDKs for Python, TypeScript and Go and a CLI, last released on 5 August with Ray 3.2 and files support, though the new deletion routes aren't in them yet (15). Each SDK repository has a CI workflow (10). 10+5+7+15+10 = 47.

Magic Hour MCP 75

Changelog entries on 3, 4 and 5 November 2026 (30). More than three dated entries in 90 days (20). Changelog and support; issues on the public MCP repository not read (10 of 25). Registry entry io.github.magichourhq/magic-hour (0.1.1, 4 November) (15). No package health read (0). 30 + 20 + 10 + 15 + 0 = 75. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Luma AI API 57

Better Stack status page at status.lumalabs.ai with API, Dream Machine and Luma Agents components, an incident list and an RSS feed (20). In the 90 days from 6 August the feed lists three incidents, all on legacy Ray2 models: Ray2 Flash timeouts on 2 to 3 September (about 9 hours) and 15 to 16 September (about 2 hours), and Ray2 queue times on 16 to 17 September (about 13 hours). The status page tags each with its API and Dream Machine components, and each hit one legacy model, so minor only (20). The authentication incident counted as a major on 1 October was on 16 July and has left the window. Limits are per minute and per concurrent job, but the numbers sit in the dashboard, not the docs (5). Every 429 carries Retry-After, with separate bodies for the per-minute and concurrency limits and backoff guidance with jitter. Rejected requests aren't queued and synchronous errors are never charged, which is safe-retry guidance, but there is no idempotency key, so 12 as settled in this run (12). No SLA document. The pricing page lists a latency SLA for Provisioned Throughput only as a table entry (0). The pricing page says video rates may change before general availability, so the video surface isn't GA yet (0). 20+20+5+12+0+0 = 57.

Magic Hour MCP 35

Status page at status.magichour.ai, all services online, with maintenance and previous incidents sections; no MCP component read (15). Incident history not read (5). No API rate limits found (0). No retry guidance found; wait_for_* tools poll long jobs (5 of 15). No SLA found (0). Not labelled beta (10). 15 + 5 + 0 + 5 + 0 + 10 = 35.

Luma AI API 66

Generations come back as small JSON objects with a presigned URL for the output (15). We found no callback for the Agents API, so jobs are polled (0 of 10). Resolution and duration set output size (10). The API reference lists create, get and delete for generations and a list call only for files, so there is no list of past generations (0 of 10). The 429 detail string tells an agent whether to wait for Retry-After or for a job to finish, and failures carry codes (16). No idempotency key. Moderated and failed generations are refunded and synchronous errors aren't charged, so a retry after a failure is safe (10). One generation endpoint with few required fields, and official SDKs for Python, TypeScript and Go plus a CLI (15). 15+0+10+0+16+10+15 = 66.

Magic Hour MCP 55

50 tools totalling about 160 KB of definitions (5). list_saved_items and project getters; limited size controls (10 of 20). Error handling not documented (5 of 20). Every tool annotated, 14 read-only and the three deletes marked destructive (20). Few required inputs and SDKs (Python, Node and others listed in the docs) (15). 5 + 10 + 5 + 20 + 15 = 55.

Luma AI API 67

Closed models. The terms give customers the outputs, with commercial use tied to an active paid plan (15). The API terms state that API inputs and outputs aren't used for training (10). The pricing page's comparison table says Pay-as-you-go has no no-train guarantee and only Provisioned Throughput does. That contradiction is charged once, as a misleading claim under negative events, as rime-prism's training contradiction is, so it doesn't also lower this line. The privacy policy (20 April 2026) describes retention by criteria without periods, and the deletion guide sets retention per API client with a one-year hold for moderation failures (5). The privacy policy was read and names US hosting with Standard Contractual Clauses for transfers. No DPA was read (5). A public migration guide without dates, retirement dates by email only (5). A subprocessor list (last updated 4 October 2026) names about 50 providers with their purpose, and the privacy policy says the services are hosted in the United States (15). 15+10+5+5+5+15 = 55.

Magic Hour MCP 58

Closed service under terms naming Magic Hour AI, Inc., revised 3 October 2026 (15). The privacy policy says prompts, uploads and outputs aren't sold or used to train models, for free and paid accounts, and MCP requests are handled the same way; retention periods aren't given (20 of 30). No deprecation policy found (5 of 20). Subprocessors not read (10 of 20, model providers named in tool docs). 15 + 20 + 5 + 10 = 50.

Luma AI API 53

Model reading of the checklist (credential, training, retention, operator visibility, programme). Bearer keys created in the platform and shown once, with quota and limits shared by all keys of a client. No scopes found (20). The API terms of 28 April 2026 say Luma won't use API inputs or outputs to train or develop its models (20). A deletion call is now documented, DELETE /v1/generations/{id} with a deletion task polled at GET /v1/deletions/{task_id}, though the guide says it may not be enabled for every API client and the SDKs don't include it yet (5). Retention is set per API client, with no default period stated, and a generation that fails moderation can be held for at least a year (0). Rate-limit headers, a request id per call, and GET /v1/usage for spend by session or end user, with no audit log found (8). No security.txt (lumalabs.ai/.well-known/security.txt returns 404), bug bounty or certification found for Luma AI (0). 20+20+5+0+8+0 = 53.

Magic Hour MCP 45

API keys as Bearer tokens or OAuth through the Claude and ChatGPT connectors (20 of 30). Destructive deletes are annotated; no read-only key (8 of 20). Tools return generated media, not third-party text (10). No audit log found (0). No security.txt or certifications found; face and voice tools come with policy limits in the terms (7 of 20). 20 + 8 + 10 + 0 + 7 = 45.