Magic Patterns vs Melius

Magic Patterns 67

24 documented tools (15 for 11 to 30), plus 5 back for the read-only endpoint that registers only 12 (20 of 25). Message history pages by 10 and version history by 20 with skip, and file reads take a list of names (14 of 20). Documented status codes, a 402 that leaves reads working and non-blocking validationErrors on design-system writes (15 of 20). No idempotency keys; 409 conflict checks on design-system writes, and annotations couldn't be read on the closed server (10 of 20). create_design needs no parameter and makes a blank scaffold, but there is no official SDK (8 of 15). 20 + 14 + 15 + 10 + 8 = 67.

Melius 51

The MCP reference lists 75 tools, in the over-30 band, with get_guide and get_docs loading guidance on demand and 18 Cast tools shown only to teams with access (10 of 25). Four list operations take limit and offset and three take search, canvas content can be narrowed to one node or to media summaries, and the CLI has --fields (14 of 20). REST errors carry statusCode, error and message, the CLI adds a code and a suggestion, and CANVAS_TOO_LARGE is documented as not worth retrying. A shortage of credits arrives as a plain 400 (14 of 20). No idempotency keys, and we couldn't read MCP annotations without an account. The docs do give safe-retry guidance (5 of 20). Auto model selection and defaults keep required fields few. There is no SDK library, only the CLI and generated code samples in six languages (8 of 15). Per the 8 October check, not re-read on 4 November, because the terms of 30 October 2026 bar automated access to melius.com and its subdomains.

Magic Patterns 84

The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback category is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.

Melius 70

Public OpenAPI 3.0.2 spec with 59 operations (25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). 58 of the 59 operations have a summary and no description. The MCP reference gives each of 75 tools one line, with ordering rules for get_guide, show_presence and canvas_plan_layout, and the tool definitions themselves need a signed-in client, so we didn't read them (8 of 20). Request bodies are typed with 336 enums, ranges, UUID formats and required fields, with 52 open additionalProperties objects (13 of 15). 401, 403 and 429 are declared on every operation and 400, 404 and 409 where they apply, but the spec has no examples and most error bodies are a bare message (9 of 15). The path is versioned at /api/v1 and the CLI states semantic versioning. No public changelog found (5 of 15). Per the 8 October check, not re-read on 4 November, because the terms of 30 October 2026 bar automated access to melius.com and its subdomains.

Magic Patterns 70

Changelog entry on 5 November 2026, the day before this check (30). Entries on twelve dates since 8 August, among them 23 September and 12 to 30 October (20). Closed service with a public changelog, email support within one to two business days, in-app chat and a Slack community. We didn't test them (12 of 15). Not in the official MCP registry (searches for magic-patterns and magicpatterns returned nothing of theirs). Official Claude connector, Cursor plugin and Codex plugin, and no SDKs (5 of 15). No public package or repository to check (3 of 10). 30 + 20 + 12 + 5 + 3 = 70.

Melius 56

The newest dated release is the CLI, 0.16.2 on 10 September 2026 per the 8 October npm reading, 55 days before this check. The vendor's Homebrew tap, whose bot tracks npm hourly, has no version after 0.16.2, and no other dated source could be read (20). Versions 0.15.0 to 0.16.2, eight in all, fall between 7 August and 10 September by the tap's bump commits, which match the 19 versions since 10 July in the 8 October npm reading (20). Closed service with no public changelog or issue tracker. Support is by email at support@melius.com and a Discord server linked from the site (5 of 15). There is no SDK library, though the CLI is on npm and Homebrew (5 of 15). The CLI has three dependencies, needs Node.js 20 and is published from GitHub Actions through npm trusted publishing. Its source is not public (6 of 10).

Magic Patterns 55

OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). x-mp-agent-name attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.

Melius 43

API keys are revocable at once, can expire and are shown once, but have no scopes. A key works with its creator's access in every team that user belongs to, capped at the user's role. The MCP OAuth flow uses S256 PKCE and dynamic client registration, lists no scopes, and ties the connector key to one team (22 of 30). A key made by a viewer can only read, bulk_delete_node asks the user to confirm and a run can return a pending approval, but there is no read-only key and the setup guide tells users to select Always Allow for every tool (9 of 20). Canvas text, comments from collaborators and files fetched by url_to_canvas reach the model, and no prompt-injection guidance was found (2 of 15). Keys list a lastUsedAt time, connector keys are named after the client, and generation history is kept per member. No audit log is documented (7 of 15). No security.txt, disclosure policy or bug bounty found. A Vanta trust centre exists at trust.melius.com but needs JavaScript, so certifications are unchecked (3 of 20). Per the 8 October check, not re-read on 4 November, because the terms of 30 October 2026 bar automated access to melius.com and its subdomains.

Magic Patterns 75

Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a baseArtifactId and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.

Melius 69

Graded on the hosted REST API and MCP server. status.melius.com runs on incident.io with component history for Web app and MCP, though it has no API component (20). Its history listed no incidents from July to 8 October 2026, as far back as the page went. 9 October to 4 November is unread, and a partly unread window keeps its recorded award (30). No rate-limit numbers are published. The docs say only that no plan has a monthly request quota and that bursts can return 429 (0). 429s carry Retry-After and a retryAfterSeconds body field, and the docs give a bounded retry policy and tell clients to check canvas or run state after a timeout or 5xx on a write. There are no idempotency keys (12 of 15). No SLA found (0). The API and MCP server carry no beta label, but the CLI is at 0.16.2 and Cast and media-URL inputs are marked beta (7 of 10). Per the 8 October check, not re-read on 4 November, because the terms of 30 October 2026 bar automated access to melius.com and its subdomains.