Magic Patterns vs Miro API + MCP

Magic Patterns 60

Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.

Miro API + MCP 77

Closed service under published terms. The miro-ai plugins and skills are MIT (17 of 30). The trust site says customer data is excluded from AI training and only opted-in, non-enterprise user data may be used, names data residency in Australia, the EU, the US and Japan, and lists subprocessors. We didn't read retention periods (22 of 30). Dated changelog notices, but the legacy MCP board tools got six days between the 8 September notice and the 14 September migration deadline (8 of 20). Subprocessors named, including AWS, Anthropic, OpenAI, Microsoft and Google, with four residency regions (20). 17 + 22 + 8 + 20 = 67.

Magic Patterns 67

24 documented tools (15 for 11 to 30), plus 5 back for the read-only endpoint that registers only 12 (20 of 25). Message history pages by 10 and version history by 20 with skip, and file reads take a list of names (14 of 20). Documented status codes, a 402 that leaves reads working and non-blocking validationErrors on design-system writes (15 of 20). No idempotency keys; 409 conflict checks on design-system writes, and annotations couldn't be read on the closed server (10 of 20). create_design needs no parameter and makes a blank scaffold, but there is no official SDK (8 of 15). 20 + 14 + 15 + 10 + 8 = 67.

Miro API + MCP 53

The MCP tools page now lists 52 tools (24 read, 28 write), up from 18 on 1 October, which is the more-than-30 band. No toolsets, dynamic loading or read-only subset is documented, and the FAQ says restricting which tools may connect is still evolving (5 of 25, was 15). REST lists page with limit and cursor and filter by item type, and board_search_boards and canvas_search find boards and items over MCP (18 of 20). Errors carry a machine code and message (16 of 20). We couldn't confirm readOnlyHint or destructiveHint on the closed MCP server, and REST creates have no idempotency key (6 of 20). The official Node client, @mirohq/miro-api 2.2.4, was last released on 5 February 2025 (8 of 15). 5 + 18 + 16 + 6 + 8 = 53.

Magic Patterns 55

OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). x-mp-agent-name attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.

Miro API + MCP 67

REST uses OAuth 2.0 apps with scopes such as boards:read, boards:write, team:read and identity:read, which are coarse. The MCP server uses OAuth 2.1 with dynamic client registration and sees only boards the user can already open (25 of 30). A boards:read token gives read-only REST access, and Enterprise admins must switch MCP on, org-wide or for chosen teams. The MCP server has no read-only mode, and the 52 tools now include section_delete, a canvas_update_from_svg that creates, updates and deletes items, and tools that share boards and spaces and change roles, so the earlier point for having no delete tool is gone (10 of 20, was 13). Sticky notes, comments and board text written by collaborators reach the model through canvas_read_as_svg and comment_list_comments, and import-claude-design-from-url fetches a public URL; we found no prompt-injection guidance (3 of 15). The trust site describes audit logs that record AI interactions (12 of 15). ISO/IEC 27001:2022, ISO/IEC 42001:2023, SOC 2 Type II, SOC 3, Cyber Essentials, a public bug bounty and security@miro.com on the trust site. No security.txt (miro.com/.well-known/security.txt answers 404) (17 of 20). 25 + 10 + 3 + 12 + 17 = 67.

Magic Patterns 23

No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.

Miro API + MCP 30

No machine payment protocol (0). Seat prices are public by plan and MCP calls are capped per plan, with no per-call price (10 of 20). Free plan with 3 editable boards, the REST API and 100 MCP calls a day, and a 14-day Business trial; no card for the Free plan per the 30 September check (20). A person creates the OAuth app or approves the MCP sign-in in a browser (0). 0 + 10 + 20 + 0 = 30.