# Magic Patterns vs Miro API + MCP (slim)

> Magic Patterns scores 63.4 (B) to Miro's 62.1 (B) for design files. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/magic-patterns-vs-miro.md (~4,050 tokens) · this version ~2,230 tokens · JSON https://www.anchorterminal.com/compare/magic-patterns-vs-miro.json · canonical https://www.anchorterminal.com/compare/magic-patterns-vs-miro
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Magic Patterns scores 63.4 (B) on agent readiness against Miro API + MCP's 62.1 (B), and leads in 3 of 7 scored categories. Miro API + MCP leads on security & auth, payments & pricing and transparency & trust. Both do design files.

- Magic Patterns: B 63.4, rank #517 of 1486 · https://www.anchorterminal.com/tools/magic-patterns.min.md
- Miro API + MCP: B 62.1, rank #573 of 1486 · https://www.anchorterminal.com/tools/miro.min.md
- Magic Patterns, good for Generating and iterating on coded React prototypes from a coding agent, and pulling a design into a codebase. Ahead on Agent ergonomics, 67 against 53. Also No incidents deducted, where Miro API + MCP loses 3 points for them.
- Miro API + MCP, good for Agents that draw diagrams, maps and planning boards people will keep editing. Ahead on Security & auth, 67 against 55; Payments & pricing, 30 against 23; Transparency & trust, 77 against 60. Also Free to start without a card.

| Category | Magic Patterns | Miro API + MCP |
| --- | --- | --- |
| Reliability (16%) | 75 | 73 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 84 | 85 |
| Agent ergonomics (13%) | 67 | 53 |
| Security & auth (14%) | 55 | 67 |
| Payments & pricing (10%) | 23 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 67 |
| Transparency & trust (7%) | 60 | 77 |

| Fact (where they differ) | Magic Patterns | Miro API + MCP |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | North Park Labs, Inc. (Magic Patterns) | Miro |
| Hosted endpoint | `https://mcp.magicpatterns.com/mcp` | `https://api.miro.com/v2` |
| Transports | Streamable HTTP, HTTP | HTTP, Streamable HTTP |
| Auth | OAuth or key | OAuth |
| Licence | Closed service under the Magic Patterns terms of service (last updated 1 April 2025) | proprietary |
| Tools exposed | 24 | 52 |
| Read-only variant documented | yes | no |
| MCP registry | not listed | `io.github.miroapp/mcp-server` |
| Last release | 2026-11-05 | 2026-09-17 |
| Terms last updated | 2025-04-01 | 2021-09-01 |
| Privacy policy last updated | 2025-04-01 | 2025-08-01 |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | none | 156 stars, 19k npm/wk |
| Agent reviews | none | 4/5 (2) |

Why the edge:
- Transparency & trust, Miro API + MCP +17: Magic Patterns 60 (Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.); Miro API + MCP 77 (Closed service under published terms. The miro-ai plugins and skills are MIT (17 of 30). The trust site says customer data is excluded from AI training and only opted-in, non-enterprise user data may be used, names data residency in Australia, the EU, the US and Japan, and lists subprocessors. We didn't read retention periods (22 of 30). Dated changelog notices, but the legacy MCP board tools got six days between the 8 September notice and the 14 September migration deadline (8 of 20). Subprocessors named, including AWS, Anthropic, OpenAI, Microsoft and Google, with four residency regions (20). 17 + 22 + 8 + 20 = 67.)
- Agent ergonomics, Magic Patterns +14: Magic Patterns 67 (24 documented tools (15 for 11 to 30), plus 5 back for the read-only endpoint that registers only 12 (20 of 25). Message history pages by 10 and version history by 20 with `skip`, and file reads take a list of names (14 of 20). Documented status codes, a 402 that leaves reads working and non-blocking `validationErrors` on design-system writes (15 of 20). No idempotency keys; 409 conflict checks on design-system writes, and annotations couldn't be read on the closed server (10 of 20). `create_design` needs no parameter and makes a blank scaffold, but there is no official SDK (8 of 15). 20 + 14 + 15 + 10 + 8 = 67.); Miro API + MCP 53 (The MCP tools page now lists 52 tools (24 read, 28 write), up from 18 on 1 October, which is the more-than-30 band. No toolsets, dynamic loading or read-only subset is documented, and the FAQ says restricting which tools may connect is still evolving (5 of 25, was 15). REST lists page with `limit` and `cursor` and filter by item type, and `board_search_boards` and `canvas_search` find boards and items over MCP (18 of 20). Errors carry a machine code and message (16 of 20). We couldn't confirm readOnlyHint or destructiveHint on the closed MCP server, and REST creates have no idempotency key (6 of 20). The official Node client, @mirohq/miro-api 2.2.4, was last released on 5 February 2025 (8 of 15). 5 + 18 + 16 + 6 + 8 = 53.)
- Security & auth, Miro API + MCP +12: Magic Patterns 55 (OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). `x-mp-agent-name` attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.); Miro API + MCP 67 (REST uses OAuth 2.0 apps with scopes such as `boards:read`, `boards:write`, `team:read` and `identity:read`, which are coarse. The MCP server uses OAuth 2.1 with dynamic client registration and sees only boards the user can already open (25 of 30). A `boards:read` token gives read-only REST access, and Enterprise admins must switch MCP on, org-wide or for chosen teams. The MCP server has no read-only mode, and the 52 tools now include `section_delete`, a `canvas_update_from_svg` that creates, updates and deletes items, and tools that share boards and spaces and change roles, so the earlier point for having no delete tool is gone (10 of 20, was 13). Sticky notes, comments and board text written by collaborators reach the model through `canvas_read_as_svg` and `comment_list_comments`, and `import-claude-design-from-url` fetches a public URL; we found no prompt-injection guidance (3 of 15). The trust site describes audit logs that record AI interactions (12 of 15). ISO/IEC 27001:2022, ISO/IEC 42001:2023, SOC 2 Type II, SOC 3, Cyber Essentials, a public bug bounty and security@miro.com on the trust site. No security.txt (miro.com/.well-known/security.txt answers 404) (17 of 20). 25 + 10 + 3 + 12 + 17 = 67.)
- Payments & pricing, Miro API + MCP +7: Magic Patterns 23 (No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.); Miro API + MCP 30 (No machine payment protocol (0). Seat prices are public by plan and MCP calls are capped per plan, with no per-call price (10 of 20). Free plan with 3 editable boards, the REST API and 100 MCP calls a day, and a 14-day Business trial; no card for the Free plan per the 30 September check (20). A person creates the OAuth app or approves the MCP sign-in in a browser (0). 0 + 10 + 20 + 0 = 30.)