{ "data": { "a": { "slug": "magic-patterns", "name": "Magic Patterns", "vendor": "North Park Labs, Inc. (Magic Patterns)", "vendorUrl": "https://www.magicpatterns.com", "kind": "mcp", "category": "design", "summary": "Magic Patterns is an AI design workspace where product teams generate interactive React prototypes from prompts and their own design system. Agents reach it through a hosted MCP server and a v3 REST API that mirrors it.", "url": "https://www.anchorterminal.com/tools/magic-patterns", "markdownUrl": "https://www.anchorterminal.com/tools/magic-patterns.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/magic-patterns.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/magic-patterns.json", "dns": "magic-patterns.grade.anchorterminal.com", "license": "Closed service under the Magic Patterns terms of service (last updated 1 April 2025)", "transports": [ "streamable-http", "http" ], "remoteUrl": "https://mcp.magicpatterns.com/mcp", "packages": [], "auth": "mixed", "authNotes": "The hosted MCP server signs in with OAuth 2.1 (PKCE S256, dynamic client registration, client ID metadata documents and a device flow, at oauth.magicpatterns.com on WorkOS). Scopes are identity only (openid, email, profile, offline_access), so access follows the user's workspace role. An API key from Settings \u003e API Keys, shown once, works for MCP as `Authorization: Bearer` and for REST as `x-mp-api-key`. A read-only MCP endpoint at /mcp/readonly takes the same credentials.", "pricing": "freemium", "pricingNotes": "MCP access needs a paid plan, Starter $20 a seat a month ($17 yearly) with 1,000 credits on top of the free monthly credits, or Business $100 ($85 yearly) with 5,000. On-demand credits beyond that cost $0.02 each on paid plans. One generation typically uses about 70 credits per the docs. Free plan $0 with free monthly credits.", "priceSummary": "$20 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "Subscription credits billed through Stripe. No x402, MPP or L402 in the docs, the v3 OpenAPI or llms.txt (checked 2026-11-06). Out of credits returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 24, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.magicpatterns.com/docs", "llmsTxt": "https://www.magicpatterns.com/docs/llms.txt", "openapi": "https://www.magicpatterns.com/docs/api/create-design.md", "capabilities": [ "design.code", "design.files", "design.components", "design.canvas" ], "tags": [ "hosted", "mcp", "remote-mcp", "oauth", "api-key", "read-only-mode", "llms-txt", "openapi", "freemium", "status-page", "yc" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 63.4, "grade": "B", "agentReady": false, "rank": 517, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 70, "payments": 23, "reliability": 75, "schema": 84, "security": 55, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Agents can create, prompt, read and edit coded prototypes through 24 documented MCP tools or a matching REST API, with a read-only endpoint and 409 conflict checks on writes. MCP access needs a paid seat from $20 a month, OAuth scopes don't narrow access below the user's role, and the status page doesn't track the API or MCP server.", "bestFor": "Generating and iterating on coded React prototypes from a coding agent, and pulling a design into a codebase.", "strengths": [ "A read-only MCP endpoint that does not register the 13 tools that create, change or publish", "Workflows, polling intervals and tool order documented for agents, with llms.txt and Markdown pages", "v3 REST API with an OpenAPI 3.0.3 description that mirrors the MCP tools, so one key works for both", "Writes carry a base artifact ID and fail with 409 on a concurrent change", "Dated product changelog with entries from 2026-08-03 to 2026-11-05" ], "weaknesses": [ "MCP and API-key access need a paid seat, Starter at $20 a month", "OAuth scopes are identity only, so a token can do whatever the user's workspace role allows", "No 429 or backoff guidance and no idempotency keys; generations take 2 to 10 minutes and must be polled", "The status page tracks the web platform and Figma plugin, not the API or MCP server", "Free plan inputs and designs may be used for training and shown publicly, per the terms" ], "agentNotes": [ "Use https://mcp.magicpatterns.com/mcp/readonly when the task only reads designs", "Call `get_design_status` before any change and poll it no more than once every 60 seconds", "Pass `baseArtifactId` from `get_design_system` on writes, and on 409 re-read before retrying", "Treat a 402 as out of credits and ask the user; read tools keep working", "Send `x-mp-agent-name` so the user sees which agent made a change" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.4 } ], "editorialScores": { "ergonomics": 67, "maintenance": 70, "payments": 23, "reliability": 75, "schema": 84, "security": 55, "transparency": 42 }, "provenanceScore": 78, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.magicpatterns.com/api/v3/health -H \"x-mp-api-key: mp_live_...\"", "claudeCode": "claude mcp add --transport http magic-patterns https://mcp.magicpatterns.com/mcp", "config": { "mcpServers": { "magic-patterns": { "url": "https://mcp.magicpatterns.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/design.code", "tool": "https://letme.dev/magic-patterns" }, "area": "design-diagrams", "unitPrices": [ { "item": "Starter seat", "unit": "seat-month", "usd": 20, "note": "$17 billed yearly, 1,000 credits on top of the free monthly credits" }, { "item": "Business seat", "unit": "seat-month", "usd": 100, "note": "$85 billed yearly, 5,000 credits on top of the free monthly credits" }, { "item": "On-demand credit", "unit": "credit", "usd": 0.02, "note": "Paid plans only, after monthly credits run out. A generation typically uses about 70 credits" } ], "provenance": { "legalEntity": "North Park Labs, Inc.", "domain": "magicpatterns.com", "domainRegistered": "2023-10-23", "endpointOnVendorDomain": true, "terms": "https://www.magicpatterns.com/docs/documentation/legal/terms", "privacy": "https://www.magicpatterns.com/docs/documentation/legal/privacy", "statusPage": "https://magicpatterns.statuspage.io/", "changelog": "https://www.magicpatterns.com/docs/documentation/feature-releases/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both last updated 1 April 2025, name North Park Labs, Inc. d.b.a. Magic Patterns, under Delaware law.", "The terms forbid accessing or searching the Services by any means other than the provided interfaces (for example, scraping) and bots that send requests faster than a person could. Public docs pages were read as data.", "www.magicpatterns.com/robots.txt disallows /private/, /settings/, /api/ and /_next/ and allows the docs. magicpatterns.statuspage.io/robots.txt disallows /api/ and /embed/, so status history was read from the page and its Atom feed.", "/.well-known/security.txt returns 404. The security docs page links a Trust Center at trust.magicpatterns.com for SOC 2 reports and subprocessors, which is drawn by script and wasn't read.", "RDAP gives magicpatterns.com a registration date of 23 October 2023. The company was founded in 2023 per its Y Combinator page." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/magic-patterns.json", "live": { "slug": "magic-patterns", "probe": { "target": "https://mcp.magicpatterns.com/mcp", "method": "mcp-initialize", "lastAt": "2026-11-07T18:20:36.546371661Z", "lastOk": true, "lastStatus": 401, "lastMs": 191, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 200, "p95ms24h": 512, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://magicpatterns.statuspage.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:21.341572331Z" }, "securityTxt": { "url": "https://magicpatterns.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:36.740973899Z" }, "llmsTxt": { "url": "https://www.magicpatterns.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:55.846864963Z" }, "pages": [ { "url": "https://www.magicpatterns.com/docs/documentation/feature-releases/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:31:04.926757349Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1d6fc782fb69" }, { "url": "https://www.magicpatterns.com/docs/documentation/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:31:07.60138431Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "98e04acdbe99" }, { "url": "https://www.magicpatterns.com/docs/documentation/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:31:09.211996324Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "264ce0076e25" } ], "mcpTools": { "url": "https://mcp.magicpatterns.com/mcp", "checkedAt": "2026-11-07T01:46:04.045898155Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:46:04.045898155Z" }, "updatedAt": "2026-11-07T18:21:21.341572331Z" } }, "answer": "Magic Patterns scores 63.4 (B) on agent readiness against pen.dev's 43.3 (E), and leads in 6 of 7 scored categories. pen.dev leads on payments \u0026 pricing.", "b": { "slug": "pen-dev", "name": "pen.dev", "vendor": "High Agency, Inc.", "vendorUrl": "https://pen.dev", "kind": "mcp", "category": "design", "summary": "Design canvas from High Agency, Inc. that stores designs as JSON `.pen` files. Agents edit them through a local MCP server in the desktop app or IDE extension, or through a headless CLI. It was called Pencil until 2026.", "url": "https://www.anchorterminal.com/tools/pen-dev", "markdownUrl": "https://www.anchorterminal.com/tools/pen-dev.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/pen-dev.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/pen-dev.json", "dns": "pen-dev.grade.anchorterminal.com", "repo": "https://github.com/highagency/pen-desktop-releases", "license": "Proprietary. The CLI package on npm carries a proprietary licence file, and the apps fall under the vendor's EULA", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@pen.dev/cli" } ], "auth": "mixed", "authNotes": "A pen.dev account is required for the desktop app, the extension and the CLI. The MCP server takes no credential of its own and reaches the signed-in app over a local socket, after the owner enables each client in Settings, MCP. The CLI signs in with `pen login` (email with password or one-time code) or with `PEN_CLI_KEY`, an organisation-scoped key created in Developer Keys on the web app. No key scopes are documented. Access is self-serve.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 5 agent days and 25 image or SVG generations a month, including the CLI, MCP access and personal developer keys, so an agent's owner can start without a contract. Pro is $16 and Ultra $48 a user a month, and Enterprise is priced on request. Model usage on the user's own provider key is billed by that provider (https://pen.dev/pricing, checked 2026-10-08).", "priceSummary": "$16 / seat-mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the CLI reference (checked 2026-10-08).", "endpoints": [] }, "toolCount": 6, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.pen.dev", "capabilities": [ "design.files", "design.canvas", "design.components", "design.code" ], "tags": [ "local", "desktop", "cli", "headless", "mcp", "stdio", "closed-source", "freemium", "free-tier", "vscode", "design-to-code" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 43.3, "grade": "E", "agentReady": false, "rank": 1235, "ranked": true, "rankOf": 1486, "categoryRank": 14, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 59, "payments": 38, "reliability": 33, "schema": 36, "security": 31, "transparency": 55 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-05" }, "negative": 0, "verdict": "An agent can create, edit and export `.pen` designs without a GUI through the `pen` CLI, with four compact MCP tools that carry annotations and a documented JSON format. The software is closed and needs a pen.dev account. Tool schemas sit only in the package code, and no changelog, status page or security contact was found.", "bestFor": "A coding agent that designs screens beside the code and keeps them in Git, including in CI.", "strengths": [ "Headless CLI (`@pen.dev/cli`) runs the same editor engine as the desktop app and exports PNG, JPEG, WEBP, PDF and HTML", "Four standard MCP tools with typed inputs in the package and readOnlyHint and destructiveHint annotations, plus two conditional tools", "The `.pen` format is JSON with a published TypeScript schema, so designs sit in Git beside code", "Free plan includes the CLI, MCP access and personal developer keys, with five agent days a month", "Privacy policy has a retention table and says prompts sent with the user's own provider key never reach the vendor's servers" ], "weaknesses": [ "No changelog. Desktop releases on GitHub had empty notes on 8 October, and the format docs reserve the right to make breaking changes", "MCP tool input schemas appear only in the package code, not in the docs", "14 issues opened between 28 July and 6 October 2026 in highagency/pen-desktop-releases had no comment or closure on 8 October", "No status page, security.txt, disclosure policy, bug bounty or certification was found", "`execute` takes one JavaScript snippet and carries destructiveHint true, with no read-only mode for an external MCP client", "Closed source under a proprietary licence that forbids reverse engineering, and every surface needs a pen.dev account" ], "agentNotes": [ "Call `read_skill()`, then `read_skill({ path: \"pen-schema.md\" })` and `read_skill({ path: \"execute.md\" })` before the first `execute`. The tool description alone doesn't document the operations", "Call `get_app_state()` and confirm the active document before editing. The MCP server works on whichever `.pen` file is open in the app", "In headless `pen interactive`, call `save()` before `exit()`, and keep `--in` and `--out` on different paths to preserve the source", "Check that an export file exists. The docs say an export failure can print an error without a nonzero exit status", "In CI set `PEN_CLI_KEY` plus a provider key such as `ANTHROPIC_API_KEY`. Run `pen version`, since `pen --version` is not a flag" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 2.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43.3 } ], "editorialScores": { "ergonomics": 66, "maintenance": 59, "payments": 38, "reliability": 33, "schema": 36, "security": 31, "transparency": 54 }, "provenanceScore": 55, "checked": { "categories": { "ergonomics": "2026-11-05", "maintenance": "2026-11-05", "payments": "2026-11-05", "reliability": "2026-11-05", "schema": "2026-11-05", "security": "2026-11-05", "transparency": "2026-11-05" }, "last": "2026-11-05", "lastMoved": "2026-11-05", "oldest": "2026-11-05", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @pen.dev/cli", "headless": { "command": "pen --out design.pen --prompt \"$TASK\"", "env": { "ANTHROPIC_API_KEY": "\u003ckey\u003e", "PEN_CLI_KEY": "\u003ckey starting pencil_cli_\u003e" } } }, "letme": { "capability": "https://letme.dev/design.files", "tool": "https://letme.dev/pen-dev" }, "area": "design-diagrams", "unitPrices": [ { "item": "Pro plan", "unit": "seat-month", "usd": 16, "note": "unlimited agent days, 350 image or SVG generations a month, up to 3 agents in parallel" }, { "item": "Ultra plan", "unit": "seat-month", "usd": 48, "note": "750 image or SVG generations a month, up to 6 agents in parallel" } ], "provenance": { "legalEntity": "High Agency, Inc.", "domain": "pen.dev", "domainRegistered": "2025-09-10", "endpointOnVendorDomain": true, "terms": "https://pen.dev/terms-of-use", "privacy": "https://pen.dev/privacy-policy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-05", "notes": [ "The terms of use are effective 26 October 2026; the EULA and privacy policy, per the 8 October check, are effective 6 October 2026. They name High Agency, Inc., 440 N Barranca Ave #2993, Covina, CA 91723, USA, and choose Delaware law.", "The terms of use cover the desktop app, web app, extensions and CLI and hold the billing terms. A separate EULA at https://pen.dev/eula governs the installed software and prevails for it where the two conflict.", "The MCP server is local. The CLI and app sign in against https://api.pen.dev, and the web app is app.pen.dev.", "The domain registration date was read from RDAP on 8 October, a data interface this method no longer reads. www.pencil.dev answered with the pen.dev site on 8 October.", "pen.dev/.well-known/security.txt and /security.txt, status.pen.dev, pen.dev/changelog and pen.dev/security returned 404 on 8 October. pen.dev redirects to www.pen.dev.", "The footer says the company is backed by a16z speedrun." ], "score": 55 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/pen-dev.json", "live": { "slug": "pen-dev", "versions": [ { "registry": "github", "name": "highagency/pen-desktop-releases", "version": "v1.2.22", "released": "2026-11-05", "seenAt": "2026-11-06T23:55:15.615366199Z" }, { "registry": "npm", "name": "@pen.dev/cli", "version": "0.3.15", "seenAt": "2026-11-06T23:55:14.788196494Z" } ], "githubStars": 2, "npmWeekly": 4927, "securityTxt": { "url": "https://pen.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:14.663584453Z" }, "domain": { "domain": "pen.dev", "registered": "2025-09-10", "source": "https://pubapi.registry.google/rdap/domain/pen.dev", "checkedAt": "2026-11-01T14:16:10.642958993Z" }, "pages": [ { "url": "https://pen.dev/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:16:14.385515813Z", "changedAt": "2026-11-06T13:37:54.37169744Z", "fingerprint": "baaa99388053" }, { "url": "https://pen.dev/privacy-policy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:16:16.557504648Z", "changedAt": "2026-11-04T08:29:34.817925027Z", "fingerprint": "f67367ab8fe0" }, { "url": "https://pen.dev/terms-of-use", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:16:18.628642947Z", "changedAt": "2026-11-04T08:29:37.167689148Z", "fingerprint": "0c3e6c77ad3c" } ], "github": { "repo": "highagency/pen-desktop-releases", "checkedAt": "2026-11-02T08:54:35.81152907Z", "stars": 2, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-29T12:57:34Z", "openIssues": 20, "openPRs": 0, "issuesOpened90d": 18, "issuesClosed90d": 0, "prsMerged90d": 0, "replies": { "sampled": 18, "unanswered": 18 } }, "updatedAt": "2026-11-07T16:01:14.663584453Z" } }, "edges": [ { "by": 48, "category": "schema", "leads": "magic-patterns", "name": "Schema \u0026 documentation", "reasons": { "a": "The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback `category` is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.", "b": "The MCP tool input schemas were read from the minified npm bundle, source code no docs page shows, so they aren't a published contract, as for other MCP servers whose schemas sit only in source. The `.pen` format's TypeScript schema on the docs site describes the file, not the tool inputs (0 of 25). No llms.txt. The package ships `SKILL.md` and Markdown reference files that `read_skill` hands to the model (6 of 10). The `execute` description is one line that points to `get_app_state`, with the operations documented only in the skill files, while `browser` states each action and when to use it (12 of 20). `execute` takes a JavaScript snippet as one string. `browser` has enums for action and target (7 of 15). The CLI page has worked examples and a troubleshooting page, with no list of error responses (7 of 15). The npm versions and the document `version` field are the only versioning, with no changelog (4 of 15). The other lines are per the 8 October check, not re-read on 5 November 2026." }, "scores": { "a": 84, "b": 36 } }, { "by": 42, "category": "reliability", "leads": "magic-patterns", "name": "Reliability", "reasons": { "a": "Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a `baseArtifactId` and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.", "b": "Read with the local-software lines, because the MCP server and the CLI run on the owner's machine. `@pen.dev/cli` installs from npm with Node.js 22.19 or later stated, and the desktop app has downloads for macOS, Windows and Linux (20). The source is closed, so no public CI or test suite can be seen (0 of 25). The public tracker highagency/pen-desktop-releases has 14 issues opened between 28 July and 6 October 2026, none closed or answered, one of them a report that headless `pen interactive` saved an empty document over a 1.4 MB file with exit status 0. These are users' reports that we did not reproduce (5 of 25). No changelog, empty release notes, and the format page reserves breaking changes (0 of 15). The desktop app is at 1.2.16 and the CLI at 0.3.11 (8 of 15). Sign-in and plan limits also depend on api.pen.dev, which has no status page. Held per the 8 October check, not re-read on 5 November 2026, because pen.dev's terms of 26 October 2026 bar crawling the Services and its hosts were paused. The GitHub issue tracker couldn't be read (github.com pages answer 403)." }, "scores": { "a": 75, "b": 33 } }, { "by": 24, "category": "security", "leads": "magic-patterns", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). `x-mp-agent-name` attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.", "b": "The CLI uses a stored session token or an organisation-scoped CLI key that the npm README says can be created and revoked in Developer Keys. No scopes, expiry or rotation are documented (18 of 30). The MCP server has no read-only mode, and `execute` is annotated destructive. The integrated agent asks permission for file and command actions, with a 'Dangerously skip permissions' switch, and an owner enables each external client by hand (6 of 20). The `browser` tool and web import bring live page content to the model, and we found no prompt-injection guidance (2 of 15). The Agent tab lists tool activity, `--usage` writes token use to JSON and Pro adds usage tracking, with no audit log documented (5 of 15). No security.txt, disclosure policy, bug bounty or certification was found. The privacy policy says stored data is encrypted in transit and at rest, and an encryption statement alone isn't a security programme (0 of 20). Held per the 8 October check, not re-read on 5 November 2026." }, "scores": { "a": 55, "b": 31 } }, { "by": 15, "category": "payments", "leads": "pen-dev", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.", "b": "Read with the hosted lines, because the software is free to install but needs a pen.dev account and paid plans lift its limits. No machine payment protocol (0). Plan prices are public, Pro $16 and Ultra $48 a user a month, with no per-call price (10 of 20). The Free plan includes the CLI, MCP access and personal developer keys, and sign-up takes an email address, a name and a username with no card step in the documented flow (20). The npm README documents `pen signup` with flags and `pen login --email --code`, so no browser is needed, but someone must open the verification email and read the code, and organisation keys for CI start at Pro (8 of 20). Held per the 8 October check, not re-read on 5 November 2026." }, "scores": { "a": 23, "b": 38 } }, { "by": 11, "category": "maintenance", "leads": "magic-patterns", "name": "Maintenance \u0026 community", "reasons": { "a": "Changelog entry on 5 November 2026, the day before this check (30). Entries on twelve dates since 8 August, among them 23 September and 12 to 30 October (20). Closed service with a public changelog, email support within one to two business days, in-app chat and a Slack community. We didn't test them (12 of 15). Not in the official MCP registry (searches for magic-patterns and magicpatterns returned nothing of theirs). Official Claude connector, Cursor plugin and Codex plugin, and no SDKs (5 of 15). No public package or repository to check (3 of 10). 30 + 20 + 12 + 5 + 3 = 70.", "b": "`@pen.dev/cli` 0.3.11 and desktop v1.2.16 were published on 8 October 2026, 28 days before this check, and the release repository's clone on 5 November 2026 holds tags up to v1.2.21, five tags added since (30). The CLI had 13 versions between 9 July and 8 October, and desktop v1.2.17 to v1.2.21 were tagged between 8 October and 5 November (20). None of the 14 issues in the current tracker had a reply on 8 October, and one of 25 in the older pencil-desktop-releases tracker was closed; the trackers weren't re-read on 5 November (github.com pages answer 403), and the Discord server wasn't read (4 of 25). No readable registry page shows an entry from the vendor; the 8 October search used the registry's data API, which this method no longer reads (0). Dependencies in 0.3.11 are current major versions, with no public CI (5 of 10)." }, "scores": { "a": 70, "b": 59 } }, { "by": 5, "category": "transparency", "leads": "magic-patterns", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.", "b": "Closed source with clear terms, an EULA and a proprietary licence file in the npm package (15 of 30). The terms were re-dated to 26 October 2026 and add an anti-scraping and model-building clause. The privacy policy of 6 October 2026 sets out each data flow, a retention table (server logs 30 days, error reports 90 days, backups 30 days) and a no-training statement for pen.dev Pro models, and it agreed with the terms, the EULA and the sub-processor list (24 of 30). The old `@pencil.dev/cli` package carries a deprecation notice pointing to the new one. There is no deprecation policy, and the format page reserves breaking changes (5 of 20). PostHog and Sentry are disclosed with what they exclude. Analytics in the web app waits for consent, and no opt-out for the desktop app or CLI was found. Sub-processors are named without locations (10 of 20). Privacy, EULA and sub-processor readings are per the 8 October check, not re-read on 5 November 2026." }, "scores": { "a": 60, "b": 55 } } ], "facts": [ { "a": "MCP server", "b": "MCP server", "name": "Kind" }, { "a": "North Park Labs, Inc. (Magic Patterns)", "b": "High Agency, Inc.", "name": "Vendor" }, { "a": "https://mcp.magicpatterns.com/mcp", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "Streamable HTTP, HTTP", "b": "stdio", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Closed service under the Magic Patterns terms of service (last updated 1 April 2025)", "b": "Proprietary. The CLI package on npm carries a proprietary licence file, and the apps fall under the vendor's EULA", "name": "Licence" }, { "a": "24", "b": "6", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-11-05", "b": "2026-10-08", "name": "Last release" }, { "a": "2025-04-01", "b": "2026-10-06", "name": "Terms last updated" }, { "a": "2025-04-01", "b": "2026-10-06", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "yes", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "2.8/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Magic Patterns scores 63.4 (B) on agent readiness against pen.dev's 43.3 (E), and leads in 6 of 7 scored categories. pen.dev leads on payments \u0026 pricing.", "question": "Which is better for AI agents, Magic Patterns or pen.dev?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Magic Patterns and pen.dev need an API key?" }, { "answer": "Magic Patterns has a hosted endpoint at https://mcp.magicpatterns.com/mcp. pen.dev runs on your own machine, with no hosted endpoint listed.", "question": "Can an agent call Magic Patterns and pen.dev without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 75 against 33", "Schema \u0026 documentation, 84 against 36", "Security \u0026 auth, 55 against 31", "Maintenance \u0026 community, 70 against 59", "Transparency \u0026 trust, 60 against 55" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Generating and iterating on coded React prototypes from a coding agent, and pulling a design into a codebase.", "slug": "magic-patterns", "watchFor": "MCP and API-key access need a paid seat, Starter at $20 a month" }, { "aheadOn": [ "Payments \u0026 pricing, 38 against 23" ], "also": [ "Runs on your own machine" ], "goodFor": "A coding agent that designs screens beside the code and keeps them in Git, including in CI.", "slug": "pen-dev", "watchFor": "No changelog. Desktop releases on GitHub had empty notes on 8 October, and the format docs reserve the right to make breaking changes" } ], "history": { "magic-patterns": null, "pen-dev": [ { "causes": [ "correction" ], "date": "2026-11-05", "delta": -4.4, "from": 47.7, "fromGrade": "D", "to": 43.3, "toGrade": "E" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": -0.1, "from": 47.8, "fromGrade": "D", "to": 47.7, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 47.6, "fromGrade": "D", "to": 47.8, "toGrade": "D" } ] }, "job": { "capability": "design.code", "name": "Design code" }, "others": [ { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-magic-patterns.json", "title": "Figma API + MCP vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-pen-dev.json", "title": "Figma API + MCP vs pen.dev", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-pen-dev" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns.json", "title": "Framelink MCP for Figma vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-pen-dev.json", "title": "Framelink MCP for Figma vs pen.dev", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-pen-dev" }, { "json": "https://www.anchorterminal.com/compare/framer-vs-magic-patterns.json", "title": "Framer Server API vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/framer-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/framer-vs-pen-dev.json", "title": "Framer Server API vs pen.dev", "url": "https://www.anchorterminal.com/compare/framer-vs-pen-dev" }, { "json": "https://www.anchorterminal.com/compare/kite-new-vs-magic-patterns.json", "title": "Kite vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/kite-new-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/kite-new-vs-pen-dev.json", "title": "Kite vs pen.dev", "url": "https://www.anchorterminal.com/compare/kite-new-vs-pen-dev" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-miro.json", "title": "Magic Patterns vs Miro API + MCP", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-miro" }, { "json": "https://www.anchorterminal.com/compare/miro-vs-pen-dev.json", "title": "Miro API + MCP vs pen.dev", "url": "https://www.anchorterminal.com/compare/miro-vs-pen-dev" }, { "json": "https://www.anchorterminal.com/compare/pen-dev-vs-penpot.json", "title": "pen.dev vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/pen-dev-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/pen-dev-vs-sketch.json", "title": "pen.dev vs Sketch", "url": "https://www.anchorterminal.com/compare/pen-dev-vs-sketch" }, { "json": "https://www.anchorterminal.com/compare/pen-dev-vs-subframe.json", "title": "pen.dev vs Subframe", "url": "https://www.anchorterminal.com/compare/pen-dev-vs-subframe" }, { "json": "https://www.anchorterminal.com/compare/pen-dev-vs-zeplin.json", "title": "pen.dev vs Zeplin", "url": "https://www.anchorterminal.com/compare/pen-dev-vs-zeplin" }, { "json": "https://www.anchorterminal.com/compare/impeccable-vs-magic-patterns.json", "title": "Impeccable vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/impeccable-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/impeccable-vs-pen-dev.json", "title": "Impeccable vs pen.dev", "url": "https://www.anchorterminal.com/compare/impeccable-vs-pen-dev" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.json", "title": "Magic Patterns vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-sketch.json", "title": "Magic Patterns vs Sketch", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-sketch" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-subframe.json", "title": "Magic Patterns vs Subframe", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-subframe" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-zeplin.json", "title": "Magic Patterns vs Zeplin", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-zeplin" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-uxkin-agent.json", "title": "Magic Patterns vs UXKIN", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-uxkin-agent" }, { "json": "https://www.anchorterminal.com/compare/pen-dev-vs-uxkin-agent.json", "title": "pen.dev vs UXKIN", "url": "https://www.anchorterminal.com/compare/pen-dev-vs-uxkin-agent" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-melius.json", "title": "Magic Patterns vs Melius", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-melius" }, { "json": "https://www.anchorterminal.com/compare/melius-vs-pen-dev.json", "title": "Melius vs pen.dev", "url": "https://www.anchorterminal.com/compare/melius-vs-pen-dev" } ], "panel": null, "scores": [ { "by": 42, "edge": "magic-patterns", "key": "reliability", "magic-patterns": 75, "name": "Reliability", "pen-dev": 33, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 48, "edge": "magic-patterns", "key": "schema", "magic-patterns": 84, "name": "Schema \u0026 documentation", "pen-dev": 36, "weight": 13 }, { "by": 1, "edge": "magic-patterns", "key": "ergonomics", "magic-patterns": 67, "name": "Agent ergonomics", "pen-dev": 66, "weight": 13 }, { "by": 24, "edge": "magic-patterns", "key": "security", "magic-patterns": 55, "name": "Security \u0026 auth", "pen-dev": 31, "weight": 14 }, { "by": 15, "edge": "pen-dev", "key": "payments", "magic-patterns": 23, "name": "Payments \u0026 pricing", "pen-dev": 38, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 11, "edge": "magic-patterns", "key": "maintenance", "magic-patterns": 70, "name": "Maintenance \u0026 community", "pen-dev": 59, "weight": 7 }, { "by": 5, "edge": "magic-patterns", "key": "transparency", "magic-patterns": 60, "name": "Transparency \u0026 trust", "pen-dev": 55, "weight": 7 } ], "summary": "Magic Patterns scores 63.4 (B) on agent readiness against pen.dev's 43.3 (E), and leads in 6 of 7 scored categories. pen.dev leads on payments \u0026 pricing. Both do design code.", "tasks": null, "tutorials": [], "verdicts": { "magic-patterns": "Agents can create, prompt, read and edit coded prototypes through 24 documented MCP tools or a matching REST API, with a read-only endpoint and 409 conflict checks on writes. MCP access needs a paid seat from $20 a month, OAuth scopes don't narrow access below the user's role, and the status page doesn't track the API or MCP server.", "pen-dev": "An agent can create, edit and export `.pen` designs without a GUI through the `pen` CLI, with four compact MCP tools that carry annotations and a documented JSON format. The software is closed and needs a pen.dev account. Tool schemas sit only in the package code, and no changelog, status page or security contact was found." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev", "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev.min.md" }, "markdown": "Magic Patterns scores 63.4 (B) on agent readiness against pen.dev's 43.3 (E), and leads in 6 of 7 scored categories. pen.dev leads on payments \u0026 pricing. Both do design code.\n\n- Magic Patterns: grade B, 63.4/100, rank #517 of 1486. Markdown https://www.anchorterminal.com/tools/magic-patterns.md · JSON https://www.anchorterminal.com/api/v1/tools/magic-patterns.json\n- pen.dev: grade E, 43.3/100, rank #1235 of 1486. Markdown https://www.anchorterminal.com/tools/pen-dev.md · JSON https://www.anchorterminal.com/api/v1/tools/pen-dev.json\n- Best design workspace and canvas APIs for AI agents: https://www.anchorterminal.com/best/design/index.md\n- All 120 design comparisons: https://www.anchorterminal.com/compare/design/index.md\n\n## Which one, for what\n\n### Magic Patterns (B)\n\nGood for: Generating and iterating on coded React prototypes from a coding agent, and pulling a design into a codebase.\n\nAhead on:\n- Reliability, 75 against 33\n- Schema \u0026 documentation, 84 against 36\n- Security \u0026 auth, 55 against 31\n- Maintenance \u0026 community, 70 against 59\n- Transparency \u0026 trust, 60 against 55\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: MCP and API-key access need a paid seat, Starter at $20 a month\n\n### pen.dev (E)\n\nGood for: A coding agent that designs screens beside the code and keeps them in Git, including in CI.\n\nAhead on:\n- Payments \u0026 pricing, 38 against 23\n\nAlso in its favour:\n- Runs on your own machine\n\nWatch for: No changelog. Desktop releases on GitHub had empty notes on 8 October, and the format docs reserve the right to make breaking changes\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Magic Patterns +48\n\n- Magic Patterns (84): The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback `category` is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.\n- pen.dev (36): The MCP tool input schemas were read from the minified npm bundle, source code no docs page shows, so they aren't a published contract, as for other MCP servers whose schemas sit only in source. The `.pen` format's TypeScript schema on the docs site describes the file, not the tool inputs (0 of 25). No llms.txt. The package ships `SKILL.md` and Markdown reference files that `read_skill` hands to the model (6 of 10). The `execute` description is one line that points to `get_app_state`, with the operations documented only in the skill files, while `browser` states each action and when to use it (12 of 20). `execute` takes a JavaScript snippet as one string. `browser` has enums for action and target (7 of 15). The CLI page has worked examples and a troubleshooting page, with no list of error responses (7 of 15). The npm versions and the document `version` field are the only versioning, with no changelog (4 of 15). The other lines are per the 8 October check, not re-read on 5 November 2026.\n\n### Reliability: Magic Patterns +42\n\n- Magic Patterns (75): Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a `baseArtifactId` and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.\n- pen.dev (33): Read with the local-software lines, because the MCP server and the CLI run on the owner's machine. `@pen.dev/cli` installs from npm with Node.js 22.19 or later stated, and the desktop app has downloads for macOS, Windows and Linux (20). The source is closed, so no public CI or test suite can be seen (0 of 25). The public tracker highagency/pen-desktop-releases has 14 issues opened between 28 July and 6 October 2026, none closed or answered, one of them a report that headless `pen interactive` saved an empty document over a 1.4 MB file with exit status 0. These are users' reports that we did not reproduce (5 of 25). No changelog, empty release notes, and the format page reserves breaking changes (0 of 15). The desktop app is at 1.2.16 and the CLI at 0.3.11 (8 of 15). Sign-in and plan limits also depend on api.pen.dev, which has no status page. Held per the 8 October check, not re-read on 5 November 2026, because pen.dev's terms of 26 October 2026 bar crawling the Services and its hosts were paused. The GitHub issue tracker couldn't be read (github.com pages answer 403).\n\n### Security \u0026 auth: Magic Patterns +24\n\n- Magic Patterns (55): OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). `x-mp-agent-name` attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.\n- pen.dev (31): The CLI uses a stored session token or an organisation-scoped CLI key that the npm README says can be created and revoked in Developer Keys. No scopes, expiry or rotation are documented (18 of 30). The MCP server has no read-only mode, and `execute` is annotated destructive. The integrated agent asks permission for file and command actions, with a 'Dangerously skip permissions' switch, and an owner enables each external client by hand (6 of 20). The `browser` tool and web import bring live page content to the model, and we found no prompt-injection guidance (2 of 15). The Agent tab lists tool activity, `--usage` writes token use to JSON and Pro adds usage tracking, with no audit log documented (5 of 15). No security.txt, disclosure policy, bug bounty or certification was found. The privacy policy says stored data is encrypted in transit and at rest, and an encryption statement alone isn't a security programme (0 of 20). Held per the 8 October check, not re-read on 5 November 2026.\n\n### Payments \u0026 pricing: pen.dev +15\n\n- Magic Patterns (23): No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.\n- pen.dev (38): Read with the hosted lines, because the software is free to install but needs a pen.dev account and paid plans lift its limits. No machine payment protocol (0). Plan prices are public, Pro $16 and Ultra $48 a user a month, with no per-call price (10 of 20). The Free plan includes the CLI, MCP access and personal developer keys, and sign-up takes an email address, a name and a username with no card step in the documented flow (20). The npm README documents `pen signup` with flags and `pen login --email --code`, so no browser is needed, but someone must open the verification email and read the code, and organisation keys for CI start at Pro (8 of 20). Held per the 8 October check, not re-read on 5 November 2026.\n\n### Maintenance \u0026 community: Magic Patterns +11\n\n- Magic Patterns (70): Changelog entry on 5 November 2026, the day before this check (30). Entries on twelve dates since 8 August, among them 23 September and 12 to 30 October (20). Closed service with a public changelog, email support within one to two business days, in-app chat and a Slack community. We didn't test them (12 of 15). Not in the official MCP registry (searches for magic-patterns and magicpatterns returned nothing of theirs). Official Claude connector, Cursor plugin and Codex plugin, and no SDKs (5 of 15). No public package or repository to check (3 of 10). 30 + 20 + 12 + 5 + 3 = 70.\n- pen.dev (59): `@pen.dev/cli` 0.3.11 and desktop v1.2.16 were published on 8 October 2026, 28 days before this check, and the release repository's clone on 5 November 2026 holds tags up to v1.2.21, five tags added since (30). The CLI had 13 versions between 9 July and 8 October, and desktop v1.2.17 to v1.2.21 were tagged between 8 October and 5 November (20). None of the 14 issues in the current tracker had a reply on 8 October, and one of 25 in the older pencil-desktop-releases tracker was closed; the trackers weren't re-read on 5 November (github.com pages answer 403), and the Discord server wasn't read (4 of 25). No readable registry page shows an entry from the vendor; the 8 October search used the registry's data API, which this method no longer reads (0). Dependencies in 0.3.11 are current major versions, with no public CI (5 of 10).\n\n### Transparency \u0026 trust: Magic Patterns +5\n\n- Magic Patterns (60): Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.\n- pen.dev (55): Closed source with clear terms, an EULA and a proprietary licence file in the npm package (15 of 30). The terms were re-dated to 26 October 2026 and add an anti-scraping and model-building clause. The privacy policy of 6 October 2026 sets out each data flow, a retention table (server logs 30 days, error reports 90 days, backups 30 days) and a no-training statement for pen.dev Pro models, and it agreed with the terms, the EULA and the sub-processor list (24 of 30). The old `@pencil.dev/cli` package carries a deprecation notice pointing to the new one. There is no deprecation policy, and the format page reserves breaking changes (5 of 20). PostHog and Sentry are disclosed with what they exclude. Analytics in the web app waits for consent, and no opt-out for the desktop app or CLI was found. Sub-processors are named without locations (10 of 20). Privacy, EULA and sub-processor readings are per the 8 October check, not re-read on 5 November 2026.\n\n## Score by category\n\n| Category | Weight | Magic Patterns | pen.dev | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 33 | Magic Patterns +42 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 84 | 36 | Magic Patterns +48 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 66 | Magic Patterns +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 55 | 31 | Magic Patterns +24 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 23 | 38 | pen.dev +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 59 | Magic Patterns +11 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 55 | Magic Patterns +5 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **63.4 · B** | **43.3 · E** | |\n\n## Facts side by side\n\n| Fact | Magic Patterns | pen.dev |\n| --- | --- | --- |\n| Kind | MCP server | MCP server |\n| Vendor | North Park Labs, Inc. (Magic Patterns) | High Agency, Inc. |\n| Hosted endpoint | `https://mcp.magicpatterns.com/mcp` | no (local only) |\n| Transports | Streamable HTTP, HTTP | stdio |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Closed service under the Magic Patterns terms of service (last updated 1 April 2025) | Proprietary. The CLI package on npm carries a proprietary licence file, and the apps fall under the vendor's EULA |\n| Tools exposed | 24 | 6 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | no |\n| Last release | 2026-11-05 | 2026-10-08 |\n| Terms last updated | 2025-04-01 | 2026-10-06 |\n| Privacy policy last updated | 2025-04-01 | 2026-10-06 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | yes | yes |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Agent reviews | none | 2.8/5 (4) |\n\n## How the scores have moved\n\n### Magic Patterns\n\nNo score change since it was listed.\n\n### pen.dev\n\n- -4.4 on 5 November 2026 (D to E): correction\n- -0.1 on 28 October 2026: correction\n- +0.2 on 27 October 2026: checklist\n\n## Verdicts\n\n**Magic Patterns.** Agents can create, prompt, read and edit coded prototypes through 24 documented MCP tools or a matching REST API, with a read-only endpoint and 409 conflict checks on writes. MCP access needs a paid seat from $20 a month, OAuth scopes don't narrow access below the user's role, and the status page doesn't track the API or MCP server.\n\n**pen.dev.** An agent can create, edit and export `.pen` designs without a GUI through the `pen` CLI, with four compact MCP tools that carry annotations and a documented JSON format. The software is closed and needs a pen.dev account. Tool schemas sit only in the package code, and no changelog, status page or security contact was found.\n\n## Before you call either\n\n### Magic Patterns\n\n1. Use https://mcp.magicpatterns.com/mcp/readonly when the task only reads designs\n2. Call `get_design_status` before any change and poll it no more than once every 60 seconds\n3. Pass `baseArtifactId` from `get_design_system` on writes, and on 409 re-read before retrying\n4. Treat a 402 as out of credits and ask the user; read tools keep working\n5. Send `x-mp-agent-name` so the user sees which agent made a change\n\n### pen.dev\n\n1. Call `read_skill()`, then `read_skill({ path: \"pen-schema.md\" })` and `read_skill({ path: \"execute.md\" })` before the first `execute`. The tool description alone doesn't document the operations\n2. Call `get_app_state()` and confirm the active document before editing. The MCP server works on whichever `.pen` file is open in the app\n3. In headless `pen interactive`, call `save()` before `exit()`, and keep `--in` and `--out` on different paths to preserve the source\n4. Check that an export file exists. The docs say an export failure can print an error without a nonzero exit status\n5. In CI set `PEN_CLI_KEY` plus a provider key such as `ANTHROPIC_API_KEY`. Run `pen version`, since `pen --version` is not a flag\n\n## Questions\n\n### Which is better for AI agents, Magic Patterns or pen.dev?\n\nMagic Patterns scores 63.4 (B) on agent readiness against pen.dev's 43.3 (E), and leads in 6 of 7 scored categories. pen.dev leads on payments \u0026 pricing.\n\n### Do Magic Patterns and pen.dev need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Magic Patterns and pen.dev without installing anything?\n\nMagic Patterns has a hosted endpoint at https://mcp.magicpatterns.com/mcp. pen.dev runs on your own machine, with no hosted endpoint listed.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev.json, and with the fewest tokens: https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"magic-patterns\", \"b\": \"pen-dev\"}`. From a terminal: `anchor compare magic-patterns pen-dev`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/magic-patterns.json and https://www.anchorterminal.com/api/v1/tools/pen-dev.json\n\n## Other comparisons with Magic Patterns or pen.dev\n\n- [Figma API + MCP vs Magic Patterns](https://www.anchorterminal.com/compare/figma-mcp-vs-magic-patterns.md)\n- [Figma API + MCP vs pen.dev](https://www.anchorterminal.com/compare/figma-mcp-vs-pen-dev.md)\n- [Framelink MCP for Figma vs Magic Patterns](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns.md)\n- [Framelink MCP for Figma vs pen.dev](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-pen-dev.md)\n- [Framer Server API vs Magic Patterns](https://www.anchorterminal.com/compare/framer-vs-magic-patterns.md)\n- [Framer Server API vs pen.dev](https://www.anchorterminal.com/compare/framer-vs-pen-dev.md)\n- [Kite vs Magic Patterns](https://www.anchorterminal.com/compare/kite-new-vs-magic-patterns.md)\n- [Kite vs pen.dev](https://www.anchorterminal.com/compare/kite-new-vs-pen-dev.md)\n- [Magic Patterns vs Miro API + MCP](https://www.anchorterminal.com/compare/magic-patterns-vs-miro.md)\n- [Miro API + MCP vs pen.dev](https://www.anchorterminal.com/compare/miro-vs-pen-dev.md)\n- [pen.dev vs Penpot API + MCP](https://www.anchorterminal.com/compare/pen-dev-vs-penpot.md)\n- [pen.dev vs Sketch](https://www.anchorterminal.com/compare/pen-dev-vs-sketch.md)\n- [pen.dev vs Subframe](https://www.anchorterminal.com/compare/pen-dev-vs-subframe.md)\n- [pen.dev vs Zeplin](https://www.anchorterminal.com/compare/pen-dev-vs-zeplin.md)\n- [Impeccable vs Magic Patterns](https://www.anchorterminal.com/compare/impeccable-vs-magic-patterns.md)\n- [Impeccable vs pen.dev](https://www.anchorterminal.com/compare/impeccable-vs-pen-dev.md)\n- [Magic Patterns vs Penpot API + MCP](https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.md)\n- [Magic Patterns vs Sketch](https://www.anchorterminal.com/compare/magic-patterns-vs-sketch.md)\n- [Magic Patterns vs Subframe](https://www.anchorterminal.com/compare/magic-patterns-vs-subframe.md)\n- [Magic Patterns vs Zeplin](https://www.anchorterminal.com/compare/magic-patterns-vs-zeplin.md)\n- [Magic Patterns vs UXKIN](https://www.anchorterminal.com/compare/magic-patterns-vs-uxkin-agent.md)\n- [pen.dev vs UXKIN](https://www.anchorterminal.com/compare/pen-dev-vs-uxkin-agent.md)\n- [Magic Patterns vs Melius](https://www.anchorterminal.com/compare/magic-patterns-vs-melius.md)\n- [Melius vs pen.dev](https://www.anchorterminal.com/compare/melius-vs-pen-dev.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Magic Patterns vs pen.dev", "url": "" } ], "description": "Magic Patterns scores 63.4 (B) to pen.dev's 43.3 (E) for design code. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Magic Patterns B 63.4", "pen.dev E 43.3", "scores" ], "h1": "Magic Patterns vs pen.dev", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/magic-patterns-vs-pen-dev", "published": "2026-10-01", "section": "tools", "title": "Magic Patterns vs pen.dev for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev" }, "tokens": { "markdown": 5200, "slim": 3330 }, "version": 1 }