{ "data": { "a": { "slug": "magic-patterns", "name": "Magic Patterns", "vendor": "North Park Labs, Inc. (Magic Patterns)", "vendorUrl": "https://www.magicpatterns.com", "kind": "mcp", "category": "design", "summary": "Magic Patterns is an AI design workspace where product teams generate interactive React prototypes from prompts and their own design system. Agents reach it through a hosted MCP server and a v3 REST API that mirrors it.", "url": "https://www.anchorterminal.com/tools/magic-patterns", "markdownUrl": "https://www.anchorterminal.com/tools/magic-patterns.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/magic-patterns.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/magic-patterns.json", "dns": "magic-patterns.grade.anchorterminal.com", "license": "Closed service under the Magic Patterns terms of service (last updated 1 April 2025)", "transports": [ "streamable-http", "http" ], "remoteUrl": "https://mcp.magicpatterns.com/mcp", "packages": [], "auth": "mixed", "authNotes": "The hosted MCP server signs in with OAuth 2.1 (PKCE S256, dynamic client registration, client ID metadata documents and a device flow, at oauth.magicpatterns.com on WorkOS). Scopes are identity only (openid, email, profile, offline_access), so access follows the user's workspace role. An API key from Settings \u003e API Keys, shown once, works for MCP as `Authorization: Bearer` and for REST as `x-mp-api-key`. A read-only MCP endpoint at /mcp/readonly takes the same credentials.", "pricing": "freemium", "pricingNotes": "MCP access needs a paid plan, Starter $20 a seat a month ($17 yearly) with 1,000 credits on top of the free monthly credits, or Business $100 ($85 yearly) with 5,000. On-demand credits beyond that cost $0.02 each on paid plans. One generation typically uses about 70 credits per the docs. Free plan $0 with free monthly credits.", "priceSummary": "$20 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "Subscription credits billed through Stripe. No x402, MPP or L402 in the docs, the v3 OpenAPI or llms.txt (checked 2026-11-06). Out of credits returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 24, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.magicpatterns.com/docs", "llmsTxt": "https://www.magicpatterns.com/docs/llms.txt", "openapi": "https://www.magicpatterns.com/docs/api/create-design.md", "capabilities": [ "design.code", "design.files", "design.components", "design.canvas" ], "tags": [ "hosted", "mcp", "remote-mcp", "oauth", "api-key", "read-only-mode", "llms-txt", "openapi", "freemium", "status-page", "yc" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 63.4, "grade": "B", "agentReady": false, "rank": 517, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 70, "payments": 23, "reliability": 75, "schema": 84, "security": 55, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Agents can create, prompt, read and edit coded prototypes through 24 documented MCP tools or a matching REST API, with a read-only endpoint and 409 conflict checks on writes. MCP access needs a paid seat from $20 a month, OAuth scopes don't narrow access below the user's role, and the status page doesn't track the API or MCP server.", "bestFor": "Generating and iterating on coded React prototypes from a coding agent, and pulling a design into a codebase.", "strengths": [ "A read-only MCP endpoint that does not register the 13 tools that create, change or publish", "Workflows, polling intervals and tool order documented for agents, with llms.txt and Markdown pages", "v3 REST API with an OpenAPI 3.0.3 description that mirrors the MCP tools, so one key works for both", "Writes carry a base artifact ID and fail with 409 on a concurrent change", "Dated product changelog with entries from 2026-08-03 to 2026-11-05" ], "weaknesses": [ "MCP and API-key access need a paid seat, Starter at $20 a month", "OAuth scopes are identity only, so a token can do whatever the user's workspace role allows", "No 429 or backoff guidance and no idempotency keys; generations take 2 to 10 minutes and must be polled", "The status page tracks the web platform and Figma plugin, not the API or MCP server", "Free plan inputs and designs may be used for training and shown publicly, per the terms" ], "agentNotes": [ "Use https://mcp.magicpatterns.com/mcp/readonly when the task only reads designs", "Call `get_design_status` before any change and poll it no more than once every 60 seconds", "Pass `baseArtifactId` from `get_design_system` on writes, and on 409 re-read before retrying", "Treat a 402 as out of credits and ask the user; read tools keep working", "Send `x-mp-agent-name` so the user sees which agent made a change" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.4 } ], "editorialScores": { "ergonomics": 67, "maintenance": 70, "payments": 23, "reliability": 75, "schema": 84, "security": 55, "transparency": 42 }, "provenanceScore": 78, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.magicpatterns.com/api/v3/health -H \"x-mp-api-key: mp_live_...\"", "claudeCode": "claude mcp add --transport http magic-patterns https://mcp.magicpatterns.com/mcp", "config": { "mcpServers": { "magic-patterns": { "url": "https://mcp.magicpatterns.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/design.code", "tool": "https://letme.dev/magic-patterns" }, "area": "design-diagrams", "unitPrices": [ { "item": "Starter seat", "unit": "seat-month", "usd": 20, "note": "$17 billed yearly, 1,000 credits on top of the free monthly credits" }, { "item": "Business seat", "unit": "seat-month", "usd": 100, "note": "$85 billed yearly, 5,000 credits on top of the free monthly credits" }, { "item": "On-demand credit", "unit": "credit", "usd": 0.02, "note": "Paid plans only, after monthly credits run out. A generation typically uses about 70 credits" } ], "provenance": { "legalEntity": "North Park Labs, Inc.", "domain": "magicpatterns.com", "domainRegistered": "2023-10-23", "endpointOnVendorDomain": true, "terms": "https://www.magicpatterns.com/docs/documentation/legal/terms", "privacy": "https://www.magicpatterns.com/docs/documentation/legal/privacy", "statusPage": "https://magicpatterns.statuspage.io/", "changelog": "https://www.magicpatterns.com/docs/documentation/feature-releases/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both last updated 1 April 2025, name North Park Labs, Inc. d.b.a. Magic Patterns, under Delaware law.", "The terms forbid accessing or searching the Services by any means other than the provided interfaces (for example, scraping) and bots that send requests faster than a person could. Public docs pages were read as data.", "www.magicpatterns.com/robots.txt disallows /private/, /settings/, /api/ and /_next/ and allows the docs. magicpatterns.statuspage.io/robots.txt disallows /api/ and /embed/, so status history was read from the page and its Atom feed.", "/.well-known/security.txt returns 404. The security docs page links a Trust Center at trust.magicpatterns.com for SOC 2 reports and subprocessors, which is drawn by script and wasn't read.", "RDAP gives magicpatterns.com a registration date of 23 October 2023. The company was founded in 2023 per its Y Combinator page." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/magic-patterns.json", "live": { "slug": "magic-patterns", "probe": { "target": "https://mcp.magicpatterns.com/mcp", "method": "mcp-initialize", "lastAt": "2026-11-07T18:20:36.546371661Z", "lastOk": true, "lastStatus": 401, "lastMs": 191, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 200, "p95ms24h": 512, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://magicpatterns.statuspage.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:21.341572331Z" }, "securityTxt": { "url": "https://magicpatterns.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:36.740973899Z" }, "llmsTxt": { "url": "https://www.magicpatterns.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:55.846864963Z" }, "pages": [ { "url": "https://www.magicpatterns.com/docs/documentation/feature-releases/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:31:04.926757349Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1d6fc782fb69" }, { "url": "https://www.magicpatterns.com/docs/documentation/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:31:07.60138431Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "98e04acdbe99" }, { "url": "https://www.magicpatterns.com/docs/documentation/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:31:09.211996324Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "264ce0076e25" } ], "mcpTools": { "url": "https://mcp.magicpatterns.com/mcp", "checkedAt": "2026-11-07T01:46:04.045898155Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:46:04.045898155Z" }, "updatedAt": "2026-11-07T18:21:21.341572331Z" } }, "answer": "Magic Patterns scores 63.4 (B) on agent readiness against Penpot API + MCP's 43.7 (E), and leads in 4 of 7 scored categories. Penpot API + MCP leads on payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "penpot", "name": "Penpot API + MCP", "vendor": "Penpot (Kaleidos)", "vendorUrl": "https://penpot.app", "kind": "http-api", "category": "design", "summary": "Open-source design and prototyping tool, used as SaaS at design.penpot.app or self-hosted.", "url": "https://www.anchorterminal.com/tools/penpot", "markdownUrl": "https://www.anchorterminal.com/tools/penpot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/penpot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/penpot.json", "dns": "penpot.grade.anchorterminal.com", "repo": "https://github.com/penpot/penpot", "license": "MPL-2.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://design.penpot.app/api/rpc/command", "packages": [ { "registry": "npm", "name": "@penpot/mcp" } ], "auth": "pat", "authNotes": "Personal access tokens from account settings, sent as `Authorization: Token \u003ctoken\u003e`. The hosted MCP URL takes a separate MCP key in the `userToken` query parameter. The local MCP server (`npx @penpot/mcp@stable`) talks to the plugin over a WebSocket on localhost.", "pricing": "freemium", "pricingNotes": "Cloud Professional plan is free with unlimited files and team members. Unlimited $7 per editor a month, capped at $175 a month. Enterprise $25 per member a month, minimum $950 a month. Private server $50,000 a year. Self-hosting the community edition is free under MPL-2.0, and self-hosted Enterprise starts at $950 a month (https://penpot.app/pricing).", "priceSummary": "$7 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No payment support in the API or MCP docs.", "endpoints": [] }, "toolCount": 5, "popularity": { "githubStars": 60534, "npmWeekly": 1259, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://help.penpot.app/technical-guide/integration/", "openapi": "https://design.penpot.app/api/main/doc/openapi", "capabilities": [ "design.files", "design.components", "design.canvas", "design.comments", "design.code" ], "tags": [ "open-source", "self-hosted", "local", "hosted", "freemium", "free-tier", "no-card", "mcp", "openapi", "webhooks" ], "lastRelease": "2026-10-01", "graded": true, "anchor": { "graded": true, "score": 43.7, "grade": "E", "agentReady": false, "rank": 1228, "ranked": true, "rankOf": 1486, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 41, "maintenance": 76, "payments": 30, "reliability": 46, "schema": 66, "security": 33, "transparency": 68 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -5, "negativeNotes": [ "-3: 2026-05-19, three advisories published together, a critical pre-authenticated account takeover through team-invitation tokens (GHSA-4937-35vc-hqjj), an MCP REPL server bound to 0.0.0.0 with an unauthenticated /execute endpoint allowing remote code execution (GHSA-22qr-rp27-j9wm, high) and authenticated SSRF in remote image import (GHSA-35g2-w7f6-8v9h, high). Fixed and published, so the deduction is reduced (https://github.com/penpot/penpot/security).", "-1: 2026-02-16, arbitrary file read through the create-font-variant RPC endpoint (GHSA-xp3f-g8rq-9px2, high). Fixed and published (https://github.com/penpot/penpot/security).", "-1: 2.18.0 (2026-09-23) fixed MCP keys being usable as full API access tokens, while the documented hosted setup puts that key in a URL query string, and fixed the MCP REPL starting in multi-user mode on the main bind address. Fixed in the changelog with no advisory (https://github.com/penpot/penpot/blob/develop/CHANGES.md)." ], "verdict": "MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan. Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string.", "bestFor": "Teams that want design files on their own servers and an agent working alongside a person in the editor.", "strengths": [ "MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan", "MCP `execute_code` reaches the whole plugin API, so an agent can create, move, restyle and delete shapes", "OpenAPI description served by every instance", "Five releases between 22 July and 1 October 2026, with issues labelled and milestoned within a day" ], "weaknesses": [ "Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string", "No annotations on MCP tools and no read-only mode", "Four advisories in 2026, including MCP REPL remote code execution", "The MCP server needs the Penpot plugin open in a browser tab, so it can't run headless", "No status page, published rate limits or webhook documentation" ], "agentNotes": [ "Call `get-profile` first to check the token, then `get-teams`, `get-projects` and `get-file` to walk down", "Ask for JSON with `Accept: application/json`, since some commands default to Transit", "Call `high_level_overview` and `penpot_api_info` before `execute_code`. They tell the model what the plugin API can do", "Keep the Penpot tab in the foreground. A backgrounded or frozen tab stalls MCP calls", "Give tokens an expiry. They carry full account access" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43.7 } ], "editorialScores": { "ergonomics": 41, "maintenance": 76, "payments": 30, "reliability": 46, "schema": 66, "security": 33, "transparency": 61 }, "provenanceScore": 74, "checked": { "categories": { "ergonomics": "2026-10-01", "maintenance": "2026-10-01", "payments": "2026-10-01", "reliability": "2026-10-01", "schema": "2026-10-01", "security": "2026-10-01", "transparency": "2026-10-01" }, "last": "2026-10-01", "lastMoved": "2026-10-27", "oldest": "2026-10-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -H \"Authorization: Token $PENPOT_TOKEN\" https://design.penpot.app/api/rpc/command/get-profile", "claudeCode": "claude mcp add --transport http penpot \"https://design.penpot.app/mcp/stream?userToken=$PENPOT_MCP_KEY\"", "config": { "mcpServers": { "penpot": { "url": "https://design.penpot.app/mcp/stream?userToken=${PENPOT_MCP_KEY}" } } } }, "letme": { "capability": "https://letme.dev/design.files", "tool": "https://letme.dev/penpot" }, "area": "design-diagrams", "unitPrices": [ { "item": "Unlimited plan", "unit": "seat-month", "usd": 7, "note": "per editor, capped at $175 a month" }, { "item": "Enterprise plan", "unit": "seat-month", "usd": 25, "note": "minimum $950 a month" } ], "provenance": { "legalEntity": "Kaleidos Subsidiary SL", "domain": "penpot.app", "domainRegistered": "2020-05-26", "domainNote": "The site footer names KALEIDOS Subsidiary SL; Penpot is built by Kaleidos in Madrid.", "endpointOnVendorDomain": true, "terms": "https://penpot.app/terms", "privacy": "https://penpot.app/privacy", "statusPage": "", "changelog": "https://github.com/penpot/penpot/blob/develop/CHANGES.md", "securityTxt": "none", "checked": "2026-09-30", "score": 74 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/penpot.json", "live": { "slug": "penpot", "probe": { "target": "https://design.penpot.app/api/rpc/command", "method": "get", "lastAt": "2026-11-07T18:20:46.437647222Z", "lastOk": true, "lastStatus": 404, "lastMs": 130, "authRequired": false, "uptime24h": 100, "uptime30d": 99.95, "p50ms24h": 88, "p95ms24h": 189, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 266 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 251 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 249 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "versions": [ { "registry": "github", "name": "penpot/penpot", "version": "2.18.6", "released": "2026-11-04", "seenAt": "2026-11-06T23:55:22.817550788Z" }, { "registry": "npm", "name": "@penpot/mcp", "version": "2.15.4", "seenAt": "2026-11-06T23:55:22.417983613Z" } ], "githubStars": 62144, "npmWeekly": 4643, "securityTxt": { "url": "https://penpot.app/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:08.275148281Z" }, "domain": { "domain": "penpot.app", "registered": "2020-05-26", "source": "https://pubapi.registry.google/rdap/domain/penpot.app", "checkedAt": "2026-11-01T14:13:55.258202557Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/penpot/penpot/develop/CHANGES.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:22:51.199407963Z", "changedAt": "2026-11-06T13:43:51.022330113Z", "fingerprint": "9bc7e62cef6f" }, { "url": "https://penpot.app/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:16:20.621482442Z", "changedAt": "2026-10-20T00:03:04.087779571Z", "fingerprint": "6a715396cbb5" }, { "url": "https://penpot.app/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:16:23.215360345Z", "changedAt": "2026-10-08T18:22:55.558773603Z", "fingerprint": "435ffd85741d" }, { "url": "https://penpot.app/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:16:25.057494031Z", "changedAt": "2026-10-08T18:22:57.540300931Z", "fingerprint": "e07ca8b29548" } ], "mcpTools": { "url": "https://design.penpot.app/mcp/stream?userToken=$PENPOT_MCP_KEY", "checkedAt": "2026-11-07T01:46:46.82538206Z", "status": "ok", "protocol": "2026-07-28", "tools": [ { "name": "execute_code", "description": "Executes JavaScript code in the Penpot plugin context.\nIMPORTANT: Before using this tool, make sure you have read the 'Penpot High-Level Overview' and know which Penpot API functionality is necessary and how to use it.\nYou have access two main objects: `penpot` (the Penpot API, of type `Penpot`), `penpotUtils`, and `storage`.\n`storage` is an object in which arbitrary data can be stored, simply by adding a new attribute; stored attributes can be referenced in future calls to this tool, so any intermediate results that could come in handy later should be stored in `storage` instead of just a fleeting variable; you can also store functions and thus build up a library).\nThink of the code being executed as the body of a function: The tool call returns whatever you return in the applicable `return` statement, if any. You can return arbitrary JS objects; no need to apply JSON.stringify.\nIf an exception occurs, the exception's message will be returned to you.\nAny output that you generate via the `console` object will be returned to you separately; so you may use it to track what your code is doing, but you should *only* do so only if there is an ACTUAL NEED for this! VERY IMPORTANT: Don't use logging prematurely! NEVER log the data you are returning, as you will otherwise receive it twice!\nVERY IMPORTANT: In general, try a simple approach first, and only if it fails, try more complex code that involves handling different cases (in particular error cases) and that applies logging.", "inputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "code": { "description": "The JavaScript code to execute in the plugin context.", "minLength": 1, "type": "string" } }, "required": [ "code" ], "type": "object" } }, { "name": "high_level_overview", "description": "Returns basic high-level instructions on the usage of Penpot-related tools and the Penpot API. If you have already read the 'Penpot High-Level Overview', you must not call this tool.", "inputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": {}, "type": "object" } }, { "name": "penpot_api_info", "description": "Retrieves Penpot API documentation for types and their members.Be sure to read the 'Penpot High-Level Overview' first.", "inputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "member": { "type": "string" }, "type": { "minLength": 1, "type": "string" } }, "required": [ "type" ], "type": "object" } }, { "name": "export_shape", "description": "Exports a shape (or a shape's image fill) from the Penpot design to a PNG or SVG image, such that you can get an impression of what it looks like.", "inputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "format": { "default": "png", "description": "The output format, either 'png' (default) or 'svg'.", "enum": [ "svg", "png" ], "type": "string" }, "mode": { "default": "shape", "description": "The export mode: either 'shape' (full shape as it appears in the design, including descendants; the default) or 'fill' (export the raw image that is used as a fill for the shape; PNG format only)", "enum": [ "shape", "fill" ], "type": "string" }, "shapeId": { "description": "Identifier of the shape to export. Special identifiers you can use: 'selection' (first shape currently selected by the user), 'page' (entire current page)", "minLength": 1, "type": "string" } }, "required": [ "shapeId" ], "type": "object" } } ], "schemaTokens": 850, "changedAt": "2026-11-07T01:46:46.82538206Z", "check": { "checker": "anchor-check/1.0", "totalTokens": 850, "counts": { "error": 0, "note": 1, "warn": 6 }, "findings": [ { "rule": "TC11", "severity": "warn", "tool": "penpot_api_info", "message": "none of its 2 parameters has a description", "fix": "Describe each one: format, units, an example, and what happens when it's left out." }, { "rule": "TC16", "severity": "warn", "tool": "execute_code", "message": "no readOnlyHint or destructiveHint", "fix": "Set readOnlyHint: true if it only reads; otherwise set destructiveHint and idempotentHint." }, { "rule": "TC16", "severity": "warn", "tool": "export_shape", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"export\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC16", "severity": "warn", "tool": "high_level_overview", "message": "no readOnlyHint or destructiveHint", "fix": "Set readOnlyHint: true if it only reads; otherwise set destructiveHint and idempotentHint." }, { "rule": "TC16", "severity": "warn", "tool": "penpot_api_info", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"info\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC20", "severity": "warn", "tool": "high_level_overview", "message": "the description steers the model", "fix": "Say what the tool is good at and let the model choose." }, { "rule": "TC24", "severity": "note", "message": "4 of 4 tools have no outputSchema", "fix": "Declare outputSchema for tools that return structured data, and return structuredContent that matches it." } ] } }, "github": { "repo": "penpot/penpot", "checkedAt": "2026-11-02T09:15:34.867304922Z", "stars": 61977, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T22:40:05Z", "openIssues": 833, "openPRs": 108, "issuesOpened90d": 749, "issuesClosed90d": 584, "prsMerged90d": 789, "ci": { "branch": "develop", "runs": 50, "success": 40, "failure": 4, "other": 6, "latest": "failure", "latestAt": "2026-11-01T18:28:19Z" }, "advisories": [ { "ghsa": "GHSA-4p97-v4wg-jxfx", "severity": "medium", "published": "2026-09-25T19:05:43Z" }, { "ghsa": "GHSA-j83r-hph3-xpxc", "cve": "CVE-2026-105687", "severity": "medium", "published": "2026-09-25T19:05:25Z" }, { "ghsa": "GHSA-fwm4-hm9f-rmcp", "cve": "CVE-2026-105684", "severity": "medium", "published": "2026-09-25T19:05:01Z" }, { "ghsa": "GHSA-cjm5-wh82-hwr2", "cve": "CVE-2026-105685", "severity": "medium", "published": "2026-09-25T19:04:33Z" }, { "ghsa": "GHSA-4f36-m4hj-cv86", "cve": "CVE-2026-105691", "severity": "critical", "published": "2026-09-25T19:03:39Z" }, { "ghsa": "GHSA-mx4v-cmxq-644v", "cve": "CVE-2026-105688", "severity": "medium", "published": "2026-09-25T19:03:13Z" }, { "ghsa": "GHSA-mj9f-5cwq-7p3q", "cve": "CVE-2026-105690", "severity": "medium", "published": "2026-09-25T19:02:42Z" }, { "ghsa": "GHSA-8257-pm4f-cfhq", "cve": "CVE-2026-105692", "severity": "medium", "published": "2026-09-25T19:01:18Z" }, { "ghsa": "GHSA-xg6f-5v5x-g4w2", "cve": "CVE-2026-105694", "severity": "medium", "published": "2026-09-25T19:00:08Z" }, { "ghsa": "GHSA-5vrm-3c6w-gjfv", "cve": "CVE-2026-105695", "severity": "medium", "published": "2026-09-25T18:59:43Z" }, { "ghsa": "GHSA-w8mf-4x22-24gg", "cve": "CVE-2026-105693", "severity": "medium", "published": "2026-09-25T18:59:11Z" }, { "ghsa": "GHSA-x9xg-qphx-8grr", "cve": "CVE-2026-105696", "severity": "medium", "published": "2026-09-25T18:58:35Z" }, { "ghsa": "GHSA-wrcr-m7p8-m2c4", "severity": "low", "published": "2026-09-25T18:57:00Z" }, { "ghsa": "GHSA-ch2q-6x56-qg5r", "severity": "low", "published": "2026-09-25T18:55:42Z" }, { "ghsa": "GHSA-852x-m8p9-558v", "severity": "low", "published": "2026-09-25T18:55:08Z" }, { "ghsa": "GHSA-wxgm-8qjw-x445", "cve": "CVE-2026-105689", "severity": "high", "published": "2026-09-25T18:54:07Z" }, { "ghsa": "GHSA-qvq5-c536-pmx8", "cve": "CVE-2026-105686", "severity": "medium", "published": "2026-09-25T18:53:40Z" }, { "ghsa": "GHSA-r8wx-23q6-w3gf", "severity": "low", "published": "2026-08-19T12:58:01Z" }, { "ghsa": "GHSA-vc72-6r45-q988", "cve": "CVE-2026-47665", "severity": "high", "published": "2026-08-19T06:56:20Z" }, { "ghsa": "GHSA-w5hh-gj5c-5wpc", "cve": "CVE-2026-47666", "severity": "high", "published": "2026-08-19T06:56:00Z" }, { "ghsa": "GHSA-35g2-w7f6-8v9h", "cve": "CVE-2026-45806", "severity": "high", "published": "2026-05-19T10:42:23Z" }, { "ghsa": "GHSA-22qr-rp27-j9wm", "cve": "CVE-2026-45805", "severity": "high", "published": "2026-05-19T10:41:54Z" }, { "ghsa": "GHSA-4937-35vc-hqjj", "cve": "CVE-2026-44986", "severity": "critical", "published": "2026-05-19T10:37:41Z" }, { "ghsa": "GHSA-xp3f-g8rq-9px2", "cve": "CVE-2026-26202", "severity": "high", "published": "2026-02-16T13:30:25Z" } ], "replies": { "sampled": 25, "unanswered": 19, "medianDays": 0.5 } }, "updatedAt": "2026-11-07T18:20:46.437647222Z" } }, "edges": [ { "by": 29, "category": "reliability", "leads": "magic-patterns", "name": "Reliability", "reasons": { "a": "Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a `baseArtifactId` and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.", "b": "Penpot runs as a cloud service and as self-hosted software, so this is the average of the two rubrics. Cloud (10). No status page per the 30 September check (0), so no readable incident history (5 of 30). No rate limits, 429 guidance or SLA published (0, 0, 0). The RPC API is documented and in use, while the repository's own notes call MCP multi-user mode 'under development and not yet fully integrated' (5 of 10). Self-hosted (82). Official Docker images and install guides (20). Backend, frontend, end-to-end and MCP test workflows run on push and pull request, pass state not visible (20 of 25). 706 open issues, actively labelled with milestones, and several regressions opened on 1 October are marked release blockers for 2.19.0 (15 of 25). CHANGES.md records every release, without an API versioning policy (12 of 15). Version 2.18 (15)." }, "scores": { "a": 75, "b": 46 } }, { "by": 26, "category": "ergonomics", "leads": "magic-patterns", "name": "Agent ergonomics", "reasons": { "a": "24 documented tools (15 for 11 to 30), plus 5 back for the read-only endpoint that registers only 12 (20 of 25). Message history pages by 10 and version history by 20 with `skip`, and file reads take a list of names (14 of 20). Documented status codes, a 402 that leaves reads working and non-blocking `validationErrors` on design-system writes (15 of 20). No idempotency keys; 409 conflict checks on design-system writes, and annotations couldn't be read on the closed server (10 of 20). `create_design` needs no parameter and makes a blank scaffold, but there is no official SDK (8 of 15). 20 + 14 + 15 + 10 + 8 = 67.", "b": "Five MCP tools locally and four on the hosted URL, though `execute_code`'s description is long. Over RPC, `get-file` returns a whole file (18 of 25). We found no documented pagination or field selection for RPC commands (8 of 20). No documented error codes for the API (8 of 20). No readOnlyHint, destructiveHint or other annotations on any MCP tool, and no idempotency keys (2 of 20). No official API client. The Plugin API is typed TypeScript (5 of 15)." }, "scores": { "a": 67, "b": 41 } }, { "by": 22, "category": "security", "leads": "magic-patterns", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). `x-mp-agent-name` attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.", "b": "Personal access tokens can expire after 30 to 180 days or never and can be deleted at any time, but carry no scopes. The hosted MCP URL takes its key in the `userToken` query parameter as the documented setup, and until 2.18.0 (23 September 2026) an MCP key also worked as a full API token, so less 10 (10 of 30). No read-only mode. `execute_code` runs arbitrary JavaScript against the plugin API, which can delete shapes, and the docs only advise starting with read-only operations. The plugin must stay open in the user's tab (5 of 20). Shared files and library content reach the model with no injection guidance (3 of 15). Audit events exist in the codebase, but we found no operator-facing call log (5 of 15). SECURITY.md routes reports through GitHub advisories, and four were published in 2026. No security.txt per the 30 September check, and no bug bounty or certification found (10 of 20)." }, "scores": { "a": 55, "b": 33 } }, { "by": 18, "category": "schema", "leads": "magic-patterns", "name": "Schema \u0026 documentation", "reasons": { "a": "The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback `category` is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.", "b": "Each instance serves API docs and an OpenAPI description generated from the backend at /api/main/doc, and the MCP tools declare zod schemas (25). No llms.txt. The MCP server's `high_level_overview` and `penpot_api_info` tools hand the model its docs instead (3 of 10). RPC docs are generated with little prose. MCP descriptions are long and tell the model to read the overview before `execute_code` (12 of 20). RPC inputs are typed, but the main MCP tool takes one JavaScript string (9 of 15). A curl example for `get-profile`. No documented error format, and the integration guide says 'we do not have any specific documentation for the webhooks yet' (5 of 15). CHANGES.md per release (12 of 15)." }, "scores": { "a": 84, "b": 66 } }, { "by": 8, "category": "transparency", "leads": "penpot", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.", "b": "MPL-2.0, including the MCP server (30). Privacy policy of 5 August 2025 names Kaleidos Subsidiary S.L., PostHog and Google Analytics, keeps data 'as long as the commercial relationship is maintained', points to a DPA in the terms and says nothing about AI training or data locations (15 of 30). Changes land in CHANGES.md, and the separate penpot-mcp repository was archived with a pointer when it moved, but there's no deprecation policy. The MCP server's move to SDK v2 removed SSE on 23 September with no changelog line we could find (8 of 20). The cloud names some processors without locations, and we didn't check self-hosted telemetry defaults (8 of 20)." }, "scores": { "a": 60, "b": 68 } }, { "by": 7, "category": "payments", "leads": "penpot", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.", "b": "No machine payment protocol (0). Plan prices are public, Unlimited $7 an editor a month capped at $175 and Enterprise $25 a member, with no per-call price (10 of 20). The cloud Professional plan is free with no card (20). A person signs up and creates the token or MCP key in account settings (0). Self-hosting the community edition is free under MPL-2.0." }, "scores": { "a": 23, "b": 30 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "North Park Labs, Inc. (Magic Patterns)", "b": "Penpot (Kaleidos)", "name": "Vendor" }, { "a": "https://mcp.magicpatterns.com/mcp", "b": "https://design.penpot.app/api/rpc/command", "name": "Hosted endpoint" }, { "a": "Streamable HTTP, HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "Token", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Closed service under the Magic Patterns terms of service (last updated 1 April 2025)", "b": "MPL-2.0", "name": "Licence" }, { "a": "24", "b": "5", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-11-05", "b": "2026-10-01", "name": "Last release" }, { "a": "2025-04-01", "b": "2025-08-05", "name": "Terms last updated" }, { "a": "2025-04-01", "b": "2025-08-05", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "61k stars, 1.3k npm/wk", "name": "Popularity" }, { "a": "none", "b": "2.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Magic Patterns scores 63.4 (B) on agent readiness against Penpot API + MCP's 43.7 (E), and leads in 4 of 7 scored categories. Penpot API + MCP leads on payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, Magic Patterns or Penpot API + MCP?" }, { "answer": "Magic Patterns takes an API key or an OAuth sign-in. Penpot API + MCP needs an access token.", "question": "Do Magic Patterns and Penpot API + MCP need an API key?" }, { "answer": "Yes. Magic Patterns has a hosted endpoint at https://mcp.magicpatterns.com/mcp and Penpot API + MCP at https://design.penpot.app/api/rpc/command.", "question": "Can an agent call Magic Patterns and Penpot API + MCP without installing anything?" }, { "answer": "No open-source release is listed for Magic Patterns. Penpot API + MCP is open source (MPL-2.0).", "question": "Are Magic Patterns and Penpot API + MCP open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 75 against 46", "Schema \u0026 documentation, 84 against 66", "Agent ergonomics, 67 against 41", "Security \u0026 auth, 55 against 33" ], "also": [ "No incidents deducted, where Penpot API + MCP loses 5 points for them" ], "goodFor": "Generating and iterating on coded React prototypes from a coding agent, and pulling a design into a codebase.", "slug": "magic-patterns", "watchFor": "MCP and API-key access need a paid seat, Starter at $20 a month" }, { "aheadOn": [ "Payments \u0026 pricing, 30 against 23", "Maintenance \u0026 community, 76 against 70", "Transparency \u0026 trust, 68 against 60" ], "also": [ "Free to start without a card", "Open source" ], "goodFor": "Teams that want design files on their own servers and an agent working alongside a person in the editor.", "slug": "penpot", "watchFor": "Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string" } ], "history": { "magic-patterns": null, "penpot": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 43.5, "fromGrade": "E", "to": 43.7, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.3, "from": 43.8, "fromGrade": "E", "to": 43.5, "toGrade": "E" } ] }, "job": { "capability": "design.code", "name": "Design code" }, "others": [ { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-magic-patterns.json", "title": "Figma API + MCP vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-penpot.json", "title": "Figma API + MCP vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns.json", "title": "Framelink MCP for Figma vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot.json", "title": "Framelink MCP for Figma vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/framer-vs-magic-patterns.json", "title": "Framer Server API vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/framer-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/framer-vs-penpot.json", "title": "Framer Server API vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/framer-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/kite-new-vs-magic-patterns.json", "title": "Kite vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/kite-new-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/kite-new-vs-penpot.json", "title": "Kite vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/kite-new-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-miro.json", "title": "Magic Patterns vs Miro API + MCP", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-miro" }, { "json": "https://www.anchorterminal.com/compare/miro-vs-penpot.json", "title": "Miro API + MCP vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/miro-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/pen-dev-vs-penpot.json", "title": "pen.dev vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/pen-dev-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/penpot-vs-sketch.json", "title": "Penpot API + MCP vs Sketch", "url": "https://www.anchorterminal.com/compare/penpot-vs-sketch" }, { "json": "https://www.anchorterminal.com/compare/penpot-vs-subframe.json", "title": "Penpot API + MCP vs Subframe", "url": "https://www.anchorterminal.com/compare/penpot-vs-subframe" }, { "json": "https://www.anchorterminal.com/compare/penpot-vs-zeplin.json", "title": "Penpot API + MCP vs Zeplin", "url": "https://www.anchorterminal.com/compare/penpot-vs-zeplin" }, { "json": "https://www.anchorterminal.com/compare/impeccable-vs-magic-patterns.json", "title": "Impeccable vs Magic Patterns", "url": "https://www.anchorterminal.com/compare/impeccable-vs-magic-patterns" }, { "json": "https://www.anchorterminal.com/compare/impeccable-vs-penpot.json", "title": "Impeccable vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/impeccable-vs-penpot" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev.json", "title": "Magic Patterns vs pen.dev", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-sketch.json", "title": "Magic Patterns vs Sketch", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-sketch" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-subframe.json", "title": "Magic Patterns vs Subframe", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-subframe" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-zeplin.json", "title": "Magic Patterns vs Zeplin", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-zeplin" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-uxkin-agent.json", "title": "Magic Patterns vs UXKIN", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-uxkin-agent" }, { "json": "https://www.anchorterminal.com/compare/penpot-vs-uxkin-agent.json", "title": "Penpot API + MCP vs UXKIN", "url": "https://www.anchorterminal.com/compare/penpot-vs-uxkin-agent" }, { "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-melius.json", "title": "Magic Patterns vs Melius", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-melius" }, { "json": "https://www.anchorterminal.com/compare/melius-vs-penpot.json", "title": "Melius vs Penpot API + MCP", "url": "https://www.anchorterminal.com/compare/melius-vs-penpot" } ], "panel": null, "scores": [ { "by": 29, "edge": "magic-patterns", "key": "reliability", "magic-patterns": 75, "name": "Reliability", "penpot": 46, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 18, "edge": "magic-patterns", "key": "schema", "magic-patterns": 84, "name": "Schema \u0026 documentation", "penpot": 66, "weight": 13 }, { "by": 26, "edge": "magic-patterns", "key": "ergonomics", "magic-patterns": 67, "name": "Agent ergonomics", "penpot": 41, "weight": 13 }, { "by": 22, "edge": "magic-patterns", "key": "security", "magic-patterns": 55, "name": "Security \u0026 auth", "penpot": 33, "weight": 14 }, { "by": 7, "edge": "penpot", "key": "payments", "magic-patterns": 23, "name": "Payments \u0026 pricing", "penpot": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 6, "edge": "penpot", "key": "maintenance", "magic-patterns": 70, "name": "Maintenance \u0026 community", "penpot": 76, "weight": 7 }, { "by": 8, "edge": "penpot", "key": "transparency", "magic-patterns": 60, "name": "Transparency \u0026 trust", "penpot": 68, "weight": 7 } ], "summary": "Magic Patterns scores 63.4 (B) on agent readiness against Penpot API + MCP's 43.7 (E), and leads in 4 of 7 scored categories. Penpot API + MCP leads on payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do design code.", "tasks": null, "tutorials": [], "verdicts": { "magic-patterns": "Agents can create, prompt, read and edit coded prototypes through 24 documented MCP tools or a matching REST API, with a read-only endpoint and 409 conflict checks on writes. MCP access needs a paid seat from $20 a month, OAuth scopes don't narrow access below the user's role, and the status page doesn't track the API or MCP server.", "penpot": "MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan. Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/magic-patterns-vs-penpot", "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.min.md" }, "markdown": "Magic Patterns scores 63.4 (B) on agent readiness against Penpot API + MCP's 43.7 (E), and leads in 4 of 7 scored categories. Penpot API + MCP leads on payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do design code.\n\n- Magic Patterns: grade B, 63.4/100, rank #517 of 1486. Markdown https://www.anchorterminal.com/tools/magic-patterns.md · JSON https://www.anchorterminal.com/api/v1/tools/magic-patterns.json\n- Penpot API + MCP: grade E, 43.7/100, rank #1228 of 1486. Markdown https://www.anchorterminal.com/tools/penpot.md · JSON https://www.anchorterminal.com/api/v1/tools/penpot.json\n- Best design workspace and canvas APIs for AI agents: https://www.anchorterminal.com/best/design/index.md\n- All 120 design comparisons: https://www.anchorterminal.com/compare/design/index.md\n\n## Which one, for what\n\n### Magic Patterns (B)\n\nGood for: Generating and iterating on coded React prototypes from a coding agent, and pulling a design into a codebase.\n\nAhead on:\n- Reliability, 75 against 46\n- Schema \u0026 documentation, 84 against 66\n- Agent ergonomics, 67 against 41\n- Security \u0026 auth, 55 against 33\n\nAlso in its favour:\n- No incidents deducted, where Penpot API + MCP loses 5 points for them\n\nWatch for: MCP and API-key access need a paid seat, Starter at $20 a month\n\n### Penpot API + MCP (E)\n\nGood for: Teams that want design files on their own servers and an agent working alongside a person in the editor.\n\nAhead on:\n- Payments \u0026 pricing, 30 against 23\n- Maintenance \u0026 community, 76 against 70\n- Transparency \u0026 trust, 68 against 60\n\nAlso in its favour:\n- Free to start without a card\n- Open source\n\nWatch for: Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string\n\n\n## Why the edge\n\n### Reliability: Magic Patterns +29\n\n- Magic Patterns (75): Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a `baseArtifactId` and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.\n- Penpot API + MCP (46): Penpot runs as a cloud service and as self-hosted software, so this is the average of the two rubrics. Cloud (10). No status page per the 30 September check (0), so no readable incident history (5 of 30). No rate limits, 429 guidance or SLA published (0, 0, 0). The RPC API is documented and in use, while the repository's own notes call MCP multi-user mode 'under development and not yet fully integrated' (5 of 10). Self-hosted (82). Official Docker images and install guides (20). Backend, frontend, end-to-end and MCP test workflows run on push and pull request, pass state not visible (20 of 25). 706 open issues, actively labelled with milestones, and several regressions opened on 1 October are marked release blockers for 2.19.0 (15 of 25). CHANGES.md records every release, without an API versioning policy (12 of 15). Version 2.18 (15).\n\n### Agent ergonomics: Magic Patterns +26\n\n- Magic Patterns (67): 24 documented tools (15 for 11 to 30), plus 5 back for the read-only endpoint that registers only 12 (20 of 25). Message history pages by 10 and version history by 20 with `skip`, and file reads take a list of names (14 of 20). Documented status codes, a 402 that leaves reads working and non-blocking `validationErrors` on design-system writes (15 of 20). No idempotency keys; 409 conflict checks on design-system writes, and annotations couldn't be read on the closed server (10 of 20). `create_design` needs no parameter and makes a blank scaffold, but there is no official SDK (8 of 15). 20 + 14 + 15 + 10 + 8 = 67.\n- Penpot API + MCP (41): Five MCP tools locally and four on the hosted URL, though `execute_code`'s description is long. Over RPC, `get-file` returns a whole file (18 of 25). We found no documented pagination or field selection for RPC commands (8 of 20). No documented error codes for the API (8 of 20). No readOnlyHint, destructiveHint or other annotations on any MCP tool, and no idempotency keys (2 of 20). No official API client. The Plugin API is typed TypeScript (5 of 15).\n\n### Security \u0026 auth: Magic Patterns +22\n\n- Magic Patterns (55): OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). `x-mp-agent-name` attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.\n- Penpot API + MCP (33): Personal access tokens can expire after 30 to 180 days or never and can be deleted at any time, but carry no scopes. The hosted MCP URL takes its key in the `userToken` query parameter as the documented setup, and until 2.18.0 (23 September 2026) an MCP key also worked as a full API token, so less 10 (10 of 30). No read-only mode. `execute_code` runs arbitrary JavaScript against the plugin API, which can delete shapes, and the docs only advise starting with read-only operations. The plugin must stay open in the user's tab (5 of 20). Shared files and library content reach the model with no injection guidance (3 of 15). Audit events exist in the codebase, but we found no operator-facing call log (5 of 15). SECURITY.md routes reports through GitHub advisories, and four were published in 2026. No security.txt per the 30 September check, and no bug bounty or certification found (10 of 20).\n\n### Schema \u0026 documentation: Magic Patterns +18\n\n- Magic Patterns (84): The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback `category` is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.\n- Penpot API + MCP (66): Each instance serves API docs and an OpenAPI description generated from the backend at /api/main/doc, and the MCP tools declare zod schemas (25). No llms.txt. The MCP server's `high_level_overview` and `penpot_api_info` tools hand the model its docs instead (3 of 10). RPC docs are generated with little prose. MCP descriptions are long and tell the model to read the overview before `execute_code` (12 of 20). RPC inputs are typed, but the main MCP tool takes one JavaScript string (9 of 15). A curl example for `get-profile`. No documented error format, and the integration guide says 'we do not have any specific documentation for the webhooks yet' (5 of 15). CHANGES.md per release (12 of 15).\n\n### Transparency \u0026 trust: Penpot API + MCP +8\n\n- Magic Patterns (60): Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.\n- Penpot API + MCP (68): MPL-2.0, including the MCP server (30). Privacy policy of 5 August 2025 names Kaleidos Subsidiary S.L., PostHog and Google Analytics, keeps data 'as long as the commercial relationship is maintained', points to a DPA in the terms and says nothing about AI training or data locations (15 of 30). Changes land in CHANGES.md, and the separate penpot-mcp repository was archived with a pointer when it moved, but there's no deprecation policy. The MCP server's move to SDK v2 removed SSE on 23 September with no changelog line we could find (8 of 20). The cloud names some processors without locations, and we didn't check self-hosted telemetry defaults (8 of 20).\n\n### Payments \u0026 pricing: Penpot API + MCP +7\n\n- Magic Patterns (23): No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.\n- Penpot API + MCP (30): No machine payment protocol (0). Plan prices are public, Unlimited $7 an editor a month capped at $175 and Enterprise $25 a member, with no per-call price (10 of 20). The cloud Professional plan is free with no card (20). A person signs up and creates the token or MCP key in account settings (0). Self-hosting the community edition is free under MPL-2.0.\n\n## Score by category\n\n| Category | Weight | Magic Patterns | Penpot API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 46 | Magic Patterns +29 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 84 | 66 | Magic Patterns +18 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 41 | Magic Patterns +26 |\n| Security \u0026 auth | 14% (17.5 this run) | 55 | 33 | Magic Patterns +22 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 23 | 30 | Penpot API + MCP +7 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 76 | Penpot API + MCP +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 68 | Penpot API + MCP +8 |\n| Negative events | ≤15 | 0 | -5 | |\n| **Total** | | **63.4 · B** | **43.7 · E** | |\n\n## Facts side by side\n\n| Fact | Magic Patterns | Penpot API + MCP |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | North Park Labs, Inc. (Magic Patterns) | Penpot (Kaleidos) |\n| Hosted endpoint | `https://mcp.magicpatterns.com/mcp` | `https://design.penpot.app/api/rpc/command` |\n| Transports | Streamable HTTP, HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth or key | Token |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Closed service under the Magic Patterns terms of service (last updated 1 April 2025) | MPL-2.0 |\n| Tools exposed | 24 | 5 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | no |\n| Last release | 2026-11-05 | 2026-10-01 |\n| Terms last updated | 2025-04-01 | 2025-08-05 |\n| Privacy policy last updated | 2025-04-01 | 2025-08-05 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | none | 61k stars, 1.3k npm/wk |\n| Agent reviews | none | 2.5/5 (2) |\n\n## How the scores have moved\n\n### Magic Patterns\n\nNo score change since it was listed.\n\n### Penpot API + MCP\n\n- +0.2 on 27 October 2026: checklist\n- -0.3 on 8 October 2026: checklist\n\n## Verdicts\n\n**Magic Patterns.** Agents can create, prompt, read and edit coded prototypes through 24 documented MCP tools or a matching REST API, with a read-only endpoint and 409 conflict checks on writes. MCP access needs a paid seat from $20 a month, OAuth scopes don't narrow access below the user's role, and the status page doesn't track the API or MCP server.\n\n**Penpot API + MCP.** MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan. Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string.\n\n## Before you call either\n\n### Magic Patterns\n\n1. Use https://mcp.magicpatterns.com/mcp/readonly when the task only reads designs\n2. Call `get_design_status` before any change and poll it no more than once every 60 seconds\n3. Pass `baseArtifactId` from `get_design_system` on writes, and on 409 re-read before retrying\n4. Treat a 402 as out of credits and ask the user; read tools keep working\n5. Send `x-mp-agent-name` so the user sees which agent made a change\n\n### Penpot API + MCP\n\n1. Call `get-profile` first to check the token, then `get-teams`, `get-projects` and `get-file` to walk down\n2. Ask for JSON with `Accept: application/json`, since some commands default to Transit\n3. Call `high_level_overview` and `penpot_api_info` before `execute_code`. They tell the model what the plugin API can do\n4. Keep the Penpot tab in the foreground. A backgrounded or frozen tab stalls MCP calls\n5. Give tokens an expiry. They carry full account access\n\n## Questions\n\n### Which is better for AI agents, Magic Patterns or Penpot API + MCP?\n\nMagic Patterns scores 63.4 (B) on agent readiness against Penpot API + MCP's 43.7 (E), and leads in 4 of 7 scored categories. Penpot API + MCP leads on payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.\n\n### Do Magic Patterns and Penpot API + MCP need an API key?\n\nMagic Patterns takes an API key or an OAuth sign-in. Penpot API + MCP needs an access token.\n\n### Can an agent call Magic Patterns and Penpot API + MCP without installing anything?\n\nYes. Magic Patterns has a hosted endpoint at https://mcp.magicpatterns.com/mcp and Penpot API + MCP at https://design.penpot.app/api/rpc/command.\n\n### Are Magic Patterns and Penpot API + MCP open source?\n\nNo open-source release is listed for Magic Patterns. Penpot API + MCP is open source (MPL-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.json, and with the fewest tokens: https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"magic-patterns\", \"b\": \"penpot\"}`. From a terminal: `anchor compare magic-patterns penpot`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/magic-patterns.json and https://www.anchorterminal.com/api/v1/tools/penpot.json\n\n## Other comparisons with Magic Patterns or Penpot API + MCP\n\n- [Figma API + MCP vs Magic Patterns](https://www.anchorterminal.com/compare/figma-mcp-vs-magic-patterns.md)\n- [Figma API + MCP vs Penpot API + MCP](https://www.anchorterminal.com/compare/figma-mcp-vs-penpot.md)\n- [Framelink MCP for Figma vs Magic Patterns](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-magic-patterns.md)\n- [Framelink MCP for Figma vs Penpot API + MCP](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot.md)\n- [Framer Server API vs Magic Patterns](https://www.anchorterminal.com/compare/framer-vs-magic-patterns.md)\n- [Framer Server API vs Penpot API + MCP](https://www.anchorterminal.com/compare/framer-vs-penpot.md)\n- [Kite vs Magic Patterns](https://www.anchorterminal.com/compare/kite-new-vs-magic-patterns.md)\n- [Kite vs Penpot API + MCP](https://www.anchorterminal.com/compare/kite-new-vs-penpot.md)\n- [Magic Patterns vs Miro API + MCP](https://www.anchorterminal.com/compare/magic-patterns-vs-miro.md)\n- [Miro API + MCP vs Penpot API + MCP](https://www.anchorterminal.com/compare/miro-vs-penpot.md)\n- [pen.dev vs Penpot API + MCP](https://www.anchorterminal.com/compare/pen-dev-vs-penpot.md)\n- [Penpot API + MCP vs Sketch](https://www.anchorterminal.com/compare/penpot-vs-sketch.md)\n- [Penpot API + MCP vs Subframe](https://www.anchorterminal.com/compare/penpot-vs-subframe.md)\n- [Penpot API + MCP vs Zeplin](https://www.anchorterminal.com/compare/penpot-vs-zeplin.md)\n- [Impeccable vs Magic Patterns](https://www.anchorterminal.com/compare/impeccable-vs-magic-patterns.md)\n- [Impeccable vs Penpot API + MCP](https://www.anchorterminal.com/compare/impeccable-vs-penpot.md)\n- [Magic Patterns vs pen.dev](https://www.anchorterminal.com/compare/magic-patterns-vs-pen-dev.md)\n- [Magic Patterns vs Sketch](https://www.anchorterminal.com/compare/magic-patterns-vs-sketch.md)\n- [Magic Patterns vs Subframe](https://www.anchorterminal.com/compare/magic-patterns-vs-subframe.md)\n- [Magic Patterns vs Zeplin](https://www.anchorterminal.com/compare/magic-patterns-vs-zeplin.md)\n- [Magic Patterns vs UXKIN](https://www.anchorterminal.com/compare/magic-patterns-vs-uxkin-agent.md)\n- [Penpot API + MCP vs UXKIN](https://www.anchorterminal.com/compare/penpot-vs-uxkin-agent.md)\n- [Magic Patterns vs Melius](https://www.anchorterminal.com/compare/magic-patterns-vs-melius.md)\n- [Melius vs Penpot API + MCP](https://www.anchorterminal.com/compare/melius-vs-penpot.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Magic Patterns vs Penpot API + MCP", "url": "" } ], "description": "Magic Patterns scores 63.4 (B) to Penpot's 43.7 (E) for design code. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Magic Patterns B 63.4", "Penpot API + MCP E 43.7", "scores" ], "h1": "Magic Patterns vs Penpot API + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/magic-patterns-vs-penpot", "published": "2026-10-01", "section": "tools", "title": "Magic Patterns vs Penpot for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-penpot" }, "tokens": { "markdown": 4850, "slim": 2980 }, "version": 1 }