# Magic Patterns vs Penpot API + MCP (slim)

> Magic Patterns scores 63.4 (B) to Penpot's 43.7 (E) for design code. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.md (~4,850 tokens) · this version ~2,980 tokens · JSON https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.json · canonical https://www.anchorterminal.com/compare/magic-patterns-vs-penpot
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Magic Patterns scores 63.4 (B) on agent readiness against Penpot API + MCP's 43.7 (E), and leads in 4 of 7 scored categories. Penpot API + MCP leads on payments & pricing, maintenance & community and transparency & trust. Both do design code.

- Magic Patterns: B 63.4, rank #517 of 1486 · https://www.anchorterminal.com/tools/magic-patterns.min.md
- Penpot API + MCP: E 43.7, rank #1228 of 1486 · https://www.anchorterminal.com/tools/penpot.min.md
- Magic Patterns, good for Generating and iterating on coded React prototypes from a coding agent, and pulling a design into a codebase. Ahead on Reliability, 75 against 46; Schema & documentation, 84 against 66; Agent ergonomics, 67 against 41; Security & auth, 55 against 33. Also No incidents deducted, where Penpot API + MCP loses 5 points for them.
- Penpot API + MCP, good for Teams that want design files on their own servers and an agent working alongside a person in the editor. Ahead on Payments & pricing, 30 against 23; Maintenance & community, 76 against 70; Transparency & trust, 68 against 60. Also Free to start without a card; Open source.

| Category | Magic Patterns | Penpot API + MCP |
| --- | --- | --- |
| Reliability (16%) | 75 | 46 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 84 | 66 |
| Agent ergonomics (13%) | 67 | 41 |
| Security & auth (14%) | 55 | 33 |
| Payments & pricing (10%) | 23 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 76 |
| Transparency & trust (7%) | 60 | 68 |

| Fact (where they differ) | Magic Patterns | Penpot API + MCP |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | North Park Labs, Inc. (Magic Patterns) | Penpot (Kaleidos) |
| Hosted endpoint | `https://mcp.magicpatterns.com/mcp` | `https://design.penpot.app/api/rpc/command` |
| Transports | Streamable HTTP, HTTP | HTTP, Streamable HTTP |
| Auth | OAuth or key | Token |
| Licence | Closed service under the Magic Patterns terms of service (last updated 1 April 2025) | MPL-2.0 |
| Tools exposed | 24 | 5 |
| Read-only variant documented | yes | no |
| llms.txt | yes | no |
| Last release | 2026-11-05 | 2026-10-01 |
| Terms last updated | 2025-04-01 | 2025-08-05 |
| Privacy policy last updated | 2025-04-01 | 2025-08-05 |
| Terms restrict benchmarking | yes | not found in the text |
| Popularity | none | 61k stars, 1.3k npm/wk |
| Agent reviews | none | 2.5/5 (2) |

Why the edge:
- Reliability, Magic Patterns +29: Magic Patterns 75 (Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a `baseArtifactId` and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.); Penpot API + MCP 46 (Penpot runs as a cloud service and as self-hosted software, so this is the average of the two rubrics. Cloud (10). No status page per the 30 September check (0), so no readable incident history (5 of 30). No rate limits, 429 guidance or SLA published (0, 0, 0). The RPC API is documented and in use, while the repository's own notes call MCP multi-user mode 'under development and not yet fully integrated' (5 of 10). Self-hosted (82). Official Docker images and install guides (20). Backend, frontend, end-to-end and MCP test workflows run on push and pull request, pass state not visible (20 of 25). 706 open issues, actively labelled with milestones, and several regressions opened on 1 October are marked release blockers for 2.19.0 (15 of 25). CHANGES.md records every release, without an API versioning policy (12 of 15). Version 2.18 (15).)
- Agent ergonomics, Magic Patterns +26: Magic Patterns 67 (24 documented tools (15 for 11 to 30), plus 5 back for the read-only endpoint that registers only 12 (20 of 25). Message history pages by 10 and version history by 20 with `skip`, and file reads take a list of names (14 of 20). Documented status codes, a 402 that leaves reads working and non-blocking `validationErrors` on design-system writes (15 of 20). No idempotency keys; 409 conflict checks on design-system writes, and annotations couldn't be read on the closed server (10 of 20). `create_design` needs no parameter and makes a blank scaffold, but there is no official SDK (8 of 15). 20 + 14 + 15 + 10 + 8 = 67.); Penpot API + MCP 41 (Five MCP tools locally and four on the hosted URL, though `execute_code`'s description is long. Over RPC, `get-file` returns a whole file (18 of 25). We found no documented pagination or field selection for RPC commands (8 of 20). No documented error codes for the API (8 of 20). No readOnlyHint, destructiveHint or other annotations on any MCP tool, and no idempotency keys (2 of 20). No official API client. The Plugin API is typed TypeScript (5 of 15).)
- Security & auth, Magic Patterns +22: Magic Patterns 55 (OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). `x-mp-agent-name` attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.); Penpot API + MCP 33 (Personal access tokens can expire after 30 to 180 days or never and can be deleted at any time, but carry no scopes. The hosted MCP URL takes its key in the `userToken` query parameter as the documented setup, and until 2.18.0 (23 September 2026) an MCP key also worked as a full API token, so less 10 (10 of 30). No read-only mode. `execute_code` runs arbitrary JavaScript against the plugin API, which can delete shapes, and the docs only advise starting with read-only operations. The plugin must stay open in the user's tab (5 of 20). Shared files and library content reach the model with no injection guidance (3 of 15). Audit events exist in the codebase, but we found no operator-facing call log (5 of 15). SECURITY.md routes reports through GitHub advisories, and four were published in 2026. No security.txt per the 30 September check, and no bug bounty or certification found (10 of 20).)
- Schema & documentation, Magic Patterns +18: Magic Patterns 84 (The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback `category` is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.); Penpot API + MCP 66 (Each instance serves API docs and an OpenAPI description generated from the backend at /api/main/doc, and the MCP tools declare zod schemas (25). No llms.txt. The MCP server's `high_level_overview` and `penpot_api_info` tools hand the model its docs instead (3 of 10). RPC docs are generated with little prose. MCP descriptions are long and tell the model to read the overview before `execute_code` (12 of 20). RPC inputs are typed, but the main MCP tool takes one JavaScript string (9 of 15). A curl example for `get-profile`. No documented error format, and the integration guide says 'we do not have any specific documentation for the webhooks yet' (5 of 15). CHANGES.md per release (12 of 15).)
- Transparency & trust, Penpot API + MCP +8: Magic Patterns 60 (Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.); Penpot API + MCP 68 (MPL-2.0, including the MCP server (30). Privacy policy of 5 August 2025 names Kaleidos Subsidiary S.L., PostHog and Google Analytics, keeps data 'as long as the commercial relationship is maintained', points to a DPA in the terms and says nothing about AI training or data locations (15 of 30). Changes land in CHANGES.md, and the separate penpot-mcp repository was archived with a pointer when it moved, but there's no deprecation policy. The MCP server's move to SDK v2 removed SSE on 23 September with no changelog line we could find (8 of 20). The cloud names some processors without locations, and we didn't check self-hosted telemetry defaults (8 of 20).)
- Payments & pricing, Penpot API + MCP +7: Magic Patterns 23 (No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.); Penpot API + MCP 30 (No machine payment protocol (0). Plan prices are public, Unlimited $7 an editor a month capped at $175 and Enterprise $25 a member, with no per-call price (10 of 20). The cloud Professional plan is free with no card (20). A person signs up and creates the token or MCP key in account settings (0). Self-hosting the community edition is free under MPL-2.0.)