Magic Patterns vs Sketch

Magic Patterns 70

Changelog entry on 5 November 2026, the day before this check (30). Entries on twelve dates since 8 August, among them 23 September and 12 to 30 October (20). Closed service with a public changelog, email support within one to two business days, in-app chat and a Slack community. We didn't test them (12 of 15). Not in the official MCP registry (searches for magic-patterns and magicpatterns returned nothing of theirs). Official Claude connector, Cursor plugin and Codex plugin, and no SDKs (5 of 15). No public package or repository to check (3 of 10). 30 + 20 + 12 + 5 + 3 = 70.

Sketch 35

2026.3.1 on 14 September 2026 is still the newest Mac app release, 51 days before this check (20). 2026.3 on 26 August and 2026.3.1 fall inside the 90 days from 6 August, two releases, and the 29 October changelog post is about the web app, so fewer than three (0). The app is closed, with a public changelog, a support form and a community Discord. The agents repository has 0 open issues and five merged pull requests, last on 25 June 2026 (10 of 15). The official MCP registry was not read, because its search runs only through a JSON API this check doesn't call, and the 9 October search reading is struck (0 of 15). The connector pins the MCP SDK at ^1.28.0 with a lockfile, last changed on 25 June 2026, with no CI (5 of 10).

Magic Patterns 75

Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a baseArtifactId and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.

Sketch 53

Read with the local-software lines, because the server runs inside the Mac app on the owner's machine. The app downloads from sketch.com with macOS 15 or newer stated for 2026.3, and the connector states Node 22 or later (20). The app is closed source, and the sketch-hq/agents repository has no CI workflow or tests (0 of 25). No public issue tracker for the app. The agents repository shows 0 open issues, and the changelog lists fixes in every release, 143 in one (10 of 25). Versions run year, release, patch with a detailed changelog and API deprecations listed per release, but the MCP notes say only that tools were added (8 of 15). The docs, updated 2 November 2026, do not mark the server as beta, and it has shipped since 2025.2.4 on 17 October 2025 (15). The cloud status page is not scored here.

Magic Patterns 55

OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). x-mp-agent-name attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.

Sketch 34

The server has no credential. The docs describe it as local-only, off by default and started by the user, and macOS asks for Local Network access. No token or per-client permission was found, so any local process that reaches port 31126 could call run_code (10 of 30). No read-only mode. The on and off switch is the only control in the app, and the terms say approval depends on the connected AI tool (6 of 20). Tools return document text, layer names and library content, which can come from other people. The terms warn about what a connected tool may send to an AI provider, and no injection guidance was found (3 of 15). run_code requires a title stating its purpose. No call log is documented (2 of 15). ISO 27001 certificate, a Responsible Disclosure Policy of 29 September 2026 with a reply promised in five business days, and a yearly external penetration test per the security page. No bug bounty and no security.txt (13 of 20).

Magic Patterns 84

The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback category is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.

Sketch 64

All eight tools have typed JSON Schema inputs in the fallback definitions of Sketch's connector source. The definitions the running app serves were not read, because we do not run vendor software (22 of 25). llms.txt, llms-full.txt and Markdown twins of the docs and legal pages (10). Descriptions are one line each and tell the model to load get_guide first, with eight guide topics served by the tool. None says when not to use a tool (11 of 20). Allowed values for kind and the bounds on depth are written in the description text with no enum or limit in the schema, and run_code takes one script string (6 of 15). Example prompts in the docs and worked references in the two skills. No documented error responses (5 of 15). Dated changelog with MCP sections and a connector at 3.0.0, without versioned tool definitions (10 of 15).

Magic Patterns 23

No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.

Sketch 30

Read with the hosted lines, because Sketch is paid software and not a free package. No machine payment protocol (0). Plan prices are public, $12, $24 and $44 an editor a month billed yearly and $120 a seat for the Mac-only licence, with no per-call price (10 of 20). A 30-day trial needs no card (20). A person downloads the app, signs in and starts the server, so there is no autonomous route (0).

Magic Patterns 60

Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.

Sketch 67

Closed application under a published End User Licence Agreement of 6 March 2025 and Terms of Service of 6 October 2026. The connector is MIT and the skills are Apache-2.0 (17 of 30). The Terms of Service and the Privacy Statement, both dated 6 October 2026, describe the MCP server in matching words, and the statement gives retention rules and points to a DPA (24 of 30). The terms let Sketch drop backend support for Mac app versions older than a year, and the developer docs list API deprecations per release. No policy or notice period covers the MCP tools (8 of 20). The Privacy Statement lists what the Mac app collects automatically (IP address, device details, Mac unique ID, licence identifier), and a sub-processor list of 10 July 2026 gives locations. No opt-out for that collection was found (10 of 20).