# Magic Patterns vs Subframe (slim)

> Magic Patterns scores 63.4 (B) to Subframe's 39.8 (E) for design code. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/magic-patterns-vs-subframe.md (~5,050 tokens) · this version ~3,180 tokens · JSON https://www.anchorterminal.com/compare/magic-patterns-vs-subframe.json · canonical https://www.anchorterminal.com/compare/magic-patterns-vs-subframe
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Magic Patterns scores 63.4 (B) on agent readiness against Subframe's 39.8 (E), and leads in 6 of 7 scored categories. Subframe leads on payments & pricing. Both do design code.

- Magic Patterns: B 63.4, rank #517 of 1486 · https://www.anchorterminal.com/tools/magic-patterns.min.md
- Subframe: E 39.8, rank #1314 of 1486 · https://www.anchorterminal.com/tools/subframe.min.md
- Magic Patterns, good for Generating and iterating on coded React prototypes from a coding agent, and pulling a design into a codebase. Ahead on Reliability, 75 against 19; Schema & documentation, 84 against 54; Agent ergonomics, 67 against 47; Security & auth, 55 against 44; Maintenance & community, 70 against 65. Also No incidents deducted, where Subframe loses 3 points for them.
- Subframe, good for A coding agent working beside a team that designs React and Tailwind interfaces in Subframe and wants the design as code, with a read-only route for review. Ahead on Payments & pricing, 33 against 23.

| Category | Magic Patterns | Subframe |
| --- | --- | --- |
| Reliability (16%) | 75 | 19 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 84 | 54 |
| Agent ergonomics (13%) | 67 | 47 |
| Security & auth (14%) | 55 | 44 |
| Payments & pricing (10%) | 23 | 33 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 65 |
| Transparency & trust (7%) | 60 | 58 |

| Fact (where they differ) | Magic Patterns | Subframe |
| --- | --- | --- |
| Vendor | North Park Labs, Inc. (Magic Patterns) | Atomic Design Inc |
| Hosted endpoint | `https://mcp.magicpatterns.com/mcp` | `https://mcp.subframe.com/mcp` |
| Transports | Streamable HTTP, HTTP | HTTP |
| Licence | Closed service under the Magic Patterns terms of service (last updated 1 April 2025) | Proprietary service under Atomic Design's terms of service. `@subframe/cli` and `@subframe/core` are marked ISC in their package files and the Claude Code plugin MIT in its manifest, with no licence file in the repository |
| Tools exposed | 24 | 46 |
| Last release | 2026-11-05 | 2026-10-08 |
| Terms last updated | 2025-04-01 | 2026-01-22 |
| Privacy policy last updated | 2025-04-01 | 2026-01-22 |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | none | 435 stars, 1k npm/wk |
| Agent reviews | none | 3/5 (4) |

Why the edge:
- Reliability, Magic Patterns +56: Magic Patterns 75 (Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a `baseArtifactId` and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.); Subframe 19 (Read with the hosted lines, because the surface an agent uses is the MCP server at mcp.subframe.com. No status page was found on the site, the docs or the footer (0 of 20). With no page there is no incident history to read (5 of 30). No rate limit is published in the docs or the skill files (0 of 15). No 429 or backoff guidance was found. The docs do say a background job that stops reporting for about 10 minutes is returned as `error`, and the CLI retries a failed request once (4 of 15). No SLA is published, and the terms say the service is not warranted to be uninterrupted (0 of 10). The MCP server carries no beta label, though the CLI's `push-component` command is marked experimental (10 of 10).)
- Schema & documentation, Magic Patterns +30: Magic Patterns 84 (The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback `category` is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.); Subframe 54 (The MCP server is closed and answers 401 without OAuth, so the tool definitions and their input schemas were not read. The docs list 46 tools by name and the public skill files give parameters for most of them (12 of 25, on that partial evidence). docs.subframe.com publishes `llms.txt`, a Markdown twin of each page and a docs MCP server (10 of 10). The `design` skill states for each tool what it is for and when another tool fits better, for example `edit_page` against `design_page`. The docs table gives one line a tool (15 of 20). Parameters are named in the skill (`id`, `name` or `url`, `force`, `deleteChildPages`, `includeResolved`), while the design tools take a free-text description (6 of 15). Ten example prompts and a troubleshooting section, with no list of error responses (7 of 15). The plugin and the CLI carry version numbers, with no changelog (4 of 15).)
- Agent ergonomics, Magic Patterns +20: Magic Patterns 67 (24 documented tools (15 for 11 to 30), plus 5 back for the read-only endpoint that registers only 12 (20 of 25). Message history pages by 10 and version history by 20 with `skip`, and file reads take a list of names (14 of 20). Documented status codes, a 402 that leaves reads working and non-blocking `validationErrors` on design-system writes (15 of 20). No idempotency keys; 409 conflict checks on design-system writes, and annotations couldn't be read on the closed server (10 of 20). `create_design` needs no parameter and makes a blank scaffold, but there is no official SDK (8 of 15). 20 + 14 + 15 + 10 + 8 = 67.); Subframe 47 (46 documented tools is over 30 (5), with 3 added back because a Viewer account gets a read-only server. No toolsets or dynamic loading are documented, and the `design` skill adds about 55 KB when loaded (8 of 25). `list_comments` can be scoped to a page, a canvas or the project, screenshots can target one element or breakpoint and `read_prototype_file` returns one file. No paging is documented (10 of 20). `wait_for_jobs` reports `running`, `done`, `error` or `not_found`, delete tools refuse when the item is referenced, `edit_page` returns `appliedCode` and parser warnings, and the CLI prints a JSON error envelope (13 of 20). No idempotency keys. Tool annotations could not be read. Deletes need `force` when references exist, and version history can restore (8 of 20). `projectId` falls back to the first project and items are addressed by id, name or URL. No API SDK (8 of 15).)
- Security & auth, Magic Patterns +11: Magic Patterns 55 (OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). `x-mp-agent-name` attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.); Subframe 44 (The MCP server uses OAuth with dynamic client registration, PKCE and refresh tokens, and rejects static tokens. The authorisation server lists only identity scopes (openid, profile, email, phone, offline_access), so access follows the user's team role and not a scope. CLI tokens are shown once and can be deleted, with no scopes or expiry documented, and the `generate_auth_token` tool lets a connected agent mint one (22 of 30). Viewers get a read-only MCP server and read-only CLI access. Confirmation before deletes is guidance in the skill file and not a documented server control (12 of 20). `list_comments`, design documents and `search_docs` return text other people wrote, and no prompt-injection guidance was found (3 of 15). No audit log is documented. Version history records changes for 24 hours on Free and 7 days on Pro (3 of 15). No security.txt, disclosure policy, bug bounty or certification was found. The DPA's Annex 2 lists security measures and the docs cover Okta SSO (4 of 20).)
- Payments & pricing, Subframe +10: Magic Patterns 23 (No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.); Subframe 33 (No machine payment protocol (0 of 40). Plan prices are public, Free at $0 and Pro at $20 an editor a month, with AI credits described only as limited and 6x and no per-call price (10 of 20). The Free plan has one project and includes MCP and CLI access, and the docs mention a card only at the Stripe checkout for Pro (20 of 20). A person has to sign in through a browser to approve OAuth. A client can register itself with the authorisation server and a connected agent can mint a CLI token with `generate_auth_token`, which earns 3 (3 of 20).)
- Maintenance & community, Magic Patterns +5: Magic Patterns 70 (Changelog entry on 5 November 2026, the day before this check (30). Entries on twelve dates since 8 August, among them 23 September and 12 to 30 October (20). Closed service with a public changelog, email support within one to two business days, in-app chat and a Slack community. We didn't test them (12 of 15). Not in the official MCP registry (searches for magic-patterns and magicpatterns returned nothing of theirs). Official Claude connector, Cursor plugin and Codex plugin, and no SDKs (5 of 15). No public package or repository to check (3 of 10). 30 + 20 + 12 + 5 + 3 = 70.); Subframe 65 (The Claude Code plugin reached 1.0.30 on 8 October 2026 and `@subframe/cli` 1.212.0 on 5 October 2026 (30 of 30). The plugin version changed ten times between 13 July and 8 October, and the CLI had three versions on 5 October after none since 24 June (20 of 20). The repository has 13 issues in all. Seven are open, among them a Codex MCP install error from 30 March 2026 and a Claude Code plugin install error from 13 February 2026 with one and two comments, and three with none. Pull requests merge most days. The Slack community was not read (10 of 25). A search of the official MCP registry for 'subframe' returned no entry (0 of 15). A commit of 12 August 2026 fixed dependency vulnerabilities. The CLI has unit and end-to-end tests in the repository, and the only public workflow publishes the package (5 of 10).)