Magic Patterns vs UX Pilot MCP server

Magic Patterns 75

Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a baseArtifactId and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.

UX Pilot MCP server 15

No status page found (0). No history (5). No limits found (0). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Magic Patterns 84

The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback category is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.

UX Pilot MCP server 45

Schemas not read without sign-in (15 of 25). No llms.txt read (0). Tools grouped by job (find, organise, delete, import, review, React), with a help tool that maps old names to new calls (14 of 20). Inputs not verifiable (5 of 15). A tool that returns any action's fields with an example (8 of 15). Registry 3.0.0 on 4 November; no changelog (3 of 15). 15 + 0 + 14 + 5 + 8 + 3 = 45.

Magic Patterns 60

Closed service under terms of service last updated 1 April 2025 (15). The privacy policy of the same date keeps personal data as long as necessary with no periods. The terms let Magic Patterns train on Free plan inputs and outputs and show Free plan designs publicly, and rule out training on paid plans. The subprocessor list sits in the Trust Center, which wasn't readable (14 of 30). No deprecation policy. v2 is 'being deprecated and will be removed in a future release' with no date, and the terms allow any part of the service to be discontinued at any time (5 of 20). The security page names Render and MongoDB Atlas as hosting, and the full subprocessor list wasn't read (8 of 20). 15 + 14 + 5 + 8 = 42.

UX Pilot MCP server 22

Terms and privacy render with script and weren't readable (0). Data handling not read (0). A tool that maps old tool names to new calls eased the 3.0 change, no dates (5 of 20). Subprocessors not found (0). 0 + 0 + 5 + 0 = 5.

Magic Patterns 70

Changelog entry on 5 November 2026, the day before this check (30). Entries on twelve dates since 8 August, among them 23 September and 12 to 30 October (20). Closed service with a public changelog, email support within one to two business days, in-app chat and a Slack community. We didn't test them (12 of 15). Not in the official MCP registry (searches for magic-patterns and magicpatterns returned nothing of theirs). Official Claude connector, Cursor plugin and Codex plugin, and no SDKs (5 of 15). No public package or repository to check (3 of 10). 30 + 20 + 12 + 5 + 3 = 70.

UX Pilot MCP server 45

Registry 3.0.0 and repository on 4 November 2026 (30). Dated releases not found (0). Issues not read (0). Official registry entry ai.uxpilot/uxpilot (15). README-only repository (0). 30 + 0 + 0 + 15 + 0 = 45. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Magic Patterns 67

24 documented tools (15 for 11 to 30), plus 5 back for the read-only endpoint that registers only 12 (20 of 25). Message history pages by 10 and version history by 20 with skip, and file reads take a list of names (14 of 20). Documented status codes, a 402 that leaves reads working and non-blocking validationErrors on design-system writes (15 of 20). No idempotency keys; 409 conflict checks on design-system writes, and annotations couldn't be read on the closed server (10 of 20). create_design needs no parameter and makes a blank scaffold, but there is no official SDK (8 of 15). 20 + 14 + 15 + 10 + 8 = 67.

UX Pilot MCP server 46

Tool count not published; grouped actions (10). Search by keyword and list calls (10 of 20). No documented errors (3 of 20). 'Nothing is deleted' by the organise tools, and deletes run only once the user confirms (15 of 20). OAuth or a key, no SDKs (8 of 15). 10 + 10 + 3 + 15 + 8 = 46.

Magic Patterns 55

OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). x-mp-agent-name attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.

UX Pilot MCP server 39

OAuth or a bearer key; scopes not published (20 of 30). Organise tools never delete, and deletes need confirmation (14 of 20). Imported AI output and comments are third-party text; no injection guidance (3 of 15). No audit log (0). No security programme found (2 of 20). 20 + 14 + 3 + 0 + 2 = 39.