Magic Patterns vs UXKIN

Magic Patterns 75

Hosted lines, for the MCP server and v3 API. A Statuspage at magicpatterns.statuspage.io with incident history, but its two components are Web Platform and Figma Plugin, with nothing for the API or MCP server (15 of 20). The history page and Atom feed post no incident since 9 January 2026, so the 90 days before this check are clean as far as the page covers (30). The page's /api/ path is disallowed by its robots.txt, so the JSON feeds weren't used. Rate limit published as 1,000 generations per 10 hours per key, with polling no faster than once every 60 seconds (15). No 429, Retry-After or backoff guidance and no idempotency keys. Design-system writes take a baseArtifactId and return 409 on a concurrent change, with re-read-and-retry advice (5 of 15). No SLA found below Enterprise's custom contracts (0). The MCP server and v3 API carry no beta label (10). 15 + 30 + 15 + 5 + 0 + 10 = 75.

UXKIN 45

Read with the hosted lines, because the surface an agent uses is the MCP server at uxkin.com/mcp. UXKIN runs its own status page with four components (library and search, sign-in and accounts, AI app connection over MCP, payments) and 30 days of checks (20). On 4 November 2026 the page listed no incidents, with 100 per cent of checks passed for the library, 98.4 per cent for sign-in and the MCP connection and 99.74 per cent for payments over 30 days. A new status page that has never posted an incident is a short record (15 of 30). No rate limit with numbers is published. The terms say agent access may be limited (0 of 15). No 429, Retry-After or backoff guidance was found, though every tool is read-only (0 of 15). No SLA (0 of 10). The server carries no beta or preview label (10). 20+15+0+0+0+10 = 45.

Magic Patterns 55

OAuth 2.1 with PKCE S256, dynamic registration and a device flow, issued by oauth.magicpatterns.com with WorkOS keys. Scopes are openid, email, profile and offline_access only, so a token carries the user's whole workspace role. API keys are shown once, with no scopes, expiry or rotation documented (22 of 30). The read-only endpoint doesn't register the 13 tools that create, change or publish. There is no confirmation step on the write endpoint (14 of 20). Tools return design code and chat history that collaborators wrote, and no prompt-injection guidance was found (3 of 15). x-mp-agent-name attributes changes in the UI, and audit logs come with Enterprise only (8 of 15). The security page describes encryption, logging and the Render and MongoDB Atlas setup and points to SOC 2 reports in a Trust Center drawn by script, which wasn't read. No security.txt, disclosure policy or bug bounty found (8 of 20). 22 + 14 + 3 + 8 + 8 = 55.

UXKIN 68

OAuth 2.1 on UXKIN's own authorisation server, with PKCE S256, dynamic client registration and refresh tokens, and one scope uxkin for a read-only service. The fallback agent token is stored hashed, can be reset at once and goes in a header, never a query string (25 of 30). Every tool is read-only, so an agent can't change the account or the project (18 of 20). Results carry text and DESIGN.md content from other products, and both skills tell the agent to treat tool results as data and not follow instructions in them (10 of 15). Connected apps show when they were added and last used, and tokens record last use, with no per-call log (5 of 15). security.txt is valid until 1 October 2027, SECURITY.md promises a reply in three working days and GitHub private reporting is on. No bounty or certification (10 of 20). Total 68.

Magic Patterns 23

No x402, MPP or L402. A 402 means out of credits, with no payment requirements (0). Seat prices are public and the on-demand rate is $0.02 a credit, but a generation's credit cost isn't known before it runs (typical 70 per generation per the docs), so between plan-only and per-unit (15 of 20). The MCP overview and the plans table say MCP and API-key access need a paid plan, while the v3 API page says free-tier accounts can call v3 up to their credits. Taking the stricter reading for the MCP surface, the free tier gives an agent no MCP access (5 of 20). A person signs in through the browser; dynamic client registration and the device flow still end with a human approval (3 of 20). 0 + 15 + 5 + 3 = 23.

UXKIN 12

No machine payment protocol (0 of 40). Plan prices are public, $9.99 a month or $99 once, with no per-call price (10 of 20). Searching needs a plan and no trial for the server was found. The skills are free, but they aren't the surface graded here (0 of 20). A person signs up and pays through Polar in a browser. Clients can register themselves with the authorisation server, which earns 2 (2 of 20). Total 12.

Magic Patterns 84

The MCP server is closed, so its tool definitions weren't read. The v3 API has an OpenAPI 3.0.3 description, served as a block in each API reference page; the file llms.txt links at /docs/openapi-v3.yml answered with a not-found page (20 of 25). llms.txt and a Markdown copy of every docs page (10). The tools page sets out four workflows with call order, says when to poll and how often, splits read from write tools and warns that the user may edit at any time (17 of 20). Parameters are typed and marked required, the feedback category is an enum, and file writes take an array of name and content pairs (10 of 15). Request and response examples, an error table (400, 401, 402, 403) and 409 behaviour on writes (12 of 15). Versioned /v3 paths, a v2 deprecation notice and a dated product changelog (15). 20 + 10 + 17 + 10 + 12 + 15 = 84.

UXKIN 74

The public server card gives every tool a typed JSON Schema input with additionalProperties: false and an output schema (25). No llms.txt (uxkin.com/llms.txt is 404). The skills are served as Markdown at /.well-known/agent-skills/ and the repository has llms-install.md (5 of 10). Tool descriptions say what each returns, how to phrase queries and when to use get_journey after a search, with less on when not to call (17 of 20). Inputs carry required fields, defaults and limits (limit 1 to 50 and 1 to 25) and no free-form objects (14 of 15). Descriptions and the MCP guide give query examples and a sample result. Error responses aren't documented (8 of 15, a partial kept for the examples). Versions 1.0.0 to 1.3.1 are in the registry and manifests, with no public changelog (5 of 15). Total 74.

Magic Patterns 70

Changelog entry on 5 November 2026, the day before this check (30). Entries on twelve dates since 8 August, among them 23 September and 12 to 30 October (20). Closed service with a public changelog, email support within one to two business days, in-app chat and a Slack community. We didn't test them (12 of 15). Not in the official MCP registry (searches for magic-patterns and magicpatterns returned nothing of theirs). Official Claude connector, Cursor plugin and Codex plugin, and no SDKs (5 of 15). No public package or repository to check (3 of 10). 30 + 20 + 12 + 5 + 3 = 70.

UXKIN 76

Version 1.3.1 reached the official MCP registry on 16 October 2026, still the latest on 4 November (30). Repository commits to 2 November add distribution notes, VS Code listing images and an Open VSX publishing workflow, with no new tag or version. Six registry versions between 5 and 16 October (20). GitHub issues and pull requests couldn't be read from this session. Support is an email address and a contact form, and there's no public changelog (5 of 25). Listed in the official MCP registry as io.github.uxkin/uxkin, matching the repository owner (15). Three workflows (packaging checks, plugin scan, skill sync with uxkin.com) pin actions by commit, and their results weren't read (6 of 10). The service is about five weeks old. Total 76.