pen.dev vs Penpot API + MCP

pen.dev

An agent can create, edit and export .pen designs without a GUI through the pen CLI, with four compact MCP tools that carry annotations and a documented JSON format. The software is closed and needs a pen.dev account. No changelog, status page or security contact was found, and 14 public issue reports had no reply on 8 October 2026.

Penpot API + MCP

MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan. Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string.

pen.dev

1. Call read_skill(), then read_skill({ path: "pen-schema.md" }) and read_skill({ path: "execute.md" }) before the first execute. The tool description alone doesn't document the operations
2. Call get_app_state() and confirm the active document before editing. The MCP server works on whichever .pen file is open in the app
3. In headless pen interactive, call save() before exit(), and keep --in and --out on different paths to preserve the source
4. Check that an export file exists. The docs say an export failure can print an error without a nonzero exit status
5. In CI set PEN_CLI_KEY plus a provider key such as ANTHROPIC_API_KEY. Run pen version, since pen --version is not a flag

Penpot API + MCP

1. Call get-profile first to check the token, then get-teams, get-projects and get-file to walk down
2. Ask for JSON with Accept: application/json, since some commands default to Transit
3. Call high_level_overview and penpot_api_info before execute_code. They tell the model what the plugin API can do
4. Keep the Penpot tab in the foreground. A backgrounded or frozen tab stalls MCP calls
5. Give tokens an expiry. They carry full account access