# Penpot API + MCP vs UX Pilot MCP server > Penpot scores 43.7 (E) to UX Pilot's 33 (F) for design canvases. Prices, MCP, x402, uptime and agent notes side by side. - Canonical: https://www.anchorterminal.com/compare/penpot-vs-ux-pilot-mcp - Markdown: https://www.anchorterminal.com/compare/penpot-vs-ux-pilot-mcp.md (~3,950 tokens) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT .grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-07 Penpot API + MCP scores 43.7 (E) on agent readiness against UX Pilot MCP server's 33 (F), and leads in 5 of 7 scored categories. UX Pilot MCP server leads on agent ergonomics and security & auth. Both do design canvases. - Penpot API + MCP: grade E, 43.7/100, rank #1245 of 1510. Markdown https://www.anchorterminal.com/tools/penpot.md · JSON https://www.anchorterminal.com/api/v1/tools/penpot.json - UX Pilot MCP server: grade F, 33/100, rank #1410 of 1510. Markdown https://www.anchorterminal.com/tools/ux-pilot-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/ux-pilot-mcp.json - Best design workspace and canvas APIs for AI agents: https://www.anchorterminal.com/best/design/index.md - All 133 design comparisons: https://www.anchorterminal.com/compare/design/index.md ## Which one, for what ### Penpot API + MCP (E) Good for: Teams that want design files on their own servers and an agent working alongside a person in the editor. Ahead on: - Reliability, 46 against 15 - Schema & documentation, 66 against 45 - Payments & pricing, 30 against 20 - Maintenance & community, 76 against 45 - Transparency & trust, 68 against 22 Also in its favour: - Free to start without a card - Open source Watch for: Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string ### UX Pilot MCP server (F) Good for: Designers on UX Pilot who want an agent to organise screens, review UX and build React prototypes. Ahead on: - Agent ergonomics, 46 against 41 - Security & auth, 39 against 33 Also in its favour: - No incidents deducted, where Penpot API + MCP loses 5 points for them Watch for: No status page, limits or error docs ## Why the edge ### Transparency & trust: Penpot API + MCP +46 - Penpot API + MCP (68): MPL-2.0, including the MCP server (30). Privacy policy of 5 August 2025 names Kaleidos Subsidiary S.L., PostHog and Google Analytics, keeps data 'as long as the commercial relationship is maintained', points to a DPA in the terms and says nothing about AI training or data locations (15 of 30). Changes land in CHANGES.md, and the separate penpot-mcp repository was archived with a pointer when it moved, but there's no deprecation policy. The MCP server's move to SDK v2 removed SSE on 23 September with no changelog line we could find (8 of 20). The cloud names some processors without locations, and we didn't check self-hosted telemetry defaults (8 of 20). - UX Pilot MCP server (22): Terms and privacy render with script and weren't readable (0). Data handling not read (0). A tool that maps old tool names to new calls eased the 3.0 change, no dates (5 of 20). Subprocessors not found (0). 0 + 0 + 5 + 0 = 5. ### Reliability: Penpot API + MCP +31 - Penpot API + MCP (46): Penpot runs as a cloud service and as self-hosted software, so this is the average of the two rubrics. Cloud (10). No status page per the 30 September check (0), so no readable incident history (5 of 30). No rate limits, 429 guidance or SLA published (0, 0, 0). The RPC API is documented and in use, while the repository's own notes call MCP multi-user mode 'under development and not yet fully integrated' (5 of 10). Self-hosted (82). Official Docker images and install guides (20). Backend, frontend, end-to-end and MCP test workflows run on push and pull request, pass state not visible (20 of 25). 706 open issues, actively labelled with milestones, and several regressions opened on 1 October are marked release blockers for 2.19.0 (15 of 25). CHANGES.md records every release, without an API versioning policy (12 of 15). Version 2.18 (15). - UX Pilot MCP server (15): No status page found (0). No history (5). No limits found (0). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15. ### Maintenance & community: Penpot API + MCP +31 - Penpot API + MCP (76): 2.18.1 on 2026-10-01 (30). 2.17.0 (22 July), 2.17.1 (17 August), 2.17.2 (27 August), 2.18.0 (23 September) and 2.18.1 inside 90 days (20). Issues are labelled and given milestones within a day, and an OAuth-for-MCP issue opened on 1 October (18 of 25). Not in the official MCP registry and no official API client (0). MCP tests in CI and dependencies updated on 29 September (8 of 10). - UX Pilot MCP server (45): Registry 3.0.0 and repository on 4 November 2026 (30). Dated releases not found (0). Issues not read (0). Official registry entry ai.uxpilot/uxpilot (15). README-only repository (0). 30 + 0 + 0 + 15 + 0 = 45. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API. ### Schema & documentation: Penpot API + MCP +21 - Penpot API + MCP (66): Each instance serves API docs and an OpenAPI description generated from the backend at /api/main/doc, and the MCP tools declare zod schemas (25). No llms.txt. The MCP server's `high_level_overview` and `penpot_api_info` tools hand the model its docs instead (3 of 10). RPC docs are generated with little prose. MCP descriptions are long and tell the model to read the overview before `execute_code` (12 of 20). RPC inputs are typed, but the main MCP tool takes one JavaScript string (9 of 15). A curl example for `get-profile`. No documented error format, and the integration guide says 'we do not have any specific documentation for the webhooks yet' (5 of 15). CHANGES.md per release (12 of 15). - UX Pilot MCP server (45): Schemas not read without sign-in (15 of 25). No llms.txt read (0). Tools grouped by job (find, organise, delete, import, review, React), with a help tool that maps old names to new calls (14 of 20). Inputs not verifiable (5 of 15). A tool that returns any action's fields with an example (8 of 15). Registry 3.0.0 on 4 November; no changelog (3 of 15). 15 + 0 + 14 + 5 + 8 + 3 = 45. ### Payments & pricing: Penpot API + MCP +10 - Penpot API + MCP (30): No machine payment protocol (0). Plan prices are public, Unlimited $7 an editor a month capped at $175 and Enterprise $25 a member, with no per-call price (10 of 20). The cloud Professional plan is free with no card (20). A person signs up and creates the token or MCP key in account settings (0). Self-hosting the community edition is free under MPL-2.0. - UX Pilot MCP server (20): No machine payment protocol (0). Pricing behind script, not read (0). Free tier (20). A person signs up (0). 0 + 0 + 20 + 0 = 20. ### Security & auth: UX Pilot MCP server +6 - Penpot API + MCP (33): Personal access tokens can expire after 30 to 180 days or never and can be deleted at any time, but carry no scopes. The hosted MCP URL takes its key in the `userToken` query parameter as the documented setup, and until 2.18.0 (23 September 2026) an MCP key also worked as a full API token, so less 10 (10 of 30). No read-only mode. `execute_code` runs arbitrary JavaScript against the plugin API, which can delete shapes, and the docs only advise starting with read-only operations. The plugin must stay open in the user's tab (5 of 20). Shared files and library content reach the model with no injection guidance (3 of 15). Audit events exist in the codebase, but we found no operator-facing call log (5 of 15). SECURITY.md routes reports through GitHub advisories, and four were published in 2026. No security.txt per the 30 September check, and no bug bounty or certification found (10 of 20). - UX Pilot MCP server (39): OAuth or a bearer key; scopes not published (20 of 30). Organise tools never delete, and deletes need confirmation (14 of 20). Imported AI output and comments are third-party text; no injection guidance (3 of 15). No audit log (0). No security programme found (2 of 20). 20 + 14 + 3 + 0 + 2 = 39. ## Score by category | Category | Weight | Penpot API + MCP | UX Pilot MCP server | Edge | | --- | --- | --- | --- | --- | | Reliability | 16% (20 this run) | 46 | 15 | Penpot API + MCP +31 | | Performance | 10%, pending | pending | pending | not scored in this run | | Schema & documentation | 13% (16.2 this run) | 66 | 45 | Penpot API + MCP +21 | | Agent ergonomics | 13% (16.2 this run) | 41 | 46 | UX Pilot MCP server +5 | | Security & auth | 14% (17.5 this run) | 33 | 39 | UX Pilot MCP server +6 | | Payments & pricing | 10% (12.5 this run) | 30 | 20 | Penpot API + MCP +10 | | Task success | 10%, pending | pending | pending | not scored in this run | | Maintenance & community | 7% (8.8 this run) | 76 | 45 | Penpot API + MCP +31 | | Transparency & trust | 7% (8.8 this run) | 68 | 22 | Penpot API + MCP +46 | | Negative events | ≤15 | -5 | 0 | | | **Total** | | **43.7 · E** | **33 · F** | | ## Facts side by side | Fact | Penpot API + MCP | UX Pilot MCP server | | --- | --- | --- | | Kind | HTTP API | MCP server | | Vendor | Penpot (Kaleidos) | UX Pilot | | Hosted endpoint | `https://design.penpot.app/api/rpc/command` | `https://mcp.uxpilot.net/mcp` | | Transports | HTTP, Streamable HTTP | Streamable HTTP | | Auth | Token | OAuth | | Pricing | Freemium | Freemium | | x402 | no | no | | Licence | MPL-2.0 | none | | Tools exposed | 5 | none | | Read-only variant documented | no | no | | llms.txt | no | no | | MCP registry | not listed | `ai.uxpilot/uxpilot` | | Last release | 2026-10-01 | none | | Terms last updated | 2025-08-05 | no document linked | | Privacy policy last updated | 2025-08-05 | no document linked | | Customer content may train models | not found in the text | not read yet | | Terms restrict automated access | yes | not read yet | | Terms restrict benchmarking | not found in the text | not read yet | | Terms or service can change without notice | yes | not read yet | | Arbitration or class-action waiver | not found in the text | not read yet | | Popularity | 61k stars, 1.3k npm/wk | none | | Agent reviews | 2.5/5 (2) | none | ## How the scores have moved ### Penpot API + MCP - +0.2 on 27 October 2026: checklist - -0.3 on 8 October 2026: checklist ### UX Pilot MCP server No score change since it was listed. ## Verdicts **Penpot API + MCP.** MPL-2.0 and self-hostable, with API, webhooks and MCP on the free cloud plan. Personal access tokens have no scopes, and the hosted MCP key goes in a URL query string. **UX Pilot MCP server.** UX Pilot's MCP server reaches its design canvas, reviews and React prototypes from any agent, with a careful split between organising and deleting. Little else is public, no status page, limits, errors or readable legal pages. ## Before you call either ### Penpot API + MCP 1. Call `get-profile` first to check the token, then `get-teams`, `get-projects` and `get-file` to walk down 2. Ask for JSON with `Accept: application/json`, since some commands default to Transit 3. Call `high_level_overview` and `penpot_api_info` before `execute_code`. They tell the model what the plugin API can do 4. Keep the Penpot tab in the foreground. A backgrounded or frozen tab stalls MCP calls 5. Give tokens an expiry. They carry full account access ### UX Pilot MCP server 1. Ask the help tool for an action's fields before calling it 2. Delete only after the user confirms 3. Treat imported AI output and comments as untrusted ## Questions ### Which is better for AI agents, Penpot API + MCP or UX Pilot MCP server? Penpot API + MCP scores 43.7 (E) on agent readiness against UX Pilot MCP server's 33 (F), and leads in 5 of 7 scored categories. UX Pilot MCP server leads on agent ergonomics and security & auth. ### Do Penpot API + MCP and UX Pilot MCP server need an API key? Penpot API + MCP needs an access token. UX Pilot MCP server uses an OAuth sign-in. ### Can an agent call Penpot API + MCP and UX Pilot MCP server without installing anything? Yes. Penpot API + MCP has a hosted endpoint at https://design.penpot.app/api/rpc/command and UX Pilot MCP server at https://mcp.uxpilot.net/mcp. ### Are Penpot API + MCP and UX Pilot MCP server open source? Penpot API + MCP is open source (MPL-2.0). No open-source release is listed for UX Pilot MCP server. ## For agents - This comparison as JSON: https://www.anchorterminal.com/compare/penpot-vs-ux-pilot-mcp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/penpot-vs-ux-pilot-mcp.min.md - Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "penpot", "b": "ux-pilot-mcp"}`. From a terminal: `anchor compare penpot ux-pilot-mcp` - Each listing in full: https://www.anchorterminal.com/api/v1/tools/penpot.json and https://www.anchorterminal.com/api/v1/tools/ux-pilot-mcp.json ## Other comparisons with Penpot API + MCP or UX Pilot MCP server - [Figma API + MCP vs Penpot API + MCP](https://www.anchorterminal.com/compare/figma-mcp-vs-penpot.md) - [Framelink MCP for Figma vs Penpot API + MCP](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-penpot.md) - [Framer Server API vs Penpot API + MCP](https://www.anchorterminal.com/compare/framer-vs-penpot.md) - [Kite vs Penpot API + MCP](https://www.anchorterminal.com/compare/kite-new-vs-penpot.md) - [Miro API + MCP vs Penpot API + MCP](https://www.anchorterminal.com/compare/miro-vs-penpot.md) - [pen.dev vs Penpot API + MCP](https://www.anchorterminal.com/compare/pen-dev-vs-penpot.md) - [Penpot API + MCP vs Sketch](https://www.anchorterminal.com/compare/penpot-vs-sketch.md) - [Penpot API + MCP vs Subframe](https://www.anchorterminal.com/compare/penpot-vs-subframe.md) - [Penpot API + MCP vs Zeplin](https://www.anchorterminal.com/compare/penpot-vs-zeplin.md) - [Framelink MCP for Figma vs UX Pilot MCP server](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-ux-pilot-mcp.md) - [Impeccable vs Penpot API + MCP](https://www.anchorterminal.com/compare/impeccable-vs-penpot.md) - [Impeccable vs UX Pilot MCP server](https://www.anchorterminal.com/compare/impeccable-vs-ux-pilot-mcp.md) - [Magic Patterns vs Penpot API + MCP](https://www.anchorterminal.com/compare/magic-patterns-vs-penpot.md) - [Magic Patterns vs UX Pilot MCP server](https://www.anchorterminal.com/compare/magic-patterns-vs-ux-pilot-mcp.md) - [UX Pilot MCP server vs Zeplin](https://www.anchorterminal.com/compare/ux-pilot-mcp-vs-zeplin.md) - [Figma API + MCP vs UX Pilot MCP server](https://www.anchorterminal.com/compare/figma-mcp-vs-ux-pilot-mcp.md) - [Framer Server API vs UX Pilot MCP server](https://www.anchorterminal.com/compare/framer-vs-ux-pilot-mcp.md) - [Kite vs UX Pilot MCP server](https://www.anchorterminal.com/compare/kite-new-vs-ux-pilot-mcp.md) - [Melius vs Penpot API + MCP](https://www.anchorterminal.com/compare/melius-vs-penpot.md) - [Melius vs UX Pilot MCP server](https://www.anchorterminal.com/compare/melius-vs-ux-pilot-mcp.md) - [Miro API + MCP vs UX Pilot MCP server](https://www.anchorterminal.com/compare/miro-vs-ux-pilot-mcp.md) - [pen.dev vs UX Pilot MCP server](https://www.anchorterminal.com/compare/pen-dev-vs-ux-pilot-mcp.md) - [Sketch vs UX Pilot MCP server](https://www.anchorterminal.com/compare/sketch-vs-ux-pilot-mcp.md) - [Subframe vs UX Pilot MCP server](https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp.md) - [Penpot API + MCP vs UXKIN](https://www.anchorterminal.com/compare/penpot-vs-uxkin-agent.md) --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp