{
  "data": {
    "a": {
      "slug": "subframe",
      "name": "Subframe",
      "vendor": "Atomic Design Inc",
      "vendorUrl": "https://www.subframe.com",
      "kind": "mcp",
      "category": "design",
      "summary": "Design tool from Atomic Design Inc for React and Tailwind interfaces, with a cloud canvas and a macOS app. Agents read and edit pages, components and themes through a hosted MCP server, and a CLI syncs components into a codebase.",
      "url": "https://www.anchorterminal.com/tools/subframe",
      "markdownUrl": "https://www.anchorterminal.com/tools/subframe.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/subframe.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/subframe.json",
      "dns": "subframe.grade.anchorterminal.com",
      "repo": "https://github.com/SubframeApp/subframe",
      "license": "Proprietary service under Atomic Design's terms of service. `@subframe/cli` and `@subframe/core` are marked ISC in their package files and the Claude Code plugin MIT in its manifest, with no licence file in the repository",
      "transports": [
        "http"
      ],
      "remoteUrl": "https://mcp.subframe.com/mcp",
      "packages": [
        {
          "registry": "npm",
          "name": "@subframe/cli"
        },
        {
          "registry": "npm",
          "name": "@subframe/core"
        }
      ],
      "auth": "mixed",
      "authNotes": "The MCP server takes OAuth only, with dynamic client registration and PKCE, and a person approves access in a browser. Subframe access tokens are not accepted there. What an agent can do follows the user's team role. Admins and Editors can write, and Viewers get a read-only server. The CLI takes an auth token from `SUBFRAME_AUTH_TOKEN` or `--auth-token`, created at app.subframe.com/cli/auth or by the `generate_auth_token` MCP tool. Tokens are shown once and can be deleted. No token scopes or expiry are documented. Access is self-serve.",
      "pricing": "freemium",
      "pricingNotes": "Free at $0 with one project, unlimited pages and members, and MCP and CLI access, so an agent's owner can start without a contract. Pro is $20 an editor a month for unlimited projects and six times the AI credits. Viewers are free on every plan. Custom plans are priced on request. MCP calls are not priced separately (https://www.subframe.com/, checked 2026-10-09).",
      "priceSummary": "$20 / seat-mo",
      "where": "hosted",
      "x402": {
        "level": "no",
        "evidence": "No x402, MPP or L402 in the docs, the pricing section or the CLI source (checked 2026-10-09).",
        "endpoints": []
      },
      "toolCount": 46,
      "popularity": {
        "githubStars": 435,
        "npmWeekly": 1006,
        "pypiWeekly": null,
        "asOf": "2026-10-09"
      },
      "docsUrl": "https://docs.subframe.com",
      "llmsTxt": "https://docs.subframe.com/llms.txt",
      "capabilities": [
        "design.files",
        "design.components",
        "design.code",
        "design.canvas",
        "design.comments"
      ],
      "tags": [
        "hosted",
        "mcp",
        "oauth",
        "remote-mcp",
        "cli",
        "agent-skills",
        "react",
        "tailwind",
        "design-to-code",
        "freemium",
        "free-tier",
        "llms-txt",
        "closed-source",
        "macos"
      ],
      "lastRelease": "2026-10-08",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 39.8,
        "grade": "E",
        "agentReady": false,
        "rank": 1332,
        "ranked": true,
        "rankOf": 1510,
        "categoryRank": 15,
        "methodology": "0.7",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 47,
          "maintenance": 65,
          "payments": 33,
          "reliability": 19,
          "schema": 54,
          "security": 44,
          "transparency": 58
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "medium",
          "date": "2026-10-09"
        },
        "negative": -3,
        "negativeNotes": [
          "23 to 24 September 2026. The docs and skill files renamed three MCP tools (`list_flows`, `get_flow_info`, `delete_flow`) to `list_canvases`, `get_canvas_info` and `delete_canvas`, with no changelog entry or notice found. Whether the server still answers the old names was not tested (-2). https://github.com/SubframeApp/subframe/commit/43bfb51d749713940cf0df8e73da2ab43b7358bc",
          "7 May 2026. A docs commit records that the MCP server 'no longer accepts CLI/access tokens, only OAuth', removing the documented header route for clients without OAuth, with no dated notice found (-1, older and documented since). https://github.com/SubframeApp/subframe/commit/ff59743593fa2b581f32233b58660ace8a23f707"
        ],
        "verdict": "An agent can read and change pages, components, snippets and themes in a Subframe project through a hosted MCP server with OAuth, and Viewer accounts get a read-only server. The server lists 46 tools, and no status page, rate limits, changelog or security contact were found. Three tools were renamed in September 2026 with no notice found.",
        "bestFor": "A coding agent working beside a team that designs React and Tailwind interfaces in Subframe and wants the design as code, with a read-only route for review.",
        "strengths": [
          "Hosted MCP server at `https://mcp.subframe.com/mcp` with OAuth, dynamic client registration and PKCE, so no key is pasted into a config file",
          "Viewer accounts get a read-only MCP server and read-only CLI access, and Viewer seats are free on every plan",
          "Write tools cover pages, components, snippets, design documents, themes, icons and fonts, and page reads return generated React and Tailwind code",
          "Docs publish `llms.txt`, a Markdown twin of every page and a separate docs MCP server that needs no credential",
          "The CLI has a non-interactive mode with `--json` output, nonzero exit status on failure and a token read from `SUBFRAME_AUTH_TOKEN`"
        ],
        "weaknesses": [
          "46 tools are documented with no toolsets, and the vendor's `design` skill that explains them is about 55 KB of text",
          "No status page, published rate limit, SLA or changelog was found, and the terms disclaim uninterrupted service",
          "`list_flows`, `get_flow_info` and `delete_flow` became `list_canvases`, `get_canvas_info` and `delete_canvas` in September 2026 with no notice found",
          "No security.txt, disclosure policy, bug bounty, certification or audit log was found",
          "Delete confirmation is guidance in the skill file. The vendor's skill calls deletes irreversible from MCP, with recovery only through version history in the editor (24 hours on Free)"
        ],
        "agentNotes": [
          "Connect with an MCP client that supports OAuth. The server rejects Subframe access tokens and static `Authorization` headers",
          "Pass `projectId` on every call. When it is omitted the server uses the first project the user can reach, which may be the wrong team's",
          "After `design_page`, `design_component` or `edit_component`, call `wait_for_jobs` with the `jobId` before reading the result. Earlier reads return stale content",
          "Ask the owner before any delete tool or a theme token deletion. A deleted token leaves every reference detached even after the token is restored",
          "For the CLI, set `SUBFRAME_AUTH_TOKEN` and `DO_NOT_TRACK=1`, and point `--dir` at a folder that holds only Subframe code, because a full sync removes other unprotected files"
        ],
        "metrics": {
          "kind": "remote",
          "measured": false
        },
        "reviewCount": 4,
        "avgRating": 3,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "medium",
            "grade": "E",
            "methodology": "0.7",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 39.8
          }
        ],
        "editorialScores": {
          "ergonomics": 47,
          "maintenance": 65,
          "payments": 33,
          "reliability": 19,
          "schema": 54,
          "security": 44,
          "transparency": 46
        },
        "provenanceScore": 70,
        "checked": {
          "categories": {
            "ergonomics": "2026-10-09",
            "maintenance": "2026-10-09",
            "payments": "2026-10-09",
            "reliability": "2026-10-09",
            "schema": "2026-10-09",
            "security": "2026-10-09",
            "transparency": "2026-10-09"
          },
          "last": "2026-10-09",
          "lastMoved": "2026-10-28",
          "oldest": "2026-10-09",
          "stale": false,
          "staleAfterDays": 90
        }
      },
      "connect": {
        "install": "npx @subframe/cli@latest init",
        "claudeCode": "claude plugin marketplace add https://github.com/SubframeApp/subframe \u0026\u0026 claude plugin install subframe@subframe",
        "config": {
          "mcpServers": {
            "subframe": {
              "url": "https://mcp.subframe.com/mcp"
            },
            "subframe-docs": {
              "url": "https://docs.subframe.com/mcp"
            }
          }
        },
        "headless": {
          "command": "npx @subframe/cli@latest sync --all --json",
          "env": {
            "SUBFRAME_AUTH_TOKEN": "\u003ctoken\u003e"
          }
        }
      },
      "letme": {
        "capability": "https://letme.dev/design.files",
        "tool": "https://letme.dev/subframe"
      },
      "area": "design-diagrams",
      "unitPrices": [
        {
          "item": "Pro plan",
          "unit": "seat-month",
          "usd": 20,
          "note": "each Admin and Editor, unlimited projects, six times the Free AI credits, 7-day version history. Viewers are free"
        }
      ],
      "provenance": {
        "legalEntity": "Atomic Design Inc",
        "domain": "subframe.com",
        "domainRegistered": "2003-09-24",
        "endpointOnVendorDomain": true,
        "terms": "https://policies.subframe.com/tos",
        "privacy": "https://policies.subframe.com/privacy",
        "statusPage": "",
        "changelog": "",
        "securityTxt": "none",
        "checked": "2026-10-09",
        "notes": [
          "The terms of service (last updated 22 January 2026) are made between Atomic Design Inc, 156 2nd Street, Ste 403, San Francisco, CA 94105, and each customer, cover the Subframe service and choose California law.",
          "The privacy policy (effective 22 January 2026) covers products and services at subframe.com. A DPA dated 21 January 2026 is at https://policies.subframe.com/dpa.",
          "The MCP server answers at mcp.subframe.com. Its protected resource metadata names an authorisation server at dbgjvucxjwkukwbojywe.supabase.co, so sign-in and tokens are issued from a Supabase host.",
          "www.subframe.com/.well-known/security.txt and /security.txt return 404.",
          "No status page or changelog is linked from the site footer, the docs or the docs index. Addresses for either were not guessed.",
          "RDAP gives subframe.com a registration date of 2003-09-24 with Cloudflare, Inc. as registrar. The repository was created on 4 March 2024."
        ],
        "score": 70
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/subframe.json",
      "live": {
        "slug": "subframe",
        "probe": {
          "target": "https://mcp.subframe.com/mcp",
          "method": "get",
          "lastAt": "2026-11-07T23:14:52.299101604Z",
          "lastOk": true,
          "lastStatus": 401,
          "lastMs": 126,
          "lastNote": "asks for credentials",
          "authRequired": true,
          "uptime24h": 98.77,
          "uptime30d": 99.93,
          "p50ms24h": 161,
          "p95ms24h": 291,
          "samples24h": 244,
          "samples30d": 7254,
          "days": [
            {
              "date": "2026-10-09",
              "probes": 85,
              "ok": 85
            },
            {
              "date": "2026-10-10",
              "probes": 247,
              "ok": 247
            },
            {
              "date": "2026-10-11",
              "probes": 247,
              "ok": 247
            },
            {
              "date": "2026-10-12",
              "probes": 247,
              "ok": 247
            },
            {
              "date": "2026-10-13",
              "probes": 248,
              "ok": 248
            },
            {
              "date": "2026-10-14",
              "probes": 249,
              "ok": 249
            },
            {
              "date": "2026-10-15",
              "probes": 253,
              "ok": 253
            },
            {
              "date": "2026-10-16",
              "probes": 252,
              "ok": 252
            },
            {
              "date": "2026-10-17",
              "probes": 253,
              "ok": 253
            },
            {
              "date": "2026-10-18",
              "probes": 256,
              "ok": 256
            },
            {
              "date": "2026-10-19",
              "probes": 255,
              "ok": 255
            },
            {
              "date": "2026-10-20",
              "probes": 252,
              "ok": 252
            },
            {
              "date": "2026-10-21",
              "probes": 253,
              "ok": 253
            },
            {
              "date": "2026-10-22",
              "probes": 253,
              "ok": 253
            },
            {
              "date": "2026-10-23",
              "probes": 248,
              "ok": 248
            },
            {
              "date": "2026-10-24",
              "probes": 251,
              "ok": 251
            },
            {
              "date": "2026-10-25",
              "probes": 250,
              "ok": 250
            },
            {
              "date": "2026-10-26",
              "probes": 252,
              "ok": 252
            },
            {
              "date": "2026-10-27",
              "probes": 249,
              "ok": 247
            },
            {
              "date": "2026-10-28",
              "probes": 250,
              "ok": 250
            },
            {
              "date": "2026-10-29",
              "probes": 249,
              "ok": 249
            },
            {
              "date": "2026-10-30",
              "probes": 249,
              "ok": 249
            },
            {
              "date": "2026-10-31",
              "probes": 251,
              "ok": 251
            },
            {
              "date": "2026-11-01",
              "probes": 249,
              "ok": 249
            },
            {
              "date": "2026-11-02",
              "probes": 250,
              "ok": 250
            },
            {
              "date": "2026-11-03",
              "probes": 248,
              "ok": 248
            },
            {
              "date": "2026-11-04",
              "probes": 246,
              "ok": 246
            },
            {
              "date": "2026-11-05",
              "probes": 185,
              "ok": 185
            },
            {
              "date": "2026-11-06",
              "probes": 241,
              "ok": 241
            },
            {
              "date": "2026-11-07",
              "probes": 236,
              "ok": 233
            }
          ],
          "outages": [
            {
              "start": "2026-11-07T01:55:45.616281332Z",
              "end": "2026-11-07T02:13:27.354895383Z",
              "note": "HTTP 500 server error"
            }
          ]
        },
        "versions": [
          {
            "registry": "npm",
            "name": "@subframe/cli",
            "version": "1.213.0",
            "seenAt": "2026-11-07T00:09:15.315061949Z"
          },
          {
            "registry": "npm",
            "name": "@subframe/core",
            "version": "1.155.0",
            "seenAt": "2026-11-07T00:09:16.203413569Z"
          }
        ],
        "githubStars": 464,
        "npmWeekly": 576,
        "securityTxt": {
          "url": "https://subframe.com/.well-known/security.txt",
          "state": "none",
          "checkedAt": "2026-11-07T16:00:36.92673736Z"
        },
        "llmsTxt": {
          "url": "https://docs.subframe.com/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-11-07T15:34:03.796184292Z"
        },
        "domain": {
          "domain": "subframe.com",
          "registered": "2003-09-24",
          "source": "https://rdap.verisign.com/com/v1/domain/subframe.com",
          "checkedAt": "2026-11-01T14:22:29.36693648Z"
        },
        "pages": [
          {
            "url": "https://policies.subframe.com/privacy",
            "kind": "privacy",
            "status": 304,
            "checkedAt": "2026-11-07T14:16:58.854272811Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "c221794f9af0"
          },
          {
            "url": "https://policies.subframe.com/tos",
            "kind": "terms",
            "status": 304,
            "checkedAt": "2026-11-07T14:17:01.189543907Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "cf29b530a2cf"
          }
        ],
        "mcpTools": {
          "url": "https://mcp.subframe.com/mcp",
          "checkedAt": "2026-11-07T01:48:09.734450211Z",
          "status": "auth",
          "note": "asks for credentials before listing its tools",
          "changedAt": "2026-10-09T21:40:55.87387771Z"
        },
        "github": {
          "repo": "subframeapp/subframe",
          "checkedAt": "2026-11-02T09:28:58.140688811Z",
          "stars": 460,
          "archived": false,
          "issuesEnabled": true,
          "pushedAt": "2026-10-29T16:58:36Z",
          "openIssues": 6,
          "openPRs": 4,
          "issuesOpened90d": 0,
          "issuesClosed90d": 0,
          "prsMerged90d": 66,
          "replies": {
            "sampled": 13,
            "unanswered": 6,
            "medianDays": 88.3
          }
        },
        "updatedAt": "2026-11-07T23:14:52.299101604Z"
      }
    },
    "answer": "Subframe scores 39.8 (E) on agent readiness against UX Pilot MCP server's 33 (F), and leads in every scored category.",
    "b": {
      "slug": "ux-pilot-mcp",
      "name": "UX Pilot MCP server",
      "vendor": "UX Pilot",
      "vendorUrl": "https://uxpilot.ai",
      "kind": "mcp",
      "category": "design",
      "summary": "UX Pilot's hosted MCP server lets an agent find, organise and import design work, run UX reviews and generate React prototypes on the UX Pilot canvas, over OAuth or an API key, with deletes only after the user confirms.",
      "url": "https://www.anchorterminal.com/tools/ux-pilot-mcp",
      "markdownUrl": "https://www.anchorterminal.com/tools/ux-pilot-mcp.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ux-pilot-mcp.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ux-pilot-mcp.json",
      "dns": "ux-pilot-mcp.grade.anchorterminal.com",
      "repo": "https://github.com/uxpilot-ai/uxpilot-mcp",
      "transports": [
        "streamable-http"
      ],
      "remoteUrl": "https://mcp.uxpilot.net/mcp",
      "packages": [],
      "auth": "oauth",
      "authNotes": "Native OAuth sign-in recommended, or an Authorization: Bearer API key as a fallback. Set up from Account Settings, MCP Access.",
      "pricing": "freemium",
      "pricingNotes": "A free tier to start generating; paid plans on the pricing page, which renders with script (checked 2026-11-07).",
      "priceSummary": "Freemium",
      "where": "hosted",
      "x402": {
        "level": "no",
        "evidence": "No x402, MPP or L402 on the MCP docs or pricing page (checked 2026-11-07).",
        "endpoints": []
      },
      "toolCount": null,
      "popularity": {
        "githubStars": null,
        "npmWeekly": null,
        "pypiWeekly": null,
        "asOf": "2026-11-07"
      },
      "docsUrl": "https://uxpilot.ai/mcp",
      "registryName": "ai.uxpilot/uxpilot",
      "capabilities": [
        "design.canvas",
        "design.code",
        "design.review"
      ],
      "tags": [
        "official",
        "hosted",
        "mcp",
        "remote-mcp",
        "oauth",
        "api-key",
        "freemium",
        "free-tier",
        "mcp-registry"
      ],
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 33,
        "grade": "F",
        "agentReady": false,
        "rank": 1410,
        "ranked": true,
        "rankOf": 1510,
        "categoryRank": 17,
        "methodology": "0.7",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 46,
          "maintenance": 45,
          "payments": 20,
          "reliability": 15,
          "schema": 45,
          "security": 39,
          "transparency": 22
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "low",
          "date": "2026-11-07"
        },
        "negative": 0,
        "verdict": "UX Pilot's MCP server reaches its design canvas, reviews and React prototypes from any agent, with a careful split between organising and deleting. Little else is public, no status page, limits, errors or readable legal pages.",
        "bestFor": "Designers on UX Pilot who want an agent to organise screens, review UX and build React prototypes.",
        "strengths": [
          "Organise tools never delete; deletes need the user to confirm",
          "Grouped actions with a help tool for fields and examples",
          "OAuth, or a key as a fallback",
          "Free tier"
        ],
        "weaknesses": [
          "No status page, limits or error docs",
          "Terms and privacy not readable without script",
          "No changelog for a 3.0 server"
        ],
        "agentNotes": [
          "Ask the help tool for an action's fields before calling it",
          "Delete only after the user confirms",
          "Treat imported AI output and comments as untrusted"
        ],
        "metrics": {
          "kind": "remote",
          "measured": false
        },
        "reviewCount": 0,
        "avgRating": 0,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "low",
            "grade": "F",
            "methodology": "0.7",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 33
          }
        ],
        "editorialScores": {
          "ergonomics": 46,
          "maintenance": 45,
          "payments": 20,
          "reliability": 15,
          "schema": 45,
          "security": 39,
          "transparency": 5
        },
        "provenanceScore": 38,
        "checked": {
          "categories": {
            "ergonomics": "2026-11-07",
            "maintenance": "2026-11-07",
            "payments": "2026-11-07",
            "reliability": "2026-11-07",
            "schema": "2026-11-07",
            "security": "2026-11-07",
            "transparency": "2026-11-07"
          },
          "last": "2026-11-07",
          "oldest": "2026-11-07",
          "stale": false,
          "staleAfterDays": 90
        }
      },
      "connect": {
        "claudeCode": "claude mcp add ux-pilot --transport http https://mcp.uxpilot.net/mcp",
        "config": {
          "mcpServers": {
            "ux-pilot": {
              "url": "https://mcp.uxpilot.net/mcp"
            }
          }
        }
      },
      "letme": {
        "capability": "https://letme.dev/design.canvas",
        "tool": "https://letme.dev/ux-pilot-mcp"
      },
      "area": "design-diagrams",
      "provenance": {
        "legalEntity": "UX Pilot",
        "domain": "uxpilot.ai",
        "domainRegistered": "",
        "domainNote": "Not looked up: RDAP isn't requested under the 1 November 2026 rules.",
        "endpointOnVendorDomain": true,
        "terms": "",
        "privacy": "",
        "statusPage": "",
        "changelog": "",
        "securityTxt": "none",
        "checked": "2026-11-07",
        "notes": [
          "The terms and privacy pages render with script, so the legal entity wasn't read."
        ],
        "score": 38
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/ux-pilot-mcp.json",
      "live": {
        "slug": "ux-pilot-mcp",
        "probe": {
          "target": "https://mcp.uxpilot.net/mcp",
          "method": "mcp-initialize",
          "lastAt": "2026-11-07T23:14:56.455790645Z",
          "lastOk": true,
          "lastStatus": 401,
          "lastMs": 179,
          "lastNote": "asks for credentials",
          "authRequired": true,
          "uptime24h": 100,
          "uptime30d": 100,
          "p50ms24h": 233,
          "p95ms24h": 515,
          "samples24h": 46,
          "samples30d": 46,
          "days": [
            {
              "date": "2026-11-07",
              "probes": 46,
              "ok": 46
            }
          ]
        },
        "updatedAt": "2026-11-07T23:14:56.455790645Z"
      }
    },
    "edges": [
      {
        "by": 36,
        "category": "transparency",
        "leads": "subframe",
        "name": "Transparency \u0026 trust",
        "reasons": {
          "a": "The service is closed under terms of service dated 22 January 2026. The CLI and `@subframe/core` are public and marked ISC in their package files, and the plugin MIT in its manifest, but the repository has no licence file (17 of 30). Terms, privacy policy (22 January 2026) and DPA (21 January 2026) agree with each other. The privacy policy gives no retention periods, and the terms say 'Unless Customer is notified otherwise, Customer Data is not used to train AI models', which leaves the default open to change by notice (15 of 30). No deprecation policy. A migration page explains the move to component directories, and three MCP tools were renamed with no notice found (4 of 20). The DPA links a sub-processor list held in a Google Sheet, which we did not read. The privacy policy names Google Analytics, PostHog, Segment and LogRocket, and the CLI's README discloses crash and usage reporting with `DO_NOT_TRACK=1` as the opt-out (10 of 20).",
          "b": "Terms and privacy render with script and weren't readable (0). Data handling not read (0). A tool that maps old tool names to new calls eased the 3.0 change, no dates (5 of 20). Subprocessors not found (0). 0 + 0 + 5 + 0 = 5."
        },
        "scores": {
          "a": 58,
          "b": 22
        }
      },
      {
        "by": 20,
        "category": "maintenance",
        "leads": "subframe",
        "name": "Maintenance \u0026 community",
        "reasons": {
          "a": "The Claude Code plugin reached 1.0.30 on 8 October 2026 and `@subframe/cli` 1.212.0 on 5 October 2026 (30 of 30). The plugin version changed ten times between 13 July and 8 October, and the CLI had three versions on 5 October after none since 24 June (20 of 20). The repository has 13 issues in all. Seven are open, among them a Codex MCP install error from 30 March 2026 and a Claude Code plugin install error from 13 February 2026 with one and two comments, and three with none. Pull requests merge most days. The Slack community was not read (10 of 25). A search of the official MCP registry for 'subframe' returned no entry (0 of 15). A commit of 12 August 2026 fixed dependency vulnerabilities. The CLI has unit and end-to-end tests in the repository, and the only public workflow publishes the package (5 of 10).",
          "b": "Registry 3.0.0 and repository on 4 November 2026 (30). Dated releases not found (0). Issues not read (0). Official registry entry ai.uxpilot/uxpilot (15). README-only repository (0). 30 + 0 + 0 + 15 + 0 = 45. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API."
        },
        "scores": {
          "a": 65,
          "b": 45
        }
      },
      {
        "by": 13,
        "category": "payments",
        "leads": "subframe",
        "name": "Payments \u0026 pricing",
        "reasons": {
          "a": "No machine payment protocol (0 of 40). Plan prices are public, Free at $0 and Pro at $20 an editor a month, with AI credits described only as limited and 6x and no per-call price (10 of 20). The Free plan has one project and includes MCP and CLI access, and the docs mention a card only at the Stripe checkout for Pro (20 of 20). A person has to sign in through a browser to approve OAuth. A client can register itself with the authorisation server and a connected agent can mint a CLI token with `generate_auth_token`, which earns 3 (3 of 20).",
          "b": "No machine payment protocol (0). Pricing behind script, not read (0). Free tier (20). A person signs up (0). 0 + 0 + 20 + 0 = 20."
        },
        "scores": {
          "a": 33,
          "b": 20
        }
      },
      {
        "by": 9,
        "category": "schema",
        "leads": "subframe",
        "name": "Schema \u0026 documentation",
        "reasons": {
          "a": "The MCP server is closed and answers 401 without OAuth, so the tool definitions and their input schemas were not read. The docs list 46 tools by name and the public skill files give parameters for most of them (12 of 25, on that partial evidence). docs.subframe.com publishes `llms.txt`, a Markdown twin of each page and a docs MCP server (10 of 10). The `design` skill states for each tool what it is for and when another tool fits better, for example `edit_page` against `design_page`. The docs table gives one line a tool (15 of 20). Parameters are named in the skill (`id`, `name` or `url`, `force`, `deleteChildPages`, `includeResolved`), while the design tools take a free-text description (6 of 15). Ten example prompts and a troubleshooting section, with no list of error responses (7 of 15). The plugin and the CLI carry version numbers, with no changelog (4 of 15).",
          "b": "Schemas not read without sign-in (15 of 25). No llms.txt read (0). Tools grouped by job (find, organise, delete, import, review, React), with a help tool that maps old names to new calls (14 of 20). Inputs not verifiable (5 of 15). A tool that returns any action's fields with an example (8 of 15). Registry 3.0.0 on 4 November; no changelog (3 of 15). 15 + 0 + 14 + 5 + 8 + 3 = 45."
        },
        "scores": {
          "a": 54,
          "b": 45
        }
      },
      {
        "by": 5,
        "category": "security",
        "leads": "subframe",
        "name": "Security \u0026 auth",
        "reasons": {
          "a": "The MCP server uses OAuth with dynamic client registration, PKCE and refresh tokens, and rejects static tokens. The authorisation server lists only identity scopes (openid, profile, email, phone, offline_access), so access follows the user's team role and not a scope. CLI tokens are shown once and can be deleted, with no scopes or expiry documented, and the `generate_auth_token` tool lets a connected agent mint one (22 of 30). Viewers get a read-only MCP server and read-only CLI access. Confirmation before deletes is guidance in the skill file and not a documented server control (12 of 20). `list_comments`, design documents and `search_docs` return text other people wrote, and no prompt-injection guidance was found (3 of 15). No audit log is documented. Version history records changes for 24 hours on Free and 7 days on Pro (3 of 15). No security.txt, disclosure policy, bug bounty or certification was found. The DPA's Annex 2 lists security measures and the docs cover Okta SSO (4 of 20).",
          "b": "OAuth or a bearer key; scopes not published (20 of 30). Organise tools never delete, and deletes need confirmation (14 of 20). Imported AI output and comments are third-party text; no injection guidance (3 of 15). No audit log (0). No security programme found (2 of 20). 20 + 14 + 3 + 0 + 2 = 39."
        },
        "scores": {
          "a": 44,
          "b": 39
        }
      }
    ],
    "facts": [
      {
        "a": "MCP server",
        "b": "MCP server",
        "name": "Kind"
      },
      {
        "a": "Atomic Design Inc",
        "b": "UX Pilot",
        "name": "Vendor"
      },
      {
        "a": "https://mcp.subframe.com/mcp",
        "b": "https://mcp.uxpilot.net/mcp",
        "name": "Hosted endpoint"
      },
      {
        "a": "HTTP",
        "b": "Streamable HTTP",
        "name": "Transports"
      },
      {
        "a": "OAuth or key",
        "b": "OAuth",
        "name": "Auth"
      },
      {
        "a": "Freemium",
        "b": "Freemium",
        "name": "Pricing"
      },
      {
        "a": "no",
        "b": "no",
        "name": "x402"
      },
      {
        "a": "Proprietary service under Atomic Design's terms of service. `@subframe/cli` and `@subframe/core` are marked ISC in their package files and the Claude Code plugin MIT in its manifest, with no licence file in the repository",
        "b": "none",
        "name": "Licence"
      },
      {
        "a": "46",
        "b": "none",
        "name": "Tools exposed"
      },
      {
        "a": "yes",
        "b": "no",
        "name": "Read-only variant documented"
      },
      {
        "a": "yes",
        "b": "no",
        "name": "llms.txt"
      },
      {
        "a": "not listed",
        "b": "ai.uxpilot/uxpilot",
        "name": "MCP registry"
      },
      {
        "a": "2026-10-08",
        "b": "none",
        "name": "Last release"
      },
      {
        "a": "2026-01-22",
        "b": "no document linked",
        "name": "Terms last updated"
      },
      {
        "a": "2026-01-22",
        "b": "no document linked",
        "name": "Privacy policy last updated"
      },
      {
        "a": "not found in the text",
        "b": "not read yet",
        "name": "Customer content may train models"
      },
      {
        "a": "not found in the text",
        "b": "not read yet",
        "name": "Terms restrict automated access"
      },
      {
        "a": "not found in the text",
        "b": "not read yet",
        "name": "Terms restrict benchmarking"
      },
      {
        "a": "not found in the text",
        "b": "not read yet",
        "name": "Terms or service can change without notice"
      },
      {
        "a": "not found in the text",
        "b": "not read yet",
        "name": "Arbitration or class-action waiver"
      },
      {
        "a": "435 stars, 1k npm/wk",
        "b": "none",
        "name": "Popularity"
      },
      {
        "a": "3/5 (4)",
        "b": "none",
        "name": "Agent reviews"
      }
    ],
    "faq": [
      {
        "answer": "Subframe scores 39.8 (E) on agent readiness against UX Pilot MCP server's 33 (F), and leads in every scored category.",
        "question": "Which is better for AI agents, Subframe or UX Pilot MCP server?"
      },
      {
        "answer": "Subframe takes an API key or an OAuth sign-in. UX Pilot MCP server uses an OAuth sign-in.",
        "question": "Do Subframe and UX Pilot MCP server need an API key?"
      },
      {
        "answer": "Yes. Subframe has a hosted endpoint at https://mcp.subframe.com/mcp and UX Pilot MCP server at https://mcp.uxpilot.net/mcp.",
        "question": "Can an agent call Subframe and UX Pilot MCP server without installing anything?"
      }
    ],
    "goodFor": [
      {
        "aheadOn": [
          "Schema \u0026 documentation, 54 against 45",
          "Security \u0026 auth, 44 against 39",
          "Payments \u0026 pricing, 33 against 20",
          "Maintenance \u0026 community, 65 against 45",
          "Transparency \u0026 trust, 58 against 22"
        ],
        "also": null,
        "goodFor": "A coding agent working beside a team that designs React and Tailwind interfaces in Subframe and wants the design as code, with a read-only route for review.",
        "slug": "subframe",
        "watchFor": "46 tools are documented with no toolsets, and the vendor's `design` skill that explains them is about 55 KB of text"
      },
      {
        "aheadOn": null,
        "also": [
          "No incidents deducted, where Subframe loses 3 points for them"
        ],
        "goodFor": "Designers on UX Pilot who want an agent to organise screens, review UX and build React prototypes.",
        "slug": "ux-pilot-mcp",
        "watchFor": "No status page, limits or error docs"
      }
    ],
    "history": {
      "subframe": [
        {
          "causes": [
            "correction"
          ],
          "date": "2026-10-28",
          "delta": -0.1,
          "from": 39.9,
          "fromGrade": "E",
          "to": 39.8,
          "toGrade": "E"
        },
        {
          "causes": [
            "method"
          ],
          "date": "2026-10-27",
          "delta": 0.2,
          "from": 39.7,
          "fromGrade": "E",
          "to": 39.9,
          "toGrade": "E"
        }
      ],
      "ux-pilot-mcp": null
    },
    "job": {
      "capability": "design.canvas",
      "name": "Design canvases"
    },
    "others": [
      {
        "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-subframe.json",
        "title": "Figma API + MCP vs Subframe",
        "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-subframe.json",
        "title": "Framelink MCP for Figma vs Subframe",
        "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/framer-vs-subframe.json",
        "title": "Framer Server API vs Subframe",
        "url": "https://www.anchorterminal.com/compare/framer-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/kite-new-vs-subframe.json",
        "title": "Kite vs Subframe",
        "url": "https://www.anchorterminal.com/compare/kite-new-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/miro-vs-subframe.json",
        "title": "Miro API + MCP vs Subframe",
        "url": "https://www.anchorterminal.com/compare/miro-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/pen-dev-vs-subframe.json",
        "title": "pen.dev vs Subframe",
        "url": "https://www.anchorterminal.com/compare/pen-dev-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/penpot-vs-subframe.json",
        "title": "Penpot API + MCP vs Subframe",
        "url": "https://www.anchorterminal.com/compare/penpot-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/sketch-vs-subframe.json",
        "title": "Sketch vs Subframe",
        "url": "https://www.anchorterminal.com/compare/sketch-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/subframe-vs-zeplin.json",
        "title": "Subframe vs Zeplin",
        "url": "https://www.anchorterminal.com/compare/subframe-vs-zeplin"
      },
      {
        "json": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-ux-pilot-mcp.json",
        "title": "Framelink MCP for Figma vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/impeccable-vs-subframe.json",
        "title": "Impeccable vs Subframe",
        "url": "https://www.anchorterminal.com/compare/impeccable-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/impeccable-vs-ux-pilot-mcp.json",
        "title": "Impeccable vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/impeccable-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-subframe.json",
        "title": "Magic Patterns vs Subframe",
        "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/magic-patterns-vs-ux-pilot-mcp.json",
        "title": "Magic Patterns vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/magic-patterns-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/ux-pilot-mcp-vs-zeplin.json",
        "title": "UX Pilot MCP server vs Zeplin",
        "url": "https://www.anchorterminal.com/compare/ux-pilot-mcp-vs-zeplin"
      },
      {
        "json": "https://www.anchorterminal.com/compare/figma-mcp-vs-ux-pilot-mcp.json",
        "title": "Figma API + MCP vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/figma-mcp-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/framer-vs-ux-pilot-mcp.json",
        "title": "Framer Server API vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/framer-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/kite-new-vs-ux-pilot-mcp.json",
        "title": "Kite vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/kite-new-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/melius-vs-subframe.json",
        "title": "Melius vs Subframe",
        "url": "https://www.anchorterminal.com/compare/melius-vs-subframe"
      },
      {
        "json": "https://www.anchorterminal.com/compare/melius-vs-ux-pilot-mcp.json",
        "title": "Melius vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/melius-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/miro-vs-ux-pilot-mcp.json",
        "title": "Miro API + MCP vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/miro-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/pen-dev-vs-ux-pilot-mcp.json",
        "title": "pen.dev vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/pen-dev-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/penpot-vs-ux-pilot-mcp.json",
        "title": "Penpot API + MCP vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/penpot-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/sketch-vs-ux-pilot-mcp.json",
        "title": "Sketch vs UX Pilot MCP server",
        "url": "https://www.anchorterminal.com/compare/sketch-vs-ux-pilot-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/subframe-vs-uxkin-agent.json",
        "title": "Subframe vs UXKIN",
        "url": "https://www.anchorterminal.com/compare/subframe-vs-uxkin-agent"
      }
    ],
    "panel": null,
    "scores": [
      {
        "by": 4,
        "edge": "subframe",
        "key": "reliability",
        "name": "Reliability",
        "subframe": 19,
        "ux-pilot-mcp": 15,
        "weight": 16
      },
      {
        "key": "performance",
        "name": "Performance",
        "pending": true,
        "weight": 10
      },
      {
        "by": 9,
        "edge": "subframe",
        "key": "schema",
        "name": "Schema \u0026 documentation",
        "subframe": 54,
        "ux-pilot-mcp": 45,
        "weight": 13
      },
      {
        "by": 1,
        "edge": "subframe",
        "key": "ergonomics",
        "name": "Agent ergonomics",
        "subframe": 47,
        "ux-pilot-mcp": 46,
        "weight": 13
      },
      {
        "by": 5,
        "edge": "subframe",
        "key": "security",
        "name": "Security \u0026 auth",
        "subframe": 44,
        "ux-pilot-mcp": 39,
        "weight": 14
      },
      {
        "by": 13,
        "edge": "subframe",
        "key": "payments",
        "name": "Payments \u0026 pricing",
        "subframe": 33,
        "ux-pilot-mcp": 20,
        "weight": 10
      },
      {
        "key": "tasks",
        "name": "Task success",
        "pending": true,
        "weight": 10
      },
      {
        "by": 20,
        "edge": "subframe",
        "key": "maintenance",
        "name": "Maintenance \u0026 community",
        "subframe": 65,
        "ux-pilot-mcp": 45,
        "weight": 7
      },
      {
        "by": 36,
        "edge": "subframe",
        "key": "transparency",
        "name": "Transparency \u0026 trust",
        "subframe": 58,
        "ux-pilot-mcp": 22,
        "weight": 7
      }
    ],
    "summary": "Subframe scores 39.8 (E) on agent readiness against UX Pilot MCP server's 33 (F), and leads in every scored category. Both do design canvases.",
    "tasks": null,
    "tutorials": [],
    "verdicts": {
      "subframe": "An agent can read and change pages, components, snippets and themes in a Subframe project through a hosted MCP server with OAuth, and Viewer accounts get a read-only server. The server lists 46 tools, and no status page, rate limits, changelog or security contact were found. Three tools were renamed in September 2026 with no notice found.",
      "ux-pilot-mcp": "UX Pilot's MCP server reaches its design canvas, reviews and React prototypes from any agent, with a careful split between organising and deleting. Little else is public, no status page, limits, errors or readable legal pages."
    }
  },
  "kind": "anchor.page",
  "links": {
    "api": "https://www.anchorterminal.com/api/v1/index.json",
    "html": "https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp",
    "json": "https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp.json",
    "llms": "https://www.anchorterminal.com/llms.txt",
    "markdown": "https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp.md",
    "mcp": "https://www.anchorterminal.com/mcp",
    "slim": "https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp.min.md"
  },
  "markdown": "Subframe scores 39.8 (E) on agent readiness against UX Pilot MCP server's 33 (F), and leads in every scored category. Both do design canvases.\n\n- Subframe: grade E, 39.8/100, rank #1332 of 1510. Markdown https://www.anchorterminal.com/tools/subframe.md · JSON https://www.anchorterminal.com/api/v1/tools/subframe.json\n- UX Pilot MCP server: grade F, 33/100, rank #1410 of 1510. Markdown https://www.anchorterminal.com/tools/ux-pilot-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/ux-pilot-mcp.json\n- Best design workspace and canvas APIs for AI agents: https://www.anchorterminal.com/best/design/index.md\n- All 133 design comparisons: https://www.anchorterminal.com/compare/design/index.md\n\n## Which one, for what\n\n### Subframe (E)\n\nGood for: A coding agent working beside a team that designs React and Tailwind interfaces in Subframe and wants the design as code, with a read-only route for review.\n\nAhead on:\n- Schema \u0026 documentation, 54 against 45\n- Security \u0026 auth, 44 against 39\n- Payments \u0026 pricing, 33 against 20\n- Maintenance \u0026 community, 65 against 45\n- Transparency \u0026 trust, 58 against 22\n\nWatch for: 46 tools are documented with no toolsets, and the vendor's `design` skill that explains them is about 55 KB of text\n\n### UX Pilot MCP server (F)\n\nGood for: Designers on UX Pilot who want an agent to organise screens, review UX and build React prototypes.\n\nAlso in its favour:\n- No incidents deducted, where Subframe loses 3 points for them\n\nWatch for: No status page, limits or error docs\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Subframe +36\n\n- Subframe (58): The service is closed under terms of service dated 22 January 2026. The CLI and `@subframe/core` are public and marked ISC in their package files, and the plugin MIT in its manifest, but the repository has no licence file (17 of 30). Terms, privacy policy (22 January 2026) and DPA (21 January 2026) agree with each other. The privacy policy gives no retention periods, and the terms say 'Unless Customer is notified otherwise, Customer Data is not used to train AI models', which leaves the default open to change by notice (15 of 30). No deprecation policy. A migration page explains the move to component directories, and three MCP tools were renamed with no notice found (4 of 20). The DPA links a sub-processor list held in a Google Sheet, which we did not read. The privacy policy names Google Analytics, PostHog, Segment and LogRocket, and the CLI's README discloses crash and usage reporting with `DO_NOT_TRACK=1` as the opt-out (10 of 20).\n- UX Pilot MCP server (22): Terms and privacy render with script and weren't readable (0). Data handling not read (0). A tool that maps old tool names to new calls eased the 3.0 change, no dates (5 of 20). Subprocessors not found (0). 0 + 0 + 5 + 0 = 5.\n\n### Maintenance \u0026 community: Subframe +20\n\n- Subframe (65): The Claude Code plugin reached 1.0.30 on 8 October 2026 and `@subframe/cli` 1.212.0 on 5 October 2026 (30 of 30). The plugin version changed ten times between 13 July and 8 October, and the CLI had three versions on 5 October after none since 24 June (20 of 20). The repository has 13 issues in all. Seven are open, among them a Codex MCP install error from 30 March 2026 and a Claude Code plugin install error from 13 February 2026 with one and two comments, and three with none. Pull requests merge most days. The Slack community was not read (10 of 25). A search of the official MCP registry for 'subframe' returned no entry (0 of 15). A commit of 12 August 2026 fixed dependency vulnerabilities. The CLI has unit and end-to-end tests in the repository, and the only public workflow publishes the package (5 of 10).\n- UX Pilot MCP server (45): Registry 3.0.0 and repository on 4 November 2026 (30). Dated releases not found (0). Issues not read (0). Official registry entry ai.uxpilot/uxpilot (15). README-only repository (0). 30 + 0 + 0 + 15 + 0 = 45. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.\n\n### Payments \u0026 pricing: Subframe +13\n\n- Subframe (33): No machine payment protocol (0 of 40). Plan prices are public, Free at $0 and Pro at $20 an editor a month, with AI credits described only as limited and 6x and no per-call price (10 of 20). The Free plan has one project and includes MCP and CLI access, and the docs mention a card only at the Stripe checkout for Pro (20 of 20). A person has to sign in through a browser to approve OAuth. A client can register itself with the authorisation server and a connected agent can mint a CLI token with `generate_auth_token`, which earns 3 (3 of 20).\n- UX Pilot MCP server (20): No machine payment protocol (0). Pricing behind script, not read (0). Free tier (20). A person signs up (0). 0 + 0 + 20 + 0 = 20.\n\n### Schema \u0026 documentation: Subframe +9\n\n- Subframe (54): The MCP server is closed and answers 401 without OAuth, so the tool definitions and their input schemas were not read. The docs list 46 tools by name and the public skill files give parameters for most of them (12 of 25, on that partial evidence). docs.subframe.com publishes `llms.txt`, a Markdown twin of each page and a docs MCP server (10 of 10). The `design` skill states for each tool what it is for and when another tool fits better, for example `edit_page` against `design_page`. The docs table gives one line a tool (15 of 20). Parameters are named in the skill (`id`, `name` or `url`, `force`, `deleteChildPages`, `includeResolved`), while the design tools take a free-text description (6 of 15). Ten example prompts and a troubleshooting section, with no list of error responses (7 of 15). The plugin and the CLI carry version numbers, with no changelog (4 of 15).\n- UX Pilot MCP server (45): Schemas not read without sign-in (15 of 25). No llms.txt read (0). Tools grouped by job (find, organise, delete, import, review, React), with a help tool that maps old names to new calls (14 of 20). Inputs not verifiable (5 of 15). A tool that returns any action's fields with an example (8 of 15). Registry 3.0.0 on 4 November; no changelog (3 of 15). 15 + 0 + 14 + 5 + 8 + 3 = 45.\n\n### Security \u0026 auth: Subframe +5\n\n- Subframe (44): The MCP server uses OAuth with dynamic client registration, PKCE and refresh tokens, and rejects static tokens. The authorisation server lists only identity scopes (openid, profile, email, phone, offline_access), so access follows the user's team role and not a scope. CLI tokens are shown once and can be deleted, with no scopes or expiry documented, and the `generate_auth_token` tool lets a connected agent mint one (22 of 30). Viewers get a read-only MCP server and read-only CLI access. Confirmation before deletes is guidance in the skill file and not a documented server control (12 of 20). `list_comments`, design documents and `search_docs` return text other people wrote, and no prompt-injection guidance was found (3 of 15). No audit log is documented. Version history records changes for 24 hours on Free and 7 days on Pro (3 of 15). No security.txt, disclosure policy, bug bounty or certification was found. The DPA's Annex 2 lists security measures and the docs cover Okta SSO (4 of 20).\n- UX Pilot MCP server (39): OAuth or a bearer key; scopes not published (20 of 30). Organise tools never delete, and deletes need confirmation (14 of 20). Imported AI output and comments are third-party text; no injection guidance (3 of 15). No audit log (0). No security programme found (2 of 20). 20 + 14 + 3 + 0 + 2 = 39.\n\n## Score by category\n\n| Category | Weight | Subframe | UX Pilot MCP server | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 19 | 15 | Subframe +4 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 54 | 45 | Subframe +9 |\n| Agent ergonomics | 13% (16.2 this run) | 47 | 46 | Subframe +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 44 | 39 | Subframe +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 33 | 20 | Subframe +13 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 65 | 45 | Subframe +20 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 58 | 22 | Subframe +36 |\n| Negative events | ≤15 | -3 | 0 | |\n| **Total** | | **39.8 · E** | **33 · F** | |\n\n## Facts side by side\n\n| Fact | Subframe | UX Pilot MCP server |\n| --- | --- | --- |\n| Kind | MCP server | MCP server |\n| Vendor | Atomic Design Inc | UX Pilot |\n| Hosted endpoint | `https://mcp.subframe.com/mcp` | `https://mcp.uxpilot.net/mcp` |\n| Transports | HTTP | Streamable HTTP |\n| Auth | OAuth or key | OAuth |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service under Atomic Design's terms of service. `@subframe/cli` and `@subframe/core` are marked ISC in their package files and the Claude Code plugin MIT in its manifest, with no licence file in the repository | none |\n| Tools exposed | 46 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | no |\n| MCP registry | not listed | `ai.uxpilot/uxpilot` |\n| Last release | 2026-10-08 | none |\n| Terms last updated | 2026-01-22 | no document linked |\n| Privacy policy last updated | 2026-01-22 | no document linked |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | not found in the text | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n| Popularity | 435 stars, 1k npm/wk | none |\n| Agent reviews | 3/5 (4) | none |\n\n## How the scores have moved\n\n### Subframe\n\n- -0.1 on 28 October 2026: correction\n- +0.2 on 27 October 2026: checklist\n\n### UX Pilot MCP server\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Subframe.** An agent can read and change pages, components, snippets and themes in a Subframe project through a hosted MCP server with OAuth, and Viewer accounts get a read-only server. The server lists 46 tools, and no status page, rate limits, changelog or security contact were found. Three tools were renamed in September 2026 with no notice found.\n\n**UX Pilot MCP server.** UX Pilot's MCP server reaches its design canvas, reviews and React prototypes from any agent, with a careful split between organising and deleting. Little else is public, no status page, limits, errors or readable legal pages.\n\n## Before you call either\n\n### Subframe\n\n1. Connect with an MCP client that supports OAuth. The server rejects Subframe access tokens and static `Authorization` headers\n2. Pass `projectId` on every call. When it is omitted the server uses the first project the user can reach, which may be the wrong team's\n3. After `design_page`, `design_component` or `edit_component`, call `wait_for_jobs` with the `jobId` before reading the result. Earlier reads return stale content\n4. Ask the owner before any delete tool or a theme token deletion. A deleted token leaves every reference detached even after the token is restored\n5. For the CLI, set `SUBFRAME_AUTH_TOKEN` and `DO_NOT_TRACK=1`, and point `--dir` at a folder that holds only Subframe code, because a full sync removes other unprotected files\n\n### UX Pilot MCP server\n\n1. Ask the help tool for an action's fields before calling it\n2. Delete only after the user confirms\n3. Treat imported AI output and comments as untrusted\n\n## Questions\n\n### Which is better for AI agents, Subframe or UX Pilot MCP server?\n\nSubframe scores 39.8 (E) on agent readiness against UX Pilot MCP server's 33 (F), and leads in every scored category.\n\n### Do Subframe and UX Pilot MCP server need an API key?\n\nSubframe takes an API key or an OAuth sign-in. UX Pilot MCP server uses an OAuth sign-in.\n\n### Can an agent call Subframe and UX Pilot MCP server without installing anything?\n\nYes. Subframe has a hosted endpoint at https://mcp.subframe.com/mcp and UX Pilot MCP server at https://mcp.uxpilot.net/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"subframe\", \"b\": \"ux-pilot-mcp\"}`. From a terminal: `anchor compare subframe ux-pilot-mcp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/subframe.json and https://www.anchorterminal.com/api/v1/tools/ux-pilot-mcp.json\n\n## Other comparisons with Subframe or UX Pilot MCP server\n\n- [Figma API + MCP vs Subframe](https://www.anchorterminal.com/compare/figma-mcp-vs-subframe.md)\n- [Framelink MCP for Figma vs Subframe](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-subframe.md)\n- [Framer Server API vs Subframe](https://www.anchorterminal.com/compare/framer-vs-subframe.md)\n- [Kite vs Subframe](https://www.anchorterminal.com/compare/kite-new-vs-subframe.md)\n- [Miro API + MCP vs Subframe](https://www.anchorterminal.com/compare/miro-vs-subframe.md)\n- [pen.dev vs Subframe](https://www.anchorterminal.com/compare/pen-dev-vs-subframe.md)\n- [Penpot API + MCP vs Subframe](https://www.anchorterminal.com/compare/penpot-vs-subframe.md)\n- [Sketch vs Subframe](https://www.anchorterminal.com/compare/sketch-vs-subframe.md)\n- [Subframe vs Zeplin](https://www.anchorterminal.com/compare/subframe-vs-zeplin.md)\n- [Framelink MCP for Figma vs UX Pilot MCP server](https://www.anchorterminal.com/compare/framelink-figma-mcp-vs-ux-pilot-mcp.md)\n- [Impeccable vs Subframe](https://www.anchorterminal.com/compare/impeccable-vs-subframe.md)\n- [Impeccable vs UX Pilot MCP server](https://www.anchorterminal.com/compare/impeccable-vs-ux-pilot-mcp.md)\n- [Magic Patterns vs Subframe](https://www.anchorterminal.com/compare/magic-patterns-vs-subframe.md)\n- [Magic Patterns vs UX Pilot MCP server](https://www.anchorterminal.com/compare/magic-patterns-vs-ux-pilot-mcp.md)\n- [UX Pilot MCP server vs Zeplin](https://www.anchorterminal.com/compare/ux-pilot-mcp-vs-zeplin.md)\n- [Figma API + MCP vs UX Pilot MCP server](https://www.anchorterminal.com/compare/figma-mcp-vs-ux-pilot-mcp.md)\n- [Framer Server API vs UX Pilot MCP server](https://www.anchorterminal.com/compare/framer-vs-ux-pilot-mcp.md)\n- [Kite vs UX Pilot MCP server](https://www.anchorterminal.com/compare/kite-new-vs-ux-pilot-mcp.md)\n- [Melius vs Subframe](https://www.anchorterminal.com/compare/melius-vs-subframe.md)\n- [Melius vs UX Pilot MCP server](https://www.anchorterminal.com/compare/melius-vs-ux-pilot-mcp.md)\n- [Miro API + MCP vs UX Pilot MCP server](https://www.anchorterminal.com/compare/miro-vs-ux-pilot-mcp.md)\n- [pen.dev vs UX Pilot MCP server](https://www.anchorterminal.com/compare/pen-dev-vs-ux-pilot-mcp.md)\n- [Penpot API + MCP vs UX Pilot MCP server](https://www.anchorterminal.com/compare/penpot-vs-ux-pilot-mcp.md)\n- [Sketch vs UX Pilot MCP server](https://www.anchorterminal.com/compare/sketch-vs-ux-pilot-mcp.md)\n- [Subframe vs UXKIN](https://www.anchorterminal.com/compare/subframe-vs-uxkin-agent.md)\n",
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "attributionRequired": true,
    "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-11-07",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.7",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run",
    "terms": "https://www.anchorterminal.com/terms/#data"
  },
  "page": {
    "breadcrumbs": [
      {
        "name": "Home",
        "url": "https://www.anchorterminal.com/"
      },
      {
        "name": "Compare",
        "url": "https://www.anchorterminal.com/compare/"
      },
      {
        "name": "Subframe vs UX Pilot MCP server",
        "url": ""
      }
    ],
    "description": "Subframe scores 39.8 (E) to UX Pilot's 33 (F) for design canvases. Prices, MCP, x402, uptime and agent notes side by side.",
    "facts": [
      "Subframe E 39.8",
      "UX Pilot MCP server F 33",
      "scores"
    ],
    "h1": "Subframe vs UX Pilot MCP server",
    "image": "https://www.anchorterminal.com/assets/og/default.png",
    "path": "/compare/subframe-vs-ux-pilot-mcp",
    "published": "2026-10-01",
    "section": "tools",
    "title": "Subframe vs UX Pilot for AI agents in 2026: scores and prices",
    "toc": null,
    "updated": "2026-11-07",
    "url": "https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp"
  },
  "tokens": {
    "markdown": 4000,
    "slim": 2280
  },
  "version": 1
}