# Subframe vs UX Pilot MCP server (slim)

> Subframe scores 39.8 (E) to UX Pilot's 33 (F) for design canvases. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp.md (~4,000 tokens) · this version ~2,280 tokens · JSON https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp.json · canonical https://www.anchorterminal.com/compare/subframe-vs-ux-pilot-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Subframe scores 39.8 (E) on agent readiness against UX Pilot MCP server's 33 (F), and leads in every scored category. Both do design canvases.

- Subframe: E 39.8, rank #1332 of 1510 · https://www.anchorterminal.com/tools/subframe.min.md
- UX Pilot MCP server: F 33, rank #1410 of 1510 · https://www.anchorterminal.com/tools/ux-pilot-mcp.min.md
- Subframe, good for A coding agent working beside a team that designs React and Tailwind interfaces in Subframe and wants the design as code, with a read-only route for review. Ahead on Schema & documentation, 54 against 45; Security & auth, 44 against 39; Payments & pricing, 33 against 20; Maintenance & community, 65 against 45; Transparency & trust, 58 against 22.
- UX Pilot MCP server, good for Designers on UX Pilot who want an agent to organise screens, review UX and build React prototypes. Also No incidents deducted, where Subframe loses 3 points for them.

| Category | Subframe | UX Pilot MCP server |
| --- | --- | --- |
| Reliability (16%) | 19 | 15 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 54 | 45 |
| Agent ergonomics (13%) | 47 | 46 |
| Security & auth (14%) | 44 | 39 |
| Payments & pricing (10%) | 33 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 65 | 45 |
| Transparency & trust (7%) | 58 | 22 |

| Fact (where they differ) | Subframe | UX Pilot MCP server |
| --- | --- | --- |
| Vendor | Atomic Design Inc | UX Pilot |
| Hosted endpoint | `https://mcp.subframe.com/mcp` | `https://mcp.uxpilot.net/mcp` |
| Transports | HTTP | Streamable HTTP |
| Auth | OAuth or key | OAuth |
| Licence | Proprietary service under Atomic Design's terms of service. `@subframe/cli` and `@subframe/core` are marked ISC in their package files and the Claude Code plugin MIT in its manifest, with no licence file in the repository | none |
| Tools exposed | 46 | none |
| Read-only variant documented | yes | no |
| llms.txt | yes | no |
| MCP registry | not listed | `ai.uxpilot/uxpilot` |
| Last release | 2026-10-08 | none |
| Terms last updated | 2026-01-22 | no document linked |
| Privacy policy last updated | 2026-01-22 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 435 stars, 1k npm/wk | none |
| Agent reviews | 3/5 (4) | none |

Why the edge:
- Transparency & trust, Subframe +36: Subframe 58 (The service is closed under terms of service dated 22 January 2026. The CLI and `@subframe/core` are public and marked ISC in their package files, and the plugin MIT in its manifest, but the repository has no licence file (17 of 30). Terms, privacy policy (22 January 2026) and DPA (21 January 2026) agree with each other. The privacy policy gives no retention periods, and the terms say 'Unless Customer is notified otherwise, Customer Data is not used to train AI models', which leaves the default open to change by notice (15 of 30). No deprecation policy. A migration page explains the move to component directories, and three MCP tools were renamed with no notice found (4 of 20). The DPA links a sub-processor list held in a Google Sheet, which we did not read. The privacy policy names Google Analytics, PostHog, Segment and LogRocket, and the CLI's README discloses crash and usage reporting with `DO_NOT_TRACK=1` as the opt-out (10 of 20).); UX Pilot MCP server 22 (Terms and privacy render with script and weren't readable (0). Data handling not read (0). A tool that maps old tool names to new calls eased the 3.0 change, no dates (5 of 20). Subprocessors not found (0). 0 + 0 + 5 + 0 = 5.)
- Maintenance & community, Subframe +20: Subframe 65 (The Claude Code plugin reached 1.0.30 on 8 October 2026 and `@subframe/cli` 1.212.0 on 5 October 2026 (30 of 30). The plugin version changed ten times between 13 July and 8 October, and the CLI had three versions on 5 October after none since 24 June (20 of 20). The repository has 13 issues in all. Seven are open, among them a Codex MCP install error from 30 March 2026 and a Claude Code plugin install error from 13 February 2026 with one and two comments, and three with none. Pull requests merge most days. The Slack community was not read (10 of 25). A search of the official MCP registry for 'subframe' returned no entry (0 of 15). A commit of 12 August 2026 fixed dependency vulnerabilities. The CLI has unit and end-to-end tests in the repository, and the only public workflow publishes the package (5 of 10).); UX Pilot MCP server 45 (Registry 3.0.0 and repository on 4 November 2026 (30). Dated releases not found (0). Issues not read (0). Official registry entry ai.uxpilot/uxpilot (15). README-only repository (0). 30 + 0 + 0 + 15 + 0 = 45. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.)
- Payments & pricing, Subframe +13: Subframe 33 (No machine payment protocol (0 of 40). Plan prices are public, Free at $0 and Pro at $20 an editor a month, with AI credits described only as limited and 6x and no per-call price (10 of 20). The Free plan has one project and includes MCP and CLI access, and the docs mention a card only at the Stripe checkout for Pro (20 of 20). A person has to sign in through a browser to approve OAuth. A client can register itself with the authorisation server and a connected agent can mint a CLI token with `generate_auth_token`, which earns 3 (3 of 20).); UX Pilot MCP server 20 (No machine payment protocol (0). Pricing behind script, not read (0). Free tier (20). A person signs up (0). 0 + 0 + 20 + 0 = 20.)
- Schema & documentation, Subframe +9: Subframe 54 (The MCP server is closed and answers 401 without OAuth, so the tool definitions and their input schemas were not read. The docs list 46 tools by name and the public skill files give parameters for most of them (12 of 25, on that partial evidence). docs.subframe.com publishes `llms.txt`, a Markdown twin of each page and a docs MCP server (10 of 10). The `design` skill states for each tool what it is for and when another tool fits better, for example `edit_page` against `design_page`. The docs table gives one line a tool (15 of 20). Parameters are named in the skill (`id`, `name` or `url`, `force`, `deleteChildPages`, `includeResolved`), while the design tools take a free-text description (6 of 15). Ten example prompts and a troubleshooting section, with no list of error responses (7 of 15). The plugin and the CLI carry version numbers, with no changelog (4 of 15).); UX Pilot MCP server 45 (Schemas not read without sign-in (15 of 25). No llms.txt read (0). Tools grouped by job (find, organise, delete, import, review, React), with a help tool that maps old names to new calls (14 of 20). Inputs not verifiable (5 of 15). A tool that returns any action's fields with an example (8 of 15). Registry 3.0.0 on 4 November; no changelog (3 of 15). 15 + 0 + 14 + 5 + 8 + 3 = 45.)
- Security & auth, Subframe +5: Subframe 44 (The MCP server uses OAuth with dynamic client registration, PKCE and refresh tokens, and rejects static tokens. The authorisation server lists only identity scopes (openid, profile, email, phone, offline_access), so access follows the user's team role and not a scope. CLI tokens are shown once and can be deleted, with no scopes or expiry documented, and the `generate_auth_token` tool lets a connected agent mint one (22 of 30). Viewers get a read-only MCP server and read-only CLI access. Confirmation before deletes is guidance in the skill file and not a documented server control (12 of 20). `list_comments`, design documents and `search_docs` return text other people wrote, and no prompt-injection guidance was found (3 of 15). No audit log is documented. Version history records changes for 24 hours on Free and 7 days on Pro (3 of 15). No security.txt, disclosure policy, bug bounty or certification was found. The DPA's Annex 2 lists security measures and the docs cover Okta SSO (4 of 20).); UX Pilot MCP server 39 (OAuth or a bearer key; scopes not published (20 of 30). Organise tools never delete, and deletes need confirmation (14 of 20). Imported AI output and comments are third-party text; no injection guidance (3 of 15). No audit log (0). No security programme found (2 of 20). 20 + 14 + 3 + 0 + 2 = 39.)