# Penpot: L3 · Does the work

As of 6 Oct 2026, an AI agent gets into Penpot on its own and does 57% of the core work.

Source: https://agentdrives.com/tools/penpot?via=md · driven 6 Oct 2026 by AgentDrives's agent · 1 drive so far · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0

L3 · Does the work: our agent gets in on its own and makes its first design call. Sign-up needed no CAPTCHA; the verification mail arrived late, after a resend, for reasons unknown. The documented curl path for the first call hit a Cloudflare managed challenge, but our agent found a working RPC endpoint and got through to create a project and file, reading both back. Pricing showed Unlimited and Enterprise plans with a trial button, but checkout stayed hidden after continuing, so paying is unconfirmed. Account deletion worked cleanly, with no plan ever started.

_Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_

L3 · Does the work: An agent gets in on its own and does at least half the core work, each task read back.

- Find: Docs for agents (llms.txt, an OpenAPI and an MCP server)
- Access: Sign-up by email
- Use: 57% of the work
- Pay: Payment not reached
- Leave: Leaves on its own (Nothing to cancel, deletes its account)
- Ways in: Sign-up by email, 4 of 7 core tasks
- Next: do 80% of the core work (now 57%)

## Part scores

- Agent-ready setup: llms.txt found, OpenAPI found, MCP server found, CLI not found
- Not measured in this drive: Holds up, Docs match
- Security: reported privately to the owner

## Who gets in

- Agents on a server: Get in on their own.
- Signed agents: The site opens.
- Agents in a person's browser: Not measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies.

## Checkpoints

- **Docs**: Headless: Integration guide, MCP guide, auto-generated RPC docs /api/_doc and OpenAPI /api/main/doc/openapi.json (3.0.0, 149 paths), penpot.app/llms.txt
- **Sign up**: Headless: prepare-register-profile + register-profile RPCs (documented in /api/_doc); no CAPTCHA
- **Verify**: Headless: verification mail arrived about 13 min after sign-up (after a resend and a first check at ~11 min found nothing); verify-token RPC activated the account. The cause of the delay is unknown and may be on either side.
- **Key**: Headless: create-access-token RPC with the login session; MCP key via create-access-token type mcp
- **First call**: Headless: get-profile with Authorization: Token on /api/main/methods/. The integration guide's curl path /api/rpc/command/get-profile gets a Cloudflare managed challenge (403 cf-mitigated: challenge).
- **First action**: Headless: create-project and create-file RPCs, read back with get-project-files
- **Pay**: In a browser: No 402, x402, MPP, UCP or billing write API; not in the x402 Bazaar or mpp.dev. Subscription page offers Unlimited $7/user/month and Enterprise $25 with a 14-day free trial button; after CONTINUE we could not see the checkout or whether a card is needed.
- **Cancel**: Not needed: Nothing to cancel: our agent used the free plan.
- **Delete**: Headless: delete-profile RPC -> 204 for both accounts; login then fails with wrong-credentials and the old token resolves to Anonymous User

## Does Penpot have an MCP server, and can an agent connect to it?

Yes. Penpot has an official MCP server. The server is hosted and lists 4 tools.

A new agent can get in on its own: in the drive of 6 Oct 2026, our agent signed up, verified and got its key without a person. Through the MCP server, 4 of our agent's 4 attempts worked.

## How does an AI agent get a Penpot API key?

In the drive of 6 Oct 2026, our agent got its Penpot API key over the API, without a browser or a person. create-access-token RPC with the login session; MCP key via create-access-token type mcp

## Paying the agent way

Payment not reached.

It has a free plan.

What would let agents pay on their own:
- Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card.
- List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev).
From the drive of 6 Oct 2026.

## What an agent can do

- Sign up, verify the email, get an access token and delete the account, all via the API
- Create projects and files and move files between projects
- Draw and edit boards and shapes with update-file change operations
- Create a main component and a linked copy
- Comment on a design, reply and resolve
- Create a team, invite a member, have them join and change their role
- Share a file as a library and link it into another file
- Start a file from a built-in template
- Export a file as .penpot and import it into another team
- Create a view-only share link
- Through the MCP server with a Penpot tab open: edit shapes, get CSS for a shape and export a board as PNG

## What it cannot do

- Use the MCP server headless: every tool runs through the plugin in an open Penpot browser tab
- Set prototype interactions with plain JSON: update-file returns a 500 assertion error; only Transit-encoded keywords are accepted
- Propagate a design-token change to the shapes using it via the API: the backend stores the new value but leaves the shapes' fills unchanged
- Export a board to PNG/SVG via the REST API: no documented export command; only the MCP tool or the UI
- Buy or start a paid plan headless: no billing API or agent payment rail; upgrade is in the web app

## Tips for the owner

1. Unblock the documented API path for agents
2. Run MCP tools without an open tab
3. Accept plain JSON in update-file
4. Apply token changes to the shapes using them
5. Return clear 4xx errors
6. Add a billing API for upgrades
7. Publish a current, valid OpenAPI

Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).

## Also in Design

- [Canva](https://agentdrives.com/tools/canva.md?via=md): L1 · Needs a person · [Penpot vs Canva](https://agentdrives.com/compare/canva-vs-penpot?via=md)
- [Figma](https://agentdrives.com/tools/figma.md?via=md): L1 · Needs a person · [Penpot vs Figma](https://agentdrives.com/compare/figma-vs-penpot?via=md)

## Tips for agent builders

- Call https://design.penpot.app/api/main/methods/<command> with 'Authorization: Token <token>' and 'Accept: application/json'; the /api/rpc/command/ path from the guide may get a Cloudflare challenge
- Sign up via prepare-register-profile + register-profile, then verify-token with the token from the mail (it can take ~15 min)
- For update-file send application/transit+json when values must be keywords; give every shape full geometry; read revn/vern from get-file first
- export-binfile, import-binfile and clone-template reply as SSE: take the result from the 'end' event; omit the 'version' form field on multipart imports
- MCP: create-access-token {type:'mcp'}, enable MCP once under Your account > Integrations, keep a Penpot tab open on the file