BCMS vs ButterCMS

BCMS 15

Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.

ButterCMS 82

Graded on the hosted Read and Write APIs. Public status page on Atlassian Statuspage with CDN, API and Login Page components and a history feed (20). The feed's newest incidents are two on 20 October 2025, so the 90 days to 4 November 2026 are clean (30). Limits are published as monthly quotas by plan, from 50,000 calls on Free to 1M on Professional, with 2,000 or 5,000 write calls on the add-on. No per-second limit is published (10 of 15, a partial kept from the 9 October check). Free and trial accounts get a 429 that the docs say may carry Retry-After, the docs show exponential backoff for 5xx errors, and the bulk-operations page says to check whether content exists before creating it to avoid duplicates during retries. There are no idempotency keys, so safe-retry guidance without keys (12). The pricing page lists an SLA on Enterprise with no SLA document or figure, which this run reads as 0. The v2 API is generally available (10).

BCMS 50

The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.

ButterCMS 78

Public OpenAPI 3.1 files for the whole API, the Read API, the Write API and webhooks, linked from the docs index. The combined file has 28 operations on 4 November 2026, 18 reads and 10 writes (25). A docs llms.txt and a Markdown copy of every docs page (10). All operations have a description, and the write descriptions state field rules, defaults and what the API cannot do. The docs say when to use an SDK and when to call REST (16 of 20). Request bodies have required fields and 40 enums in the combined file, but the fields object depends on each account's page types and no endpoint returns those types (9 of 15). 328 examples in the combined file and a page of status codes with causes and sample bodies (13 of 15). The version is in the /v2 path. No API changelog was found (5 of 15).

BCMS 36

45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.

ButterCMS 64

Responses are sized with page_size, a fields selection, exclude_body on posts and levels for reference depth (20 of 25). Page and offset pagination with meta.count, filters on field values and order (20). Errors are documented with causes, but bodies come in three shapes (detail, a field map, error) with no stable codes, and a write answers 202 with status: pending and no identifier, so the result has to be read back (11 of 20). No idempotency keys. Page and post slugs are unique, which limits duplicates, and collection items have no such guard (4 of 20). Writes default to draft, but page creation needs every field key of the page type. Ten SDKs are listed and the docs say to call REST for writes (9 of 15).

BCMS 30

No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.

ButterCMS 20

No x402, MPP or L402 (0). Four plans have public dollar prices, the Write API add-on's price is not published and Enterprise is through sales (10). The Free plan needs no card and covers the Read API. Writing needs a paid plan and the add-on, and we did not establish whether the 14-day trial includes it (10 of 20). A person signs up in a browser, and the write token needs a purchase or a request to support (0).

BCMS 39

Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as ?mcpKey= in the URL and REST examples pass apiKey the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.

ButterCMS 31

One read token and one write token per account, with no scopes, and the docs say rotation is done by contacting support (20 for plain revocable keys, less the fixed 10 because the read token is documented as an auth_token query parameter, 10 of 30). That token also returns drafts with preview=1. The read token is a read-only credential and writes default to draft. No approval step for API writes was found, and approval workflows are listed on Enterprise (10 of 20). The API returns stored content, and no guidance on treating it as untrusted input was found (3 of 15). Audit logs and access logs are listed as Enterprise functions, and versions record who saved them (6 of 15). A responsible-disclosure section in the docs gives security@buttercms.com and says reports get a prompt response, with no stated time, and the security page describes penetration tests. No security.txt, no bug bounty, and the certifications listed are those of the AWS and Heroku data centres (7 of 20).