{ "data": { "a": { "slug": "bcms", "name": "BCMS", "vendor": "Becomes tech, LLC", "vendorUrl": "https://www.thebcms.com", "kind": "http-api", "category": "cms", "summary": "BCMS is a hosted headless CMS from Becomes tech, LLC. People edit structured content in a dashboard, and agents work with templates, entries, media and languages through a REST API, a JavaScript client, a CLI and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/bcms", "markdownUrl": "https://www.anchorterminal.com/tools/bcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bcms.json", "dns": "bcms.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.thebcms.com/api/v3/mcp", "packages": [ { "registry": "npm", "name": "@thebcms/client" } ], "auth": "api-key", "authNotes": "Three-part keys (keyId.secret.instanceId) created in the dashboard and scoped to templates and media, with schema tools only for keys allowed them. The MCP endpoint takes the key only as the `mcpKey` query parameter, and the REST examples pass `apiKey` in the query string. The docs advise a key per person, client and environment and regular rotation.", "pricing": "paid", "pricingNotes": "Hobby $5 a month ($4 billed yearly) with 2 seats, 100 entries and 500 MB of media; Pro $50 a month ($33 yearly) with 5 seats, then $15 a seat a month, and unlimited entries; Enterprise by quote. Every plan starts with a 14-day free trial with no card. No self-hosted edition.", "priceSummary": "$5 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the docs, the MCP page or pricing.md (checked 2026-11-06).", "endpoints": [] }, "toolCount": 45, "popularity": { "githubStars": null, "npmWeekly": 396, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.thebcms.com/docs", "llmsTxt": "https://www.thebcms.com/llms.txt", "capabilities": [ "cms.content", "cms.assets", "cms.localisation", "cms.schema", "cms.publish" ], "tags": [ "hosted", "mcp", "remote-mcp", "llms-txt", "no-card", "closed-source", "webhooks", "typescript", "cli" ], "lastRelease": "2026-03-16", "graded": true, "anchor": { "graded": true, "score": 33.5, "grade": "F", "agentReady": false, "rank": 1383, "ranked": true, "rankOf": 1486, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "bestFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "strengths": [ "Remote MCP server covering templates, entries, statuses, entry history, media, languages and trash", "Keys scoped to the templates and media an agent needs, with schema tools gated separately", "llms.txt that says when to use BCMS and when not to, plus a public SKILL.md", "Entry history and trash readable through MCP, so an agent can trace and recover changes", "14-day trial with no card, then plans from $5 a month" ], "weaknesses": [ "The MCP key is accepted only as a URL query parameter", "No status page, documented rate limits, SLA or changelog found", "No security.txt, disclosure policy or certification found", "The JavaScript client hasn't been released since March 2026", "No self-hosted edition; the open-source repository has been unmaintained since October 2024" ], "agentNotes": [ "Keep the MCP URL out of logs and shared config, since the key is inside it", "Call get-all-templates first and mutate only once you have template and entry ids", "Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model", "List and confirm entry ids with the user before calling delete-entries", "Use the bcms-content CLI for scripted runs that need JSON output and exit codes" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 33.5 } ], "editorialScores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 48 }, "provenanceScore": 56, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @thebcms/client", "claudeCode": "claude mcp add --transport http bcms \"https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE\"", "config": { "mcpServers": { "bcms": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/bcms" }, "area": "business", "unitPrices": [ { "item": "Hobby plan", "unit": "month", "usd": 5, "note": "$4 a month billed yearly; 2 seats, 100 entries" }, { "item": "Pro plan", "unit": "month", "usd": 50, "note": "$33 a month billed yearly; 5 seats" }, { "item": "Extra Pro seat", "unit": "seat-month", "usd": 15, "note": "$120 a year on yearly billing" } ], "provenance": { "legalEntity": "Becomes tech, LLC", "domain": "thebcms.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.thebcms.com/terms-of-use/", "privacy": "https://www.thebcms.com/privacy-policy/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both effective 30 July 2026, name Becomes tech, LLC, a Delaware LLC. The terms forbid scraping or crawling that burdens or abuses the services, except through the documented APIs within rate limits.", "www.thebcms.com/robots.txt allows all. app.thebcms.com/robots.txt disallows all paths.", "www.thebcms.com/.well-known/security.txt returned 404 and no status page was found.", "RDAP gave no registration date for thebcms.com through rdap.org." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bcms.json", "live": { "slug": "bcms", "probe": { "target": "https://app.thebcms.com/api/v3/mcp", "method": "get", "lastAt": "2026-11-07T18:07:43.87352091Z", "lastOk": true, "lastStatus": 400, "lastMs": 197, "authRequired": false, "uptime24h": 99.49, "uptime30d": 99.49, "p50ms24h": 140, "p95ms24h": 393, "samples24h": 198, "samples30d": 198, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 185, "ok": 184 } ] }, "versions": [ { "registry": "npm", "name": "@thebcms/client", "version": "2.0.3", "seenAt": "2026-11-06T23:10:32.023184196Z" } ], "npmWeekly": 396, "securityTxt": { "url": "https://thebcms.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:49.817334601Z" }, "llmsTxt": { "url": "https://www.thebcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:42.21650798Z" }, "pages": [ { "url": "https://www.thebcms.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:35:35.490295236Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "abae80fa615e" }, { "url": "https://www.thebcms.com/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:35:37.777884178Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "58d8ef9074aa" } ], "mcpTools": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE", "checkedAt": "2026-11-07T01:42:42.874889438Z", "status": "error", "note": "initialize: no JSON-RPC answer", "changedAt": "2026-11-07T01:42:42.874889438Z" }, "updatedAt": "2026-11-07T18:07:43.87352091Z" } }, "answer": "Contentstack scores 66.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories.", "b": { "slug": "contentstack", "name": "Contentstack", "vendor": "Contentstack Inc.", "vendorUrl": "https://www.contentstack.com", "kind": "http-api", "category": "cms", "summary": "Contentstack is a hosted headless CMS. Its Content Management API reads and writes entries, assets, content types, locales, releases and publishing across seven regional endpoints, and an official local MCP server wraps the same API for agents.", "url": "https://www.anchorterminal.com/tools/contentstack", "markdownUrl": "https://www.anchorterminal.com/tools/contentstack.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/contentstack.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/contentstack.json", "dns": "contentstack.grade.anchorterminal.com", "repo": "https://github.com/contentstack/contentstack-openapi", "license": "Proprietary service under Contentstack's Master Agreement and Terms of Service. The OpenAPI files, the management SDKs, the CLI and the @contentstack/mcp package are MIT", "transports": [ "http", "stdio" ], "remoteUrl": "https://api.contentstack.io", "packages": [ { "registry": "npm", "name": "@contentstack/mcp" }, { "registry": "npm", "name": "@contentstack/management" }, { "registry": "pypi", "name": "contentstack-management" } ], "auth": "mixed", "authNotes": "Access is self-serve. Sign up, create a stack, then create a management token in the stack's settings (stack Owner or Admin only) and send it in the `authorization` header with the stack's `api_key`. Management tokens can be read-only or read-write, limited to branches, and given an expiry date. OAuth 2.0 apps are created in Developer Hub, with authorisation code and client credentials grants, scopes per module and action, 60-minute tokens and a refresh grant. A user authtoken from the login endpoint also works. The MCP server uses OAuth through `npx @contentstack/mcp --auth`, or a management token for content tools.", "pricing": "freemium", "pricingNotes": "Free plan at $0 a month with no card and no expiry (one stack, three users, 100,000 API calls a month, 1,000 entries), so an agent's owner can start without a contract. Build is $29 a month and Growth $299 a month with extra users at $25 each. Enterprise is priced by quote. Build mentions pay-as-you-go overages, and no overage rate is shown on the pricing page (https://www.contentstack.com/pricing, checked 2026-10-07).", "priceSummary": "$29 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI file, the MCP package or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": 206, "popularity": { "githubStars": null, "npmWeekly": 43992, "pypiWeekly": 1504, "asOf": "2026-10-07" }, "docsUrl": "https://www.contentstack.com/docs/developers/apis/content-management-api", "llmsTxt": "https://www.contentstack.com/llms.txt", "openapi": "https://github.com/contentstack/contentstack-openapi", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.localisation", "cms.schema" ], "tags": [ "hosted", "official", "mcp", "openapi", "llms-txt", "oauth", "free-tier", "no-card", "closed-source", "webhooks", "typescript", "python", "java", "dotnet", "status-page", "soc2", "sla" ], "lastRelease": "2026-10-21", "graded": true, "anchor": { "graded": true, "score": 66.4, "grade": "B", "agentReady": false, "rank": 369, "ranked": true, "rankOf": 1486, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 82, "payments": 30, "reliability": 81, "schema": 79, "security": 69, "transparency": 74 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -3, "negativeNotes": [ "11 September 2026. The `limit` query parameter on delivery and management requests changed behaviour inside v3. `limit=0` used to return every matching record and now returns the default 100, so an integration relying on it gets a truncated result with a 200 status. The changelog entry is dated the same day and gives a migration path, and no earlier notice was found in the changelog feed. Deducted 3, the low end, because it was documented (https://www.contentstack.com/docs/changelog)." ], "verdict": "The Content Management API has a public OpenAPI file, OAuth scopes that separate read, write and publish, read-only management tokens and a stack audit log. A free plan needs no card. The MCP server loads 78 tools by default with no annotations or read-only switch, and the `limit=0` behaviour changed on 11 September 2026 without advance notice.", "bestFor": "Teams already on Contentstack, or starting on its free plan, who want an agent to draft, localise, release and publish structured content with scoped credentials and an audit trail.", "strengths": [ "OAuth 2.0 scopes separate read, write, publish and unpublish for entries and assets, with 60-minute tokens and a refresh grant", "Management tokens can be read-only, limited to named branches, given an expiry date and given their own per-second rate limits", "Free plan at $0 with no card and no expiry (one stack, three users, 100,000 API calls a month), launched 16 September 2026", "Public OpenAPI 3.0.0 file for the Content Management API (138 paths, 221 operations) and public JSON Schema for all 206 MCP tools at mcp.contentstack.com", "Stack audit log readable through /v3/audit-logs, and entry and asset version history through the API", "Uptime commitment of 99.50 or 99.95 per cent by plan, with service credits, published in the Services Description" ], "weaknesses": [ "The MCP server's default group loads 78 tools, including nine deletes, with no readOnlyHint or destructiveHint annotations and no read-only switch", "On 11 September 2026 `limit=0` stopped returning every record and now returns the default 100. The changelog entry is dated the same day", "The OpenAPI file documents only 200 responses and has no enums or component schemas. Request bodies are shown as examples", "No idempotency keys and no Retry-After header were found. The docs name only X-RateLimit-Limit and X-RateLimit-Remaining", "No security.txt and no bug bounty were found, and no deprecation policy with a notice period", "Five incidents touching the product on status.contentstack.com between 28 August and 10 October 2026, each confined to one region" ], "agentNotes": [ "Pick the base URL for the stack's region first. North America on AWS is https://api.contentstack.io, and the other six regions use contentstack.com hosts", "Send `api_key` and `authorization` headers on every Content Management API call. Ask for a read-only management token when the task only reads", "Page with `limit` (100 at most), `skip` and `include_count=true`. `limit=0` no longer returns everything", "Stay under 10 reads and 10 writes a second per organisation, and one bulk request a second. Watch `X-RateLimit-Remaining` and back off on 429, since management API 429s carry no Retry-After", "Start the MCP server with `--groups cma` only, and add `cma-extended` when the task needs audit logs or version history. Publishing and deleting need no confirmation" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 2.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.4 } ], "editorialScores": { "ergonomics": 67, "maintenance": 82, "payments": 30, "reliability": 81, "schema": 79, "security": 69, "transparency": 59 }, "provenanceScore": 89, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @contentstack/mcp", "http": "curl \"https://api.contentstack.io/v3/content_types\" \\\n -H \"api_key: $CONTENTSTACK_API_KEY\" -H \"authorization: $CONTENTSTACK_MANAGEMENT_TOKEN\"", "config": { "mcpServers": { "contentstack": { "args": [ "-y", "@contentstack/mcp" ], "command": "npx", "env": { "CONTENTSTACK_API_KEY": "\u003cYOUR_STACK_API_KEY\u003e", "GROUPS": "cma" } } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/contentstack" }, "area": "business", "unitPrices": [ { "item": "Build", "unit": "month", "usd": 29, "note": "3 users, 250,000 API calls a month" }, { "item": "Growth", "unit": "month", "usd": 299, "note": "10 users, 1M API calls a month" }, { "item": "Growth, each extra user", "unit": "seat-month", "usd": 25, "note": "beyond the 10 included" } ], "provenance": { "legalEntity": "Contentstack Inc.", "domain": "contentstack.com", "domainRegistered": "2011-10-29", "domainNote": "The AWS North America API is on api.contentstack.io. The other six regions and the MCP tool definitions are on contentstack.com hosts.", "endpointOnVendorDomain": true, "terms": "https://www.contentstack.com/legal/terms-of-service", "privacy": "https://www.contentstack.com/legal/privacy", "statusPage": "https://status.contentstack.com", "changelog": "https://www.contentstack.com/docs/changelog", "securityTxt": "none", "checked": "2026-10-07", "notes": [ "The Master Agreement (last updated 17 July 2026) names Contentstack Inc., a Delaware corporation at 1023 Springdale Rd., Bldg. 14A, Austin, TX 78721. The privacy policy is dated 30 June 2026.", "The online Terms of Service carry an effective date of August 2022. Paid subscriptions are governed by the Master Agreement and the Services Description (last updated 28 July 2026).", "www.contentstack.com/.well-known/security.txt and /security.txt both return 404. SECURITY.md in Contentstack's GitHub repositories sends reports to security@contentstack.com.", "RDAP for contentstack.com gives a registration date of 2011-10-29.", "The npm package @contentstack/mcp names github.com/contentstack/mcp as its repository. That repository asked for credentials when we tried to clone it, so it isn't public." ], "score": 89 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/contentstack.json", "live": { "slug": "contentstack", "probe": { "target": "https://api.contentstack.io", "method": "get", "lastAt": "2026-11-07T18:07:49.15829992Z", "lastOk": true, "lastStatus": 404, "lastMs": 622, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 549, "p95ms24h": 660, "samples24h": 239, "samples30d": 7461, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 185, "ok": 185 } ] }, "vendorStatus": { "page": "https://status.contentstack.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:09:12.764342935Z" }, "versions": [ { "registry": "npm", "name": "@contentstack/management", "version": "1.31.3", "seenAt": "2026-11-06T23:17:20.279280506Z" }, { "registry": "npm", "name": "@contentstack/mcp", "version": "0.9.0", "seenAt": "2026-11-06T23:17:18.275980206Z" }, { "registry": "pypi", "name": "contentstack-management", "version": "1.11.3", "released": "2026-11-02", "seenAt": "2026-11-06T23:17:22.225019663Z" } ], "githubStars": 8, "npmWeekly": 780, "pypiWeekly": 1077, "securityTxt": { "url": "https://contentstack.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:56.154325477Z" }, "llmsTxt": { "url": "https://www.contentstack.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:11.816445692Z" }, "domain": { "domain": "contentstack.com", "registered": "2011-10-29", "source": "https://rdap.verisign.com/com/v1/domain/contentstack.com", "checkedAt": "2026-11-01T14:16:30.448418471Z" }, "pages": [ { "url": "https://www.contentstack.com/docs/changelog", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:27:16.950732562Z", "changedAt": "2026-11-07T14:27:16.950732562Z", "fingerprint": "7919e0674348" }, { "url": "https://www.contentstack.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:27:24.121315376Z", "changedAt": "2026-11-07T14:27:24.121315376Z", "fingerprint": "ee75f8dc5977" }, { "url": "https://www.contentstack.com/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:27:19.754432788Z", "changedAt": "2026-10-20T00:10:46.660290095Z", "fingerprint": "cc491abdfd29" }, { "url": "https://www.contentstack.com/legal/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:27:22.27803892Z", "changedAt": "2026-10-20T00:10:49.171571845Z", "fingerprint": "75dbf5c969d0" } ], "github": { "repo": "contentstack/contentstack-openapi", "checkedAt": "2026-11-02T08:41:32.413867522Z", "stars": 8, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-12T10:13:48Z", "openIssues": 1, "openPRs": 0, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "replies": { "sampled": 2, "unanswered": 1, "medianDays": 135.9 } }, "updatedAt": "2026-11-07T18:09:12.764342935Z" } }, "edges": [ { "by": 66, "category": "reliability", "leads": "contentstack", "name": "Reliability", "reasons": { "a": "Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.", "b": "Read with the hosted lines and scored on the Content Management API. status.contentstack.com is a Statuspage site with components by cloud, region and service and a full incident history (20). history.atom, read on 2 November, lists five incidents touching the product from 4 August to 2 November 2026, each confined to one region. Webhook delivery on AWS Europe stopped on 28 August for every customer in that region, with publishing unaffected (posted 11:16 to 12:15 UTC, though the post says investigation began around 08:00 UTC). Publishing and webhooks were delayed on Azure Europe on 1 September (51 minutes) and 16 September, newly published content was delayed on Google Cloud North America on 19 September, and Custom Agents, Polaris and Automation were disrupted on Google Cloud North America on 10 October. Two outages of the support portal and live chat (16 September and 22 October) didn't touch the APIs. The 7 October reading came from the page's /api/v2/incidents.json, which the host's robots.txt disallows, so it is struck. That reading counted the 28 August webhook outage as a major (10). This run reads an incident limited to one region or one service as partial and minor, so minor incidents only (20). Rate limits have numbers, 10 reads and 10 writes a second per organisation and one bulk request a second (15). The docs say a 429 is returned and name `X-RateLimit-Limit` and `X-RateLimit-Remaining`. Adaptive Rate Limiting (13 October 2026) adds Retry-After on 429s, but only for the Content Delivery, Image Delivery and GraphQL delivery APIs and only in an Early Access Program on request. No Retry-After, backoff guidance or idempotency key was found for the Content Management API (6 of 15). The Services Description commits to 99.50 or 99.95 per cent monthly availability by plan, with service credits (10). The v3 API is generally available. The MCP server is at version 0.9.0 (10). 20+20+15+6+10+10 = 81." }, "scores": { "a": 15, "b": 81 } }, { "by": 66, "category": "maintenance", "leads": "contentstack", "name": "Maintenance \u0026 community", "reasons": { "a": "@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.", "b": "The changelog's newest entry is 30 October 2026 (Polaris in the Visual Editor), after CLI 2.0.2 and 1.69.0 on 21 October with bug fixes, and the JavaScript management SDK 1.31.2 (changelog 22 September, tag 5 October) only resolved dependency vulnerabilities (30). Dated entries from 4 August to 2 November include the `limit` change on 11 September, recursive embedded items on 7 September, Adaptive Rate Limiting on 13 October, Java management SDK 1.13.1, 1.14.0 and 1.14.1 (17, 24 and 31 August) and Python management SDK 1.11.2 (10 August) (20). Closed service with a public changelog and RSS feed, email support and a Discord community. We didn't test a support channel (10 of 15). Official management SDKs in four languages, all with releases since 27 July 2026. The MCP server isn't in the official MCP registry (15). The JavaScript SDK repository has unit-test, CodeQL and dependency-scan workflows, and its changelog shows regular dependency fixes. We didn't see the CI results (7 of 10). 30+20+10+15+7 = 82." }, "scores": { "a": 16, "b": 82 } }, { "by": 31, "category": "ergonomics", "leads": "contentstack", "name": "Agent ergonomics", "reasons": { "a": "45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.", "b": "Responses can be sized with `only[BASE][]`, `except[BASE][]` and `limit`. The MCP server's default group is 78 tools and about 66 KB of schema, split from nine other groups by `--groups` (17 of 25). `limit` up to 100, `skip`, `include_count`, sort and a JSON `query` filter (20). Errors use standard status codes with a JSON body, with 412 and 422 explained in the docs. Error bodies aren't in the spec (12 of 20). No idempotency keys or conditional writes were found, and the MCP package contains no readOnlyHint or destructiveHint annotations. Entries keep version numbers, which helps check a write after a lost response (4 of 20). Management SDKs in JavaScript, Python, Java and .NET. Every call needs two headers and the right regional host (14 of 15)." }, "scores": { "a": 36, "b": 67 } }, { "by": 30, "category": "security", "leads": "contentstack", "name": "Security \u0026 auth", "reasons": { "a": "Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.", "b": "OAuth 2.0 with scopes per module and action (cm.entry:read, cm.entry:write and cm.entry:publish are separate), 60-minute tokens, a refresh grant and revocation by users or organisation admins. Management tokens can be read-only, branch-limited and expiring, and are shown once. PKCE isn't mentioned in the OAuth docs (27 of 30). Read-only tokens and separate publish scopes allow least privilege, and stacks have workflows and publish rules. The MCP server has no read-only switch and no confirmation step, and its default group includes nine delete tools (13 of 20). Entries are written by a stack's own users and can still carry instructions. No prompt-injection guidance was found in the MCP docs (3 of 15). A stack audit log records creates, updates, deletes and publishes by user, with an API endpoint and MCP tools to read it. Its retention period isn't stated (13 of 15). SOC 2 Type II, ISO 27001:2022 and penetration tests twice a year. Reports go to security@contentstack.com with a stated 24-hour response, and SDK security fixes are listed in the changelog with CVE numbers. security.txt returns 404 and no bug bounty was found. We didn't search NVD (13 of 20)." }, "scores": { "a": 39, "b": 69 } }, { "by": 29, "category": "schema", "leads": "contentstack", "name": "Schema \u0026 documentation", "reasons": { "a": "The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.", "b": "An OpenAPI 3.0.0 file for the Content Management API is public, with 138 paths and 221 operations, and every MCP tool has a JSON Schema published at mcp.contentstack.com (25). www.contentstack.com/llms.txt indexes the docs, the full-text export llms-full.txt answered on 2 November (about 25 MB, it returned 502 on 7 October), and doc pages are served as Markdown at their `.md` path (10). Operation descriptions in the spec are long (median 1,189 characters, in HTML) and MCP tool descriptions say what each tool does (median 142 characters in the `cma` group). Few say when not to use a tool (15 of 20). The spec has no enums and no component schemas, and request bodies are examples. The `cma` tool schemas have 369 properties with two enums and 13 untyped objects such as `entry_data`. Version 0.9.0 says it adds enums from the connected stack at run time, which we couldn't see without an account (7 of 15). The spec carries 494 examples but documents only a 200 response for each operation. The docs list status codes in a table (9 of 15). The API version is in the path, and a dated changelog with an RSS feed covers API, SDK and CLI changes. A behaviour change to `limit` shipped inside v3 (13 of 15). 25+10+15+7+9+13 = 79." }, "scores": { "a": 50, "b": 79 } }, { "by": 22, "category": "transparency", "leads": "contentstack", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.", "b": "The service is closed under a Master Agreement last updated 17 July 2026 and Terms of Service from August 2022. The spec, SDKs, CLI and MCP package are MIT, though the MCP repository named on npm isn't public (15). The privacy policy of 30 June 2026 says customer content is deleted within 180 days of termination, data processing agreements for the US and for EMEA are published, and the AI addendum of 27 July 2026 says customer data isn't used to train general AI models. The older Terms of Service only say access to content ends on termination (24 of 30). No deprecation policy with a notice period was found. The Services Description lets Contentstack end a service during a term with a pro-rata refund, and the `limit` change was announced on the day it applied (5 of 20). The sub-processor list was updated on 25 May 2026 with purposes and locations. It gives the United States for Azure and Google Cloud although both have European regions in the API docs, and the page states no notice period for changes (15 of 20)." }, "scores": { "a": 52, "b": 74 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Becomes tech, LLC", "b": "Contentstack Inc.", "name": "Vendor" }, { "a": "https://app.thebcms.com/api/v3/mcp", "b": "https://api.contentstack.io", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, stdio", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary service under Contentstack's Master Agreement and Terms of Service. The OpenAPI files, the management SDKs, the CLI and the @contentstack/mcp package are MIT", "name": "Licence" }, { "a": "45", "b": "206", "name": "Tools exposed" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-03-16", "b": "2026-10-21", "name": "Last release" }, { "a": "2026-07-30", "b": "2022-08-01", "name": "Terms last updated" }, { "a": "2026-07-30", "b": "2026-06-30", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "396 npm/wk", "b": "44k npm/wk, 1.5k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "2.8/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Contentstack scores 66.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, BCMS or Contentstack?" }, { "answer": "BCMS needs an API key. Contentstack takes an API key or an OAuth sign-in.", "question": "Do BCMS and Contentstack need an API key?" }, { "answer": "Yes. BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp and Contentstack at https://api.contentstack.io.", "question": "Can an agent call BCMS and Contentstack without installing anything?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where Contentstack loses 3 points for them" ], "goodFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "slug": "bcms", "watchFor": "The MCP key is accepted only as a URL query parameter" }, { "aheadOn": [ "Reliability, 81 against 15", "Schema \u0026 documentation, 79 against 50", "Agent ergonomics, 67 against 36", "Security \u0026 auth, 69 against 39", "Maintenance \u0026 community, 82 against 16", "Transparency \u0026 trust, 74 against 52" ], "also": [ "Runs on your own machine" ], "goodFor": "Teams already on Contentstack, or starting on its free plan, who want an agent to draft, localise, release and publish structured content with scoped credentials and an audit trail.", "slug": "contentstack", "watchFor": "The MCP server's default group loads 78 tools, including nine deletes, with no readOnlyHint or destructiveHint annotations and no read-only switch" } ], "history": { "bcms": null, "contentstack": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-02", "delta": 2.3, "from": 64.1, "fromGrade": "B", "to": 66.4, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 64, "fromGrade": "B", "to": 64.1, "toGrade": "B" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-buttercms.json", "title": "BCMS vs ButterCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-buttercms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-datocms.json", "title": "BCMS vs DatoCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-directus.json", "title": "BCMS vs Directus", "url": "https://www.anchorterminal.com/compare/bcms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-ghost.json", "title": "BCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/bcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-hygraph.json", "title": "BCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/bcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.json", "title": "BCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-payload.json", "title": "BCMS vs Payload", "url": "https://www.anchorterminal.com/compare/bcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-prismic.json", "title": "BCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/bcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-sanity.json", "title": "BCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/bcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-storyblok.json", "title": "BCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/bcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-strapi.json", "title": "BCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/bcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-webflow.json", "title": "BCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/bcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-wordpress.json", "title": "BCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/bcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-contentstack.json", "title": "ButterCMS vs Contentstack", "url": "https://www.anchorterminal.com/compare/buttercms-vs-contentstack" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic.json", "title": "Contentstack vs Cosmic", "url": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-datocms.json", "title": "Contentstack vs DatoCMS", "url": "https://www.anchorterminal.com/compare/contentstack-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-directus.json", "title": "Contentstack vs Directus", "url": "https://www.anchorterminal.com/compare/contentstack-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms.json", "title": "Contentstack vs dotCMS", "url": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-ghost.json", "title": "Contentstack vs Ghost", "url": "https://www.anchorterminal.com/compare/contentstack-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-hygraph.json", "title": "Contentstack vs Hygraph", "url": "https://www.anchorterminal.com/compare/contentstack-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-kontent-ai.json", "title": "Contentstack vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/contentstack-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-payload.json", "title": "Contentstack vs Payload", "url": "https://www.anchorterminal.com/compare/contentstack-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-prismic.json", "title": "Contentstack vs Prismic", "url": "https://www.anchorterminal.com/compare/contentstack-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-sanity.json", "title": "Contentstack vs Sanity", "url": "https://www.anchorterminal.com/compare/contentstack-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-storyblok.json", "title": "Contentstack vs Storyblok", "url": "https://www.anchorterminal.com/compare/contentstack-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-strapi.json", "title": "Contentstack vs Strapi", "url": "https://www.anchorterminal.com/compare/contentstack-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-webflow.json", "title": "Contentstack vs Webflow", "url": "https://www.anchorterminal.com/compare/contentstack-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-wordpress.json", "title": "Contentstack vs WordPress", "url": "https://www.anchorterminal.com/compare/contentstack-vs-wordpress" } ], "panel": null, "scores": [ { "bcms": 15, "by": 66, "contentstack": 81, "edge": "contentstack", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "bcms": 50, "by": 29, "contentstack": 79, "edge": "contentstack", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "bcms": 36, "by": 31, "contentstack": 67, "edge": "contentstack", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "bcms": 39, "by": 30, "contentstack": 69, "edge": "contentstack", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "bcms": 30, "by": 0, "contentstack": 30, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "bcms": 16, "by": 66, "contentstack": 82, "edge": "contentstack", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "bcms": 52, "by": 22, "contentstack": 74, "edge": "contentstack", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Contentstack scores 66.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "bcms": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "contentstack": "The Content Management API has a public OpenAPI file, OAuth scopes that separate read, write and publish, read-only management tokens and a stack audit log. A free plan needs no card. The MCP server loads 78 tools by default with no annotations or read-only switch, and the `limit=0` behaviour changed on 11 September 2026 without advance notice." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/bcms-vs-contentstack", "json": "https://www.anchorterminal.com/compare/bcms-vs-contentstack.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/bcms-vs-contentstack.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/bcms-vs-contentstack.min.md" }, "markdown": "Contentstack scores 66.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories. Both do content management.\n\n- BCMS: grade F, 33.5/100, rank #1383 of 1486. Markdown https://www.anchorterminal.com/tools/bcms.md · JSON https://www.anchorterminal.com/api/v1/tools/bcms.json\n- Contentstack: grade B, 66.4/100, rank #369 of 1486. Markdown https://www.anchorterminal.com/tools/contentstack.md · JSON https://www.anchorterminal.com/api/v1/tools/contentstack.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### BCMS (F)\n\nGood for: Small sites and agencies that want a cheap hosted CMS an agent can edit.\n\nAlso in its favour:\n- No incidents deducted, where Contentstack loses 3 points for them\n\nWatch for: The MCP key is accepted only as a URL query parameter\n\n### Contentstack (B)\n\nGood for: Teams already on Contentstack, or starting on its free plan, who want an agent to draft, localise, release and publish structured content with scoped credentials and an audit trail.\n\nAhead on:\n- Reliability, 81 against 15\n- Schema \u0026 documentation, 79 against 50\n- Agent ergonomics, 67 against 36\n- Security \u0026 auth, 69 against 39\n- Maintenance \u0026 community, 82 against 16\n- Transparency \u0026 trust, 74 against 52\n\nAlso in its favour:\n- Runs on your own machine\n\nWatch for: The MCP server's default group loads 78 tools, including nine deletes, with no readOnlyHint or destructiveHint annotations and no read-only switch\n\n\n## Why the edge\n\n### Reliability: Contentstack +66\n\n- BCMS (15): Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.\n- Contentstack (81): Read with the hosted lines and scored on the Content Management API. status.contentstack.com is a Statuspage site with components by cloud, region and service and a full incident history (20). history.atom, read on 2 November, lists five incidents touching the product from 4 August to 2 November 2026, each confined to one region. Webhook delivery on AWS Europe stopped on 28 August for every customer in that region, with publishing unaffected (posted 11:16 to 12:15 UTC, though the post says investigation began around 08:00 UTC). Publishing and webhooks were delayed on Azure Europe on 1 September (51 minutes) and 16 September, newly published content was delayed on Google Cloud North America on 19 September, and Custom Agents, Polaris and Automation were disrupted on Google Cloud North America on 10 October. Two outages of the support portal and live chat (16 September and 22 October) didn't touch the APIs. The 7 October reading came from the page's /api/v2/incidents.json, which the host's robots.txt disallows, so it is struck. That reading counted the 28 August webhook outage as a major (10). This run reads an incident limited to one region or one service as partial and minor, so minor incidents only (20). Rate limits have numbers, 10 reads and 10 writes a second per organisation and one bulk request a second (15). The docs say a 429 is returned and name `X-RateLimit-Limit` and `X-RateLimit-Remaining`. Adaptive Rate Limiting (13 October 2026) adds Retry-After on 429s, but only for the Content Delivery, Image Delivery and GraphQL delivery APIs and only in an Early Access Program on request. No Retry-After, backoff guidance or idempotency key was found for the Content Management API (6 of 15). The Services Description commits to 99.50 or 99.95 per cent monthly availability by plan, with service credits (10). The v3 API is generally available. The MCP server is at version 0.9.0 (10). 20+20+15+6+10+10 = 81.\n\n### Maintenance \u0026 community: Contentstack +66\n\n- BCMS (16): @thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.\n- Contentstack (82): The changelog's newest entry is 30 October 2026 (Polaris in the Visual Editor), after CLI 2.0.2 and 1.69.0 on 21 October with bug fixes, and the JavaScript management SDK 1.31.2 (changelog 22 September, tag 5 October) only resolved dependency vulnerabilities (30). Dated entries from 4 August to 2 November include the `limit` change on 11 September, recursive embedded items on 7 September, Adaptive Rate Limiting on 13 October, Java management SDK 1.13.1, 1.14.0 and 1.14.1 (17, 24 and 31 August) and Python management SDK 1.11.2 (10 August) (20). Closed service with a public changelog and RSS feed, email support and a Discord community. We didn't test a support channel (10 of 15). Official management SDKs in four languages, all with releases since 27 July 2026. The MCP server isn't in the official MCP registry (15). The JavaScript SDK repository has unit-test, CodeQL and dependency-scan workflows, and its changelog shows regular dependency fixes. We didn't see the CI results (7 of 10). 30+20+10+15+7 = 82.\n\n### Agent ergonomics: Contentstack +31\n\n- BCMS (36): 45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.\n- Contentstack (67): Responses can be sized with `only[BASE][]`, `except[BASE][]` and `limit`. The MCP server's default group is 78 tools and about 66 KB of schema, split from nine other groups by `--groups` (17 of 25). `limit` up to 100, `skip`, `include_count`, sort and a JSON `query` filter (20). Errors use standard status codes with a JSON body, with 412 and 422 explained in the docs. Error bodies aren't in the spec (12 of 20). No idempotency keys or conditional writes were found, and the MCP package contains no readOnlyHint or destructiveHint annotations. Entries keep version numbers, which helps check a write after a lost response (4 of 20). Management SDKs in JavaScript, Python, Java and .NET. Every call needs two headers and the right regional host (14 of 15).\n\n### Security \u0026 auth: Contentstack +30\n\n- BCMS (39): Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.\n- Contentstack (69): OAuth 2.0 with scopes per module and action (cm.entry:read, cm.entry:write and cm.entry:publish are separate), 60-minute tokens, a refresh grant and revocation by users or organisation admins. Management tokens can be read-only, branch-limited and expiring, and are shown once. PKCE isn't mentioned in the OAuth docs (27 of 30). Read-only tokens and separate publish scopes allow least privilege, and stacks have workflows and publish rules. The MCP server has no read-only switch and no confirmation step, and its default group includes nine delete tools (13 of 20). Entries are written by a stack's own users and can still carry instructions. No prompt-injection guidance was found in the MCP docs (3 of 15). A stack audit log records creates, updates, deletes and publishes by user, with an API endpoint and MCP tools to read it. Its retention period isn't stated (13 of 15). SOC 2 Type II, ISO 27001:2022 and penetration tests twice a year. Reports go to security@contentstack.com with a stated 24-hour response, and SDK security fixes are listed in the changelog with CVE numbers. security.txt returns 404 and no bug bounty was found. We didn't search NVD (13 of 20).\n\n### Schema \u0026 documentation: Contentstack +29\n\n- BCMS (50): The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.\n- Contentstack (79): An OpenAPI 3.0.0 file for the Content Management API is public, with 138 paths and 221 operations, and every MCP tool has a JSON Schema published at mcp.contentstack.com (25). www.contentstack.com/llms.txt indexes the docs, the full-text export llms-full.txt answered on 2 November (about 25 MB, it returned 502 on 7 October), and doc pages are served as Markdown at their `.md` path (10). Operation descriptions in the spec are long (median 1,189 characters, in HTML) and MCP tool descriptions say what each tool does (median 142 characters in the `cma` group). Few say when not to use a tool (15 of 20). The spec has no enums and no component schemas, and request bodies are examples. The `cma` tool schemas have 369 properties with two enums and 13 untyped objects such as `entry_data`. Version 0.9.0 says it adds enums from the connected stack at run time, which we couldn't see without an account (7 of 15). The spec carries 494 examples but documents only a 200 response for each operation. The docs list status codes in a table (9 of 15). The API version is in the path, and a dated changelog with an RSS feed covers API, SDK and CLI changes. A behaviour change to `limit` shipped inside v3 (13 of 15). 25+10+15+7+9+13 = 79.\n\n### Transparency \u0026 trust: Contentstack +22\n\n- BCMS (52): A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.\n- Contentstack (74): The service is closed under a Master Agreement last updated 17 July 2026 and Terms of Service from August 2022. The spec, SDKs, CLI and MCP package are MIT, though the MCP repository named on npm isn't public (15). The privacy policy of 30 June 2026 says customer content is deleted within 180 days of termination, data processing agreements for the US and for EMEA are published, and the AI addendum of 27 July 2026 says customer data isn't used to train general AI models. The older Terms of Service only say access to content ends on termination (24 of 30). No deprecation policy with a notice period was found. The Services Description lets Contentstack end a service during a term with a pro-rata refund, and the `limit` change was announced on the day it applied (5 of 20). The sub-processor list was updated on 25 May 2026 with purposes and locations. It gives the United States for Azure and Google Cloud although both have European regions in the API docs, and the page states no notice period for changes (15 of 20).\n\n## Score by category\n\n| Category | Weight | BCMS | Contentstack | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 81 | Contentstack +66 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 50 | 79 | Contentstack +29 |\n| Agent ergonomics | 13% (16.2 this run) | 36 | 67 | Contentstack +31 |\n| Security \u0026 auth | 14% (17.5 this run) | 39 | 69 | Contentstack +30 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 30 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 16 | 82 | Contentstack +66 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 74 | Contentstack +22 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **33.5 · F** | **66.4 · B** | |\n\n## Facts side by side\n\n| Fact | BCMS | Contentstack |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Becomes tech, LLC | Contentstack Inc. |\n| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | `https://api.contentstack.io` |\n| Transports | HTTP, Streamable HTTP | HTTP, stdio |\n| Auth | API key | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | none | Proprietary service under Contentstack's Master Agreement and Terms of Service. The OpenAPI files, the management SDKs, the CLI and the @contentstack/mcp package are MIT |\n| Tools exposed | 45 | 206 |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| Last release | 2026-03-16 | 2026-10-21 |\n| Terms last updated | 2026-07-30 | 2022-08-01 |\n| Privacy policy last updated | 2026-07-30 | 2026-06-30 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 396 npm/wk | 44k npm/wk, 1.5k PyPI/wk |\n| Agent reviews | none | 2.8/5 (4) |\n\n## How the scores have moved\n\n### BCMS\n\nNo score change since it was listed.\n\n### Contentstack\n\n- +2.3 on 2 November 2026: new evidence, correction\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**BCMS.** BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.\n\n**Contentstack.** The Content Management API has a public OpenAPI file, OAuth scopes that separate read, write and publish, read-only management tokens and a stack audit log. A free plan needs no card. The MCP server loads 78 tools by default with no annotations or read-only switch, and the `limit=0` behaviour changed on 11 September 2026 without advance notice.\n\n## Before you call either\n\n### BCMS\n\n1. Keep the MCP URL out of logs and shared config, since the key is inside it\n2. Call get-all-templates first and mutate only once you have template and entry ids\n3. Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model\n4. List and confirm entry ids with the user before calling delete-entries\n5. Use the bcms-content CLI for scripted runs that need JSON output and exit codes\n\n### Contentstack\n\n1. Pick the base URL for the stack's region first. North America on AWS is https://api.contentstack.io, and the other six regions use contentstack.com hosts\n2. Send `api_key` and `authorization` headers on every Content Management API call. Ask for a read-only management token when the task only reads\n3. Page with `limit` (100 at most), `skip` and `include_count=true`. `limit=0` no longer returns everything\n4. Stay under 10 reads and 10 writes a second per organisation, and one bulk request a second. Watch `X-RateLimit-Remaining` and back off on 429, since management API 429s carry no Retry-After\n5. Start the MCP server with `--groups cma` only, and add `cma-extended` when the task needs audit logs or version history. Publishing and deleting need no confirmation\n\n## Questions\n\n### Which is better for AI agents, BCMS or Contentstack?\n\nContentstack scores 66.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories.\n\n### Do BCMS and Contentstack need an API key?\n\nBCMS needs an API key. Contentstack takes an API key or an OAuth sign-in.\n\n### Can an agent call BCMS and Contentstack without installing anything?\n\nYes. BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp and Contentstack at https://api.contentstack.io.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/bcms-vs-contentstack.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bcms-vs-contentstack.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"bcms\", \"b\": \"contentstack\"}`. From a terminal: `anchor compare bcms contentstack`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bcms.json and https://www.anchorterminal.com/api/v1/tools/contentstack.json\n\n## Other comparisons with BCMS or Contentstack\n\n- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)\n- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Ghost](https://www.anchorterminal.com/compare/bcms-vs-ghost.md)\n- [BCMS vs Hygraph](https://www.anchorterminal.com/compare/bcms-vs-hygraph.md)\n- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)\n- [BCMS vs Payload](https://www.anchorterminal.com/compare/bcms-vs-payload.md)\n- [BCMS vs Prismic](https://www.anchorterminal.com/compare/bcms-vs-prismic.md)\n- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)\n- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)\n- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)\n- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)\n- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)\n- [ButterCMS vs Contentstack](https://www.anchorterminal.com/compare/buttercms-vs-contentstack.md)\n- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)\n- [Contentstack vs DatoCMS](https://www.anchorterminal.com/compare/contentstack-vs-datocms.md)\n- [Contentstack vs Directus](https://www.anchorterminal.com/compare/contentstack-vs-directus.md)\n- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)\n- [Contentstack vs Ghost](https://www.anchorterminal.com/compare/contentstack-vs-ghost.md)\n- [Contentstack vs Hygraph](https://www.anchorterminal.com/compare/contentstack-vs-hygraph.md)\n- [Contentstack vs Kontent.ai](https://www.anchorterminal.com/compare/contentstack-vs-kontent-ai.md)\n- [Contentstack vs Payload](https://www.anchorterminal.com/compare/contentstack-vs-payload.md)\n- [Contentstack vs Prismic](https://www.anchorterminal.com/compare/contentstack-vs-prismic.md)\n- [Contentstack vs Sanity](https://www.anchorterminal.com/compare/contentstack-vs-sanity.md)\n- [Contentstack vs Storyblok](https://www.anchorterminal.com/compare/contentstack-vs-storyblok.md)\n- [Contentstack vs Strapi](https://www.anchorterminal.com/compare/contentstack-vs-strapi.md)\n- [Contentstack vs Webflow](https://www.anchorterminal.com/compare/contentstack-vs-webflow.md)\n- [Contentstack vs WordPress](https://www.anchorterminal.com/compare/contentstack-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BCMS vs Contentstack", "url": "" } ], "description": "Contentstack scores 66.4 (B) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BCMS F 33.5", "Contentstack B 66.4", "scores" ], "h1": "BCMS vs Contentstack", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/bcms-vs-contentstack", "published": "2026-10-01", "section": "tools", "title": "BCMS vs Contentstack for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/bcms-vs-contentstack" }, "tokens": { "markdown": 5200, "slim": 3330 }, "version": 1 }