BCMS vs DatoCMS

BCMS 15

Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.

DatoCMS 80

Graded on the Content Management API, with the hosted MCP server noted. Public status page at status.datocms.com with the Content Management API as a named component and incident history back to 2023 (20). In the 90 days to 1 November 2026 the JSON history feed, re-read on 1 November, lists two email delivery faults (9 to 10 August, 27 to 28 September), a partial outage of the upstream image provider on 1 September, and a scheduled database upgrade on 19 September that kept every project read-only from 05:30 to about 09:43 UTC against a three-hour window, with writes returning 503. No unplanned API outage in the period and still no entry after 27 September, so 18 of 30. An API outage on 2 December 2025 falls outside the 90 days. Rate limit published as 60 requests every 3 seconds, re-read on 1 November (15). 429 responses carry x-ratelimit-reset, errors carry a transient flag and the official client retries both. No idempotency keys, though updates take optimistic locking (12). The pricing page lists guaranteed uptime SLAs on Enterprise with no figure (5). API version 3 is generally available. The MCP docs describe their limits as those of an initial beta phase (10).

BCMS 16

@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.

DatoCMS 81

@datocms/cma-client 6.8.0 of 1 October 2026 is still the latest client tag on 1 November, and the product changelog's newest entry is dated the same day. The same repository tagged @datocms/dashboard-client 6.10.0 on 14 October and @datocms/rest-client-utils 6.10.1, the HTTP layer under the clients, on 23 October (30). Ten changelog entries from 24 August to 1 October and 37 client tags in the 90 days from 3 August, nine of them cma-client releases (20). Public changelog, a community forum, a Slack community and support by email. Per the 8 October check, not re-read since, the client repository had 14 issues in all, three open, the oldest from 2023 (11 of 15). Current official client and CLI. The official MCP registry still returned no DatoCMS entry on 1 November (13). The client and CLI repositories have CI and release workflows, and both had commits on 26 October. The CLI's last tags are from 31 August. We couldn't check that CI passes (7).

BCMS 36

45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.

DatoCMS 78

List responses are sized with page[limit] and a nested switch for block content. No field selection was found on the management API. The MCP server names nine tools, and the vendor says its documentation tools are token intensive. The CLI's schema:inspect has an output format written for models (18 of 25). Offset pagination with meta.total_count and filters by ids, model, text and field values (20). Error bodies carry a stable code, a doc_url and a transient flag (20). No idempotency keys. Updates take optimistic locking through meta.current_version, POST /items/validate tests a payload without saving, and the MCP server splits read-only and read-write execution. We couldn't read the tool annotations (12). Every request needs the X-Api-Version header, and the only official client library is JavaScript and TypeScript (8).

BCMS 39

Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as ?mcpKey= in the URL and REST examples pass apiKey the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.

DatoCMS 77

API tokens bound to custom roles, revocable and rotatable by API, sent only as a Bearer header. The MCP server uses OAuth with PKCE S256, dynamic client registration and revocation, with projects and one of three access levels chosen on the consent screen. The OAuth metadata lists three coarse scopes, per the 8 October check, not re-read since because oauth.datocms.com's robots.txt disallows every path (28). Every project starts with a read-only token, roles limit by model, action and environment, and the MCP read-only level is enforced by the runner and by the API through X-Abort-If-Destructive-Request. Read-write scripts ask the user to confirm (18). The MCP docs treat model-written code as untrusted, with restricted network egress, credential brokering and static checks. No guidance on treating stored content as untrusted input was found (11). Audit logs are Enterprise only with two months of retention by default. Record versions name the editor on every plan (8). ISO 27001, a security.txt with a PGP key and a disclosure address, re-read on 1 November and still without an Expires field. No bug bounty or SOC 2 report of its own found (12).

BCMS 50

The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.

DatoCMS 85

A public JSON Hyper-Schema describes 53 resources and 202 operations. It is not OpenAPI, and the .well-known/api-catalog file links it (22 of 25). A root llms.txt, llms-full.txt and a Markdown copy of every docs page at the same URL plus .md (10). Every operation has a title, 43 of 202 have a description in the schema, and the docs say when to use the management API, the delivery API, the CLI skills or the MCP server (14). Inputs are typed with required fields and 72 enums. Record field values depend on each project's own models, checked by the validate endpoints (11). 656 examples in the schema and 100 error codes on one page, each with a recovery hint (15). X-Api-Version with a written rule that breaking changes come only with a new version, and a dated product changelog. The management API has no changelog of its own (13).

BCMS 52

A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.

DatoCMS 80

Closed service with published terms for the Free and Professional plans, per the 8 October check, not re-read on 17 October or 1 November because www.datocms.com's robots.txt disallows /legal/ for every agent, and MIT clients and CLI. The Enterprise agreement isn't published (15). Per the same check, the privacy policy, a GDPR page updated on 3 June 2026 and the security page state EU hosting, 14 days of database backups and deletion of content within 4 days of termination. No data processing agreement was found on the legal pages (20). A written rule that breaking changes come only with a new API version, and one dated notice (30 days for legacy upload endpoints in 2025). The terms also reserve the right to modify or discontinue API access with or without notice (12). The GDPR page, per the 8 October check, lists 22 third-party services with the data each receives, and names AWS in Ireland, backups in France and Cloudflare R2 in the EU (18).