# BCMS vs Directus (slim)

> Directus scores 58.1 (C) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bcms-vs-directus.md (~4,550 tokens) · this version ~2,730 tokens · JSON https://www.anchorterminal.com/compare/bcms-vs-directus.json · canonical https://www.anchorterminal.com/compare/bcms-vs-directus
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Directus scores 58.1 (C) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.

- BCMS: F 33.5, rank #1383 of 1486 · https://www.anchorterminal.com/tools/bcms.min.md
- Directus: C 58.1, rank #758 of 1486 · https://www.anchorterminal.com/tools/directus.min.md
- BCMS, good for Small sites and agencies that want a cheap hosted CMS an agent can edit. Also A hosted endpoint, with nothing to install; Free to start without a card; No incidents deducted, where Directus loses 15 points for them.
- Directus, good for Teams that already keep content in an SQL database and want an agent to edit items, files and the data model under a named user's permissions. Ahead on Reliability, 82 against 15; Schema & documentation, 81 against 50; Agent ergonomics, 73 against 36; Security & auth, 68 against 39; Payments & pricing, 55 against 30; Maintenance & community, 86 against 16; Transparency & trust, 62 against 52.

| Category | BCMS | Directus |
| --- | --- | --- |
| Reliability (16%) | 15 | 82 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 50 | 81 |
| Agent ergonomics (13%) | 36 | 73 |
| Security & auth (14%) | 39 | 68 |
| Payments & pricing (10%) | 30 | 55 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 16 | 86 |
| Transparency & trust (7%) | 52 | 62 |

| Fact (where they differ) | BCMS | Directus |
| --- | --- | --- |
| Vendor | Becomes tech, LLC | Monospace Inc. (Directus) |
| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | no (local only) |
| Auth | API key | OAuth or key |
| Pricing | Paid | Freemium |
| Licence | none | MSCL-1.0-GPL (Monospace Sustainable Core Licence 1.0), source-available with a licence key for paid tiers, each version converting to GPL-3.0 after four years. `@directus/sdk` is MIT |
| Tools exposed | 45 | 12 |
| Last release | 2026-03-16 | 2026-10-27 |
| Terms last updated | 2026-07-30 | no date given |
| Privacy policy last updated | 2026-07-30 | 2026-06-09 |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | not found in the text | yes |
| Popularity | 396 npm/wk | 38k stars, 23k npm/wk |
| Agent reviews | none | 2.8/5 (4) |

Why the edge:
- Maintenance & community, Directus +70: BCMS 16 (@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.); Directus 86 (v12.6.0 was tagged on 27 October 2026 (30). Seven tagged releases in the 90 days from 3 August (12.3.0, 12.3.1, 12.4.0, 12.4.1, 12.5.0, 12.5.1 and 12.6.0) (20). 339 open issues, the newest labelled and answered, with 170 commits on main since 10 July, per the 8 October check, not re-read on 1 November. Closed-issue counts weren't readable (17 of 25). `@directus/sdk` is current and is the only official SDK. We couldn't reach the official MCP registry, which matters less for a server built into the product (10 of 15). Dependency updates for CVEs land in each release (12.5.1 and 12.6.0 among them), CI passed on main on 8 October and CodeQL runs (9 of 10).)
- Reliability, Directus +67: BCMS 15 (Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.); Directus 82 (Read with the local-software lines, since the graded surface is the self-hosted software on the free Core tier. Directus Cloud's status page isn't scored here. Official Docker image `directus/directus` and npm package `directus` 12.6.0, with Node.js 26 or later in `engines` since 12.6.0 and the supported databases listed (20). The Check workflow passed on the 10 most recent runs on main on 8 October, per the 8 October check, not re-read on 1 November, and separate end-to-end and CodeQL workflows exist (25). 339 open issues. The 15 newest carry labels and one to eight comments, but we couldn't read closed counts, and at least 20 advisories were fixed between June and September 2026 (15 of 25). The docs say releases don't follow semantic versioning and any release may break. Breaking changes are listed per version, and 12.1 to 12.6 each had some (7 of 15). Version 12, and the MCP server isn't marked beta (15).)
- Agent ergonomics, Directus +37: BCMS 36 (45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.); Directus 73 (Default mode lists 12 tools, the 11 to 30 band, but each definition carries its whole instruction file, 78,855 bytes in total at v12.5.0, so we scored 10 and added 8 for registry mode, which lists three tools and loads details on demand (18 of 25). `limit` (default 100), `offset`, `page`, `fields`, `filter`, `search`, `sort` and `aggregate`, with `QUERY_LIMIT_MAX` as a server cap (20). One error shape with a machine-readable `extensions.code`. Missing items answer `FORBIDDEN`, not 404, by design (17 of 20). Tools set `readOnlyHint` and `destructiveHint`, though one `items` tool covers reads and writes and is marked destructive. No idempotency keys were found in the reviewed documentation (10 of 20). Few required parameters. One official SDK, `@directus/sdk` for JavaScript and TypeScript (8 of 15).)
- Schema & documentation, Directus +31: BCMS 50 (The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.); Directus 81 (An OpenAPI file ships in `@directus/specs` with 70 paths, each instance serves its own at `/server/specs/oas`, and every MCP tool has a typed input schema. The spec's `info.version` still reads 10 (22 of 25). llms.txt, llms-full.txt and a raw Markdown copy of every docs page (10). Each tool has a one-sentence description and a `prompt.md` of instructions with worked examples, up to 13 KB for flows, and a `system-prompt` tool sets conventions (16 of 20). Actions are enums and validation uses strict unions per action, but item data, filters, `deep`, and field `schema` and `meta` are open records (8 of 15). The errors page lists HTTP statuses and error codes with the response shape, and guides show REST, GraphQL and SDK examples side by side (14 of 15). A monthly changelog, release notes and breaking-change pages per major version. REST paths carry no version and releases aren't semantic (11 of 15).)
- Security & auth, Directus +29: BCMS 39 (Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.); Directus 68 (MCP OAuth uses PKCE with dynamic client registration or client ID metadata documents, issues a token with the single `mcp:access` scope and the MCP endpoint as audience, and lets administrators revoke clients. Static tokens are one per user, don't expire and are stored in plain text. We scored 26 and took 10 because `?access_token=` in the URL is a documented option that the MCP guide uses for three clients (16 of 30). Access policies limit a user by collection, action, field and item rule, the MCP server is off by default, and deletes are refused unless Allow Deletes is on. No server-side approval step for other writes (16 of 20). A security guide for MCP covers prompt injection, mixing servers and auto-approval, with advice only (11 of 15). The activity log records user, action, time, IP address, user agent, collection and item, kept 30 days on Core (11 of 15). A disclosure policy with private GitHub reports and a security address, advisories published in public, and SOC 2 Type 2 with a penetration test report on the trust centre. No bug bounty found, and security.txt returns 404 (14 of 20).)
- Payments & pricing, Directus +25: BCMS 30 (No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.); Directus 55 (Scored with the self-hosted rule, taking prices from the paid options beside the free tier. No x402, MPP or L402 (0). Core is $0, Team is $499 a month on an annual term or $599 monthly, extra seats are $50 each a month, and Directus Cloud hosting is a $99 a month add-on, all public. Enterprise is priced by sales (20). The Core tier is free to self-host with no card and no account, and Cloud has a 14-day trial (20). `ADMIN_EMAIL`, `ADMIN_PASSWORD` and `ADMIN_TOKEN` create the first administrator and a static token at start-up, so the REST route needs no browser. The docs enable the MCP server only through the Studio settings page, so we took 5 off (15 of 20).)