# BCMS vs dotCMS

> dotCMS scores 57.7 (C) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/bcms-vs-dotcms
- Markdown: https://www.anchorterminal.com/compare/bcms-vs-dotcms.md (~3,800 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

dotCMS scores 57.7 (C) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.

- BCMS: grade F, 33.5/100, rank #1383 of 1486. Markdown https://www.anchorterminal.com/tools/bcms.md · JSON https://www.anchorterminal.com/api/v1/tools/bcms.json
- dotCMS: grade C, 57.7/100, rank #780 of 1486. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### BCMS (F)

Good for: Small sites and agencies that want a cheap hosted CMS an agent can edit.

Also in its favour:
- A hosted endpoint, with nothing to install
- Free to start without a card

Watch for: The MCP key is accepted only as a URL query parameter

### dotCMS (C)

Good for: Enterprises already on dotCMS who want an agent to manage content and pages.

Ahead on:
- Reliability, 47 against 15
- Schema & documentation, 65 against 50
- Agent ergonomics, 68 against 36
- Security & auth, 63 against 39
- Payments & pricing, 35 against 30
- Maintenance & community, 75 against 16

Also in its favour:
- Runs on your own machine

Watch for: Pre-1.0 package, with the dev docs still pointing at the beta tag


## Why the edge

### Maintenance & community: dotCMS +59

- BCMS (16): @thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.
- dotCMS (75): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.

### Reliability: dotCMS +32

- BCMS (15): Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.
- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.

### Agent ergonomics: dotCMS +32

- BCMS (36): 45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.
- dotCMS (68): 7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.

### Security & auth: dotCMS +24

- BCMS (39): Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.
- dotCMS (63): JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.

### Schema & documentation: dotCMS +15

- BCMS (50): The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.
- dotCMS (65): The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.

### Payments & pricing: dotCMS +5

- BCMS (30): No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.
- dotCMS (35): Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.

## Score by category

| Category | Weight | BCMS | dotCMS | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 15 | 47 | dotCMS +32 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 50 | 65 | dotCMS +15 |
| Agent ergonomics | 13% (16.2 this run) | 36 | 68 | dotCMS +32 |
| Security & auth | 14% (17.5 this run) | 39 | 63 | dotCMS +24 |
| Payments & pricing | 10% (12.5 this run) | 30 | 35 | dotCMS +5 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 16 | 75 | dotCMS +59 |
| Transparency & trust | 7% (8.8 this run) | 52 | 54 | dotCMS +2 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **33.5 · F** | **57.7 · C** | |

## Facts side by side

| Fact | BCMS | dotCMS |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Becomes tech, LLC | dotCMS LLC |
| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | no (local only) |
| Transports | HTTP, Streamable HTTP | stdio |
| Auth | API key | API key |
| Pricing | Paid | Freemium |
| x402 | no | no |
| Licence | none | BUSL-1.1 |
| Tools exposed | 45 | 7 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-03-16 | 2026-09-02 |
| Terms last updated | 2026-07-30 | no date given |
| Privacy policy last updated | 2026-07-30 | 2026-09-08 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 396 npm/wk | 43 npm/wk |

## Verdicts

**BCMS.** BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.

**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.

## Before you call either

### BCMS

1. Keep the MCP URL out of logs and shared config, since the key is inside it
2. Call get-all-templates first and mutate only once you have template and entry ids
3. Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model
4. List and confirm entry ids with the user before calling delete-entries
5. Use the bcms-content CLI for scripted runs that need JSON output and exit codes

### dotCMS

1. Search the spec with `search` before writing an `execute` call, and return only the fields you need
2. Use a token for a dedicated user and role, not an administrator's
3. Confirm with the user before execute calls that publish, archive or delete content
4. Keep results small with pick and first, since output is capped at about 25,000 characters
5. Use download_assets for theme folders so files land on disk instead of in context

## Questions

### Which is better for AI agents, BCMS or dotCMS?

dotCMS scores 57.7 (C) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.

### Do BCMS and dotCMS need an API key?

Both need an API key.

### Can an agent call BCMS and dotCMS without installing anything?

BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp. dotCMS runs on your own machine, with no hosted endpoint listed.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/bcms-vs-dotcms.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bcms-vs-dotcms.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "bcms", "b": "dotcms"}`. From a terminal: `anchor compare bcms dotcms`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bcms.json and https://www.anchorterminal.com/api/v1/tools/dotcms.json

## Other comparisons with BCMS or dotCMS

- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)
- [BCMS vs Contentstack](https://www.anchorterminal.com/compare/bcms-vs-contentstack.md)
- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)
- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)
- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)
- [BCMS vs Ghost](https://www.anchorterminal.com/compare/bcms-vs-ghost.md)
- [BCMS vs Hygraph](https://www.anchorterminal.com/compare/bcms-vs-hygraph.md)
- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)
- [BCMS vs Payload](https://www.anchorterminal.com/compare/bcms-vs-payload.md)
- [BCMS vs Prismic](https://www.anchorterminal.com/compare/bcms-vs-prismic.md)
- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)
- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)
- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)
- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)
- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)
- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)
- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)
- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)
- [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md)
- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)
- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)
- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)
- [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md)
- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)
- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)
- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)
- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)
- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)
- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)
- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp