{ "data": { "a": { "slug": "bcms", "name": "BCMS", "vendor": "Becomes tech, LLC", "vendorUrl": "https://www.thebcms.com", "kind": "http-api", "category": "cms", "summary": "BCMS is a hosted headless CMS from Becomes tech, LLC. People edit structured content in a dashboard, and agents work with templates, entries, media and languages through a REST API, a JavaScript client, a CLI and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/bcms", "markdownUrl": "https://www.anchorterminal.com/tools/bcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bcms.json", "dns": "bcms.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.thebcms.com/api/v3/mcp", "packages": [ { "registry": "npm", "name": "@thebcms/client" } ], "auth": "api-key", "authNotes": "Three-part keys (keyId.secret.instanceId) created in the dashboard and scoped to templates and media, with schema tools only for keys allowed them. The MCP endpoint takes the key only as the `mcpKey` query parameter, and the REST examples pass `apiKey` in the query string. The docs advise a key per person, client and environment and regular rotation.", "pricing": "paid", "pricingNotes": "Hobby $5 a month ($4 billed yearly) with 2 seats, 100 entries and 500 MB of media; Pro $50 a month ($33 yearly) with 5 seats, then $15 a seat a month, and unlimited entries; Enterprise by quote. Every plan starts with a 14-day free trial with no card. No self-hosted edition.", "priceSummary": "$5 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the docs, the MCP page or pricing.md (checked 2026-11-06).", "endpoints": [] }, "toolCount": 45, "popularity": { "githubStars": null, "npmWeekly": 396, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.thebcms.com/docs", "llmsTxt": "https://www.thebcms.com/llms.txt", "capabilities": [ "cms.content", "cms.assets", "cms.localisation", "cms.schema", "cms.publish" ], "tags": [ "hosted", "mcp", "remote-mcp", "llms-txt", "no-card", "closed-source", "webhooks", "typescript", "cli" ], "lastRelease": "2026-03-16", "graded": true, "anchor": { "graded": true, "score": 33.5, "grade": "F", "agentReady": false, "rank": 1383, "ranked": true, "rankOf": 1486, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "bestFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "strengths": [ "Remote MCP server covering templates, entries, statuses, entry history, media, languages and trash", "Keys scoped to the templates and media an agent needs, with schema tools gated separately", "llms.txt that says when to use BCMS and when not to, plus a public SKILL.md", "Entry history and trash readable through MCP, so an agent can trace and recover changes", "14-day trial with no card, then plans from $5 a month" ], "weaknesses": [ "The MCP key is accepted only as a URL query parameter", "No status page, documented rate limits, SLA or changelog found", "No security.txt, disclosure policy or certification found", "The JavaScript client hasn't been released since March 2026", "No self-hosted edition; the open-source repository has been unmaintained since October 2024" ], "agentNotes": [ "Keep the MCP URL out of logs and shared config, since the key is inside it", "Call get-all-templates first and mutate only once you have template and entry ids", "Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model", "List and confirm entry ids with the user before calling delete-entries", "Use the bcms-content CLI for scripted runs that need JSON output and exit codes" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 33.5 } ], "editorialScores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 48 }, "provenanceScore": 56, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @thebcms/client", "claudeCode": "claude mcp add --transport http bcms \"https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE\"", "config": { "mcpServers": { "bcms": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/bcms" }, "area": "business", "unitPrices": [ { "item": "Hobby plan", "unit": "month", "usd": 5, "note": "$4 a month billed yearly; 2 seats, 100 entries" }, { "item": "Pro plan", "unit": "month", "usd": 50, "note": "$33 a month billed yearly; 5 seats" }, { "item": "Extra Pro seat", "unit": "seat-month", "usd": 15, "note": "$120 a year on yearly billing" } ], "provenance": { "legalEntity": "Becomes tech, LLC", "domain": "thebcms.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.thebcms.com/terms-of-use/", "privacy": "https://www.thebcms.com/privacy-policy/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both effective 30 July 2026, name Becomes tech, LLC, a Delaware LLC. The terms forbid scraping or crawling that burdens or abuses the services, except through the documented APIs within rate limits.", "www.thebcms.com/robots.txt allows all. app.thebcms.com/robots.txt disallows all paths.", "www.thebcms.com/.well-known/security.txt returned 404 and no status page was found.", "RDAP gave no registration date for thebcms.com through rdap.org." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bcms.json", "live": { "slug": "bcms", "probe": { "target": "https://app.thebcms.com/api/v3/mcp", "method": "get", "lastAt": "2026-11-07T18:20:13.025269198Z", "lastOk": true, "lastStatus": 400, "lastMs": 197, "authRequired": false, "uptime24h": 99.5, "uptime30d": 99.5, "p50ms24h": 141, "p95ms24h": 393, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 186 } ] }, "versions": [ { "registry": "npm", "name": "@thebcms/client", "version": "2.0.3", "seenAt": "2026-11-06T23:10:32.023184196Z" } ], "npmWeekly": 396, "securityTxt": { "url": "https://thebcms.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:49.817334601Z" }, "llmsTxt": { "url": "https://www.thebcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:42.21650798Z" }, "pages": [ { "url": "https://www.thebcms.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:35:35.490295236Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "abae80fa615e" }, { "url": "https://www.thebcms.com/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:35:37.777884178Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "58d8ef9074aa" } ], "mcpTools": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE", "checkedAt": "2026-11-07T01:42:42.874889438Z", "status": "error", "note": "initialize: no JSON-RPC answer", "changedAt": "2026-11-07T01:42:42.874889438Z" }, "updatedAt": "2026-11-07T18:20:13.025269198Z" } }, "answer": "Ghost scores 51.2 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.", "b": { "slug": "ghost", "name": "Ghost", "vendor": "Ghost Foundation", "vendorUrl": "https://ghost.org", "kind": "http-api", "category": "cms", "summary": "Ghost is an open-source publishing platform for websites, newsletters and paid memberships, self-hosted or run by the Ghost Foundation as Ghost(Pro). Agents create, edit and publish posts and pages and upload images through its Admin API.", "url": "https://www.anchorterminal.com/tools/ghost", "markdownUrl": "https://www.anchorterminal.com/tools/ghost.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ghost.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ghost.json", "dns": "ghost.grade.anchorterminal.com", "repo": "https://github.com/TryGhost/Ghost", "license": "MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "ghost" }, { "registry": "npm", "name": "@tryghost/admin-api" }, { "registry": "npm", "name": "ghost-cli" } ], "auth": "api-key", "authNotes": "Self-serve, with no app review or partner approval. An owner or administrator creates a custom integration in Ghost Admin and copies its Admin API key, an id and a hex secret joined by a colon. The client signs an HS256 JSON Web Token with the secret (`kid` the id, `aud` `/admin/`, expiry at most 5 minutes) and sends it as `Authorization: Ghost \u003ctoken\u003e`. Integrations hold one fixed permission set with no scopes. A staff access token from a user's profile works the same way and carries that user's role. Session login with email and password is meant for clients where the user is present. On Ghost(Pro) the Admin API and custom integrations need the Publisher plan or above.", "pricing": "freemium", "pricingNotes": "The software is free under MIT to self-host, so an agent's owner can start without a contract or a card. Ghost(Pro) lists Starter at $18, Publisher at $29 and Business at $199 a month billed yearly for up to 1,000 members, rising with audience size, and Custom through sales. The Admin API isn't included in Starter. Plans show a free trial, and we couldn't read whether it needs a card (checked 2026-10-08).", "priceSummary": "$18 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation index, the pricing page or the repository's file list (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 55500, "npmWeekly": 23628, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.ghost.org/admin-api", "llmsTxt": "https://docs.ghost.org/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets" ], "tags": [ "open-source", "self-hosted", "hosted", "rest", "llms-txt", "webhooks", "newsletter", "memberships", "nodejs", "status-page" ], "lastRelease": "2026-11-03", "graded": true, "anchor": { "graded": true, "score": 51.2, "grade": "D", "agentReady": false, "rank": 1027, "ranked": true, "rankOf": 1486, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 85, "payments": 50, "reliability": 83, "schema": 51, "security": 56, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -15, "negativeNotes": [ "4 November 2025 to 27 October 2026: OSV holds 46 advisories for the `ghost` package published in the 12 months, 2 critical, 13 high, 28 moderate and 3 low, all with fixed versions and published by Ghost on GitHub. Counted one by one by this run's values (a fixed High under two months 2, older Criticals and Highs 1, vendor-published fixed Moderates 1, fixed Lows 0), they pass the floor on the 8 Highs published on 7 October 2026 alone, among them GHSA-788w-68h3-cvxp and GHSA-jj74-hc2q-xrvm (remote code execution through bookmark card images and theme translation files), GHSA-v6q3-xqxm-6f5v (invite token disclosure) and five stored-XSS advisories. Self-hosted-only advisories count, since the listing covers the software and Ghost(Pro). The newest, GHSA-qrh6-cwg3-343x (moderate, comment like authorisation bypass, fixed in 6.44.1), was published on 27 October 2026. -15, the floor (https://api.osv.dev/v1/query, https://github.com/TryGhost/Ghost/security/advisories)" ], "verdict": "A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical.", "bestFor": "A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.", "strengths": [ "Admin API keys sign JSON Web Tokens that last at most 5 minutes and travel in the Authorization header, so the key itself is never sent", "A staff access token carries its user's role, and a Contributor can add and edit drafts but can't change a post's status", "Every PUT must send the post's current `updated_at`, which Ghost uses for collision detection", "Weekly releases, with v6.70.0 to v6.74.0 tagged between 13 October and 3 November 2026", "MIT licence, with llms.txt, llms-full.txt and a Markdown copy of every docs page" ], "weaknesses": [ "No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository", "A custom integration has one fixed permission set covering posts, members, settings, themes and users, with no scopes and no read-only Admin key", "46 advisories published in 12 months to 27 October 2026, 15 high or critical, including remote code execution through bookmark card images", "No content locales or custom content types, and the Admin API has no documented route for restoring a post revision", "On Ghost(Pro) the Admin API and custom integrations start at the Publisher plan, not Starter" ], "agentNotes": [ "Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set `kid` to the key id, `aud` to `/admin/` and `exp` at most 5 minutes ahead", "Set `status` to `draft` on every create unless told to publish, and publish later with a PUT that sets `status` to `published`", "GET the post before each PUT and send its `updated_at` back. Tags and authors in a PUT replace the existing lists", "Send content as a Lexical JSON string, or add `?source=html` and send `html`. The HTML conversion is lossy unless wrapped in an HTML card", "Page through lists with `limit` up to 100 and `page`. Since Ghost 6.0 `limit=all` returns 100 items without an error" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 51.2 } ], "editorialScores": { "ergonomics": 69, "maintenance": 85, "payments": 50, "reliability": 83, "schema": 51, "security": 56, "transparency": 76 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @tryghost/admin-api", "http": "curl -H \"Authorization: Ghost $token\" -H \"Accept-Version: $version\" https://{admin_domain}/ghost/api/admin/{resource}/" }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/ghost" }, "area": "business", "unitPrices": [ { "item": "Self-hosted Ghost", "unit": "month", "usd": 0, "note": "MIT, you pay for your own hosting and email delivery" }, { "item": "Ghost(Pro) Starter", "unit": "month", "usd": 18, "note": "billed yearly, up to 1,000 members, no Admin API" }, { "item": "Ghost(Pro) Publisher", "unit": "month", "usd": 29, "note": "billed yearly, up to 1,000 members, 3 staff users, Admin API included" }, { "item": "Ghost(Pro) Business", "unit": "month", "usd": 199, "note": "billed yearly, up to 1,000 members, 15 staff users" } ], "provenance": { "legalEntity": "Ghost Foundation Ltd", "domain": "ghost.org", "domainRegistered": "2005-06-25", "endpointOnVendorDomain": false, "terms": "https://ghost.org/terms/", "privacy": "https://ghost.org/privacy/", "statusPage": "https://ghoststatus.org", "changelog": "https://github.com/TryGhost/Ghost/releases", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms govern the Ghost.org website, the Ghost software and the hosted service, and name the Ghost Foundation as owner and operator under the law of England and Wales. The privacy policy names Ghost Foundation Ltd. Neither page showed a dated revision that we could read.", "The privacy policy covers Ghost Foundation's own website and services. Content on a self-hosted site stays on its owner's server and isn't covered by it.", "A self-hosted install answers on its owner's domain. Ghost(Pro) sites use a `*.ghost.io` admin domain.", "https://ghost.org/.well-known/security.txt returned 404 on 8 October 2026. SECURITY.md in the repository and https://docs.ghost.org/security give security@ghost.org and a disclosure policy.", "RDAP for ghost.org gives a registration date of 2005-06-25 and a transfer on 2013-09-12.", "status.ghost.org redirects to ghoststatus.org, an incident.io page for Ghost(Pro), not for self-hosted installs. It listed three minor incidents between 10 July and 8 October 2026." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ghost.json", "live": { "slug": "ghost", "vendorStatus": { "page": "https://ghoststatus.org", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:12.785760962Z" }, "versions": [ { "registry": "github", "name": "TryGhost/Ghost", "version": "v6.75.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:28:07.551181612Z" }, { "registry": "npm", "name": "@tryghost/admin-api", "version": "1.14.14", "seenAt": "2026-11-06T23:28:03.481723829Z" }, { "registry": "npm", "name": "ghost", "version": "6.75.0", "seenAt": "2026-11-06T23:28:03.271076255Z" }, { "registry": "npm", "name": "ghost-cli", "version": "1.34.1", "seenAt": "2026-11-06T23:28:05.5408522Z" } ], "githubStars": 55700, "npmWeekly": 27684, "securityTxt": { "url": "https://ghost.org/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:51.111296428Z" }, "llmsTxt": { "url": "https://docs.ghost.org/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:35.412849236Z" }, "domain": { "domain": "ghost.org", "registered": "2005-06-25", "source": "https://rdap.publicinterestregistry.org/rdap/domain/ghost.org", "checkedAt": "2026-11-01T14:09:34.995895353Z" }, "pages": [ { "url": "https://ghost.org/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:10:26.706948154Z", "changedAt": "2026-11-05T12:33:58.2502144Z", "fingerprint": "d7b08147c021" }, { "url": "https://ghost.org/terms/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:10:29.038519001Z", "changedAt": "2026-11-05T12:34:00.703860998Z", "fingerprint": "65e4a1f15699" } ], "github": { "repo": "tryghost/ghost", "checkedAt": "2026-11-02T09:33:05.874117023Z", "stars": 55656, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:28:37Z", "openIssues": 31, "openPRs": 165, "issuesOpened90d": 68, "issuesClosed90d": 67, "prsMerged90d": 2135, "ci": { "branch": "main", "runs": 50, "success": 44, "failure": 1, "other": 5, "latest": "success", "latestAt": "2026-11-02T06:16:34Z" }, "advisories": [ { "ghsa": "GHSA-cr6m-qrr6-q3j8", "cve": "CVE-2026-84383", "severity": "high", "published": "2026-10-01T15:22:42Z" }, { "ghsa": "GHSA-788w-68h3-cvxp", "cve": "CVE-2026-105642", "severity": "high", "published": "2026-10-01T15:22:29Z" }, { "ghsa": "GHSA-69qc-f5m6-889c", "cve": "CVE-2026-105643", "severity": "high", "published": "2026-10-01T15:20:36Z" }, { "ghsa": "GHSA-hqq2-xqr2-fmx2", "cve": "CVE-2026-105644", "severity": "medium", "published": "2026-10-01T15:20:13Z" }, { "ghsa": "GHSA-9m4w-fmjw-fvjq", "cve": "CVE-2026-105645", "severity": "medium", "published": "2026-10-01T15:19:23Z" }, { "ghsa": "GHSA-fwh9-qg68-vxp4", "cve": "CVE-2026-105646", "severity": "medium", "published": "2026-10-01T15:17:44Z" }, { "ghsa": "GHSA-322m-ff4g-9vx9", "cve": "CVE-2026-105647", "severity": "medium", "published": "2026-09-24T14:25:11Z" }, { "ghsa": "GHSA-r7f2-6fj8-6fg2", "cve": "CVE-2026-105648", "severity": "medium", "published": "2026-09-24T14:24:59Z" }, { "ghsa": "GHSA-8575-cr6v-7jh4", "cve": "CVE-2026-105649", "severity": "high", "published": "2026-09-24T14:24:46Z" }, { "ghsa": "GHSA-v3xr-g6p2-fvgv", "cve": "CVE-2026-105650", "severity": "high", "published": "2026-09-17T18:24:59Z" }, { "ghsa": "GHSA-347q-26qq-h2p6", "cve": "CVE-2026-105651", "severity": "high", "published": "2026-09-17T18:23:00Z" }, { "ghsa": "GHSA-53vv-xm9f-mm82", "cve": "CVE-2026-105652", "severity": "low", "published": "2026-09-17T18:21:33Z" }, { "ghsa": "GHSA-v6q3-xqxm-6f5v", "cve": "CVE-2026-105675", "severity": "high", "published": "2026-09-17T18:19:01Z" }, { "ghsa": "GHSA-m382-6jw4-fmp6", "cve": "CVE-2026-105676", "severity": "medium", "published": "2026-09-17T18:17:57Z" }, { "ghsa": "GHSA-jj74-hc2q-xrvm", "cve": "CVE-2026-105677", "severity": "high", "published": "2026-09-17T18:15:14Z" }, { "ghsa": "GHSA-4pvx-fwjj-8gpc", "cve": "CVE-2026-105678", "severity": "medium", "published": "2026-09-17T18:12:05Z" }, { "ghsa": "GHSA-gfjp-2p8f-94qv", "cve": "CVE-2026-105679", "severity": "high", "published": "2026-09-17T18:02:48Z" }, { "ghsa": "GHSA-rcx7-6m7p-xw5c", "severity": "high", "published": "2026-09-11T15:47:08Z" }, { "ghsa": "GHSA-ffmj-3ppp-cj4r", "severity": "high", "published": "2026-09-11T15:46:48Z" }, { "ghsa": "GHSA-rrq6-9r3c-7w26", "severity": "medium", "published": "2026-09-09T00:22:45Z" }, { "ghsa": "GHSA-mp9q-4q6m-44f5", "cve": "CVE-2026-103292", "severity": "high", "published": "2026-09-08T22:49:46Z" }, { "ghsa": "GHSA-q734-xjgc-vpj9", "severity": "critical", "published": "2026-09-03T20:44:38Z" }, { "ghsa": "GHSA-rv92-9vfp-2826", "severity": "medium", "published": "2026-09-03T20:40:32Z" }, { "ghsa": "GHSA-x3mg-q38v-m562", "cve": "CVE-2026-105680", "severity": "medium", "published": "2026-09-03T20:39:42Z" }, { "ghsa": "GHSA-xcgh-2828-cvmx", "severity": "medium", "published": "2026-09-03T20:39:22Z" }, { "ghsa": "GHSA-qppx-rw6v-xjqf", "severity": "high", "published": "2026-09-03T20:36:45Z" }, { "ghsa": "GHSA-ghq6-q78f-2cpg", "severity": "medium", "published": "2026-08-20T16:58:52Z" }, { "ghsa": "GHSA-5ppm-p957-x46r", "severity": "medium", "published": "2026-08-20T16:57:44Z" }, { "ghsa": "GHSA-jj85-wvj2-r86m", "severity": "medium", "published": "2026-08-20T16:57:23Z" }, { "ghsa": "GHSA-6v8p-3jx9-8chr", "severity": "medium", "published": "2026-08-13T15:00:36Z" }, { "ghsa": "GHSA-5pxf-whwv-g54g", "severity": "high", "published": "2026-08-13T15:00:22Z" }, { "ghsa": "GHSA-v9vj-6fq5-99xj", "severity": "medium", "published": "2026-08-13T15:00:10Z" }, { "ghsa": "GHSA-8vhf-xxpj-4qrg", "severity": "high", "published": "2026-08-13T14:59:47Z" }, { "ghsa": "GHSA-5685-hwm9-62cg", "severity": "medium", "published": "2026-08-13T14:59:34Z" }, { "ghsa": "GHSA-vm82-r49m-224q", "severity": "medium", "published": "2026-08-13T14:55:42Z" }, { "ghsa": "GHSA-q55r-w7fh-rmh6", "severity": "high", "published": "2026-08-13T14:55:25Z" }, { "ghsa": "GHSA-mf3j-vxq2-vmc4", "severity": "medium", "published": "2026-08-13T14:55:04Z" }, { "ghsa": "GHSA-q98w-jm4q-wch7", "severity": "medium", "published": "2026-08-12T15:27:09Z" }, { "ghsa": "GHSA-vf9h-87xm-g767", "severity": "medium", "published": "2026-08-12T15:26:22Z" }, { "ghsa": "GHSA-pv24-pfvg-vr83", "severity": "high", "published": "2026-08-11T16:03:10Z" }, { "ghsa": "GHSA-qrh6-cwg3-343x", "severity": "medium", "published": "2026-08-11T16:02:11Z" }, { "ghsa": "GHSA-6q6j-f24j-p477", "cve": "CVE-2026-105681", "severity": "medium", "published": "2026-08-11T16:01:40Z" }, { "ghsa": "GHSA-354h-gmhv-mr9c", "cve": "CVE-2026-105682", "severity": "low", "published": "2026-08-11T16:01:02Z" }, { "ghsa": "GHSA-83rp-q473-j88c", "cve": "CVE-2026-105683", "severity": "low", "published": "2026-08-11T16:00:28Z" }, { "ghsa": "GHSA-4wx2-7gvj-qfq3", "cve": "CVE-2026-70589", "severity": "medium", "published": "2026-07-30T17:38:18Z" }, { "ghsa": "GHSA-7mpp-r37j-x5wh", "cve": "CVE-2026-70594", "severity": "medium", "published": "2026-07-30T17:38:09Z" }, { "ghsa": "GHSA-2gx6-7gx2-wwcf", "cve": "CVE-2026-70588", "severity": "medium", "published": "2026-07-30T17:37:55Z" }, { "ghsa": "GHSA-cjc9-q5gf-327p", "cve": "CVE-2026-70593", "severity": "medium", "published": "2026-07-30T17:37:42Z" }, { "ghsa": "GHSA-x5mm-wm4g-j5xv", "cve": "CVE-2026-70595", "severity": "medium", "published": "2026-07-30T17:37:32Z" }, { "ghsa": "GHSA-pr22-p9rp-2cqv", "cve": "CVE-2026-70596", "severity": "medium", "published": "2026-07-30T17:37:22Z" }, { "ghsa": "GHSA-cj62-hvv2-2q5h", "cve": "CVE-2026-70592", "severity": "medium", "published": "2026-07-30T17:37:04Z" }, { "ghsa": "GHSA-gcvv-72q8-9v76", "cve": "CVE-2026-70591", "severity": "medium", "published": "2026-07-30T17:36:37Z" }, { "ghsa": "GHSA-jm22-3w23-5q7w", "cve": "CVE-2026-70590", "severity": "medium", "published": "2026-07-30T17:36:22Z" }, { "ghsa": "GHSA-xm43-3m56-w3wf", "cve": "CVE-2026-59817", "severity": "medium", "published": "2026-06-23T19:47:17Z" }, { "ghsa": "GHSA-xpp7-93x6-v29m", "cve": "CVE-2026-53950", "severity": "high", "published": "2026-06-10T08:25:13Z" }, { "ghsa": "GHSA-jx35-x7fj-vgpr", "cve": "CVE-2026-53949", "severity": "medium", "published": "2026-06-10T08:24:57Z" }, { "ghsa": "GHSA-944x-pm95-3jpr", "cve": "CVE-2026-53948", "severity": "medium", "published": "2026-06-10T08:24:43Z" }, { "ghsa": "GHSA-chgm-3698-jm42", "cve": "CVE-2026-53947", "severity": "medium", "published": "2026-06-10T08:24:25Z" }, { "ghsa": "GHSA-g366-23fw-ggp6", "cve": "CVE-2026-53946", "severity": "medium", "published": "2026-06-10T08:24:06Z" }, { "ghsa": "GHSA-ch52-px8q-f22j", "cve": "CVE-2026-53945", "severity": "medium", "published": "2026-06-10T08:23:44Z" }, { "ghsa": "GHSA-wvp2-4qqp-4h3r", "cve": "CVE-2026-53944", "severity": "medium", "published": "2026-06-10T08:23:16Z" }, { "ghsa": "GHSA-62q6-4hv4-vjrw", "cve": "CVE-2026-53943", "severity": "critical", "published": "2026-05-28T07:03:25Z" }, { "ghsa": "GHSA-9m84-wc28-w895", "cve": "CVE-2026-29784", "severity": "high", "published": "2026-03-04T17:51:38Z" }, { "ghsa": "GHSA-cgc2-rcrh-qr5x", "cve": "CVE-2026-29053", "severity": "high", "published": "2026-03-02T15:45:46Z" }, { "ghsa": "GHSA-w52v-v783-gw97", "cve": "CVE-2026-26980", "severity": "critical", "published": "2026-02-16T18:04:35Z" }, { "ghsa": "GHSA-gv6q-2m97-882h", "cve": "CVE-2026-24778", "severity": "high", "published": "2026-01-27T12:28:29Z" }, { "ghsa": "GHSA-gjrp-xgmh-x9qq", "cve": "CVE-2026-22596", "severity": "medium", "published": "2026-01-08T14:38:23Z" }, { "ghsa": "GHSA-vmc4-9828-r48r", "cve": "CVE-2026-22597", "severity": "medium", "published": "2026-01-08T14:38:01Z" }, { "ghsa": "GHSA-9xg7-mwmp-xmjx", "cve": "CVE-2026-22595", "severity": "high", "published": "2026-01-08T14:37:41Z" }, { "ghsa": "GHSA-5fp7-g646-ccf4", "cve": "CVE-2026-22594", "severity": "high", "published": "2026-01-08T14:37:08Z" }, { "ghsa": "GHSA-f7qg-xj45-w956", "cve": "CVE-2025-9862", "severity": "medium", "published": "2025-09-14T13:48:18Z" }, { "ghsa": "GHSA-78x2-cwp9-5j42", "cve": "CVE-2024-43409", "severity": "medium", "published": "2024-08-20T14:43:13Z" }, { "ghsa": "GHSA-9c9v-w225-v5rg", "cve": "CVE-2023-40028", "severity": "medium", "published": "2023-08-15T11:36:14Z" }, { "ghsa": "GHSA-r97q-ghch-82j9", "cve": "CVE-2023-31133", "severity": "high", "published": "2023-05-03T12:55:49Z" }, { "ghsa": "GHSA-9gh8-wp53-ccc6", "cve": "CVE-2022-41654", "severity": "high", "published": "2022-11-28T15:06:43Z" }, { "ghsa": "GHSA-7v28-g2pq-ggg8", "cve": "CVE-2022-24785", "severity": "medium", "published": "2022-06-15T03:15:13Z" }, { "ghsa": "GHSA-65p7-pjj8-ggmr", "severity": "medium", "published": "2021-09-23T10:28:44Z" }, { "ghsa": "GHSA-wfrj-qqc2-83cm", "severity": "medium", "published": "2021-09-17T16:10:16Z" }, { "ghsa": "GHSA-j5c2-hm46-wp5c", "cve": "CVE-2021-39192", "severity": "medium", "published": "2021-07-20T15:15:46Z" }, { "ghsa": "GHSA-9fgx-q25h-jxrg", "cve": "CVE-2021-29484", "severity": "high", "published": "2021-04-29T11:19:15Z" } ], "replies": { "sampled": 25, "unanswered": 0, "medianDays": 4.8 } }, "updatedAt": "2026-11-07T18:21:12.785760962Z" } }, "edges": [ { "by": 69, "category": "maintenance", "leads": "ghost", "name": "Maintenance \u0026 community", "reasons": { "a": "@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.", "b": "v6.74.0 was tagged on 3 November 2026, the day before this check, after v6.70.0 (13 October), v6.71.0 (15 October), v6.72.0 (20 October) and v6.73.0 (27 October) (30). Five tags since 13 October alone, and 19 npm versions between 10 July and 8 October per the earlier check (20). 33 open issues on 8 October and advisories fixed and published with reporter credits; reply times on individual issues not read (18 of 25). @tryghost/admin-api 1.14.13 was published on 21 September 2026 per the 8 October check; npm couldn't be read on 4 November. The official MCP registry listed third-party Ghost servers only (10 of 15). A Renovate workflow keeps dependencies current. The CI badge on main read failing on 8 October; today's result is unread (7 of 10)." }, "scores": { "a": 16, "b": 85 } }, { "by": 68, "category": "reliability", "leads": "ghost", "name": "Reliability", "reasons": { "a": "Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.", "b": "Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official `ghost` package on npm, with Node.js ^22.23.1 or ^24.20.0 in `engines` in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of `limit=all` documented there (13 of 15). 6.x is the current stable line (15)." }, "scores": { "a": 15, "b": 83 } }, { "by": 33, "category": "ergonomics", "leads": "ghost", "name": "Agent ergonomics", "reasons": { "a": "45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.", "b": "Per the 8 October check, not re-read on 4 November (docs host paused under the terms). `fields`, `include` and `formats` size a response, and lists return 15 records by default (20 of 25). `page`, `limit` up to 100, `order` and a `filter` query language, with `meta.pagination` on every list (20). Errors are JSON with `message` and `errorType`, and the documented list is short (13 of 20). No idempotency keys. A PUT must carry the current `updated_at` and is refused on a collision, and a repeated POST creates a second post (8 of 20). A create needs only `title`. The one official client is JavaScript, @tryghost/admin-api (8 of 15)." }, "scores": { "a": 36, "b": 69 } }, { "by": 23, "category": "transparency", "leads": "ghost", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.", "b": "MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and `useTinfoil` for all. The default configuration also points `updateCheck` at updates.ghost.org, which that section doesn't list; the 4 November source sends only `ghost_version` in that request (13 of 20)." }, "scores": { "a": 52, "b": 75 } }, { "by": 20, "category": "payments", "leads": "ghost", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.", "b": "Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10)." }, "scores": { "a": 30, "b": 50 } }, { "by": 17, "category": "security", "leads": "ghost", "name": "Security \u0026 auth", "reasons": { "a": "Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.", "b": "An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at `GET /actions`. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20)." }, "scores": { "a": 39, "b": 56 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Becomes tech, LLC", "b": "Ghost Foundation", "name": "Vendor" }, { "a": "https://app.thebcms.com/api/v3/mcp", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms", "name": "Licence" }, { "a": "45", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-03-16", "b": "2026-11-03", "name": "Last release" }, { "a": "2026-07-30", "b": "no date given", "name": "Terms last updated" }, { "a": "2026-07-30", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "396 npm/wk", "b": "56k stars, 24k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Ghost scores 51.2 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.", "question": "Which is better for AI agents, BCMS or Ghost?" }, { "answer": "Both need an API key.", "question": "Do BCMS and Ghost need an API key?" }, { "answer": "BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp. No hosted endpoint is listed for Ghost.", "question": "Can an agent call BCMS and Ghost without installing anything?" }, { "answer": "No open-source release is listed for BCMS. Ghost is open source (MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms).", "question": "Are BCMS and Ghost open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card", "No incidents deducted, where Ghost loses 15 points for them" ], "goodFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "slug": "bcms", "watchFor": "The MCP key is accepted only as a URL query parameter" }, { "aheadOn": [ "Reliability, 83 against 15", "Agent ergonomics, 69 against 36", "Security \u0026 auth, 56 against 39", "Payments \u0026 pricing, 50 against 30", "Maintenance \u0026 community, 85 against 16", "Transparency \u0026 trust, 75 against 52" ], "also": [ "Open source" ], "goodFor": "A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.", "slug": "ghost", "watchFor": "No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository" } ], "history": { "bcms": null, "ghost": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-04", "delta": -7.4, "from": 58.6, "fromGrade": "C", "to": 51.2, "toGrade": "D" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.2, "from": 58.4, "fromGrade": "C", "to": 58.6, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 58.3, "fromGrade": "C", "to": 58.4, "toGrade": "C" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-buttercms.json", "title": "BCMS vs ButterCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-buttercms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-contentstack.json", "title": "BCMS vs Contentstack", "url": "https://www.anchorterminal.com/compare/bcms-vs-contentstack" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-datocms.json", "title": "BCMS vs DatoCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-directus.json", "title": "BCMS vs Directus", "url": "https://www.anchorterminal.com/compare/bcms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-hygraph.json", "title": "BCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/bcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.json", "title": "BCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-payload.json", "title": "BCMS vs Payload", "url": "https://www.anchorterminal.com/compare/bcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-prismic.json", "title": "BCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/bcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-sanity.json", "title": "BCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/bcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-storyblok.json", "title": "BCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/bcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-strapi.json", "title": "BCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/bcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-webflow.json", "title": "BCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/bcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-wordpress.json", "title": "BCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/bcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-ghost.json", "title": "ButterCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/buttercms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-ghost.json", "title": "Contentstack vs Ghost", "url": "https://www.anchorterminal.com/compare/contentstack-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.json", "title": "Cosmic vs Ghost", "url": "https://www.anchorterminal.com/compare/cosmic-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-ghost.json", "title": "DatoCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/datocms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-ghost.json", "title": "Directus vs Ghost", "url": "https://www.anchorterminal.com/compare/directus-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-ghost.json", "title": "dotCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/dotcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-hygraph.json", "title": "Ghost vs Hygraph", "url": "https://www.anchorterminal.com/compare/ghost-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-kontent-ai.json", "title": "Ghost vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/ghost-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-payload.json", "title": "Ghost vs Payload", "url": "https://www.anchorterminal.com/compare/ghost-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-prismic.json", "title": "Ghost vs Prismic", "url": "https://www.anchorterminal.com/compare/ghost-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-sanity.json", "title": "Ghost vs Sanity", "url": "https://www.anchorterminal.com/compare/ghost-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-storyblok.json", "title": "Ghost vs Storyblok", "url": "https://www.anchorterminal.com/compare/ghost-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-strapi.json", "title": "Ghost vs Strapi", "url": "https://www.anchorterminal.com/compare/ghost-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-webflow.json", "title": "Ghost vs Webflow", "url": "https://www.anchorterminal.com/compare/ghost-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-wordpress.json", "title": "Ghost vs WordPress", "url": "https://www.anchorterminal.com/compare/ghost-vs-wordpress" } ], "panel": null, "scores": [ { "bcms": 15, "by": 68, "edge": "ghost", "ghost": 83, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "bcms": 50, "by": 1, "edge": "ghost", "ghost": 51, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "bcms": 36, "by": 33, "edge": "ghost", "ghost": 69, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "bcms": 39, "by": 17, "edge": "ghost", "ghost": 56, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "bcms": 30, "by": 20, "edge": "ghost", "ghost": 50, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "bcms": 16, "by": 69, "edge": "ghost", "ghost": 85, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "bcms": 52, "by": 23, "edge": "ghost", "ghost": 75, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Ghost scores 51.2 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "bcms": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "ghost": "A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/bcms-vs-ghost", "json": "https://www.anchorterminal.com/compare/bcms-vs-ghost.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/bcms-vs-ghost.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/bcms-vs-ghost.min.md" }, "markdown": "Ghost scores 51.2 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.\n\n- BCMS: grade F, 33.5/100, rank #1383 of 1486. Markdown https://www.anchorterminal.com/tools/bcms.md · JSON https://www.anchorterminal.com/api/v1/tools/bcms.json\n- Ghost: grade D, 51.2/100, rank #1027 of 1486. Markdown https://www.anchorterminal.com/tools/ghost.md · JSON https://www.anchorterminal.com/api/v1/tools/ghost.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### BCMS (F)\n\nGood for: Small sites and agencies that want a cheap hosted CMS an agent can edit.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n- No incidents deducted, where Ghost loses 15 points for them\n\nWatch for: The MCP key is accepted only as a URL query parameter\n\n### Ghost (D)\n\nGood for: A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.\n\nAhead on:\n- Reliability, 83 against 15\n- Agent ergonomics, 69 against 36\n- Security \u0026 auth, 56 against 39\n- Payments \u0026 pricing, 50 against 30\n- Maintenance \u0026 community, 85 against 16\n- Transparency \u0026 trust, 75 against 52\n\nAlso in its favour:\n- Open source\n\nWatch for: No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Ghost +69\n\n- BCMS (16): @thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.\n- Ghost (85): v6.74.0 was tagged on 3 November 2026, the day before this check, after v6.70.0 (13 October), v6.71.0 (15 October), v6.72.0 (20 October) and v6.73.0 (27 October) (30). Five tags since 13 October alone, and 19 npm versions between 10 July and 8 October per the earlier check (20). 33 open issues on 8 October and advisories fixed and published with reporter credits; reply times on individual issues not read (18 of 25). @tryghost/admin-api 1.14.13 was published on 21 September 2026 per the 8 October check; npm couldn't be read on 4 November. The official MCP registry listed third-party Ghost servers only (10 of 15). A Renovate workflow keeps dependencies current. The CI badge on main read failing on 8 October; today's result is unread (7 of 10).\n\n### Reliability: Ghost +68\n\n- BCMS (15): Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.\n- Ghost (83): Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official `ghost` package on npm, with Node.js ^22.23.1 or ^24.20.0 in `engines` in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of `limit=all` documented there (13 of 15). 6.x is the current stable line (15).\n\n### Agent ergonomics: Ghost +33\n\n- BCMS (36): 45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.\n- Ghost (69): Per the 8 October check, not re-read on 4 November (docs host paused under the terms). `fields`, `include` and `formats` size a response, and lists return 15 records by default (20 of 25). `page`, `limit` up to 100, `order` and a `filter` query language, with `meta.pagination` on every list (20). Errors are JSON with `message` and `errorType`, and the documented list is short (13 of 20). No idempotency keys. A PUT must carry the current `updated_at` and is refused on a collision, and a repeated POST creates a second post (8 of 20). A create needs only `title`. The one official client is JavaScript, @tryghost/admin-api (8 of 15).\n\n### Transparency \u0026 trust: Ghost +23\n\n- BCMS (52): A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.\n- Ghost (75): MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and `useTinfoil` for all. The default configuration also points `updateCheck` at updates.ghost.org, which that section doesn't list; the 4 November source sends only `ghost_version` in that request (13 of 20).\n\n### Payments \u0026 pricing: Ghost +20\n\n- BCMS (30): No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.\n- Ghost (50): Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10).\n\n### Security \u0026 auth: Ghost +17\n\n- BCMS (39): Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.\n- Ghost (56): An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at `GET /actions`. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20).\n\n## Score by category\n\n| Category | Weight | BCMS | Ghost | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 83 | Ghost +68 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 50 | 51 | Ghost +1 |\n| Agent ergonomics | 13% (16.2 this run) | 36 | 69 | Ghost +33 |\n| Security \u0026 auth | 14% (17.5 this run) | 39 | 56 | Ghost +17 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 50 | Ghost +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 16 | 85 | Ghost +69 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 75 | Ghost +23 |\n| Negative events | ≤15 | 0 | -15 | |\n| **Total** | | **33.5 · F** | **51.2 · D** | |\n\n## Facts side by side\n\n| Fact | BCMS | Ghost |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Becomes tech, LLC | Ghost Foundation |\n| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | no (local only) |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | API key | API key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | none | MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms |\n| Tools exposed | 45 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-03-16 | 2026-11-03 |\n| Terms last updated | 2026-07-30 | no date given |\n| Privacy policy last updated | 2026-07-30 | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 396 npm/wk | 56k stars, 24k npm/wk |\n\n## How the scores have moved\n\n### BCMS\n\nNo score change since it was listed.\n\n### Ghost\n\n- -7.4 on 4 November 2026 (C to D): new evidence, correction\n- +0.2 on 28 October 2026: new evidence\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**BCMS.** BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.\n\n**Ghost.** A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical.\n\n## Before you call either\n\n### BCMS\n\n1. Keep the MCP URL out of logs and shared config, since the key is inside it\n2. Call get-all-templates first and mutate only once you have template and entry ids\n3. Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model\n4. List and confirm entry ids with the user before calling delete-entries\n5. Use the bcms-content CLI for scripted runs that need JSON output and exit codes\n\n### Ghost\n\n1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set `kid` to the key id, `aud` to `/admin/` and `exp` at most 5 minutes ahead\n2. Set `status` to `draft` on every create unless told to publish, and publish later with a PUT that sets `status` to `published`\n3. GET the post before each PUT and send its `updated_at` back. Tags and authors in a PUT replace the existing lists\n4. Send content as a Lexical JSON string, or add `?source=html` and send `html`. The HTML conversion is lossy unless wrapped in an HTML card\n5. Page through lists with `limit` up to 100 and `page`. Since Ghost 6.0 `limit=all` returns 100 items without an error\n\n## Questions\n\n### Which is better for AI agents, BCMS or Ghost?\n\nGhost scores 51.2 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.\n\n### Do BCMS and Ghost need an API key?\n\nBoth need an API key.\n\n### Can an agent call BCMS and Ghost without installing anything?\n\nBCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp. No hosted endpoint is listed for Ghost.\n\n### Are BCMS and Ghost open source?\n\nNo open-source release is listed for BCMS. Ghost is open source (MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/bcms-vs-ghost.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bcms-vs-ghost.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"bcms\", \"b\": \"ghost\"}`. From a terminal: `anchor compare bcms ghost`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bcms.json and https://www.anchorterminal.com/api/v1/tools/ghost.json\n\n## Other comparisons with BCMS or Ghost\n\n- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)\n- [BCMS vs Contentstack](https://www.anchorterminal.com/compare/bcms-vs-contentstack.md)\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)\n- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Hygraph](https://www.anchorterminal.com/compare/bcms-vs-hygraph.md)\n- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)\n- [BCMS vs Payload](https://www.anchorterminal.com/compare/bcms-vs-payload.md)\n- [BCMS vs Prismic](https://www.anchorterminal.com/compare/bcms-vs-prismic.md)\n- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)\n- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)\n- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)\n- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)\n- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)\n- [ButterCMS vs Ghost](https://www.anchorterminal.com/compare/buttercms-vs-ghost.md)\n- [Contentstack vs Ghost](https://www.anchorterminal.com/compare/contentstack-vs-ghost.md)\n- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)\n- [DatoCMS vs Ghost](https://www.anchorterminal.com/compare/datocms-vs-ghost.md)\n- [Directus vs Ghost](https://www.anchorterminal.com/compare/directus-vs-ghost.md)\n- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)\n- [Ghost vs Hygraph](https://www.anchorterminal.com/compare/ghost-vs-hygraph.md)\n- [Ghost vs Kontent.ai](https://www.anchorterminal.com/compare/ghost-vs-kontent-ai.md)\n- [Ghost vs Payload](https://www.anchorterminal.com/compare/ghost-vs-payload.md)\n- [Ghost vs Prismic](https://www.anchorterminal.com/compare/ghost-vs-prismic.md)\n- [Ghost vs Sanity](https://www.anchorterminal.com/compare/ghost-vs-sanity.md)\n- [Ghost vs Storyblok](https://www.anchorterminal.com/compare/ghost-vs-storyblok.md)\n- [Ghost vs Strapi](https://www.anchorterminal.com/compare/ghost-vs-strapi.md)\n- [Ghost vs Webflow](https://www.anchorterminal.com/compare/ghost-vs-webflow.md)\n- [Ghost vs WordPress](https://www.anchorterminal.com/compare/ghost-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BCMS vs Ghost", "url": "" } ], "description": "Ghost scores 51.2 (D) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BCMS F 33.5", "Ghost D 51.2", "scores" ], "h1": "BCMS vs Ghost", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/bcms-vs-ghost", "published": "2026-10-01", "section": "tools", "title": "BCMS vs Ghost for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/bcms-vs-ghost" }, "tokens": { "markdown": 4400, "slim": 2530 }, "version": 1 }