# BCMS vs Ghost

> Ghost scores 51.2 (D) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/bcms-vs-ghost
- Markdown: https://www.anchorterminal.com/compare/bcms-vs-ghost.md (~4,400 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Ghost scores 51.2 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.

- BCMS: grade F, 33.5/100, rank #1383 of 1486. Markdown https://www.anchorterminal.com/tools/bcms.md · JSON https://www.anchorterminal.com/api/v1/tools/bcms.json
- Ghost: grade D, 51.2/100, rank #1027 of 1486. Markdown https://www.anchorterminal.com/tools/ghost.md · JSON https://www.anchorterminal.com/api/v1/tools/ghost.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### BCMS (F)

Good for: Small sites and agencies that want a cheap hosted CMS an agent can edit.

Also in its favour:
- A hosted endpoint, with nothing to install
- Free to start without a card
- No incidents deducted, where Ghost loses 15 points for them

Watch for: The MCP key is accepted only as a URL query parameter

### Ghost (D)

Good for: A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.

Ahead on:
- Reliability, 83 against 15
- Agent ergonomics, 69 against 36
- Security & auth, 56 against 39
- Payments & pricing, 50 against 30
- Maintenance & community, 85 against 16
- Transparency & trust, 75 against 52

Also in its favour:
- Open source

Watch for: No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository


## Why the edge

### Maintenance & community: Ghost +69

- BCMS (16): @thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.
- Ghost (85): v6.74.0 was tagged on 3 November 2026, the day before this check, after v6.70.0 (13 October), v6.71.0 (15 October), v6.72.0 (20 October) and v6.73.0 (27 October) (30). Five tags since 13 October alone, and 19 npm versions between 10 July and 8 October per the earlier check (20). 33 open issues on 8 October and advisories fixed and published with reporter credits; reply times on individual issues not read (18 of 25). @tryghost/admin-api 1.14.13 was published on 21 September 2026 per the 8 October check; npm couldn't be read on 4 November. The official MCP registry listed third-party Ghost servers only (10 of 15). A Renovate workflow keeps dependencies current. The CI badge on main read failing on 8 October; today's result is unread (7 of 10).

### Reliability: Ghost +68

- BCMS (15): Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.
- Ghost (83): Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official `ghost` package on npm, with Node.js ^22.23.1 or ^24.20.0 in `engines` in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of `limit=all` documented there (13 of 15). 6.x is the current stable line (15).

### Agent ergonomics: Ghost +33

- BCMS (36): 45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.
- Ghost (69): Per the 8 October check, not re-read on 4 November (docs host paused under the terms). `fields`, `include` and `formats` size a response, and lists return 15 records by default (20 of 25). `page`, `limit` up to 100, `order` and a `filter` query language, with `meta.pagination` on every list (20). Errors are JSON with `message` and `errorType`, and the documented list is short (13 of 20). No idempotency keys. A PUT must carry the current `updated_at` and is refused on a collision, and a repeated POST creates a second post (8 of 20). A create needs only `title`. The one official client is JavaScript, @tryghost/admin-api (8 of 15).

### Transparency & trust: Ghost +23

- BCMS (52): A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.
- Ghost (75): MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and `useTinfoil` for all. The default configuration also points `updateCheck` at updates.ghost.org, which that section doesn't list; the 4 November source sends only `ghost_version` in that request (13 of 20).

### Payments & pricing: Ghost +20

- BCMS (30): No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.
- Ghost (50): Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10).

### Security & auth: Ghost +17

- BCMS (39): Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.
- Ghost (56): An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at `GET /actions`. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20).

## Score by category

| Category | Weight | BCMS | Ghost | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 15 | 83 | Ghost +68 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 50 | 51 | Ghost +1 |
| Agent ergonomics | 13% (16.2 this run) | 36 | 69 | Ghost +33 |
| Security & auth | 14% (17.5 this run) | 39 | 56 | Ghost +17 |
| Payments & pricing | 10% (12.5 this run) | 30 | 50 | Ghost +20 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 16 | 85 | Ghost +69 |
| Transparency & trust | 7% (8.8 this run) | 52 | 75 | Ghost +23 |
| Negative events | ≤15 | 0 | -15 | |
| **Total** | | **33.5 · F** | **51.2 · D** | |

## Facts side by side

| Fact | BCMS | Ghost |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Becomes tech, LLC | Ghost Foundation |
| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | no (local only) |
| Transports | HTTP, Streamable HTTP | HTTP |
| Auth | API key | API key |
| Pricing | Paid | Freemium |
| x402 | no | no |
| Licence | none | MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms |
| Tools exposed | 45 | none |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-03-16 | 2026-11-03 |
| Terms last updated | 2026-07-30 | no date given |
| Privacy policy last updated | 2026-07-30 | no date given |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | yes |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 396 npm/wk | 56k stars, 24k npm/wk |

## How the scores have moved

### BCMS

No score change since it was listed.

### Ghost

- -7.4 on 4 November 2026 (C to D): new evidence, correction
- +0.2 on 28 October 2026: new evidence
- +0.1 on 27 October 2026: checklist

## Verdicts

**BCMS.** BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.

**Ghost.** A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical.

## Before you call either

### BCMS

1. Keep the MCP URL out of logs and shared config, since the key is inside it
2. Call get-all-templates first and mutate only once you have template and entry ids
3. Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model
4. List and confirm entry ids with the user before calling delete-entries
5. Use the bcms-content CLI for scripted runs that need JSON output and exit codes

### Ghost

1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set `kid` to the key id, `aud` to `/admin/` and `exp` at most 5 minutes ahead
2. Set `status` to `draft` on every create unless told to publish, and publish later with a PUT that sets `status` to `published`
3. GET the post before each PUT and send its `updated_at` back. Tags and authors in a PUT replace the existing lists
4. Send content as a Lexical JSON string, or add `?source=html` and send `html`. The HTML conversion is lossy unless wrapped in an HTML card
5. Page through lists with `limit` up to 100 and `page`. Since Ghost 6.0 `limit=all` returns 100 items without an error

## Questions

### Which is better for AI agents, BCMS or Ghost?

Ghost scores 51.2 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.

### Do BCMS and Ghost need an API key?

Both need an API key.

### Can an agent call BCMS and Ghost without installing anything?

BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp. No hosted endpoint is listed for Ghost.

### Are BCMS and Ghost open source?

No open-source release is listed for BCMS. Ghost is open source (MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/bcms-vs-ghost.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bcms-vs-ghost.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "bcms", "b": "ghost"}`. From a terminal: `anchor compare bcms ghost`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bcms.json and https://www.anchorterminal.com/api/v1/tools/ghost.json

## Other comparisons with BCMS or Ghost

- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)
- [BCMS vs Contentstack](https://www.anchorterminal.com/compare/bcms-vs-contentstack.md)
- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)
- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)
- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)
- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)
- [BCMS vs Hygraph](https://www.anchorterminal.com/compare/bcms-vs-hygraph.md)
- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)
- [BCMS vs Payload](https://www.anchorterminal.com/compare/bcms-vs-payload.md)
- [BCMS vs Prismic](https://www.anchorterminal.com/compare/bcms-vs-prismic.md)
- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)
- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)
- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)
- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)
- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)
- [ButterCMS vs Ghost](https://www.anchorterminal.com/compare/buttercms-vs-ghost.md)
- [Contentstack vs Ghost](https://www.anchorterminal.com/compare/contentstack-vs-ghost.md)
- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)
- [DatoCMS vs Ghost](https://www.anchorterminal.com/compare/datocms-vs-ghost.md)
- [Directus vs Ghost](https://www.anchorterminal.com/compare/directus-vs-ghost.md)
- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)
- [Ghost vs Hygraph](https://www.anchorterminal.com/compare/ghost-vs-hygraph.md)
- [Ghost vs Kontent.ai](https://www.anchorterminal.com/compare/ghost-vs-kontent-ai.md)
- [Ghost vs Payload](https://www.anchorterminal.com/compare/ghost-vs-payload.md)
- [Ghost vs Prismic](https://www.anchorterminal.com/compare/ghost-vs-prismic.md)
- [Ghost vs Sanity](https://www.anchorterminal.com/compare/ghost-vs-sanity.md)
- [Ghost vs Storyblok](https://www.anchorterminal.com/compare/ghost-vs-storyblok.md)
- [Ghost vs Strapi](https://www.anchorterminal.com/compare/ghost-vs-strapi.md)
- [Ghost vs Webflow](https://www.anchorterminal.com/compare/ghost-vs-webflow.md)
- [Ghost vs WordPress](https://www.anchorterminal.com/compare/ghost-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp