# BCMS vs Ghost (slim)

> Ghost scores 51.2 (D) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bcms-vs-ghost.md (~4,400 tokens) · this version ~2,530 tokens · JSON https://www.anchorterminal.com/compare/bcms-vs-ghost.json · canonical https://www.anchorterminal.com/compare/bcms-vs-ghost
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Ghost scores 51.2 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.

- BCMS: F 33.5, rank #1383 of 1486 · https://www.anchorterminal.com/tools/bcms.min.md
- Ghost: D 51.2, rank #1027 of 1486 · https://www.anchorterminal.com/tools/ghost.min.md
- BCMS, good for Small sites and agencies that want a cheap hosted CMS an agent can edit. Also A hosted endpoint, with nothing to install; Free to start without a card; No incidents deducted, where Ghost loses 15 points for them.
- Ghost, good for A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes. Ahead on Reliability, 83 against 15; Agent ergonomics, 69 against 36; Security & auth, 56 against 39; Payments & pricing, 50 against 30; Maintenance & community, 85 against 16; Transparency & trust, 75 against 52. Also Open source.

| Category | BCMS | Ghost |
| --- | --- | --- |
| Reliability (16%) | 15 | 83 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 50 | 51 |
| Agent ergonomics (13%) | 36 | 69 |
| Security & auth (14%) | 39 | 56 |
| Payments & pricing (10%) | 30 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 16 | 85 |
| Transparency & trust (7%) | 52 | 75 |

| Fact (where they differ) | BCMS | Ghost |
| --- | --- | --- |
| Vendor | Becomes tech, LLC | Ghost Foundation |
| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | no (local only) |
| Transports | HTTP, Streamable HTTP | HTTP |
| Pricing | Paid | Freemium |
| Licence | none | MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms |
| Tools exposed | 45 | none |
| Last release | 2026-03-16 | 2026-11-03 |
| Terms last updated | 2026-07-30 | no date given |
| Privacy policy last updated | 2026-07-30 | no date given |
| Popularity | 396 npm/wk | 56k stars, 24k npm/wk |

Why the edge:
- Maintenance & community, Ghost +69: BCMS 16 (@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.); Ghost 85 (v6.74.0 was tagged on 3 November 2026, the day before this check, after v6.70.0 (13 October), v6.71.0 (15 October), v6.72.0 (20 October) and v6.73.0 (27 October) (30). Five tags since 13 October alone, and 19 npm versions between 10 July and 8 October per the earlier check (20). 33 open issues on 8 October and advisories fixed and published with reporter credits; reply times on individual issues not read (18 of 25). @tryghost/admin-api 1.14.13 was published on 21 September 2026 per the 8 October check; npm couldn't be read on 4 November. The official MCP registry listed third-party Ghost servers only (10 of 15). A Renovate workflow keeps dependencies current. The CI badge on main read failing on 8 October; today's result is unread (7 of 10).)
- Reliability, Ghost +68: BCMS 15 (Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.); Ghost 83 (Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official `ghost` package on npm, with Node.js ^22.23.1 or ^24.20.0 in `engines` in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of `limit=all` documented there (13 of 15). 6.x is the current stable line (15).)
- Agent ergonomics, Ghost +33: BCMS 36 (45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.); Ghost 69 (Per the 8 October check, not re-read on 4 November (docs host paused under the terms). `fields`, `include` and `formats` size a response, and lists return 15 records by default (20 of 25). `page`, `limit` up to 100, `order` and a `filter` query language, with `meta.pagination` on every list (20). Errors are JSON with `message` and `errorType`, and the documented list is short (13 of 20). No idempotency keys. A PUT must carry the current `updated_at` and is refused on a collision, and a repeated POST creates a second post (8 of 20). A create needs only `title`. The one official client is JavaScript, @tryghost/admin-api (8 of 15).)
- Transparency & trust, Ghost +23: BCMS 52 (A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.); Ghost 75 (MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and `useTinfoil` for all. The default configuration also points `updateCheck` at updates.ghost.org, which that section doesn't list; the 4 November source sends only `ghost_version` in that request (13 of 20).)
- Payments & pricing, Ghost +20: BCMS 30 (No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.); Ghost 50 (Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10).)
- Security & auth, Ghost +17: BCMS 39 (Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.); Ghost 56 (An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at `GET /actions`. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20).)