BCMS vs Hygraph

BCMS 15

Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.

Hygraph 83

Graded on the GraphQL Content and Management APIs, with the hosted MCP server noted. Public status page at status.hygraph.com, now on incident.io, with the API, the Content API cache and the asset CDN for 11 regions (20). In the 90 days to 1 November 2026 its feed lists two incidents, both partial outages. On 7 August new sign-ups were unavailable for 36 minutes (11:38 to 12:14 UTC) with existing users unaffected, and on 16 October cache invalidation for the Content API in the AP South 1 shared region was delayed for 1 hour 47 minutes (09:13 to 11:01 UTC). Each hit one function or one region, so both read as minor (20 of 30). Rate limits published by plan as uncached requests a second (5, 25, up to 500) and concurrent operations (15). The docs give exponential backoff guidance with sample code. Retry-After is documented only for asset transformation limits, and there are no idempotency keys (10). The pricing page lists an Enterprise uptime SLA of up to 99.95%. The SLA document was not found (8). The APIs and the MCP server carry no beta label (10).

BCMS 16

@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.

Hygraph 64

The changelog's newest entry is still 30 September 2026, 32 days before 1 November, and no newer dated change was found (20). In the 90 days from 3 August, entries on 31 August and 30 September and @hygraph/management-sdk 1.6.1 on 19 August, per the 8 October check of npm, not re-read on 1 November (20). Public changelog, a community Slack, in-app chat and email support on Growth. The SDK's GitHub repository shows no commit since 13 September 2024 (9 of 15). The Management SDK was current on npm on 8 October. The official MCP registry still returns no Hygraph entry (11). The public repository does not carry the 2026 npm releases, so CI could not be seen (4).

BCMS 36

45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.

Hygraph 72

GraphQL field selection sizes every response, first defaults to 10 and is capped at 100, and the MCP tool list_entities takes a limit and field selection. The project MCP endpoint lists 17 tools (22 of 25). first, last, skip, before and after, Relay connections, typed where filters and ordering (20). Errors use documented HTTP statuses and a requestId, with free-text messages and no machine code (11). No idempotency keys. upsert mutations key on a unique field, batch migrations apply all or nothing with a dry_run on the MCP tool, and MCP rejects delete and unpublish. We couldn't read the tool annotations (12). Only the Bearer header is required and any GraphQL client works. The one official SDK covers the Management API in JavaScript and TypeScript (7).

BCMS 50

The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.

Hygraph 78

GraphQL introspection is on by default for each project's Content API, so the contract is machine-readable and specific to the project. The Management API answered 401 to an introspection query without a token, and no static schema file was found (20 of 25). A root llms.txt with a Markdown copy of every docs section under /llms-full/ (10). The Management SDK page states when to use it and when not to, and the MCP tools reference gives each of 19 tools one line with a warning on execute_graphql (15). Inputs are typed per model with enums and required fields. Rich Text takes an AST and JSON fields are free-form (13). Request and response examples throughout, and an errors page for nine HTTP statuses. Error bodies carry a message only, with no code list (10). The endpoint path carries /v2/ and the changelog is public and dated. No API versioning policy was found (10).

BCMS 39

Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as ?mcpKey= in the URL and REST examples pass apiKey the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.

Hygraph 63

Permanent Auth Tokens are JWTs sent as a Bearer header, each limited by model, stage, locale, environment and action, with separate Management API permissions, and deleting one invalidates it. No expiry or rotation was found. The global MCP endpoint uses OAuth through auth.hygraph.com with PKCE and a registration endpoint, with access following the user's own permissions (25 of 30). New tokens start with no permissions, MCP token presets include read-only and content-only, MCP rejects delete and unpublish, and public API access is off by default. The API itself has no confirmation step (17). The docs warn against always allowing execute_graphql. No guidance on treating stored content as untrusted input was found (5). Audit logs are Enterprise only with 90 days of retention and record the token that made a change (7). The site states SOC 2 Type 2 and ISO 27001 certified hosting. /.well-known/security.txt answered 404, no disclosure policy or bounty was found, and the trust report on app.drata.com answered 403 (9).

BCMS 52

A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.

Hygraph 62

Closed service under published Terms of Service from Hygraph GmbH, with the Management SDK under MIT (15 of 30). The privacy policy, last updated 19 March 2025, covers the service and lists six categories of service provider without naming them. Retention is stated only as the legal period, the terms disclaim liability for deleted content, and no data processing agreement was found (12). Dated notices for the 2025 move off the legacy asset system and a statement that the old @graphcms/management SDK is deprecated. The terms allow the service to change without prior notice (10). The status page and pricing page name 11 hosting regions. Sub-processors are not named (8).