{ "data": { "a": { "slug": "bcms", "name": "BCMS", "vendor": "Becomes tech, LLC", "vendorUrl": "https://www.thebcms.com", "kind": "http-api", "category": "cms", "summary": "BCMS is a hosted headless CMS from Becomes tech, LLC. People edit structured content in a dashboard, and agents work with templates, entries, media and languages through a REST API, a JavaScript client, a CLI and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/bcms", "markdownUrl": "https://www.anchorterminal.com/tools/bcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bcms.json", "dns": "bcms.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.thebcms.com/api/v3/mcp", "packages": [ { "registry": "npm", "name": "@thebcms/client" } ], "auth": "api-key", "authNotes": "Three-part keys (keyId.secret.instanceId) created in the dashboard and scoped to templates and media, with schema tools only for keys allowed them. The MCP endpoint takes the key only as the `mcpKey` query parameter, and the REST examples pass `apiKey` in the query string. The docs advise a key per person, client and environment and regular rotation.", "pricing": "paid", "pricingNotes": "Hobby $5 a month ($4 billed yearly) with 2 seats, 100 entries and 500 MB of media; Pro $50 a month ($33 yearly) with 5 seats, then $15 a seat a month, and unlimited entries; Enterprise by quote. Every plan starts with a 14-day free trial with no card. No self-hosted edition.", "priceSummary": "$5 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the docs, the MCP page or pricing.md (checked 2026-11-06).", "endpoints": [] }, "toolCount": 45, "popularity": { "githubStars": null, "npmWeekly": 396, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.thebcms.com/docs", "llmsTxt": "https://www.thebcms.com/llms.txt", "capabilities": [ "cms.content", "cms.assets", "cms.localisation", "cms.schema", "cms.publish" ], "tags": [ "hosted", "mcp", "remote-mcp", "llms-txt", "no-card", "closed-source", "webhooks", "typescript", "cli" ], "lastRelease": "2026-03-16", "graded": true, "anchor": { "graded": true, "score": 33.5, "grade": "F", "agentReady": false, "rank": 1383, "ranked": true, "rankOf": 1486, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "bestFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "strengths": [ "Remote MCP server covering templates, entries, statuses, entry history, media, languages and trash", "Keys scoped to the templates and media an agent needs, with schema tools gated separately", "llms.txt that says when to use BCMS and when not to, plus a public SKILL.md", "Entry history and trash readable through MCP, so an agent can trace and recover changes", "14-day trial with no card, then plans from $5 a month" ], "weaknesses": [ "The MCP key is accepted only as a URL query parameter", "No status page, documented rate limits, SLA or changelog found", "No security.txt, disclosure policy or certification found", "The JavaScript client hasn't been released since March 2026", "No self-hosted edition; the open-source repository has been unmaintained since October 2024" ], "agentNotes": [ "Keep the MCP URL out of logs and shared config, since the key is inside it", "Call get-all-templates first and mutate only once you have template and entry ids", "Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model", "List and confirm entry ids with the user before calling delete-entries", "Use the bcms-content CLI for scripted runs that need JSON output and exit codes" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 33.5 } ], "editorialScores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 48 }, "provenanceScore": 56, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @thebcms/client", "claudeCode": "claude mcp add --transport http bcms \"https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE\"", "config": { "mcpServers": { "bcms": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/bcms" }, "area": "business", "unitPrices": [ { "item": "Hobby plan", "unit": "month", "usd": 5, "note": "$4 a month billed yearly; 2 seats, 100 entries" }, { "item": "Pro plan", "unit": "month", "usd": 50, "note": "$33 a month billed yearly; 5 seats" }, { "item": "Extra Pro seat", "unit": "seat-month", "usd": 15, "note": "$120 a year on yearly billing" } ], "provenance": { "legalEntity": "Becomes tech, LLC", "domain": "thebcms.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.thebcms.com/terms-of-use/", "privacy": "https://www.thebcms.com/privacy-policy/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both effective 30 July 2026, name Becomes tech, LLC, a Delaware LLC. The terms forbid scraping or crawling that burdens or abuses the services, except through the documented APIs within rate limits.", "www.thebcms.com/robots.txt allows all. app.thebcms.com/robots.txt disallows all paths.", "www.thebcms.com/.well-known/security.txt returned 404 and no status page was found.", "RDAP gave no registration date for thebcms.com through rdap.org." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bcms.json", "live": { "slug": "bcms", "probe": { "target": "https://app.thebcms.com/api/v3/mcp", "method": "get", "lastAt": "2026-11-07T18:20:13.025269198Z", "lastOk": true, "lastStatus": 400, "lastMs": 197, "authRequired": false, "uptime24h": 99.5, "uptime30d": 99.5, "p50ms24h": 141, "p95ms24h": 393, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 186 } ] }, "versions": [ { "registry": "npm", "name": "@thebcms/client", "version": "2.0.3", "seenAt": "2026-11-06T23:10:32.023184196Z" } ], "npmWeekly": 396, "securityTxt": { "url": "https://thebcms.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:49.817334601Z" }, "llmsTxt": { "url": "https://www.thebcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:42.21650798Z" }, "pages": [ { "url": "https://www.thebcms.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:35:35.490295236Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "abae80fa615e" }, { "url": "https://www.thebcms.com/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:35:37.777884178Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "58d8ef9074aa" } ], "mcpTools": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE", "checkedAt": "2026-11-07T01:42:42.874889438Z", "status": "error", "note": "initialize: no JSON-RPC answer", "changedAt": "2026-11-07T01:42:42.874889438Z" }, "updatedAt": "2026-11-07T18:20:13.025269198Z" } }, "answer": "Hygraph scores 67.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.", "b": { "slug": "hygraph", "name": "Hygraph", "vendor": "Hygraph GmbH", "vendorUrl": "https://hygraph.com", "kind": "http-api", "category": "cms", "summary": "Hygraph is a hosted headless CMS from Hygraph GmbH in Berlin. Agents read and write entries, assets and localisations through a GraphQL Content API, change schema through a Management API and SDK, or connect through a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/hygraph", "markdownUrl": "https://www.anchorterminal.com/tools/hygraph.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/hygraph.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/hygraph.json", "dns": "hygraph.grade.anchorterminal.com", "repo": "https://github.com/hygraph/management-sdk", "license": "Proprietary service under Hygraph GmbH's Terms of Service. The `@hygraph/management-sdk` package is MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://mcp.hygraph.com/mcp", "packages": [ { "registry": "npm", "name": "@hygraph/management-sdk" } ], "auth": "mixed", "authNotes": "Self-serve. The Content API and Management API take a Permanent Auth Token as a Bearer header. A person creates the token in Project Settings and sets its content permissions (by model, stage, locale, environment and action) and its Management API permissions. A new token has none enabled. Deleting a token invalidates it, and no expiry or rotation was found. The project MCP endpoint takes the same token. The global MCP endpoint uses a browser login through auth.hygraph.com and follows the user's own permissions. OAuth for third-party apps needs a client ID from Hygraph support. No app review or sales approval is needed for tokens.", "pricing": "freemium", "pricingNotes": "The Hobby plan is free with no card and includes 500,000 API calls a month, 1,000 entries, 2 locales and 3 API tokens. Usage past the limit is blocked until the next period. Growth is $199 a month with 1,000,000 API calls, and overage of $0.20 per 10,000 API operations and per GB of asset traffic. Enterprise is sold through sales, with a 30-day trial that needs no card (https://hygraph.com/pricing, checked 2026-10-08).", "priceSummary": "$199 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference, the MCP server docs or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 17, "popularity": { "githubStars": 52, "npmWeekly": 8645, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://hygraph.com/docs/api-reference", "llmsTxt": "https://hygraph.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.localisation", "cms.schema" ], "tags": [ "official", "hosted", "mcp", "graphql", "closed-source", "no-card", "free-tier", "llms-txt", "webhooks", "typescript", "status-page", "soc2" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 67.4, "grade": "B", "agentReady": false, "rank": 323, "ranked": true, "rankOf": 1486, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 64, "payments": 35, "reliability": 83, "schema": 78, "security": 63, "transparency": 62 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "Tokens are limited by model, stage, locale and action, the GraphQL schema is typed and introspectable, and a hosted MCP server rejects delete and unpublish operations. Error bodies carry a message without a machine code, there are no idempotency keys, audit logs are Enterprise only, and no data processing agreement, sub-processor list or security.txt was found.", "bestFor": "Teams on Hygraph who want an agent to create, localise and publish entries, upload assets or change schema, with delete and unpublish kept out of reach on MCP.", "strengths": [ "Permanent Auth Tokens are limited by model, stage, locale, environment and action, and a new token starts with no permissions enabled", "The hosted MCP server rejects `delete*` and `unpublish*` operations, and `submit_batch_migration` takes `dry_run` and applies schema changes in one transaction", "GraphQL field selection, `first`, `skip` and cursor arguments and typed filters size every response. The default page is 10 entries and the maximum 100", "The Hobby plan needs no card and includes 500,000 API calls a month, 1,000 entries and 3 API tokens", "`llms.txt` links a Markdown copy of every documentation section, and the changelog has dated entries for 31 August and 30 September 2026" ], "weaknesses": [ "GraphQL error bodies carry a message and a `requestId` with no machine-readable code, and only asset transformation 429 responses are documented with `Retry-After`", "No idempotency keys in the reviewed documentation. Safe retries rest on `upsert` mutations keyed on a unique field", "Audit logs, backups with recovery and an uptime SLA are Enterprise only, and version history is absent on Hobby and 14 days on Growth", "No data processing agreement, named sub-processor list, security.txt or disclosure policy was found on hygraph.com. The privacy policy names categories of service provider only", "The only official SDK is `@hygraph/management-sdk` for JavaScript and TypeScript, and its public GitHub repository was last pushed on 13 September 2024" ], "agentNotes": [ "Send the Permanent Auth Token as `Authorization: Bearer \u003ctoken\u003e` to `https://\u003cregion\u003e.hygraph.com/v2/\u003cprojectId\u003e/\u003cenvironment\u003e`. Read the schema by introspection first, because every type is generated from the project's models", "Mutations write to DRAFT. Call `publish\u003cModel\u003e` with `to: [PUBLISHED]` as a separate mutation, and pass `locales` to write or publish a localisation", "Stay under the plan's limit for uncached requests (5 a second on Hobby, 25 on Growth) and its concurrent mutations (5 and 10). Back off exponentially on 429", "Upload an asset with `createAsset`, then POST the file to the returned pre-signed URL, or pass `uploadUrl` for a remote file. The asset stays `ASSET_CREATE_PENDING` until processed", "Schema changes go to the Management API through `@hygraph/management-sdk` or the MCP tool `submit_batch_migration`. Version restore has no documented mutation, so read `\u003cmodel\u003eVersion` and write the old values back" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.4 } ], "editorialScores": { "ergonomics": 72, "maintenance": 64, "payments": 35, "reliability": 83, "schema": 78, "security": 63, "transparency": 45 }, "provenanceScore": 78, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @hygraph/management-sdk", "claudeCode": "claude mcp add hygraph https://mcp-{REGION}.hygraph.com/{PROJECT_ID}/{ENVIRONMENT}/mcp \\\n --transport http \\\n --header \"Authorization: Bearer ${HYGRAPH_TOKEN}\"", "config": { "mcpServers": { "hygraph": { "args": [ "mcp-remote", "https://mcp-{REGION}.hygraph.com/{PROJECT_ID}/master/mcp", "--header", "Authorization: Bearer ${HYGRAPH_TOKEN}" ], "command": "npx", "env": { "HYGRAPH_TOKEN": "token_here" } } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/hygraph" }, "area": "business", "unitPrices": [ { "item": "Growth", "unit": "month", "usd": 199, "note": "10 seats, 1,000,000 API calls and 500 GB of asset traffic included" }, { "item": "Additional API operations on Growth", "unit": "1k-requests", "usd": 0.02, "note": "sold as $0.20 per 10,000 API operations" }, { "item": "Additional asset traffic on Growth", "unit": "gb", "usd": 0.2, "note": "per GB past the plan's 500 GB" } ], "provenance": { "legalEntity": "Hygraph GmbH", "domain": "hygraph.com", "domainRegistered": "2022-03-04", "endpointOnVendorDomain": true, "terms": "https://hygraph.com/terms", "privacy": "https://hygraph.com/privacy", "statusPage": "https://status.hygraph.com", "changelog": "https://hygraph.com/changelog", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The imprint and the privacy policy name Hygraph GmbH, Dircksenstraße 47, 10178 Berlin, registered at Amtsgericht Berlin Charlottenburg under HRB 250696 B.", "The Terms of Service define the Hygraph Services to include the cloud platform and the Hygraph API. The pricing page lists them as the online terms for Hobby and Growth, with custom terms on Enterprise.", "The privacy policy has a section on use of the Hygraph service and was last updated on 19 March 2025. It names categories of service provider and no companies. No data processing agreement was found on hygraph.com.", "The Content API answers at \u003cregion\u003e.hygraph.com, the Management API at management.hygraph.com, the MCP server at mcp.hygraph.com and the OAuth server at auth.hygraph.com.", "https://hygraph.com/.well-known/security.txt answered 404 on 8 October 2026.", "RDAP for hygraph.com gives a registration date of 2022-03-04. The product was named GraphCMS before that, and the older SDK is still on npm as `@graphcms/management`." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/hygraph.json", "live": { "slug": "hygraph", "probe": { "target": "https://mcp.hygraph.com/mcp", "method": "get", "lastAt": "2026-11-07T18:20:31.280716558Z", "lastOk": true, "lastStatus": 401, "lastMs": 144, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 82, "p95ms24h": 195, "samples24h": 239, "samples30d": 7289, "days": [ { "date": "2026-10-09", "probes": 169, "ok": 169 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.hygraph.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:16.459522564Z" }, "versions": [ { "registry": "github", "name": "hygraph/management-sdk", "version": "v1.6.1", "released": "2022-07-12", "seenAt": "2026-11-06T23:33:45.983282732Z" }, { "registry": "npm", "name": "@hygraph/management-sdk", "version": "1.6.1", "seenAt": "2026-11-06T23:33:45.494613478Z" } ], "githubStars": 52, "npmWeekly": 8506, "securityTxt": { "url": "https://hygraph.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:38.083782324Z" }, "llmsTxt": { "url": "https://hygraph.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:43.620279737Z" }, "domain": { "domain": "hygraph.com", "registered": "2022-03-04", "source": "https://rdap.verisign.com/com/v1/domain/hygraph.com", "checkedAt": "2026-11-01T14:13:36.604689646Z" }, "pages": [ { "url": "https://hygraph.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:11:18.292616533Z", "changedAt": "2026-11-04T08:25:16.362105863Z", "fingerprint": "3527953c9d59" }, { "url": "https://hygraph.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:11:21.460123953Z", "changedAt": "2026-10-28T04:19:18.115624781Z", "fingerprint": "a3279fa87009" }, { "url": "https://hygraph.com/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:11:22.538584231Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "cf4fb9d76bd8" }, { "url": "https://hygraph.com/terms", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:11:24.36183068Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "48b302df4eb6" } ], "github": { "repo": "hygraph/management-sdk", "checkedAt": "2026-11-02T08:55:24.162312188Z", "stars": 52, "archived": false, "issuesEnabled": true, "pushedAt": "2024-09-13T18:56:48Z", "openIssues": 7, "openPRs": 2, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "replies": { "sampled": 11, "unanswered": 7, "medianDays": 6.2 } }, "updatedAt": "2026-11-07T18:21:16.459522564Z" } }, "edges": [ { "by": 68, "category": "reliability", "leads": "hygraph", "name": "Reliability", "reasons": { "a": "Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.", "b": "Graded on the GraphQL Content and Management APIs, with the hosted MCP server noted. Public status page at status.hygraph.com, now on incident.io, with the API, the Content API cache and the asset CDN for 11 regions (20). In the 90 days to 1 November 2026 its feed lists two incidents, both partial outages. On 7 August new sign-ups were unavailable for 36 minutes (11:38 to 12:14 UTC) with existing users unaffected, and on 16 October cache invalidation for the Content API in the AP South 1 shared region was delayed for 1 hour 47 minutes (09:13 to 11:01 UTC). Each hit one function or one region, so both read as minor (20 of 30). Rate limits published by plan as uncached requests a second (5, 25, up to 500) and concurrent operations (15). The docs give exponential backoff guidance with sample code. `Retry-After` is documented only for asset transformation limits, and there are no idempotency keys (10). The pricing page lists an Enterprise uptime SLA of up to 99.95%. The SLA document was not found (8). The APIs and the MCP server carry no beta label (10)." }, "scores": { "a": 15, "b": 83 } }, { "by": 48, "category": "maintenance", "leads": "hygraph", "name": "Maintenance \u0026 community", "reasons": { "a": "@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.", "b": "The changelog's newest entry is still 30 September 2026, 32 days before 1 November, and no newer dated change was found (20). In the 90 days from 3 August, entries on 31 August and 30 September and `@hygraph/management-sdk` 1.6.1 on 19 August, per the 8 October check of npm, not re-read on 1 November (20). Public changelog, a community Slack, in-app chat and email support on Growth. The SDK's GitHub repository shows no commit since 13 September 2024 (9 of 15). The Management SDK was current on npm on 8 October. The official MCP registry still returns no Hygraph entry (11). The public repository does not carry the 2026 npm releases, so CI could not be seen (4)." }, "scores": { "a": 16, "b": 64 } }, { "by": 36, "category": "ergonomics", "leads": "hygraph", "name": "Agent ergonomics", "reasons": { "a": "45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.", "b": "GraphQL field selection sizes every response, `first` defaults to 10 and is capped at 100, and the MCP tool `list_entities` takes a limit and field selection. The project MCP endpoint lists 17 tools (22 of 25). `first`, `last`, `skip`, `before` and `after`, Relay connections, typed `where` filters and ordering (20). Errors use documented HTTP statuses and a `requestId`, with free-text messages and no machine code (11). No idempotency keys. `upsert` mutations key on a unique field, batch migrations apply all or nothing with a `dry_run` on the MCP tool, and MCP rejects delete and unpublish. We couldn't read the tool annotations (12). Only the Bearer header is required and any GraphQL client works. The one official SDK covers the Management API in JavaScript and TypeScript (7)." }, "scores": { "a": 36, "b": 72 } }, { "by": 28, "category": "schema", "leads": "hygraph", "name": "Schema \u0026 documentation", "reasons": { "a": "The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.", "b": "GraphQL introspection is on by default for each project's Content API, so the contract is machine-readable and specific to the project. The Management API answered 401 to an introspection query without a token, and no static schema file was found (20 of 25). A root `llms.txt` with a Markdown copy of every docs section under `/llms-full/` (10). The Management SDK page states when to use it and when not to, and the MCP tools reference gives each of 19 tools one line with a warning on `execute_graphql` (15). Inputs are typed per model with enums and required fields. Rich Text takes an AST and JSON fields are free-form (13). Request and response examples throughout, and an errors page for nine HTTP statuses. Error bodies carry a message only, with no code list (10). The endpoint path carries `/v2/` and the changelog is public and dated. No API versioning policy was found (10)." }, "scores": { "a": 50, "b": 78 } }, { "by": 24, "category": "security", "leads": "hygraph", "name": "Security \u0026 auth", "reasons": { "a": "Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.", "b": "Permanent Auth Tokens are JWTs sent as a Bearer header, each limited by model, stage, locale, environment and action, with separate Management API permissions, and deleting one invalidates it. No expiry or rotation was found. The global MCP endpoint uses OAuth through auth.hygraph.com with PKCE and a registration endpoint, with access following the user's own permissions (25 of 30). New tokens start with no permissions, MCP token presets include read-only and content-only, MCP rejects delete and unpublish, and public API access is off by default. The API itself has no confirmation step (17). The docs warn against always allowing `execute_graphql`. No guidance on treating stored content as untrusted input was found (5). Audit logs are Enterprise only with 90 days of retention and record the token that made a change (7). The site states SOC 2 Type 2 and ISO 27001 certified hosting. `/.well-known/security.txt` answered 404, no disclosure policy or bounty was found, and the trust report on app.drata.com answered 403 (9)." }, "scores": { "a": 39, "b": 63 } }, { "by": 10, "category": "transparency", "leads": "hygraph", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.", "b": "Closed service under published Terms of Service from Hygraph GmbH, with the Management SDK under MIT (15 of 30). The privacy policy, last updated 19 March 2025, covers the service and lists six categories of service provider without naming them. Retention is stated only as the legal period, the terms disclaim liability for deleted content, and no data processing agreement was found (12). Dated notices for the 2025 move off the legacy asset system and a statement that the old `@graphcms/management` SDK is deprecated. The terms allow the service to change without prior notice (10). The status page and pricing page name 11 hosting regions. Sub-processors are not named (8)." }, "scores": { "a": 52, "b": 62 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Becomes tech, LLC", "b": "Hygraph GmbH", "name": "Vendor" }, { "a": "https://app.thebcms.com/api/v3/mcp", "b": "https://mcp.hygraph.com/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary service under Hygraph GmbH's Terms of Service. The `@hygraph/management-sdk` package is MIT", "name": "Licence" }, { "a": "45", "b": "17", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-03-16", "b": "2026-09-30", "name": "Last release" }, { "a": "2026-07-30", "b": "no date given", "name": "Terms last updated" }, { "a": "2026-07-30", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "396 npm/wk", "b": "52 stars, 8.6k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Hygraph scores 67.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.", "question": "Which is better for AI agents, BCMS or Hygraph?" }, { "answer": "BCMS needs an API key. Hygraph takes an API key or an OAuth sign-in.", "question": "Do BCMS and Hygraph need an API key?" }, { "answer": "Yes. BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp and Hygraph at https://mcp.hygraph.com/mcp.", "question": "Can an agent call BCMS and Hygraph without installing anything?" } ], "goodFor": [ { "aheadOn": null, "also": null, "goodFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "slug": "bcms", "watchFor": "The MCP key is accepted only as a URL query parameter" }, { "aheadOn": [ "Reliability, 83 against 15", "Schema \u0026 documentation, 78 against 50", "Agent ergonomics, 72 against 36", "Security \u0026 auth, 63 against 39", "Payments \u0026 pricing, 35 against 30", "Maintenance \u0026 community, 64 against 16", "Transparency \u0026 trust, 62 against 52" ], "also": null, "goodFor": "Teams on Hygraph who want an agent to create, localise and publish entries, upload assets or change schema, with delete and unpublish kept out of reach on MCP.", "slug": "hygraph", "watchFor": "GraphQL error bodies carry a message and a `requestId` with no machine-readable code, and only asset transformation 429 responses are documented with `Retry-After`" } ], "history": { "bcms": null, "hygraph": [ { "causes": [ "reliability", "time" ], "date": "2026-11-01", "delta": -2.1, "from": 69.5, "fromGrade": "B", "to": 67.4, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 69.3, "fromGrade": "B", "to": 69.5, "toGrade": "B" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-buttercms.json", "title": "BCMS vs ButterCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-buttercms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-contentstack.json", "title": "BCMS vs Contentstack", "url": "https://www.anchorterminal.com/compare/bcms-vs-contentstack" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-datocms.json", "title": "BCMS vs DatoCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-directus.json", "title": "BCMS vs Directus", "url": "https://www.anchorterminal.com/compare/bcms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-ghost.json", "title": "BCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/bcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.json", "title": "BCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-payload.json", "title": "BCMS vs Payload", "url": "https://www.anchorterminal.com/compare/bcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-prismic.json", "title": "BCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/bcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-sanity.json", "title": "BCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/bcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-storyblok.json", "title": "BCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/bcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-strapi.json", "title": "BCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/bcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-webflow.json", "title": "BCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/bcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-wordpress.json", "title": "BCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/bcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-hygraph.json", "title": "ButterCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/buttercms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-hygraph.json", "title": "Contentstack vs Hygraph", "url": "https://www.anchorterminal.com/compare/contentstack-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph.json", "title": "Cosmic vs Hygraph", "url": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-hygraph.json", "title": "DatoCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/datocms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-hygraph.json", "title": "Directus vs Hygraph", "url": "https://www.anchorterminal.com/compare/directus-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph.json", "title": "dotCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-hygraph.json", "title": "Ghost vs Hygraph", "url": "https://www.anchorterminal.com/compare/ghost-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-kontent-ai.json", "title": "Hygraph vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/hygraph-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-payload.json", "title": "Hygraph vs Payload", "url": "https://www.anchorterminal.com/compare/hygraph-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-prismic.json", "title": "Hygraph vs Prismic", "url": "https://www.anchorterminal.com/compare/hygraph-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-sanity.json", "title": "Hygraph vs Sanity", "url": "https://www.anchorterminal.com/compare/hygraph-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-storyblok.json", "title": "Hygraph vs Storyblok", "url": "https://www.anchorterminal.com/compare/hygraph-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-strapi.json", "title": "Hygraph vs Strapi", "url": "https://www.anchorterminal.com/compare/hygraph-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-webflow.json", "title": "Hygraph vs Webflow", "url": "https://www.anchorterminal.com/compare/hygraph-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-wordpress.json", "title": "Hygraph vs WordPress", "url": "https://www.anchorterminal.com/compare/hygraph-vs-wordpress" } ], "panel": null, "scores": [ { "bcms": 15, "by": 68, "edge": "hygraph", "hygraph": 83, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "bcms": 50, "by": 28, "edge": "hygraph", "hygraph": 78, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "bcms": 36, "by": 36, "edge": "hygraph", "hygraph": 72, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "bcms": 39, "by": 24, "edge": "hygraph", "hygraph": 63, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "bcms": 30, "by": 5, "edge": "hygraph", "hygraph": 35, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "bcms": 16, "by": 48, "edge": "hygraph", "hygraph": 64, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "bcms": 52, "by": 10, "edge": "hygraph", "hygraph": 62, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Hygraph scores 67.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "bcms": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "hygraph": "Tokens are limited by model, stage, locale and action, the GraphQL schema is typed and introspectable, and a hosted MCP server rejects delete and unpublish operations. Error bodies carry a message without a machine code, there are no idempotency keys, audit logs are Enterprise only, and no data processing agreement, sub-processor list or security.txt was found." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/bcms-vs-hygraph", "json": "https://www.anchorterminal.com/compare/bcms-vs-hygraph.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/bcms-vs-hygraph.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/bcms-vs-hygraph.min.md" }, "markdown": "Hygraph scores 67.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.\n\n- BCMS: grade F, 33.5/100, rank #1383 of 1486. Markdown https://www.anchorterminal.com/tools/bcms.md · JSON https://www.anchorterminal.com/api/v1/tools/bcms.json\n- Hygraph: grade B, 67.4/100, rank #323 of 1486. Markdown https://www.anchorterminal.com/tools/hygraph.md · JSON https://www.anchorterminal.com/api/v1/tools/hygraph.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### BCMS (F)\n\nGood for: Small sites and agencies that want a cheap hosted CMS an agent can edit.\n\nWatch for: The MCP key is accepted only as a URL query parameter\n\n### Hygraph (B)\n\nGood for: Teams on Hygraph who want an agent to create, localise and publish entries, upload assets or change schema, with delete and unpublish kept out of reach on MCP.\n\nAhead on:\n- Reliability, 83 against 15\n- Schema \u0026 documentation, 78 against 50\n- Agent ergonomics, 72 against 36\n- Security \u0026 auth, 63 against 39\n- Payments \u0026 pricing, 35 against 30\n- Maintenance \u0026 community, 64 against 16\n- Transparency \u0026 trust, 62 against 52\n\nWatch for: GraphQL error bodies carry a message and a `requestId` with no machine-readable code, and only asset transformation 429 responses are documented with `Retry-After`\n\n\n## Why the edge\n\n### Reliability: Hygraph +68\n\n- BCMS (15): Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.\n- Hygraph (83): Graded on the GraphQL Content and Management APIs, with the hosted MCP server noted. Public status page at status.hygraph.com, now on incident.io, with the API, the Content API cache and the asset CDN for 11 regions (20). In the 90 days to 1 November 2026 its feed lists two incidents, both partial outages. On 7 August new sign-ups were unavailable for 36 minutes (11:38 to 12:14 UTC) with existing users unaffected, and on 16 October cache invalidation for the Content API in the AP South 1 shared region was delayed for 1 hour 47 minutes (09:13 to 11:01 UTC). Each hit one function or one region, so both read as minor (20 of 30). Rate limits published by plan as uncached requests a second (5, 25, up to 500) and concurrent operations (15). The docs give exponential backoff guidance with sample code. `Retry-After` is documented only for asset transformation limits, and there are no idempotency keys (10). The pricing page lists an Enterprise uptime SLA of up to 99.95%. The SLA document was not found (8). The APIs and the MCP server carry no beta label (10).\n\n### Maintenance \u0026 community: Hygraph +48\n\n- BCMS (16): @thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.\n- Hygraph (64): The changelog's newest entry is still 30 September 2026, 32 days before 1 November, and no newer dated change was found (20). In the 90 days from 3 August, entries on 31 August and 30 September and `@hygraph/management-sdk` 1.6.1 on 19 August, per the 8 October check of npm, not re-read on 1 November (20). Public changelog, a community Slack, in-app chat and email support on Growth. The SDK's GitHub repository shows no commit since 13 September 2024 (9 of 15). The Management SDK was current on npm on 8 October. The official MCP registry still returns no Hygraph entry (11). The public repository does not carry the 2026 npm releases, so CI could not be seen (4).\n\n### Agent ergonomics: Hygraph +36\n\n- BCMS (36): 45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.\n- Hygraph (72): GraphQL field selection sizes every response, `first` defaults to 10 and is capped at 100, and the MCP tool `list_entities` takes a limit and field selection. The project MCP endpoint lists 17 tools (22 of 25). `first`, `last`, `skip`, `before` and `after`, Relay connections, typed `where` filters and ordering (20). Errors use documented HTTP statuses and a `requestId`, with free-text messages and no machine code (11). No idempotency keys. `upsert` mutations key on a unique field, batch migrations apply all or nothing with a `dry_run` on the MCP tool, and MCP rejects delete and unpublish. We couldn't read the tool annotations (12). Only the Bearer header is required and any GraphQL client works. The one official SDK covers the Management API in JavaScript and TypeScript (7).\n\n### Schema \u0026 documentation: Hygraph +28\n\n- BCMS (50): The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.\n- Hygraph (78): GraphQL introspection is on by default for each project's Content API, so the contract is machine-readable and specific to the project. The Management API answered 401 to an introspection query without a token, and no static schema file was found (20 of 25). A root `llms.txt` with a Markdown copy of every docs section under `/llms-full/` (10). The Management SDK page states when to use it and when not to, and the MCP tools reference gives each of 19 tools one line with a warning on `execute_graphql` (15). Inputs are typed per model with enums and required fields. Rich Text takes an AST and JSON fields are free-form (13). Request and response examples throughout, and an errors page for nine HTTP statuses. Error bodies carry a message only, with no code list (10). The endpoint path carries `/v2/` and the changelog is public and dated. No API versioning policy was found (10).\n\n### Security \u0026 auth: Hygraph +24\n\n- BCMS (39): Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.\n- Hygraph (63): Permanent Auth Tokens are JWTs sent as a Bearer header, each limited by model, stage, locale, environment and action, with separate Management API permissions, and deleting one invalidates it. No expiry or rotation was found. The global MCP endpoint uses OAuth through auth.hygraph.com with PKCE and a registration endpoint, with access following the user's own permissions (25 of 30). New tokens start with no permissions, MCP token presets include read-only and content-only, MCP rejects delete and unpublish, and public API access is off by default. The API itself has no confirmation step (17). The docs warn against always allowing `execute_graphql`. No guidance on treating stored content as untrusted input was found (5). Audit logs are Enterprise only with 90 days of retention and record the token that made a change (7). The site states SOC 2 Type 2 and ISO 27001 certified hosting. `/.well-known/security.txt` answered 404, no disclosure policy or bounty was found, and the trust report on app.drata.com answered 403 (9).\n\n### Transparency \u0026 trust: Hygraph +10\n\n- BCMS (52): A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.\n- Hygraph (62): Closed service under published Terms of Service from Hygraph GmbH, with the Management SDK under MIT (15 of 30). The privacy policy, last updated 19 March 2025, covers the service and lists six categories of service provider without naming them. Retention is stated only as the legal period, the terms disclaim liability for deleted content, and no data processing agreement was found (12). Dated notices for the 2025 move off the legacy asset system and a statement that the old `@graphcms/management` SDK is deprecated. The terms allow the service to change without prior notice (10). The status page and pricing page name 11 hosting regions. Sub-processors are not named (8).\n\n## Score by category\n\n| Category | Weight | BCMS | Hygraph | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 83 | Hygraph +68 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 50 | 78 | Hygraph +28 |\n| Agent ergonomics | 13% (16.2 this run) | 36 | 72 | Hygraph +36 |\n| Security \u0026 auth | 14% (17.5 this run) | 39 | 63 | Hygraph +24 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 35 | Hygraph +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 16 | 64 | Hygraph +48 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 62 | Hygraph +10 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **33.5 · F** | **67.4 · B** | |\n\n## Facts side by side\n\n| Fact | BCMS | Hygraph |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Becomes tech, LLC | Hygraph GmbH |\n| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | `https://mcp.hygraph.com/mcp` |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | none | Proprietary service under Hygraph GmbH's Terms of Service. The `@hygraph/management-sdk` package is MIT |\n| Tools exposed | 45 | 17 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-03-16 | 2026-09-30 |\n| Terms last updated | 2026-07-30 | no date given |\n| Privacy policy last updated | 2026-07-30 | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 396 npm/wk | 52 stars, 8.6k npm/wk |\n| Agent reviews | none | 3.5/5 (4) |\n\n## How the scores have moved\n\n### BCMS\n\nNo score change since it was listed.\n\n### Hygraph\n\n- -2.1 on 1 November 2026: reliability, time\n- +0.2 on 27 October 2026: checklist\n\n## Verdicts\n\n**BCMS.** BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.\n\n**Hygraph.** Tokens are limited by model, stage, locale and action, the GraphQL schema is typed and introspectable, and a hosted MCP server rejects delete and unpublish operations. Error bodies carry a message without a machine code, there are no idempotency keys, audit logs are Enterprise only, and no data processing agreement, sub-processor list or security.txt was found.\n\n## Before you call either\n\n### BCMS\n\n1. Keep the MCP URL out of logs and shared config, since the key is inside it\n2. Call get-all-templates first and mutate only once you have template and entry ids\n3. Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model\n4. List and confirm entry ids with the user before calling delete-entries\n5. Use the bcms-content CLI for scripted runs that need JSON output and exit codes\n\n### Hygraph\n\n1. Send the Permanent Auth Token as `Authorization: Bearer \u003ctoken\u003e` to `https://\u003cregion\u003e.hygraph.com/v2/\u003cprojectId\u003e/\u003cenvironment\u003e`. Read the schema by introspection first, because every type is generated from the project's models\n2. Mutations write to DRAFT. Call `publish\u003cModel\u003e` with `to: [PUBLISHED]` as a separate mutation, and pass `locales` to write or publish a localisation\n3. Stay under the plan's limit for uncached requests (5 a second on Hobby, 25 on Growth) and its concurrent mutations (5 and 10). Back off exponentially on 429\n4. Upload an asset with `createAsset`, then POST the file to the returned pre-signed URL, or pass `uploadUrl` for a remote file. The asset stays `ASSET_CREATE_PENDING` until processed\n5. Schema changes go to the Management API through `@hygraph/management-sdk` or the MCP tool `submit_batch_migration`. Version restore has no documented mutation, so read `\u003cmodel\u003eVersion` and write the old values back\n\n## Questions\n\n### Which is better for AI agents, BCMS or Hygraph?\n\nHygraph scores 67.4 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.\n\n### Do BCMS and Hygraph need an API key?\n\nBCMS needs an API key. Hygraph takes an API key or an OAuth sign-in.\n\n### Can an agent call BCMS and Hygraph without installing anything?\n\nYes. BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp and Hygraph at https://mcp.hygraph.com/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/bcms-vs-hygraph.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bcms-vs-hygraph.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"bcms\", \"b\": \"hygraph\"}`. From a terminal: `anchor compare bcms hygraph`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bcms.json and https://www.anchorterminal.com/api/v1/tools/hygraph.json\n\n## Other comparisons with BCMS or Hygraph\n\n- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)\n- [BCMS vs Contentstack](https://www.anchorterminal.com/compare/bcms-vs-contentstack.md)\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)\n- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Ghost](https://www.anchorterminal.com/compare/bcms-vs-ghost.md)\n- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)\n- [BCMS vs Payload](https://www.anchorterminal.com/compare/bcms-vs-payload.md)\n- [BCMS vs Prismic](https://www.anchorterminal.com/compare/bcms-vs-prismic.md)\n- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)\n- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)\n- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)\n- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)\n- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)\n- [ButterCMS vs Hygraph](https://www.anchorterminal.com/compare/buttercms-vs-hygraph.md)\n- [Contentstack vs Hygraph](https://www.anchorterminal.com/compare/contentstack-vs-hygraph.md)\n- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)\n- [DatoCMS vs Hygraph](https://www.anchorterminal.com/compare/datocms-vs-hygraph.md)\n- [Directus vs Hygraph](https://www.anchorterminal.com/compare/directus-vs-hygraph.md)\n- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)\n- [Ghost vs Hygraph](https://www.anchorterminal.com/compare/ghost-vs-hygraph.md)\n- [Hygraph vs Kontent.ai](https://www.anchorterminal.com/compare/hygraph-vs-kontent-ai.md)\n- [Hygraph vs Payload](https://www.anchorterminal.com/compare/hygraph-vs-payload.md)\n- [Hygraph vs Prismic](https://www.anchorterminal.com/compare/hygraph-vs-prismic.md)\n- [Hygraph vs Sanity](https://www.anchorterminal.com/compare/hygraph-vs-sanity.md)\n- [Hygraph vs Storyblok](https://www.anchorterminal.com/compare/hygraph-vs-storyblok.md)\n- [Hygraph vs Strapi](https://www.anchorterminal.com/compare/hygraph-vs-strapi.md)\n- [Hygraph vs Webflow](https://www.anchorterminal.com/compare/hygraph-vs-webflow.md)\n- [Hygraph vs WordPress](https://www.anchorterminal.com/compare/hygraph-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BCMS vs Hygraph", "url": "" } ], "description": "Hygraph scores 67.4 (B) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BCMS F 33.5", "Hygraph B 67.4", "scores" ], "h1": "BCMS vs Hygraph", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/bcms-vs-hygraph", "published": "2026-10-01", "section": "tools", "title": "BCMS vs Hygraph for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/bcms-vs-hygraph" }, "tokens": { "markdown": 4600, "slim": 2730 }, "version": 1 }