# BCMS vs Payload

> Payload scores 50.1 (D) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/bcms-vs-payload
- Markdown: https://www.anchorterminal.com/compare/bcms-vs-payload.md (~4,450 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Payload scores 50.1 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.

- BCMS: grade F, 33.5/100, rank #1383 of 1486. Markdown https://www.anchorterminal.com/tools/bcms.md · JSON https://www.anchorterminal.com/api/v1/tools/bcms.json
- Payload: grade D, 50.1/100, rank #1068 of 1486. Markdown https://www.anchorterminal.com/tools/payload.md · JSON https://www.anchorterminal.com/api/v1/tools/payload.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### BCMS (F)

Good for: Small sites and agencies that want a cheap hosted CMS an agent can edit.

Also in its favour:
- A hosted endpoint, with nothing to install
- Free to start without a card
- No incidents deducted, where Payload loses 15 points for them

Watch for: The MCP key is accepted only as a URL query parameter

### Payload (D)

Good for: Teams that build on Next.js and want the content model in TypeScript, with drafts, versions and localisation in the free core.

Ahead on:
- Reliability, 76 against 15
- Schema & documentation, 70 against 50
- Agent ergonomics, 64 against 36
- Security & auth, 57 against 39
- Payments & pricing, 45 against 30
- Maintenance & community, 78 against 16
- Transparency & trust, 65 against 52

Also in its favour:
- Open source

Watch for: 38 security advisories on OSV in the 12 months to 4 November 2026, 7 critical, 28 published on 6 and 7 October


## Why the edge

### Maintenance & community: Payload +62

- BCMS (16): @thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.
- Payload (78): 3.92.1 is tagged on 27 October 2026, 8 days before this check (30). Nine stable releases from 3.87.1 on 6 August to 3.92.1 on 27 October 2026, with 4.0.0 betas alongside, which don't count (20). 225 issues opened against 116 closed since 10 July, 140 open issues awaiting triage and 763 open pull requests, per the 8 October check (12 of 25). `@payloadcms/sdk` ships with each release but is beta and TypeScript only, and the official MCP registry has no Payload entry, which fits a plugin that runs inside each install (8 of 15). CI runs on every push. The latest 3.x run had failed on 8 October 2026, and runs couldn't be read on 4 November (8 of 10).

### Reliability: Payload +61

- BCMS (15): Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.
- Payload (76): Read with the local-software lines, since the graded surface is software its owner hosts. Official npm packages, with Node.js `^22.23.4 || >=24.22.1` in `engines` and in the installation docs since 3.92.0 (20). A public `ci` workflow runs unit, type, integration and end-to-end tests on every push to 3.x. GitHub's pages and API couldn't be read on 4 November, so the result is unread (15 of 25). 499 issues were open on 8 October, 140 of them awaiting triage, with 225 opened and 116 closed since 10 July 2026, not re-read (12 of 25). A written semver policy marks breaking commits with `!` and lists them in release notes, but lets security fixes and experimental APIs change in minor releases (14 of 15). 3.x is the stable line, with 4.0 in beta (15).

### Agent ergonomics: Payload +28

- BCMS (36): 45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.
- Payload (64): Four MCP tools per enabled collection and two per global, so five collections give 20 tools, the 11 to 30 band (15). We added 7 because the owner enables collections and operations one by one, each key narrows the list again, and find tools default to 10 documents at depth 0 with `select` (22 of 25). Page-based pagination with `limit` and `page`, 17 `where` operators, `sort`, `select` and `populate` (20). REST errors come back in an `errors` array and MCP tools return a text line beginning `Error:`. Neither format is documented as a list an agent can match on (10 of 20). No idempotency keys, and no `readOnlyHint` or `destructiveHint` in the plugin source. An update by id is repeatable (4 of 20). Few required parameters and sensible defaults. The one official client, `@payloadcms/sdk` for TypeScript, is labelled beta (8 of 15).

### Schema & documentation: Payload +20

- BCMS (50): The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.
- Payload (70): No OpenAPI file is published or generated by the core packages, because endpoints depend on each project's config. Every MCP tool carries a typed input schema built from the collection's fields, and the GraphQL schema is generated from the same config (20 of 25). llms.txt per major version, llms-full.txt and a Markdown copy of every docs page (10). Default MCP tool descriptions are one line, such as `Create a document in a collection.`, unless the owner writes one in the plugin config. The docs tell owners to do so (10 of 20). Field inputs are typed with bounds on `limit` and `depth`, but `where` is JSON passed as a string. `select` became an object in the MCP find tools in 3.91.0 (10 of 15). REST operations show a request and a response each. No reference page for error responses or status codes was found (8 of 15). Semver, release notes on GitHub and separate docs per major version. REST paths carry no version (12 of 15).

### Security & auth: Payload +18

- BCMS (39): Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.
- Payload (57): REST keys are per user, revocable and regenerable, shown once, and limited by that user's access control down to field level. MCP keys carry per-collection, per-operation switches. Both travel only in the Authorization header. Neither expires, and there is no OAuth (24 of 30). A find-only MCP key is a config switch away and the collection's access control still runs under it. Nothing asks a person to approve a delete or a publish in the free edition (14 of 20). Documents hold text written by other people, and no prompt-injection guidance was found. `overrideResponse` can strip fields before they reach a model (3 of 15). Versions record each change, and `onEvent` and `verboseLogs` expose MCP calls to the owner's own logging. No built-in audit log (7 of 15). SECURITY.md gives a reporting address and, since 16 October 2026, says Payload pays no monetary rewards and runs no bug bounty. Advisories are published on GitHub with affected versions, patches and workarounds. No security.txt or SOC 2 statement was found (9 of 20).

### Payments & pricing: Payload +15

- BCMS (30): No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.
- Payload (45): Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under MIT, which the get-started page states. The only paid option, Enterprise, is priced by sales, and Payload Cloud is closed to new projects, so 15 of 20. No card and no account at Payload are needed (20). `npx create-payload-app` installs it, but the docs create REST and MCP API keys in the admin panel, so half (10).

## Score by category

| Category | Weight | BCMS | Payload | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 15 | 76 | Payload +61 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 50 | 70 | Payload +20 |
| Agent ergonomics | 13% (16.2 this run) | 36 | 64 | Payload +28 |
| Security & auth | 14% (17.5 this run) | 39 | 57 | Payload +18 |
| Payments & pricing | 10% (12.5 this run) | 30 | 45 | Payload +15 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 16 | 78 | Payload +62 |
| Transparency & trust | 7% (8.8 this run) | 52 | 65 | Payload +13 |
| Negative events | ≤15 | 0 | -15 | |
| **Total** | | **33.5 · F** | **50.1 · D** | |

## Facts side by side

| Fact | BCMS | Payload |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Becomes tech, LLC | Payload CMS, Inc. (Figma) |
| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | no (local only) |
| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | API key | API key |
| Pricing | Paid | Free |
| x402 | no | no |
| Licence | none | MIT for the core and the official packages. Enterprise add-ons are sold separately through sales |
| Tools exposed | 45 | none |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-03-16 | 2026-10-27 |
| Terms last updated | 2026-07-30 | no document linked |
| Privacy policy last updated | 2026-07-30 | 2024-03-28 |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 396 npm/wk | 45k stars, 1.1M npm/wk |

## How the scores have moved

### BCMS

No score change since it was listed.

### Payload

- -5.4 on 4 November 2026 (C to D): new evidence, correction
- +0.3 on 27 October 2026: checklist

## Verdicts

**BCMS.** BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.

**Payload.** Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. 38 advisories were published in the 12 months to November 2026, most on 6 and 7 October, so an install older than 3.90.0 is exposed. No OpenAPI file is published.

## Before you call either

### BCMS

1. Keep the MCP URL out of logs and shared config, since the key is inside it
2. Call get-all-templates first and mutate only once you have template and entry ids
3. Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model
4. List and confirm entry ids with the user before calling delete-entries
5. Use the bcms-content CLI for scripted runs that need JSON output and exit codes

### Payload

1. Check the installed version first. Anything below 3.90.0 carries published critical advisories, and 3.92.0 and later need Node.js 22.23.4 or 24.22.1, so ask the owner to upgrade before writing
2. Send REST keys as `Authorization: {collection-slug} API-Key {key}` and MCP keys as `Authorization: Bearer {key}`. The two key kinds are separate
3. To publish, set `_status: 'published'` in the data. The `draft` parameter only relaxes validation and chooses where an update is written
4. Upload files with multipart POST to the upload collection, with other fields as JSON in `_payload`. No MCP upload tool is documented
5. Roll back with `POST /api/{collection-slug}/versions/:id` after listing versions. Versions exist only where the collection config enables them

## Questions

### Which is better for AI agents, BCMS or Payload?

Payload scores 50.1 (D) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.

### Do BCMS and Payload need an API key?

Both need an API key.

### Can an agent call BCMS and Payload without installing anything?

BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp. No hosted endpoint is listed for Payload.

### Are BCMS and Payload open source?

No open-source release is listed for BCMS. Payload is open source (MIT for the core and the official packages. Enterprise add-ons are sold separately through sales).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/bcms-vs-payload.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bcms-vs-payload.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "bcms", "b": "payload"}`. From a terminal: `anchor compare bcms payload`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bcms.json and https://www.anchorterminal.com/api/v1/tools/payload.json

## Other comparisons with BCMS or Payload

- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)
- [BCMS vs Contentstack](https://www.anchorterminal.com/compare/bcms-vs-contentstack.md)
- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)
- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)
- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)
- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)
- [BCMS vs Ghost](https://www.anchorterminal.com/compare/bcms-vs-ghost.md)
- [BCMS vs Hygraph](https://www.anchorterminal.com/compare/bcms-vs-hygraph.md)
- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)
- [BCMS vs Prismic](https://www.anchorterminal.com/compare/bcms-vs-prismic.md)
- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)
- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)
- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)
- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)
- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)
- [ButterCMS vs Payload](https://www.anchorterminal.com/compare/buttercms-vs-payload.md)
- [Contentstack vs Payload](https://www.anchorterminal.com/compare/contentstack-vs-payload.md)
- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)
- [DatoCMS vs Payload](https://www.anchorterminal.com/compare/datocms-vs-payload.md)
- [Directus vs Payload](https://www.anchorterminal.com/compare/directus-vs-payload.md)
- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)
- [Ghost vs Payload](https://www.anchorterminal.com/compare/ghost-vs-payload.md)
- [Hygraph vs Payload](https://www.anchorterminal.com/compare/hygraph-vs-payload.md)
- [Kontent.ai vs Payload](https://www.anchorterminal.com/compare/kontent-ai-vs-payload.md)
- [Payload vs Prismic](https://www.anchorterminal.com/compare/payload-vs-prismic.md)
- [Payload vs Sanity](https://www.anchorterminal.com/compare/payload-vs-sanity.md)
- [Payload vs Storyblok](https://www.anchorterminal.com/compare/payload-vs-storyblok.md)
- [Payload vs Strapi](https://www.anchorterminal.com/compare/payload-vs-strapi.md)
- [Payload vs Webflow](https://www.anchorterminal.com/compare/payload-vs-webflow.md)
- [Payload vs WordPress](https://www.anchorterminal.com/compare/payload-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp