BCMS vs Prismic

BCMS 16

@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.

Prismic 79

@prismicio/client 7.23.0 was tagged on 27 October 2026 and CLI 1.24.0 on 15 October 2026 (30). Five client tags and 11 CLI tags from 4 August, and dated updates posts on 11 August and 15 October 2026 (20). A public updates page, a community forum and a help centre. The client repository shows 2 open issues. We did not sample reply times (11 of 15). Current official JavaScript SDKs and CLI, and listings in the Claude and ChatGPT directories. No entry in the official MCP registry (11). The client and CLI repositories have validate and publish workflows. We did not check that CI passes (7).

BCMS 15

Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.

Prismic 73

Graded on the hosted MCP server and the Migration, Asset and Types APIs. Public status page at status.prismic.io with nine components, the Migration API among them and no MCP component (18 of 20). The feed lists one incident in the 90 days from 4 August, on 14 September 2026, labelled a full outage of the Content API and Editor. Its write-up gives 18 minutes (09:02 to 09:20 UTC) in which a majority of requests to the Content Delivery API's document search and GraphQL endpoints returned server errors. One product and a share of its requests, with the Migration API untouched, so it reads as partial and minor (20 of 30). Limits published for the Migration API and Asset API (one request a second) and the Content API (200 a second uncached). No MCP limit found (13). The docs say @prismicio/client retries rate-limited queries, and its source reads retry-after on 429. The write API references give no 429 guidance and no idempotency keys (7). The pricing page lists support and uptime SLAs on Enterprise with no figures (5). The Migration API went generally available on 4 August 2025 and the MCP docs carry no beta label (10).

BCMS 36

45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.

Prismic 63

16 MCP tools (15), plus 4 because search_documents returns metadata only and get_custom_type returns an empty template to fill in (19 of 25). limit, cursor and keyword on the Asset API, and type, locale, status and tag filters on search_documents (16). Migration API errors return a list naming the property, the value and the fault. Status codes are not listed (12). No idempotency keys. Updates are PUT by id, MCP writes stay as drafts in a release, and we could not read the tool annotations (8). create_document fills missing fields with model defaults. The official SDK is JavaScript only (8).

BCMS 52

A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.

Prismic 73

Closed service with a published Master Services Agreement, and Apache-2.0 clients (17). Privacy policy of 8 April 2026 with an MCP section, a self-service DPA and deletion of customer data 60 days after termination. The security page of 11 June 2026 still says a DPA is not yet online, the privacy policy still cites Privacy Shield, and the AI terms allow use of AI feature data for training (18 of 30). No written deprecation policy. Notices are dated but brief, such as the old MCP server and Slice Machine, and the terms promise an effort at 7 days' notice of updates (8). A sub-processor list published as a PDF and hosting stated as AWS us-east-1 (16).

BCMS 39

Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as ?mcpKey= in the URL and REST examples pass apiKey the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.

Prismic 50

The MCP server uses OAuth with PKCE S256, dynamic client registration, refresh tokens and revocation, with no scopes, and works with the signed-in person's role. Write tokens are revocable, repository-wide and unscoped (20 of 30). MCP has no delete tool, stages writes as drafts and publishes only for a Publisher on request, and an Administrator can switch it off per repository. Writer and Publisher roles need the Medium plan, and write tokens have no read-only form (13). The docs recommend human review before publishing. No guidance on treating stored content as untrusted was found, and upload_asset fetches a URL the agent supplies (5). Revision history on every plan and a version list in MCP. No audit log for API or MCP calls found (6). A security page with yearly penetration tests, external audits and a contact address. No security.txt, bug bounty, SOC 2 or ISO 27001 report for Prismic found (6).

BCMS 50

The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.

Prismic 60

No OpenAPI file was found for the Migration, Asset or Types APIs. The Types API links a Postman collection, the client ships TypeScript types, and the MCP tool schemas need a signed-in session we did not have (10 of 25). A root llms.txt, a docs llms.txt and a Markdown copy of every docs page at the same URL plus .md (10). The MCP page gives each tool's purpose and says which to call first, and the docs say when to prefer the packages or an agent over raw HTTP (14). The Migration API reference types every field with formats and allowed values, while data follows the repository's own types and Types API models are free-form JSON (9). One full request body, two error examples and Types API status codes. The Asset API page promises error handling and documents none (9). No version in the write API paths. A dated updates page, the latest post 15 October 2026, plus changelogs for the client and CLI (8).