{ "data": { "a": { "slug": "bcms", "name": "BCMS", "vendor": "Becomes tech, LLC", "vendorUrl": "https://www.thebcms.com", "kind": "http-api", "category": "cms", "summary": "BCMS is a hosted headless CMS from Becomes tech, LLC. People edit structured content in a dashboard, and agents work with templates, entries, media and languages through a REST API, a JavaScript client, a CLI and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/bcms", "markdownUrl": "https://www.anchorterminal.com/tools/bcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bcms.json", "dns": "bcms.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.thebcms.com/api/v3/mcp", "packages": [ { "registry": "npm", "name": "@thebcms/client" } ], "auth": "api-key", "authNotes": "Three-part keys (keyId.secret.instanceId) created in the dashboard and scoped to templates and media, with schema tools only for keys allowed them. The MCP endpoint takes the key only as the `mcpKey` query parameter, and the REST examples pass `apiKey` in the query string. The docs advise a key per person, client and environment and regular rotation.", "pricing": "paid", "pricingNotes": "Hobby $5 a month ($4 billed yearly) with 2 seats, 100 entries and 500 MB of media; Pro $50 a month ($33 yearly) with 5 seats, then $15 a seat a month, and unlimited entries; Enterprise by quote. Every plan starts with a 14-day free trial with no card. No self-hosted edition.", "priceSummary": "$5 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the docs, the MCP page or pricing.md (checked 2026-11-06).", "endpoints": [] }, "toolCount": 45, "popularity": { "githubStars": null, "npmWeekly": 396, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.thebcms.com/docs", "llmsTxt": "https://www.thebcms.com/llms.txt", "capabilities": [ "cms.content", "cms.assets", "cms.localisation", "cms.schema", "cms.publish" ], "tags": [ "hosted", "mcp", "remote-mcp", "llms-txt", "no-card", "closed-source", "webhooks", "typescript", "cli" ], "lastRelease": "2026-03-16", "graded": true, "anchor": { "graded": true, "score": 33.5, "grade": "F", "agentReady": false, "rank": 1383, "ranked": true, "rankOf": 1486, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "bestFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "strengths": [ "Remote MCP server covering templates, entries, statuses, entry history, media, languages and trash", "Keys scoped to the templates and media an agent needs, with schema tools gated separately", "llms.txt that says when to use BCMS and when not to, plus a public SKILL.md", "Entry history and trash readable through MCP, so an agent can trace and recover changes", "14-day trial with no card, then plans from $5 a month" ], "weaknesses": [ "The MCP key is accepted only as a URL query parameter", "No status page, documented rate limits, SLA or changelog found", "No security.txt, disclosure policy or certification found", "The JavaScript client hasn't been released since March 2026", "No self-hosted edition; the open-source repository has been unmaintained since October 2024" ], "agentNotes": [ "Keep the MCP URL out of logs and shared config, since the key is inside it", "Call get-all-templates first and mutate only once you have template and entry ids", "Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model", "List and confirm entry ids with the user before calling delete-entries", "Use the bcms-content CLI for scripted runs that need JSON output and exit codes" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 33.5 } ], "editorialScores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 48 }, "provenanceScore": 56, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @thebcms/client", "claudeCode": "claude mcp add --transport http bcms \"https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE\"", "config": { "mcpServers": { "bcms": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/bcms" }, "area": "business", "unitPrices": [ { "item": "Hobby plan", "unit": "month", "usd": 5, "note": "$4 a month billed yearly; 2 seats, 100 entries" }, { "item": "Pro plan", "unit": "month", "usd": 50, "note": "$33 a month billed yearly; 5 seats" }, { "item": "Extra Pro seat", "unit": "seat-month", "usd": 15, "note": "$120 a year on yearly billing" } ], "provenance": { "legalEntity": "Becomes tech, LLC", "domain": "thebcms.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.thebcms.com/terms-of-use/", "privacy": "https://www.thebcms.com/privacy-policy/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both effective 30 July 2026, name Becomes tech, LLC, a Delaware LLC. The terms forbid scraping or crawling that burdens or abuses the services, except through the documented APIs within rate limits.", "www.thebcms.com/robots.txt allows all. app.thebcms.com/robots.txt disallows all paths.", "www.thebcms.com/.well-known/security.txt returned 404 and no status page was found.", "RDAP gave no registration date for thebcms.com through rdap.org." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bcms.json", "live": { "slug": "bcms", "probe": { "target": "https://app.thebcms.com/api/v3/mcp", "method": "get", "lastAt": "2026-11-07T18:20:13.025269198Z", "lastOk": true, "lastStatus": 400, "lastMs": 197, "authRequired": false, "uptime24h": 99.5, "uptime30d": 99.5, "p50ms24h": 141, "p95ms24h": 393, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 186 } ] }, "versions": [ { "registry": "npm", "name": "@thebcms/client", "version": "2.0.3", "seenAt": "2026-11-06T23:10:32.023184196Z" } ], "npmWeekly": 396, "securityTxt": { "url": "https://thebcms.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:49.817334601Z" }, "llmsTxt": { "url": "https://www.thebcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:42.21650798Z" }, "pages": [ { "url": "https://www.thebcms.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:35:35.490295236Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "abae80fa615e" }, { "url": "https://www.thebcms.com/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:35:37.777884178Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "58d8ef9074aa" } ], "mcpTools": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE", "checkedAt": "2026-11-07T01:42:42.874889438Z", "status": "error", "note": "initialize: no JSON-RPC answer", "changedAt": "2026-11-07T01:42:42.874889438Z" }, "updatedAt": "2026-11-07T18:20:13.025269198Z" } }, "answer": "Strapi scores 67.7 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.", "b": { "slug": "strapi", "name": "Strapi", "vendor": "Strapi, Inc.", "vendorUrl": "https://strapi.io", "kind": "http-api", "category": "cms", "summary": "Strapi is an open-source headless CMS for Node.js that its owner hosts, with a paid cloud. Agents create, localise and publish entries through generated REST and GraphQL APIs or a built-in MCP server.", "url": "https://www.anchorterminal.com/tools/strapi", "markdownUrl": "https://www.anchorterminal.com/tools/strapi.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/strapi.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/strapi.json", "dns": "strapi.grade.anchorterminal.com", "repo": "https://github.com/strapi/strapi", "license": "MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "@strapi/strapi" }, { "registry": "npm", "name": "@strapi/client" } ], "auth": "api-key", "authNotes": "Self-serve tokens created in the admin panel of your own instance, with no app review or partner approval. API tokens authenticate the Content API under /api and are read-only, full access or custom per content type and action. Admin tokens authenticate admin routes and the MCP server at /mcp and hold a chosen subset of their owner's permissions, down to field and locale. Each kind is rejected on the other's routes. Both expire after 7, 30 or 90 days or never, can be regenerated, and travel as `Authorization: Bearer`. An Admin token is shown once.", "pricing": "freemium", "pricingNotes": "The Community Edition is free to self-host with unlimited seats, so an agent can start without a contract or a card. Growth is $45 a month for 3 seats ($15 per extra seat) with a 30-day trial and no card, and Enterprise is priced by sales. Strapi Cloud is $35, $90 or $450 a project a month, needs a card at project creation, and charges $1.50 per 25,000 API requests over the plan (checked 2026-10-07).", "priceSummary": "$45 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation index, the pricing pages or the repository's MCP code (checked 2026-10-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 73289, "npmWeekly": 258813, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://docs.strapi.io", "llmsTxt": "https://docs.strapi.io/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.localisation", "cms.assets", "cms.schema" ], "tags": [ "open-source", "self-hosted", "hosted", "mcp", "llms-txt", "webhooks", "graphql", "typescript", "status-page", "soc2" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 67.7, "grade": "B", "agentReady": false, "rank": 308, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 87, "payments": 50, "reliability": 82, "schema": 80, "security": 66, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -4, "negativeNotes": [ "Strapi publishes its own advisories on GitHub, and this run counts them one by one. OSV lists five for Strapi's packages published in the last 12 months, all fixed in released versions and more than two months old. Two are critical, GHSA-3xcq-8mjw-h6mx (CVE-2026-22599, 13 May 2026, SQL injection in the Content-Type Builder, fixed in 5.33.2 and 4.26.1) and GHSA-rjg2-95x7-8qmx (CVE-2026-27886, 14 May 2026, sensitive data leaked through relation filters, fixed in 5.37.0), 1 each, the value this run gives a fixed critical or High more than two months old. Two are Moderate, GHSA-7mqx-wwh4-f9fw (CVE-2025-64526, 13 May, a rate-limit bypass in Users \u0026 Permissions, fixed in 5.45.0) and GHSA-pcw7-5633-82vv (CVE-2026-22707, 14 May, an upload MIME check bypass, fixed in 5.33.3), 1 each. GHSA-hvp3-26wx-g2w4 (Low, password reset kept refresh sessions) costs nothing. 1 + 1 + 1 + 1 = 4. https://api.osv.dev/v1/query ; https://github.com/strapi/strapi/security/advisories" ], "verdict": "The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is paid-only and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.", "bestFor": "Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.", "strengths": [ "Admin tokens carry a chosen subset of the owner's permissions, down to content type, action, field and locale, with 7, 30 or 90 day expiry", "The MCP server lists only the tools a token may use and narrows each input and output schema to permitted fields", "Media delete tools preview by default through `dryRun` and name what would be removed before anything is deleted", "Weekly releases, 14 tagged versions between 5 August and 28 October 2026, with release notes per version", "MIT Community Edition, free to self-host with unlimited seats, plus llms.txt, llms-full.txt and Markdown copies of every docs page" ], "weaknesses": [ "Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans", "Audit Logs and Review Workflows are Enterprise only, so the free edition has no record of what an agent changed", "A REST POST or PUT publishes immediately unless the request passes `status=draft`", "The MCP server can't upload files, describes dynamic zones as untyped arrays and sets no read-only or destructive annotations", "Five advisories were published in May 2026, two critical (SQL injection in the Content-Type Builder, a data leak through relation filters), all fixed in earlier releases" ], "agentNotes": [ "Pass `status=draft` on every REST POST and PUT. Without it the Content API publishes the entry at once", "Use an Admin token for `/mcp` and admin routes and an API token for `/api`. Each kind is rejected on the other's routes", "Upload files with multipart POST to `/api/upload` first, then reference the returned file id in the entry. MCP tools can't upload", "Call `media_delete_assets` and `media_delete_folder` without `dryRun` first to preview, and take asset ids only from `media_list_assets`", "Keep your own copy of an entry before updating it. API and MCP writes create no Content History version" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.7 } ], "editorialScores": { "ergonomics": 65, "maintenance": 87, "payments": 50, "reliability": 82, "schema": 80, "security": 66, "transparency": 75 }, "provenanceScore": 69, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx create-strapi@latest", "http": "curl 'http://localhost:1337/api/restaurants?status=draft' \\\n -H \"Authorization: Bearer $STRAPI_API_TOKEN\"", "claudeCode": "claude mcp add strapi-mcp --transport http http://localhost:1337/mcp -H \"Authorization: Bearer YOUR_ADMIN_TOKEN\"", "config": { "mcpServers": { "strapi-mcp": { "headers": { "Authorization": "Bearer YOUR_ADMIN_TOKEN" }, "type": "streamable-http", "url": "http://localhost:1337/mcp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/strapi" }, "area": "business", "unitPrices": [ { "item": "Community Edition, self-hosted", "unit": "month", "usd": 0, "note": "MIT, unlimited seats, you pay for your own hosting" }, { "item": "Growth, self-hosted", "unit": "month", "usd": 45, "note": "3 seats included, $15 per extra seat" }, { "item": "Strapi Cloud Starter", "unit": "month", "usd": 35, "note": "per project, 100,000 API requests" }, { "item": "Strapi Cloud Pro", "unit": "month", "usd": 90, "note": "per project, 1 million API requests" }, { "item": "Strapi Cloud Business", "unit": "month", "usd": 450, "note": "per project, 10 million API requests" }, { "item": "Strapi Cloud API requests over the plan", "unit": "1k-requests", "usd": 0.06, "note": "$1.50 per 25,000" } ], "provenance": { "legalEntity": "Strapi, Inc.", "domain": "strapi.io", "domainRegistered": "2015-09-21", "endpointOnVendorDomain": false, "terms": "https://strapi.io/cloud-legal", "privacy": "https://strapi.io/privacy", "statusPage": "https://status.strapi.io", "changelog": "https://github.com/strapi/strapi/releases", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The Strapi Cloud terms (effective 7 October 2026) name Strapi, Inc., 548 Market St, PMB 60577, San Francisco, California 94104. The repository's copyright line names Strapi Solutions SAS, and the privacy policy gives Strapi Solutions, 128 rue de la Boétie, 75008 Paris.", "A self-hosted install answers on its owner's domain. Strapi Cloud projects answer at https://\u003cproject\u003e.strapiapp.com.", "https://strapi.io/.well-known/security.txt returned 404 on 1 November 2026, as on 7 October. The repository holds a .well-known/security.txt with an Expires of 20 May 2027 and a Canonical line pointing at that URL.", "RDAP for strapi.io gives a registration date of 2015-09-21.", "The status page runs on Better Stack and covers Strapi Cloud, the website and the docs, not self-hosted installs." ], "score": 69 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/strapi.json", "live": { "slug": "strapi", "vendorStatus": { "page": "https://status.strapi.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:49.371257801Z" }, "versions": [ { "registry": "github", "name": "strapi/strapi", "version": "v5.61.0", "released": "2026-11-04", "seenAt": "2026-11-07T00:08:50.606092668Z" }, { "registry": "npm", "name": "@strapi/client", "version": "1.6.2", "seenAt": "2026-11-07T00:08:48.630156095Z" }, { "registry": "npm", "name": "@strapi/strapi", "version": "5.61.0", "seenAt": "2026-11-07T00:08:48.416025704Z" } ], "githubStars": 73439, "npmWeekly": 272760, "securityTxt": { "url": "https://strapi.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:29.878163067Z" }, "llmsTxt": { "url": "https://docs.strapi.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:03.195364993Z" }, "domain": { "domain": "strapi.io", "checkedAt": "2026-11-01T14:14:17.339178201Z" }, "pages": [ { "url": "https://strapi.io/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:21:04.710154099Z", "changedAt": "2026-10-21T00:35:29.759997175Z", "fingerprint": "ebba9951194b" }, { "url": "https://strapi.io/cloud-legal", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:21:02.008660727Z", "changedAt": "2026-10-21T00:35:27.142871952Z", "fingerprint": "79685bdc4a33" } ], "github": { "repo": "strapi/strapi", "checkedAt": "2026-11-02T09:28:28.153243123Z", "stars": 73423, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:28:09Z", "openIssues": 228, "openPRs": 437, "issuesOpened90d": 201, "issuesClosed90d": 231, "prsMerged90d": 456, "ci": { "branch": "develop", "runs": 50, "success": 30, "failure": 2, "other": 18, "latest": "success", "latestAt": "2026-11-02T09:27:48Z" }, "advisories": [ { "ghsa": "GHSA-rjg2-95x7-8qmx", "cve": "CVE-2026-27886", "severity": "critical", "published": "2026-05-13T13:39:31Z" }, { "ghsa": "GHSA-pcw7-5633-82vv", "cve": "CVE-2026-22707", "severity": "medium", "published": "2026-05-13T13:39:19Z" }, { "ghsa": "GHSA-7mqx-wwh4-f9fw", "cve": "CVE-2025-64526", "severity": "medium", "published": "2026-05-13T13:38:04Z" }, { "ghsa": "GHSA-hvp3-26wx-g2w4", "cve": "CVE-2026-22706", "severity": "low", "published": "2026-05-13T13:37:55Z" }, { "ghsa": "GHSA-3xcq-8mjw-h6mx", "cve": "CVE-2026-22599", "severity": "critical", "published": "2026-05-13T13:37:42Z" }, { "ghsa": "GHSA-495j-h493-42q2", "cve": "CVE-2024-56143", "severity": "high", "published": "2025-10-16T15:07:22Z" }, { "ghsa": "GHSA-2cjv-6wg9-f4f3", "cve": "CVE-2025-25298", "severity": "low", "published": "2025-10-16T15:07:06Z" }, { "ghsa": "GHSA-9329-mxxw-qwf8", "cve": "CVE-2025-53092", "severity": "high", "published": "2025-10-16T15:06:12Z" }, { "ghsa": "GHSA-v8wj-f5c7-pvxf", "cve": "CVE-2024-52588", "severity": "medium", "published": "2025-05-27T14:27:33Z" }, { "ghsa": "GHSA-wrvh-rcmr-9qfc", "cve": "CVE-2024-34065", "severity": "high", "published": "2024-06-12T13:03:16Z" }, { "ghsa": "GHSA-pm9q-xj9p-96pm", "cve": "CVE-2024-31217", "severity": "medium", "published": "2024-06-12T13:02:22Z" }, { "ghsa": "GHSA-6j89-frxc-q26m", "cve": "CVE-2024-29181", "severity": "low", "published": "2024-06-12T13:01:39Z" }, { "ghsa": "GHSA-gc7p-j5xm-xxh2", "cve": "CVE-2023-39345", "severity": "high", "published": "2023-11-03T07:43:47Z" }, { "ghsa": "GHSA-m284-85mf-cgrc", "cve": "CVE-2023-37263", "severity": "low", "published": "2023-09-13T15:15:38Z" }, { "ghsa": "GHSA-v8gg-4mq2-88q4", "cve": "CVE-2023-36472", "severity": "medium", "published": "2023-09-13T15:15:10Z" }, { "ghsa": "GHSA-24q2-59hm-rh9r", "cve": "CVE-2023-38507", "severity": "high", "published": "2023-09-13T15:15:03Z" }, { "ghsa": "GHSA-9xg4-3qfm-9w8f", "cve": "CVE-2023-34235", "severity": "high", "published": "2023-07-25T13:10:12Z" }, { "ghsa": "GHSA-chmr-rg2f-9jmf", "cve": "CVE-2023-34093", "severity": "medium", "published": "2023-07-25T13:10:08Z" }, { "ghsa": "GHSA-2h87-4q2w-v4hf", "cve": "CVE-2023-22621", "severity": "critical", "published": "2023-04-18T16:47:52Z" }, { "ghsa": "GHSA-jjqf-j4w7-92w8", "cve": "CVE-2023-22894", "severity": "critical", "published": "2023-04-18T16:47:44Z" }, { "ghsa": "GHSA-xv3q-jrmm-4fxv", "cve": "CVE-2023-22893", "severity": "high", "published": "2023-04-18T16:47:06Z" } ], "replies": { "sampled": 25, "unanswered": 18, "medianDays": 1.7 } }, "updatedAt": "2026-11-07T16:01:29.878163067Z" } }, "edges": [ { "by": 71, "category": "maintenance", "leads": "strapi", "name": "Maintenance \u0026 community", "reasons": { "a": "@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.", "b": "v5.60.0 was tagged on 28 October 2026 (30). 14 tagged versions between 5 August and 28 October, one a week (20). Per the 7 October check, not re-read on 1 November, 283 issues closed against 208 opened since 9 July and the newest pull requests carry labels and a reply the same day, with 217 issues open, 45 labelled severity high (18 of 25). @strapi/client 1.6.2 (4 June 2026) is still the newest tag and the only official client. The official MCP registry lists third-party Strapi servers only, which fits a server built into the product (10 of 15). Dependency bumps land weekly in the clone (5.60.0 moved in-range dependencies past published advisories). CI state per the 7 October check, when the Tests run on main failed (9 of 10)." }, "scores": { "a": 16, "b": 87 } }, { "by": 67, "category": "reliability", "leads": "strapi", "name": "Reliability", "reasons": { "a": "Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.", "b": "Read with the local-software lines, since the graded surface is the Community Edition its owner hosts. Strapi Cloud's status page isn't scored here. Official npm packages, with Node.js 20 to 26 stated in `engines` at v5.60.0 (20). A Tests workflow runs unit, API, CLI and end-to-end suites. Per the 7 October check, not re-read on 1 November (GitHub's pages refuse our reader), the latest push run on develop passed on 7 October 2026, and on main the 30 September run passed and the 7 October run failed (20 of 25). Per the same check, 217 open issues, 45 labelled severity high and one critical, with 283 closed against 208 opened since 9 July (15 of 25). Semver releases with notes per version and each v5 breaking change documented on its own page, but OpenAPI generation is declared outside semver. No commit from 5.51.2 to 5.60.0 is marked breaking (12 of 15). 5.x is the stable line and SECURITY.md marks it LTS (15)." }, "scores": { "a": 15, "b": 82 } }, { "by": 30, "category": "schema", "leads": "strapi", "name": "Schema \u0026 documentation", "reasons": { "a": "The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.", "b": "No published OpenAPI file, because endpoints depend on each project's content types. `strapi openapi generate` writes an OpenAPI 3.1.0 file for a project and is marked experimental, and every MCP tool carries JSON Schema 2020-12 input and output schemas built from the content model (20 of 25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). The 10 media tools say when to use each one and when not to, while generated content tools get a single line such as `Content-manager list for api::article.article` (14 of 20). Schemas are narrowed per field, action and locale and sort values are enums, but dynamic zones are untyped arrays and circular components fall back to an open record (12 of 15). REST pages pair curl examples with responses, and the error format and error classes are documented, without a list of status codes per endpoint (12 of 15). Semver with release notes on GitHub. The REST paths carry no API version (12 of 15)." }, "scores": { "a": 50, "b": 80 } }, { "by": 29, "category": "ergonomics", "leads": "strapi", "name": "Agent ergonomics", "reasons": { "a": "45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.", "b": "A project with five collection types and Draft \u0026 Publish exposes about 50 MCP tools, 40 generated plus 10 for media, which is the more-than-30 band (5). We added 8 because a token only sees the tools its permissions allow, so a narrow token cuts the list, and 2 for REST `fields` selection (15 of 25). Page and offset pagination with a default of 25, filters with more than 20 operators, sort and field selection (20). One error shape with status, name, message and details, and partial-failure reports on bulk media tools (16 of 20). No idempotency keys, and we found no `readOnlyHint` or `destructiveHint` in the MCP source. PUT by `documentId` is repeatable and media deletes have `dryRun` (6 of 20). Few required parameters and sensible defaults, with one official client library, @strapi/client for JavaScript (8 of 15)." }, "scores": { "a": 36, "b": 65 } }, { "by": 27, "category": "security", "leads": "strapi", "name": "Security \u0026 auth", "reasons": { "a": "Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.", "b": "API tokens are read-only, full access or custom per content type and action. Admin tokens hold a chosen subset of the owner's permissions down to field and locale. Both expire after 7, 30 or 90 days or never, can be regenerated, and travel only in the Authorization header. No OAuth (28 of 30). Read-only tokens hide every write tool, permissions are checked again at run time, MCP create writes a draft and media deletes preview first. Nothing asks a person to approve a publish or a delete, and Review Workflows are Enterprise only (15 of 20). Entries hold text written by other people, and we found no prompt-injection guidance in the MCP docs. Media responses are cut to an allowlist of fields (3 of 15). Audit Logs mark MCP actions with `origin: mcp` but need the Enterprise plan and skip reads (7 of 15). SECURITY.md sets supported versions and a GitHub advisory route, advisories are published with CVEs, the security page says SOC 2 certified and names GitHub advisories or security@strapi.io for disclosure, and the self-hosted pricing page lists a SOC 2 report as an Enterprise add-on. No bug bounty by stated policy, and strapi.io/.well-known/security.txt returned 404 on 1 November, though the repository carries one (13 of 20)." }, "scores": { "a": 39, "b": 66 } }, { "by": 20, "category": "payments", "leads": "strapi", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.", "b": "Scored with the self-hosted rule, taking prices from the paid options beside the free edition. No x402, MPP or L402 (0). The Community Edition is free, Growth is $45 a month, and Strapi Cloud lists $35, $90 and $450 a project a month with $1.50 per further 25,000 API requests, all public (20). The Community Edition needs no card and Growth has a 30-day trial without one. Strapi Cloud asks for a card at project creation (20). Install and the first administrator can be scripted (`create-strapi`, `strapi admin:create-user`) with no account at Strapi, but the docs create API and Admin tokens only in the admin panel, so half (10)." }, "scores": { "a": 30, "b": 50 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Becomes tech, LLC", "b": "Strapi, Inc.", "name": "Vendor" }, { "a": "https://app.thebcms.com/api/v3/mcp", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms", "name": "Licence" }, { "a": "45", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-03-16", "b": "2026-10-28", "name": "Last release" }, { "a": "2026-07-30", "b": "2026-10-07", "name": "Terms last updated" }, { "a": "2026-07-30", "b": "2023-03-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "396 npm/wk", "b": "73k stars, 259k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Strapi scores 67.7 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.", "question": "Which is better for AI agents, BCMS or Strapi?" }, { "answer": "Both need an API key.", "question": "Do BCMS and Strapi need an API key?" }, { "answer": "BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp. No hosted endpoint is listed for Strapi.", "question": "Can an agent call BCMS and Strapi without installing anything?" }, { "answer": "No open-source release is listed for BCMS. Strapi is open source (MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms).", "question": "Are BCMS and Strapi open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card", "No incidents deducted, where Strapi loses 4 points for them" ], "goodFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "slug": "bcms", "watchFor": "The MCP key is accepted only as a URL query parameter" }, { "aheadOn": [ "Reliability, 82 against 15", "Schema \u0026 documentation, 80 against 50", "Agent ergonomics, 65 against 36", "Security \u0026 auth, 66 against 39", "Payments \u0026 pricing, 50 against 30", "Maintenance \u0026 community, 87 against 16", "Transparency \u0026 trust, 72 against 52" ], "also": [ "Open source" ], "goodFor": "Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.", "slug": "strapi", "watchFor": "Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans" } ], "history": { "bcms": null, "strapi": [ { "causes": [ "correction" ], "date": "2026-11-01", "delta": 2, "from": 65.7, "fromGrade": "B", "to": 67.7, "toGrade": "B" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": -0.2, "from": 65.9, "fromGrade": "B", "to": 65.7, "toGrade": "B" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.2, "from": 65.7, "fromGrade": "B", "to": 65.9, "toGrade": "B" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-buttercms.json", "title": "BCMS vs ButterCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-buttercms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-contentstack.json", "title": "BCMS vs Contentstack", "url": "https://www.anchorterminal.com/compare/bcms-vs-contentstack" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-datocms.json", "title": "BCMS vs DatoCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-directus.json", "title": "BCMS vs Directus", "url": "https://www.anchorterminal.com/compare/bcms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-ghost.json", "title": "BCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/bcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-hygraph.json", "title": "BCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/bcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.json", "title": "BCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-payload.json", "title": "BCMS vs Payload", "url": "https://www.anchorterminal.com/compare/bcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-prismic.json", "title": "BCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/bcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-sanity.json", "title": "BCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/bcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-storyblok.json", "title": "BCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/bcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-webflow.json", "title": "BCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/bcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-wordpress.json", "title": "BCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/bcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-strapi.json", "title": "ButterCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/buttercms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-strapi.json", "title": "Contentstack vs Strapi", "url": "https://www.anchorterminal.com/compare/contentstack-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.json", "title": "Cosmic vs Strapi", "url": "https://www.anchorterminal.com/compare/cosmic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-strapi.json", "title": "DatoCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/datocms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-strapi.json", "title": "Directus vs Strapi", "url": "https://www.anchorterminal.com/compare/directus-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-strapi.json", "title": "dotCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/dotcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-strapi.json", "title": "Ghost vs Strapi", "url": "https://www.anchorterminal.com/compare/ghost-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-strapi.json", "title": "Hygraph vs Strapi", "url": "https://www.anchorterminal.com/compare/hygraph-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-strapi.json", "title": "Kontent.ai vs Strapi", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-strapi.json", "title": "Payload vs Strapi", "url": "https://www.anchorterminal.com/compare/payload-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/prismic-vs-strapi.json", "title": "Prismic vs Strapi", "url": "https://www.anchorterminal.com/compare/prismic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-strapi.json", "title": "Sanity vs Strapi", "url": "https://www.anchorterminal.com/compare/sanity-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-strapi.json", "title": "Storyblok vs Strapi", "url": "https://www.anchorterminal.com/compare/storyblok-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-webflow.json", "title": "Strapi vs Webflow", "url": "https://www.anchorterminal.com/compare/strapi-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-wordpress.json", "title": "Strapi vs WordPress", "url": "https://www.anchorterminal.com/compare/strapi-vs-wordpress" } ], "panel": null, "scores": [ { "bcms": 15, "by": 67, "edge": "strapi", "key": "reliability", "name": "Reliability", "strapi": 82, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "bcms": 50, "by": 30, "edge": "strapi", "key": "schema", "name": "Schema \u0026 documentation", "strapi": 80, "weight": 13 }, { "bcms": 36, "by": 29, "edge": "strapi", "key": "ergonomics", "name": "Agent ergonomics", "strapi": 65, "weight": 13 }, { "bcms": 39, "by": 27, "edge": "strapi", "key": "security", "name": "Security \u0026 auth", "strapi": 66, "weight": 14 }, { "bcms": 30, "by": 20, "edge": "strapi", "key": "payments", "name": "Payments \u0026 pricing", "strapi": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "bcms": 16, "by": 71, "edge": "strapi", "key": "maintenance", "name": "Maintenance \u0026 community", "strapi": 87, "weight": 7 }, { "bcms": 52, "by": 20, "edge": "strapi", "key": "transparency", "name": "Transparency \u0026 trust", "strapi": 72, "weight": 7 } ], "summary": "Strapi scores 67.7 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "bcms": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "strapi": "The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is paid-only and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/bcms-vs-strapi", "json": "https://www.anchorterminal.com/compare/bcms-vs-strapi.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/bcms-vs-strapi.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/bcms-vs-strapi.min.md" }, "markdown": "Strapi scores 67.7 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.\n\n- BCMS: grade F, 33.5/100, rank #1383 of 1486. Markdown https://www.anchorterminal.com/tools/bcms.md · JSON https://www.anchorterminal.com/api/v1/tools/bcms.json\n- Strapi: grade B, 67.7/100, rank #308 of 1486. Markdown https://www.anchorterminal.com/tools/strapi.md · JSON https://www.anchorterminal.com/api/v1/tools/strapi.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### BCMS (F)\n\nGood for: Small sites and agencies that want a cheap hosted CMS an agent can edit.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n- No incidents deducted, where Strapi loses 4 points for them\n\nWatch for: The MCP key is accepted only as a URL query parameter\n\n### Strapi (B)\n\nGood for: Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.\n\nAhead on:\n- Reliability, 82 against 15\n- Schema \u0026 documentation, 80 against 50\n- Agent ergonomics, 65 against 36\n- Security \u0026 auth, 66 against 39\n- Payments \u0026 pricing, 50 against 30\n- Maintenance \u0026 community, 87 against 16\n- Transparency \u0026 trust, 72 against 52\n\nAlso in its favour:\n- Open source\n\nWatch for: Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Strapi +71\n\n- BCMS (16): @thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.\n- Strapi (87): v5.60.0 was tagged on 28 October 2026 (30). 14 tagged versions between 5 August and 28 October, one a week (20). Per the 7 October check, not re-read on 1 November, 283 issues closed against 208 opened since 9 July and the newest pull requests carry labels and a reply the same day, with 217 issues open, 45 labelled severity high (18 of 25). @strapi/client 1.6.2 (4 June 2026) is still the newest tag and the only official client. The official MCP registry lists third-party Strapi servers only, which fits a server built into the product (10 of 15). Dependency bumps land weekly in the clone (5.60.0 moved in-range dependencies past published advisories). CI state per the 7 October check, when the Tests run on main failed (9 of 10).\n\n### Reliability: Strapi +67\n\n- BCMS (15): Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.\n- Strapi (82): Read with the local-software lines, since the graded surface is the Community Edition its owner hosts. Strapi Cloud's status page isn't scored here. Official npm packages, with Node.js 20 to 26 stated in `engines` at v5.60.0 (20). A Tests workflow runs unit, API, CLI and end-to-end suites. Per the 7 October check, not re-read on 1 November (GitHub's pages refuse our reader), the latest push run on develop passed on 7 October 2026, and on main the 30 September run passed and the 7 October run failed (20 of 25). Per the same check, 217 open issues, 45 labelled severity high and one critical, with 283 closed against 208 opened since 9 July (15 of 25). Semver releases with notes per version and each v5 breaking change documented on its own page, but OpenAPI generation is declared outside semver. No commit from 5.51.2 to 5.60.0 is marked breaking (12 of 15). 5.x is the stable line and SECURITY.md marks it LTS (15).\n\n### Schema \u0026 documentation: Strapi +30\n\n- BCMS (50): The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.\n- Strapi (80): No published OpenAPI file, because endpoints depend on each project's content types. `strapi openapi generate` writes an OpenAPI 3.1.0 file for a project and is marked experimental, and every MCP tool carries JSON Schema 2020-12 input and output schemas built from the content model (20 of 25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). The 10 media tools say when to use each one and when not to, while generated content tools get a single line such as `Content-manager list for api::article.article` (14 of 20). Schemas are narrowed per field, action and locale and sort values are enums, but dynamic zones are untyped arrays and circular components fall back to an open record (12 of 15). REST pages pair curl examples with responses, and the error format and error classes are documented, without a list of status codes per endpoint (12 of 15). Semver with release notes on GitHub. The REST paths carry no API version (12 of 15).\n\n### Agent ergonomics: Strapi +29\n\n- BCMS (36): 45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.\n- Strapi (65): A project with five collection types and Draft \u0026 Publish exposes about 50 MCP tools, 40 generated plus 10 for media, which is the more-than-30 band (5). We added 8 because a token only sees the tools its permissions allow, so a narrow token cuts the list, and 2 for REST `fields` selection (15 of 25). Page and offset pagination with a default of 25, filters with more than 20 operators, sort and field selection (20). One error shape with status, name, message and details, and partial-failure reports on bulk media tools (16 of 20). No idempotency keys, and we found no `readOnlyHint` or `destructiveHint` in the MCP source. PUT by `documentId` is repeatable and media deletes have `dryRun` (6 of 20). Few required parameters and sensible defaults, with one official client library, @strapi/client for JavaScript (8 of 15).\n\n### Security \u0026 auth: Strapi +27\n\n- BCMS (39): Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.\n- Strapi (66): API tokens are read-only, full access or custom per content type and action. Admin tokens hold a chosen subset of the owner's permissions down to field and locale. Both expire after 7, 30 or 90 days or never, can be regenerated, and travel only in the Authorization header. No OAuth (28 of 30). Read-only tokens hide every write tool, permissions are checked again at run time, MCP create writes a draft and media deletes preview first. Nothing asks a person to approve a publish or a delete, and Review Workflows are Enterprise only (15 of 20). Entries hold text written by other people, and we found no prompt-injection guidance in the MCP docs. Media responses are cut to an allowlist of fields (3 of 15). Audit Logs mark MCP actions with `origin: mcp` but need the Enterprise plan and skip reads (7 of 15). SECURITY.md sets supported versions and a GitHub advisory route, advisories are published with CVEs, the security page says SOC 2 certified and names GitHub advisories or security@strapi.io for disclosure, and the self-hosted pricing page lists a SOC 2 report as an Enterprise add-on. No bug bounty by stated policy, and strapi.io/.well-known/security.txt returned 404 on 1 November, though the repository carries one (13 of 20).\n\n### Payments \u0026 pricing: Strapi +20\n\n- BCMS (30): No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.\n- Strapi (50): Scored with the self-hosted rule, taking prices from the paid options beside the free edition. No x402, MPP or L402 (0). The Community Edition is free, Growth is $45 a month, and Strapi Cloud lists $35, $90 and $450 a project a month with $1.50 per further 25,000 API requests, all public (20). The Community Edition needs no card and Growth has a 30-day trial without one. Strapi Cloud asks for a card at project creation (20). Install and the first administrator can be scripted (`create-strapi`, `strapi admin:create-user`) with no account at Strapi, but the docs create API and Admin tokens only in the admin panel, so half (10).\n\n## Score by category\n\n| Category | Weight | BCMS | Strapi | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 82 | Strapi +67 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 50 | 80 | Strapi +30 |\n| Agent ergonomics | 13% (16.2 this run) | 36 | 65 | Strapi +29 |\n| Security \u0026 auth | 14% (17.5 this run) | 39 | 66 | Strapi +27 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 50 | Strapi +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 16 | 87 | Strapi +71 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 72 | Strapi +20 |\n| Negative events | ≤15 | 0 | -4 | |\n| **Total** | | **33.5 · F** | **67.7 · B** | |\n\n## Facts side by side\n\n| Fact | BCMS | Strapi |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Becomes tech, LLC | Strapi, Inc. |\n| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | no (local only) |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | API key | API key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | none | MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms |\n| Tools exposed | 45 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-03-16 | 2026-10-28 |\n| Terms last updated | 2026-07-30 | 2026-10-07 |\n| Privacy policy last updated | 2026-07-30 | 2023-03-01 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 396 npm/wk | 73k stars, 259k npm/wk |\n| Agent reviews | none | 3.5/5 (4) |\n\n## How the scores have moved\n\n### BCMS\n\nNo score change since it was listed.\n\n### Strapi\n\n- +2.0 on 1 November 2026: correction\n- -0.2 on 28 October 2026: correction\n- +0.2 on 28 October 2026: new evidence\n\n## Verdicts\n\n**BCMS.** BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.\n\n**Strapi.** The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is paid-only and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.\n\n## Before you call either\n\n### BCMS\n\n1. Keep the MCP URL out of logs and shared config, since the key is inside it\n2. Call get-all-templates first and mutate only once you have template and entry ids\n3. Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model\n4. List and confirm entry ids with the user before calling delete-entries\n5. Use the bcms-content CLI for scripted runs that need JSON output and exit codes\n\n### Strapi\n\n1. Pass `status=draft` on every REST POST and PUT. Without it the Content API publishes the entry at once\n2. Use an Admin token for `/mcp` and admin routes and an API token for `/api`. Each kind is rejected on the other's routes\n3. Upload files with multipart POST to `/api/upload` first, then reference the returned file id in the entry. MCP tools can't upload\n4. Call `media_delete_assets` and `media_delete_folder` without `dryRun` first to preview, and take asset ids only from `media_list_assets`\n5. Keep your own copy of an entry before updating it. API and MCP writes create no Content History version\n\n## Questions\n\n### Which is better for AI agents, BCMS or Strapi?\n\nStrapi scores 67.7 (B) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.\n\n### Do BCMS and Strapi need an API key?\n\nBoth need an API key.\n\n### Can an agent call BCMS and Strapi without installing anything?\n\nBCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp. No hosted endpoint is listed for Strapi.\n\n### Are BCMS and Strapi open source?\n\nNo open-source release is listed for BCMS. Strapi is open source (MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/bcms-vs-strapi.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bcms-vs-strapi.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"bcms\", \"b\": \"strapi\"}`. From a terminal: `anchor compare bcms strapi`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bcms.json and https://www.anchorterminal.com/api/v1/tools/strapi.json\n\n## Other comparisons with BCMS or Strapi\n\n- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)\n- [BCMS vs Contentstack](https://www.anchorterminal.com/compare/bcms-vs-contentstack.md)\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)\n- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Ghost](https://www.anchorterminal.com/compare/bcms-vs-ghost.md)\n- [BCMS vs Hygraph](https://www.anchorterminal.com/compare/bcms-vs-hygraph.md)\n- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)\n- [BCMS vs Payload](https://www.anchorterminal.com/compare/bcms-vs-payload.md)\n- [BCMS vs Prismic](https://www.anchorterminal.com/compare/bcms-vs-prismic.md)\n- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)\n- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)\n- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)\n- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)\n- [ButterCMS vs Strapi](https://www.anchorterminal.com/compare/buttercms-vs-strapi.md)\n- [Contentstack vs Strapi](https://www.anchorterminal.com/compare/contentstack-vs-strapi.md)\n- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)\n- [DatoCMS vs Strapi](https://www.anchorterminal.com/compare/datocms-vs-strapi.md)\n- [Directus vs Strapi](https://www.anchorterminal.com/compare/directus-vs-strapi.md)\n- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)\n- [Ghost vs Strapi](https://www.anchorterminal.com/compare/ghost-vs-strapi.md)\n- [Hygraph vs Strapi](https://www.anchorterminal.com/compare/hygraph-vs-strapi.md)\n- [Kontent.ai vs Strapi](https://www.anchorterminal.com/compare/kontent-ai-vs-strapi.md)\n- [Payload vs Strapi](https://www.anchorterminal.com/compare/payload-vs-strapi.md)\n- [Prismic vs Strapi](https://www.anchorterminal.com/compare/prismic-vs-strapi.md)\n- [Sanity vs Strapi](https://www.anchorterminal.com/compare/sanity-vs-strapi.md)\n- [Storyblok vs Strapi](https://www.anchorterminal.com/compare/storyblok-vs-strapi.md)\n- [Strapi vs Webflow](https://www.anchorterminal.com/compare/strapi-vs-webflow.md)\n- [Strapi vs WordPress](https://www.anchorterminal.com/compare/strapi-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BCMS vs Strapi", "url": "" } ], "description": "Strapi scores 67.7 (B) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BCMS F 33.5", "Strapi B 67.7", "scores" ], "h1": "BCMS vs Strapi", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/bcms-vs-strapi", "published": "2026-10-01", "section": "tools", "title": "BCMS vs Strapi for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/bcms-vs-strapi" }, "tokens": { "markdown": 4600, "slim": 2780 }, "version": 1 }