{ "data": { "a": { "slug": "bcms", "name": "BCMS", "vendor": "Becomes tech, LLC", "vendorUrl": "https://www.thebcms.com", "kind": "http-api", "category": "cms", "summary": "BCMS is a hosted headless CMS from Becomes tech, LLC. People edit structured content in a dashboard, and agents work with templates, entries, media and languages through a REST API, a JavaScript client, a CLI and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/bcms", "markdownUrl": "https://www.anchorterminal.com/tools/bcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bcms.json", "dns": "bcms.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.thebcms.com/api/v3/mcp", "packages": [ { "registry": "npm", "name": "@thebcms/client" } ], "auth": "api-key", "authNotes": "Three-part keys (keyId.secret.instanceId) created in the dashboard and scoped to templates and media, with schema tools only for keys allowed them. The MCP endpoint takes the key only as the `mcpKey` query parameter, and the REST examples pass `apiKey` in the query string. The docs advise a key per person, client and environment and regular rotation.", "pricing": "paid", "pricingNotes": "Hobby $5 a month ($4 billed yearly) with 2 seats, 100 entries and 500 MB of media; Pro $50 a month ($33 yearly) with 5 seats, then $15 a seat a month, and unlimited entries; Enterprise by quote. Every plan starts with a 14-day free trial with no card. No self-hosted edition.", "priceSummary": "$5 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the docs, the MCP page or pricing.md (checked 2026-11-06).", "endpoints": [] }, "toolCount": 45, "popularity": { "githubStars": null, "npmWeekly": 396, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.thebcms.com/docs", "llmsTxt": "https://www.thebcms.com/llms.txt", "capabilities": [ "cms.content", "cms.assets", "cms.localisation", "cms.schema", "cms.publish" ], "tags": [ "hosted", "mcp", "remote-mcp", "llms-txt", "no-card", "closed-source", "webhooks", "typescript", "cli" ], "lastRelease": "2026-03-16", "graded": true, "anchor": { "graded": true, "score": 33.5, "grade": "F", "agentReady": false, "rank": 1383, "ranked": true, "rankOf": 1486, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "bestFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "strengths": [ "Remote MCP server covering templates, entries, statuses, entry history, media, languages and trash", "Keys scoped to the templates and media an agent needs, with schema tools gated separately", "llms.txt that says when to use BCMS and when not to, plus a public SKILL.md", "Entry history and trash readable through MCP, so an agent can trace and recover changes", "14-day trial with no card, then plans from $5 a month" ], "weaknesses": [ "The MCP key is accepted only as a URL query parameter", "No status page, documented rate limits, SLA or changelog found", "No security.txt, disclosure policy or certification found", "The JavaScript client hasn't been released since March 2026", "No self-hosted edition; the open-source repository has been unmaintained since October 2024" ], "agentNotes": [ "Keep the MCP URL out of logs and shared config, since the key is inside it", "Call get-all-templates first and mutate only once you have template and entry ids", "Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model", "List and confirm entry ids with the user before calling delete-entries", "Use the bcms-content CLI for scripted runs that need JSON output and exit codes" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 33.5 } ], "editorialScores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 48 }, "provenanceScore": 56, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @thebcms/client", "claudeCode": "claude mcp add --transport http bcms \"https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE\"", "config": { "mcpServers": { "bcms": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/bcms" }, "area": "business", "unitPrices": [ { "item": "Hobby plan", "unit": "month", "usd": 5, "note": "$4 a month billed yearly; 2 seats, 100 entries" }, { "item": "Pro plan", "unit": "month", "usd": 50, "note": "$33 a month billed yearly; 5 seats" }, { "item": "Extra Pro seat", "unit": "seat-month", "usd": 15, "note": "$120 a year on yearly billing" } ], "provenance": { "legalEntity": "Becomes tech, LLC", "domain": "thebcms.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.thebcms.com/terms-of-use/", "privacy": "https://www.thebcms.com/privacy-policy/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both effective 30 July 2026, name Becomes tech, LLC, a Delaware LLC. The terms forbid scraping or crawling that burdens or abuses the services, except through the documented APIs within rate limits.", "www.thebcms.com/robots.txt allows all. app.thebcms.com/robots.txt disallows all paths.", "www.thebcms.com/.well-known/security.txt returned 404 and no status page was found.", "RDAP gave no registration date for thebcms.com through rdap.org." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bcms.json", "live": { "slug": "bcms", "probe": { "target": "https://app.thebcms.com/api/v3/mcp", "method": "get", "lastAt": "2026-11-07T18:20:13.025269198Z", "lastOk": true, "lastStatus": 400, "lastMs": 197, "authRequired": false, "uptime24h": 99.5, "uptime30d": 99.5, "p50ms24h": 141, "p95ms24h": 393, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 186 } ] }, "versions": [ { "registry": "npm", "name": "@thebcms/client", "version": "2.0.3", "seenAt": "2026-11-06T23:10:32.023184196Z" } ], "npmWeekly": 396, "securityTxt": { "url": "https://thebcms.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:49.817334601Z" }, "llmsTxt": { "url": "https://www.thebcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:42.21650798Z" }, "pages": [ { "url": "https://www.thebcms.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:35:35.490295236Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "abae80fa615e" }, { "url": "https://www.thebcms.com/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:35:37.777884178Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "58d8ef9074aa" } ], "mcpTools": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE", "checkedAt": "2026-11-07T01:42:42.874889438Z", "status": "error", "note": "initialize: no JSON-RPC answer", "changedAt": "2026-11-07T01:42:42.874889438Z" }, "updatedAt": "2026-11-07T18:20:13.025269198Z" } }, "answer": "Webflow scores 70.4 (BB) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories.", "b": { "slug": "webflow", "name": "Webflow", "vendor": "Webflow, Inc.", "vendorUrl": "https://webflow.com", "kind": "http-api", "category": "cms", "summary": "Webflow is a hosted website builder with a built-in CMS. Agents reach it through the Data API v2 (collections, items, assets, pages, locales, publishing) or the official hosted MCP server, which wraps that API in 34 tools.", "url": "https://www.anchorterminal.com/tools/webflow", "markdownUrl": "https://www.anchorterminal.com/tools/webflow.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/webflow.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/webflow.json", "dns": "webflow.grade.anchorterminal.com", "repo": "https://github.com/webflow/openapi-spec", "license": "Proprietary service under Webflow's Terms of Service. The OpenAPI spec, the JavaScript and Python SDKs and the open-source MCP server on GitHub are MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.webflow.com/v2", "packages": [ { "registry": "npm", "name": "webflow-api" }, { "registry": "pypi", "name": "webflow" }, { "registry": "npm", "name": "webflow-mcp-server" } ], "auth": "mixed", "authNotes": "Self-serve. The Data API takes a Bearer token, either a site token or an OAuth access token. A site administrator creates a site token under Apps \u0026 integrations and picks read and write scopes. Each site allows 5 tokens and a token expires after 365 days without use. An OAuth app is registered in a workspace with its scopes, and only apps listed on the Marketplace go through review. The MCP server uses browser OAuth with PKCE and dynamic client registration, where a site owner or admin picks the sites or the workspace. Custom code endpoints and workspace activity logs aren't open to site tokens.", "pricing": "freemium", "pricingNotes": "The Starter site plan is free and includes the CMS APIs at 60 requests a minute, 50 CMS items and the MCP server, so an agent can start without a contract. Basic is $15 a month billed yearly and has no CMS. Premium is $25 a month billed yearly with 20,000 CMS items and 120 requests a minute. Team is $2,500 a month on an annual contract and Enterprise is sold through sales. Prices are per site (https://webflow.com/pricing, checked 2026-10-08).", "priceSummary": "$15 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Data API docs, the MCP server docs or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 34, "popularity": { "githubStars": null, "npmWeekly": 85160, "pypiWeekly": 121246, "asOf": "2026-10-08" }, "docsUrl": "https://developers.webflow.com/data/docs", "llmsTxt": "https://developers.webflow.com/llms.txt", "openapi": "https://raw.githubusercontent.com/webflow/openapi-spec/main/openapi/v2.yml", "registryName": "com.webflow/mcp", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.schema", "cms.localisation" ], "tags": [ "official", "hosted", "mcp", "oauth", "openapi", "llms-txt", "closed-source", "free-tier", "webhooks", "typescript", "python", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 70.4, "grade": "BB", "agentReady": true, "rank": 199, "ranked": true, "rankOf": 1486, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 80, "payments": 30, "reliability": 84, "schema": 87, "security": 74, "transparency": 81 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "7 October 2026. The Get Site Plan endpoint changed the `id` and `displayName` it returns for Starter sites and renamed some plans, in place. The changelog entry of the same date calls it a breaking change and no earlier notice was found. It is documented, so the deduction is small (https://developers.webflow.com/home/changelog/2026/10/7)." ], "verdict": "The Data API has a public OpenAPI 3.1 spec with 140 operations, scoped OAuth and site tokens, and CMS items that stay drafts until a separate publish call. The MCP server loads 34 multi-action tools and can't create new localised CMS items. The free plan holds 50 CMS items, and the activity log needs the $2,500 Team plan.", "bestFor": "Teams whose website already runs on Webflow and who want an agent to draft, update and publish CMS items, fix metadata or manage assets.", "strengths": [ "Public OpenAPI 3.1 spec for Data API v2 with 140 operations, MIT, last synced on 2 September 2026, plus llms.txt and a Markdown copy of every docs page", "OAuth and site tokens take read and write scope pairs per resource (cms, assets, pages, sites and others), and each site allows at most 5 tokens", "CMS items are created and updated as drafts. Publishing an item or the whole site is a separate call", "429 responses carry Retry-After, every response carries X-RateLimit-Remaining, and the JavaScript and Python SDKs back off automatically", "Hosted MCP server at mcp.webflow.com/mcp is listed in the official MCP registry as com.webflow/mcp and has its own component on the status page" ], "weaknesses": [ "The MCP server documents 34 tools (27 data, 3 Designer session, 4 utility), each with several actions, and a granted tool grants all its actions", "No idempotency keys on Data API writes in the reviewed documentation. Site publish is limited to one successful call a minute", "The MCP server can't create new localised CMS items. It reads and updates existing items in secondary locales", "The Starter plan allows 50 CMS items and 60 requests a minute. The site activity log that records agent changes is listed on Team ($2,500 a month) and Enterprise", "On 7 October 2026 Get Site Plan changed its `id` and `displayName` values in place, marked as breaking in the changelog entry of the same day" ], "agentNotes": [ "Send the token as `Authorization: Bearer` to https://api.webflow.com/v2. Ask for `cms:read` and `cms:write` only, plus `sites:write` if the task publishes", "Create or update items first, then call Publish Items or Publish Site. An item with `isDraft` true and a `lastPublished` date is live with unpublished changes", "Stay under 60 requests a minute on Starter and Basic and 120 on Premium, read X-RateLimit-Remaining, and wait for Retry-After on 429", "Page item lists with `limit` (maximum 100) and `offset`, and filter with `filter[\u003cfieldSlug\u003e][\u003coperator\u003e]`, up to 10 terms", "Upload an asset in two steps (create the asset with a file hash, then POST the bytes to the presigned URL). Write localised content with the item's `cmsLocaleId`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.4 } ], "editorialScores": { "ergonomics": 72, "maintenance": 80, "payments": 30, "reliability": 84, "schema": 87, "security": 74, "transparency": 65 }, "provenanceScore": 97, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install webflow-api", "http": "curl --request GET \\\n --url https://api.webflow.com/v2/sites \\\n --header 'accept: application/json' \\\n --header 'authorization: Bearer YOUR_API_TOKEN'", "claudeCode": "claude mcp add --transport http webflow https://mcp.webflow.com/mcp" }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/webflow" }, "area": "business", "unitPrices": [ { "item": "Basic site plan", "unit": "month", "usd": 15, "note": "billed yearly, per site, no CMS" }, { "item": "Premium site plan", "unit": "month", "usd": 25, "note": "billed yearly, per site, 20,000 CMS items and 120 requests a minute" }, { "item": "Team platform plan", "unit": "month", "usd": 2500, "note": "annual contract, 5 full and 5 limited seats included" } ], "provenance": { "legalEntity": "Webflow, Inc.", "domain": "webflow.com", "domainRegistered": "2003-03-31", "endpointOnVendorDomain": true, "terms": "https://webflow.com/legal/terms", "privacy": "https://webflow.com/legal/privacy", "statusPage": "https://status.webflow.com", "changelog": "https://developers.webflow.com/home/changelog", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Terms of Service name Webflow, Inc., a Delaware corporation at 398 11th Street, Floor 2, San Francisco, CA 94103, and are governed by California law.", "The Terms of Service (effective 15 November 2023) govern the platform and incorporate the Developer Terms of Service at https://webflow.com/legal/developer-terms-of-service, which cover API use and rate limits.", "The privacy policy is effective 17 March 2025. The DPA is effective 15 November 2023 and the sub-processor list was updated on 9 July 2026.", "The Data API answers at api.webflow.com and the MCP server at mcp.webflow.com.", "webflow.com/.well-known/security.txt points to a Bugcrowd disclosure programme and expires on 31 December 2026.", "RDAP for webflow.com gives a registration date of 2003-03-31.", "status.webflow.com runs on Statuspage with components for the Data API and the MCP server." ], "score": 97 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/webflow.json", "live": { "slug": "webflow", "probe": { "target": "https://api.webflow.com/v2", "method": "get", "lastAt": "2026-11-07T18:21:05.18640595Z", "lastOk": true, "lastStatus": 404, "lastMs": 270, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 287, "p95ms24h": 397, "samples24h": 239, "samples30d": 7440, "days": [ { "date": "2026-10-08", "probes": 70, "ok": 70 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.webflow.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:22:11.183509603Z" }, "versions": [ { "registry": "mcp-registry", "name": "com.webflow/mcp", "version": "2.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "webflow-api", "version": "3.3.4", "seenAt": "2026-11-07T00:16:57.354522678Z" }, { "registry": "npm", "name": "webflow-mcp-server", "version": "1.0.0", "seenAt": "2026-11-07T00:17:00.104827849Z" }, { "registry": "pypi", "name": "webflow", "version": "2.0.0", "released": "2026-03-12", "seenAt": "2026-11-07T00:16:57.805129165Z" } ], "githubStars": 14, "npmWeekly": 82354, "pypiWeekly": 186963, "securityTxt": { "url": "https://webflow.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:15.527868378Z" }, "llmsTxt": { "url": "https://developers.webflow.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:21.8813987Z" }, "domain": { "domain": "webflow.com", "registered": "2003-03-31", "source": "https://rdap.verisign.com/com/v1/domain/webflow.com", "checkedAt": "2026-11-01T14:27:26.928129519Z" }, "pages": [ { "url": "https://developers.webflow.com/home/changelog", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:04:42.015675459Z", "changedAt": "2026-10-31T06:08:42.770759668Z", "fingerprint": "3987ccb7f811" }, { "url": "https://developers.webflow.com/home/changelog/2026/10/9", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:04:44.700652093Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "7e67cf4ed8ff" }, { "url": "https://webflow.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:23:49.01246629Z", "changedAt": "2026-10-31T06:23:49.011572947Z", "fingerprint": "b615de0b6bb9" }, { "url": "https://webflow.com/legal/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:23:44.827786609Z", "changedAt": "2026-10-31T06:23:44.639467742Z", "fingerprint": "3152a1cd712c" }, { "url": "https://webflow.com/legal/terms", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:23:46.950481319Z", "changedAt": "2026-10-31T06:23:46.941328164Z", "fingerprint": "0108e43611ca" } ], "mcpTools": { "url": "https://mcp.webflow.com/mcp", "checkedAt": "2026-11-07T01:49:13.117649065Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:49:13.117649065Z" }, "github": { "repo": "webflow/openapi-spec", "checkedAt": "2026-11-02T09:38:09.499391382Z", "stars": 14, "archived": false, "issuesEnabled": true, "pushedAt": "2026-09-02T20:19:20Z", "openIssues": 10, "openPRs": 0, "issuesOpened90d": 4, "issuesClosed90d": 0, "prsMerged90d": 0, "replies": { "sampled": 9, "unanswered": 6, "medianDays": 13.2 } }, "updatedAt": "2026-11-07T18:22:11.183509603Z" } }, "edges": [ { "by": 69, "category": "reliability", "leads": "webflow", "name": "Reliability", "reasons": { "a": "Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.", "b": "Graded on the Data API v2 and the hosted MCP server. Public status page at status.webflow.com with components for the Data API and the MCP server and a full incident history (20). In the 90 days to 1 November 2026, read from the status history feed (the /api/ path is disallowed by the host's robots.txt), the graded surface had two incidents, both partial and read as minor. They were 503 errors on some hosted sites, Webflow.com and the MCP server on 25 August, and MCP authorisation failing for some sites in client workspaces on 17 September (about 40 minutes). The week-long missing MCP tools of 9 to 16 July and the 28 July webhooks failure have left the window. Publishing failed or slowed for some customers on 14 September (an upstream provider fault that also touched Analyze and Optimize) and 28 September, which is partial whichever surface it reached. The other incidents in the window (intermittent 500s on some hosted sites on 15 September, form notification emails on 21 and 22 September, site creation and the Canvas on 12 August) were outside the graded surface, and none was posted after 28 September (20). Rate limits published, 60 requests a minute on Starter and Basic and 120 on higher site plans (15). 429 carries Retry-After and the SDKs back off, but no idempotency keys were found for Data API writes (11). An SLA page dated 1 September 2026 exists and the pricing page lists enhanced SLAs on Enterprise. The terms sit in a PDF we didn't read (8 of 10). The /v2 namespace is described as production and the MCP server has a separate beta URL (10)." }, "scores": { "a": 15, "b": 84 } }, { "by": 64, "category": "maintenance", "leads": "webflow", "name": "Maintenance \u0026 community", "reasons": { "a": "@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.", "b": "The newest developer changelog entry is dated 28 October 2026 (a robots.txt Content API in beta) (30). Twenty-two dated entries between 10 August and 28 October 2026, among them the AEO Analytics and Optimize APIs out of beta on 13 and 15 October (20). Public changelog, a support site and a community forum. We couldn't read the GitHub issue trackers, and the open-source MCP repository has had only a CI change (26 October) since 10 April 2026 while the hosted server moved to v2.1 (8 of 15). The server is in the official MCP registry as com.webflow/mcp, and the JavaScript SDK (tag v3.3.4, 16 March 2026; main's package.json reads 3.3.5) and Python SDK (2.0.0, 12 March 2026) are the current official SDKs (15). The JavaScript SDK repository has CI, a dependency patch merged on 6 October and a CI pin on 26 October 2026. The MCP repository pins webflow-api 3.2.1 (7)." }, "scores": { "a": 16, "b": 80 } }, { "by": 37, "category": "schema", "leads": "webflow", "name": "Schema \u0026 documentation", "reasons": { "a": "The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.", "b": "Public OpenAPI 3.1 spec in webflow/openapi-spec with 140 operations for v2 and 139 for v2 beta, MIT. Its last sync is 2 September 2026, so the Workspace Members (29 September), AEO Analytics (13 October) and Optimize (15 October) endpoints aren't in it yet. The hosted MCP server's v2.1 tool schemas aren't in the public repository, whose last commit is 10 April 2026 (23 of 25). A root llms.txt, section indexes and a Markdown copy of every page at the URL plus .md (10). The MCP data tools reference says for each tool whether it reads or writes, when to use it and what each action needs (16). The spec types parameters with enums and required fields. Item content in `fieldData` is an object checked against the collection's own schema (11). Request and response examples throughout, an error format with `code`, `message` and `details`, and an enumerated list of about 100 error codes (13). /v2 and /beta in the path and a dated changelog with a full index, though some changes land in place on the day (14)." }, "scores": { "a": 50, "b": 87 } }, { "by": 36, "category": "ergonomics", "leads": "webflow", "name": "Agent ergonomics", "reasons": { "a": "45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.", "b": "The MCP server documents 34 tools, each bundling several actions, which is the checklist's 5. We added 6 for `get_more_tools`, which loads specialised tools on request, and for tools labelled read or write (11 of 25). `limit` up to 100 and `offset` on lists, and custom-field filters and sorts on collection items with up to 10 filter terms (20). Errors carry a machine-readable code from a published list, and the MCP server returns `ModeForbidden` when a tool can't run in the current Designer mode (16). No idempotency keys on Data API writes. The open-source server sets `readOnlyHint` on its tools, and the hosted server has a dry run and an idempotency key for Webflow Cloud deploys only (10 of 20). Few required parameters, and official SDKs for JavaScript and Python (15)." }, "scores": { "a": 36, "b": 72 } }, { "by": 35, "category": "security", "leads": "webflow", "name": "Security \u0026 auth", "reasons": { "a": "Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.", "b": "OAuth with read and write scope pairs per resource, or site tokens with the same scopes, at most 5 per site, which expire after 365 days without use. The MCP server uses OAuth with PKCE, dynamic client registration, refresh tokens and a revocation endpoint. Tokens travel in the Authorization header. We took 2 off because the MCP metadata also accepts the `plain` challenge method and site-token rotation isn't described (28). Scopes split read from write, the person picks sites or a workspace at authorisation, and the MCP server follows the user's role. A granted tool grants all its actions and no confirmation step for deletes was found (14). Agent Instructions stored on a site are given to every connected agent automatically, and the docs give no guidance on treating site content as untrusted beyond limiting authorised sites and reviewing generated drafts (5). Agent changes are recorded in the site activity log, which the pricing page lists on Team and Enterprise, with an Audit Logs API on Enterprise (9). A valid security.txt pointing to a Bugcrowd disclosure programme, SOC 2 Type II, ISO 27001, 27017, 27018 and 42001, and an annual penetration test report in the trust centre (18)." }, "scores": { "a": 39, "b": 74 } }, { "by": 29, "category": "transparency", "leads": "webflow", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.", "b": "Closed service with published Terms of Service and Developer Terms. The OpenAPI spec, both SDKs and the older open-source MCP server are MIT (17). Privacy policy effective 17 March 2025 and a DPA effective 15 November 2023 with deletion or return of personal data at termination. Retention is stated as for as long as necessary, with no periods (20). A dated v1 deprecation notice (31 March 2025) and a removal notice for the User Accounts APIs, but no written deprecation policy, and two breaking changes in the last 90 days landed on the day of their changelog entry (11). Sub-processor list updated 9 July 2026 with each company's country, nearly all in the USA. No choice of data region was found (17)." }, "scores": { "a": 52, "b": 81 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Becomes tech, LLC", "b": "Webflow, Inc.", "name": "Vendor" }, { "a": "https://app.thebcms.com/api/v3/mcp", "b": "https://api.webflow.com/v2", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary service under Webflow's Terms of Service. The OpenAPI spec, the JavaScript and Python SDKs and the open-source MCP server on GitHub are MIT", "name": "Licence" }, { "a": "45", "b": "34", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "com.webflow/mcp", "name": "MCP registry" }, { "a": "2026-03-16", "b": "2026-10-28", "name": "Last release" }, { "a": "2026-07-30", "b": "2023-11-15", "name": "Terms last updated" }, { "a": "2026-07-30", "b": "2025-03-17", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "396 npm/wk", "b": "85k npm/wk, 121k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Webflow scores 70.4 (BB) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, BCMS or Webflow?" }, { "answer": "BCMS needs an API key. Webflow takes an API key or an OAuth sign-in.", "question": "Do BCMS and Webflow need an API key?" }, { "answer": "Yes. BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp and Webflow at https://api.webflow.com/v2.", "question": "Can an agent call BCMS and Webflow without installing anything?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Free to start without a card", "No incidents deducted, where Webflow loses 3 points for them" ], "goodFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "slug": "bcms", "watchFor": "The MCP key is accepted only as a URL query parameter" }, { "aheadOn": [ "Reliability, 84 against 15", "Schema \u0026 documentation, 87 against 50", "Agent ergonomics, 72 against 36", "Security \u0026 auth, 74 against 39", "Maintenance \u0026 community, 80 against 16", "Transparency \u0026 trust, 81 against 52" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "Teams whose website already runs on Webflow and who want an agent to draft, update and publish CMS items, fix metadata or manage assets.", "slug": "webflow", "watchFor": "The MCP server documents 34 tools (27 data, 3 Designer session, 4 utility), each with several actions, and a granted tool grants all its actions" } ], "history": { "bcms": null, "webflow": [ { "causes": [ "time" ], "date": "2026-11-01", "delta": 1, "from": 69.4, "fromGrade": "B", "to": 70.4, "toGrade": "BB" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-buttercms.json", "title": "BCMS vs ButterCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-buttercms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-contentstack.json", "title": "BCMS vs Contentstack", "url": "https://www.anchorterminal.com/compare/bcms-vs-contentstack" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-datocms.json", "title": "BCMS vs DatoCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-directus.json", "title": "BCMS vs Directus", "url": "https://www.anchorterminal.com/compare/bcms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-ghost.json", "title": "BCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/bcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-hygraph.json", "title": "BCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/bcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.json", "title": "BCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-payload.json", "title": "BCMS vs Payload", "url": "https://www.anchorterminal.com/compare/bcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-prismic.json", "title": "BCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/bcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-sanity.json", "title": "BCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/bcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-storyblok.json", "title": "BCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/bcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-strapi.json", "title": "BCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/bcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-wordpress.json", "title": "BCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/bcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-webflow.json", "title": "ButterCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/buttercms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-webflow.json", "title": "Contentstack vs Webflow", "url": "https://www.anchorterminal.com/compare/contentstack-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.json", "title": "Cosmic vs Webflow", "url": "https://www.anchorterminal.com/compare/cosmic-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-webflow.json", "title": "DatoCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/datocms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-webflow.json", "title": "Directus vs Webflow", "url": "https://www.anchorterminal.com/compare/directus-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-webflow.json", "title": "dotCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/dotcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-webflow.json", "title": "Ghost vs Webflow", "url": "https://www.anchorterminal.com/compare/ghost-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-webflow.json", "title": "Hygraph vs Webflow", "url": "https://www.anchorterminal.com/compare/hygraph-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-webflow.json", "title": "Kontent.ai vs Webflow", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-webflow.json", "title": "Payload vs Webflow", "url": "https://www.anchorterminal.com/compare/payload-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/prismic-vs-webflow.json", "title": "Prismic vs Webflow", "url": "https://www.anchorterminal.com/compare/prismic-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-webflow.json", "title": "Sanity vs Webflow", "url": "https://www.anchorterminal.com/compare/sanity-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-webflow.json", "title": "Storyblok vs Webflow", "url": "https://www.anchorterminal.com/compare/storyblok-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-webflow.json", "title": "Strapi vs Webflow", "url": "https://www.anchorterminal.com/compare/strapi-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/webflow-vs-wordpress.json", "title": "Webflow vs WordPress", "url": "https://www.anchorterminal.com/compare/webflow-vs-wordpress" } ], "panel": null, "scores": [ { "bcms": 15, "by": 69, "edge": "webflow", "key": "reliability", "name": "Reliability", "webflow": 84, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "bcms": 50, "by": 37, "edge": "webflow", "key": "schema", "name": "Schema \u0026 documentation", "webflow": 87, "weight": 13 }, { "bcms": 36, "by": 36, "edge": "webflow", "key": "ergonomics", "name": "Agent ergonomics", "webflow": 72, "weight": 13 }, { "bcms": 39, "by": 35, "edge": "webflow", "key": "security", "name": "Security \u0026 auth", "webflow": 74, "weight": 14 }, { "bcms": 30, "by": 0, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "webflow": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "bcms": 16, "by": 64, "edge": "webflow", "key": "maintenance", "name": "Maintenance \u0026 community", "webflow": 80, "weight": 7 }, { "bcms": 52, "by": 29, "edge": "webflow", "key": "transparency", "name": "Transparency \u0026 trust", "webflow": 81, "weight": 7 } ], "summary": "Webflow scores 70.4 (BB) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "bcms": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "webflow": "The Data API has a public OpenAPI 3.1 spec with 140 operations, scoped OAuth and site tokens, and CMS items that stay drafts until a separate publish call. The MCP server loads 34 multi-action tools and can't create new localised CMS items. The free plan holds 50 CMS items, and the activity log needs the $2,500 Team plan." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/bcms-vs-webflow", "json": "https://www.anchorterminal.com/compare/bcms-vs-webflow.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/bcms-vs-webflow.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/bcms-vs-webflow.min.md" }, "markdown": "Webflow scores 70.4 (BB) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories. Both do content management.\n\n- BCMS: grade F, 33.5/100, rank #1383 of 1486. Markdown https://www.anchorterminal.com/tools/bcms.md · JSON https://www.anchorterminal.com/api/v1/tools/bcms.json\n- Webflow: grade BB, 70.4/100, rank #199 of 1486. Markdown https://www.anchorterminal.com/tools/webflow.md · JSON https://www.anchorterminal.com/api/v1/tools/webflow.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### BCMS (F)\n\nGood for: Small sites and agencies that want a cheap hosted CMS an agent can edit.\n\nAlso in its favour:\n- Free to start without a card\n- No incidents deducted, where Webflow loses 3 points for them\n\nWatch for: The MCP key is accepted only as a URL query parameter\n\n### Webflow (BB)\n\nGood for: Teams whose website already runs on Webflow and who want an agent to draft, update and publish CMS items, fix metadata or manage assets.\n\nAhead on:\n- Reliability, 84 against 15\n- Schema \u0026 documentation, 87 against 50\n- Agent ergonomics, 72 against 36\n- Security \u0026 auth, 74 against 39\n- Maintenance \u0026 community, 80 against 16\n- Transparency \u0026 trust, 81 against 52\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: The MCP server documents 34 tools (27 data, 3 Designer session, 4 utility), each with several actions, and a granted tool grants all its actions\n\n\n## Why the edge\n\n### Reliability: Webflow +69\n\n- BCMS (15): Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.\n- Webflow (84): Graded on the Data API v2 and the hosted MCP server. Public status page at status.webflow.com with components for the Data API and the MCP server and a full incident history (20). In the 90 days to 1 November 2026, read from the status history feed (the /api/ path is disallowed by the host's robots.txt), the graded surface had two incidents, both partial and read as minor. They were 503 errors on some hosted sites, Webflow.com and the MCP server on 25 August, and MCP authorisation failing for some sites in client workspaces on 17 September (about 40 minutes). The week-long missing MCP tools of 9 to 16 July and the 28 July webhooks failure have left the window. Publishing failed or slowed for some customers on 14 September (an upstream provider fault that also touched Analyze and Optimize) and 28 September, which is partial whichever surface it reached. The other incidents in the window (intermittent 500s on some hosted sites on 15 September, form notification emails on 21 and 22 September, site creation and the Canvas on 12 August) were outside the graded surface, and none was posted after 28 September (20). Rate limits published, 60 requests a minute on Starter and Basic and 120 on higher site plans (15). 429 carries Retry-After and the SDKs back off, but no idempotency keys were found for Data API writes (11). An SLA page dated 1 September 2026 exists and the pricing page lists enhanced SLAs on Enterprise. The terms sit in a PDF we didn't read (8 of 10). The /v2 namespace is described as production and the MCP server has a separate beta URL (10).\n\n### Maintenance \u0026 community: Webflow +64\n\n- BCMS (16): @thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.\n- Webflow (80): The newest developer changelog entry is dated 28 October 2026 (a robots.txt Content API in beta) (30). Twenty-two dated entries between 10 August and 28 October 2026, among them the AEO Analytics and Optimize APIs out of beta on 13 and 15 October (20). Public changelog, a support site and a community forum. We couldn't read the GitHub issue trackers, and the open-source MCP repository has had only a CI change (26 October) since 10 April 2026 while the hosted server moved to v2.1 (8 of 15). The server is in the official MCP registry as com.webflow/mcp, and the JavaScript SDK (tag v3.3.4, 16 March 2026; main's package.json reads 3.3.5) and Python SDK (2.0.0, 12 March 2026) are the current official SDKs (15). The JavaScript SDK repository has CI, a dependency patch merged on 6 October and a CI pin on 26 October 2026. The MCP repository pins webflow-api 3.2.1 (7).\n\n### Schema \u0026 documentation: Webflow +37\n\n- BCMS (50): The docs link an OpenAPI reference at app.thebcms.com/open-api-docs, but that host's robots.txt disallows every path, so it wasn't read. The MCP tool schemas need a session (10 of 25). llms.txt, docs llms.txt, llms-full.txt, Markdown pages and a public SKILL.md (10). llms.txt says when to use BCMS and when not to, and the MCP page gives each tool group's purpose (12 of 20). Input typing couldn't be checked (5 of 15). Curl and JavaScript examples, and troubleshooting for 403 and permission errors (7 of 15). API v3 paths and a 3.0.0 server card, with no changelog found (6 of 15). 10+10+12+5+7+6 = 50.\n- Webflow (87): Public OpenAPI 3.1 spec in webflow/openapi-spec with 140 operations for v2 and 139 for v2 beta, MIT. Its last sync is 2 September 2026, so the Workspace Members (29 September), AEO Analytics (13 October) and Optimize (15 October) endpoints aren't in it yet. The hosted MCP server's v2.1 tool schemas aren't in the public repository, whose last commit is 10 April 2026 (23 of 25). A root llms.txt, section indexes and a Markdown copy of every page at the URL plus .md (10). The MCP data tools reference says for each tool whether it reads or writes, when to use it and what each action needs (16). The spec types parameters with enums and required fields. Item content in `fieldData` is an object checked against the collection's own schema (11). Request and response examples throughout, an error format with `code`, `message` and `details`, and an enumerated list of about 100 error codes (13). /v2 and /beta in the path and a dated changelog with a full index, though some changes land in place on the day (14).\n\n### Agent ergonomics: Webflow +36\n\n- BCMS (36): 45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.\n- Webflow (72): The MCP server documents 34 tools, each bundling several actions, which is the checklist's 5. We added 6 for `get_more_tools`, which loads specialised tools on request, and for tools labelled read or write (11 of 25). `limit` up to 100 and `offset` on lists, and custom-field filters and sorts on collection items with up to 10 filter terms (20). Errors carry a machine-readable code from a published list, and the MCP server returns `ModeForbidden` when a tool can't run in the current Designer mode (16). No idempotency keys on Data API writes. The open-source server sets `readOnlyHint` on its tools, and the hosted server has a dry run and an idempotency key for Webflow Cloud deploys only (10 of 20). Few required parameters, and official SDKs for JavaScript and Python (15).\n\n### Security \u0026 auth: Webflow +35\n\n- BCMS (39): Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.\n- Webflow (74): OAuth with read and write scope pairs per resource, or site tokens with the same scopes, at most 5 per site, which expire after 365 days without use. The MCP server uses OAuth with PKCE, dynamic client registration, refresh tokens and a revocation endpoint. Tokens travel in the Authorization header. We took 2 off because the MCP metadata also accepts the `plain` challenge method and site-token rotation isn't described (28). Scopes split read from write, the person picks sites or a workspace at authorisation, and the MCP server follows the user's role. A granted tool grants all its actions and no confirmation step for deletes was found (14). Agent Instructions stored on a site are given to every connected agent automatically, and the docs give no guidance on treating site content as untrusted beyond limiting authorised sites and reviewing generated drafts (5). Agent changes are recorded in the site activity log, which the pricing page lists on Team and Enterprise, with an Audit Logs API on Enterprise (9). A valid security.txt pointing to a Bugcrowd disclosure programme, SOC 2 Type II, ISO 27001, 27017, 27018 and 42001, and an annual penetration test report in the trust centre (18).\n\n### Transparency \u0026 trust: Webflow +29\n\n- BCMS (52): A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.\n- Webflow (81): Closed service with published Terms of Service and Developer Terms. The OpenAPI spec, both SDKs and the older open-source MCP server are MIT (17). Privacy policy effective 17 March 2025 and a DPA effective 15 November 2023 with deletion or return of personal data at termination. Retention is stated as for as long as necessary, with no periods (20). A dated v1 deprecation notice (31 March 2025) and a removal notice for the User Accounts APIs, but no written deprecation policy, and two breaking changes in the last 90 days landed on the day of their changelog entry (11). Sub-processor list updated 9 July 2026 with each company's country, nearly all in the USA. No choice of data region was found (17).\n\n## Score by category\n\n| Category | Weight | BCMS | Webflow | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 84 | Webflow +69 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 50 | 87 | Webflow +37 |\n| Agent ergonomics | 13% (16.2 this run) | 36 | 72 | Webflow +36 |\n| Security \u0026 auth | 14% (17.5 this run) | 39 | 74 | Webflow +35 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 30 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 16 | 80 | Webflow +64 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 81 | Webflow +29 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **33.5 · F** | **70.4 · BB** | |\n\n## Facts side by side\n\n| Fact | BCMS | Webflow |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Becomes tech, LLC | Webflow, Inc. |\n| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | `https://api.webflow.com/v2` |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | none | Proprietary service under Webflow's Terms of Service. The OpenAPI spec, the JavaScript and Python SDKs and the open-source MCP server on GitHub are MIT |\n| Tools exposed | 45 | 34 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `com.webflow/mcp` |\n| Last release | 2026-03-16 | 2026-10-28 |\n| Terms last updated | 2026-07-30 | 2023-11-15 |\n| Privacy policy last updated | 2026-07-30 | 2025-03-17 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 396 npm/wk | 85k npm/wk, 121k PyPI/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### BCMS\n\nNo score change since it was listed.\n\n### Webflow\n\n- +1.0 on 1 November 2026 (B to BB): time\n\n## Verdicts\n\n**BCMS.** BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.\n\n**Webflow.** The Data API has a public OpenAPI 3.1 spec with 140 operations, scoped OAuth and site tokens, and CMS items that stay drafts until a separate publish call. The MCP server loads 34 multi-action tools and can't create new localised CMS items. The free plan holds 50 CMS items, and the activity log needs the $2,500 Team plan.\n\n## Before you call either\n\n### BCMS\n\n1. Keep the MCP URL out of logs and shared config, since the key is inside it\n2. Call get-all-templates first and mutate only once you have template and entry ids\n3. Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model\n4. List and confirm entry ids with the user before calling delete-entries\n5. Use the bcms-content CLI for scripted runs that need JSON output and exit codes\n\n### Webflow\n\n1. Send the token as `Authorization: Bearer` to https://api.webflow.com/v2. Ask for `cms:read` and `cms:write` only, plus `sites:write` if the task publishes\n2. Create or update items first, then call Publish Items or Publish Site. An item with `isDraft` true and a `lastPublished` date is live with unpublished changes\n3. Stay under 60 requests a minute on Starter and Basic and 120 on Premium, read X-RateLimit-Remaining, and wait for Retry-After on 429\n4. Page item lists with `limit` (maximum 100) and `offset`, and filter with `filter[\u003cfieldSlug\u003e][\u003coperator\u003e]`, up to 10 terms\n5. Upload an asset in two steps (create the asset with a file hash, then POST the bytes to the presigned URL). Write localised content with the item's `cmsLocaleId`\n\n## Questions\n\n### Which is better for AI agents, BCMS or Webflow?\n\nWebflow scores 70.4 (BB) on agent readiness against BCMS's 33.5 (F), and leads in 6 of 7 scored categories.\n\n### Do BCMS and Webflow need an API key?\n\nBCMS needs an API key. Webflow takes an API key or an OAuth sign-in.\n\n### Can an agent call BCMS and Webflow without installing anything?\n\nYes. BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp and Webflow at https://api.webflow.com/v2.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/bcms-vs-webflow.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bcms-vs-webflow.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"bcms\", \"b\": \"webflow\"}`. From a terminal: `anchor compare bcms webflow`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bcms.json and https://www.anchorterminal.com/api/v1/tools/webflow.json\n\n## Other comparisons with BCMS or Webflow\n\n- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)\n- [BCMS vs Contentstack](https://www.anchorterminal.com/compare/bcms-vs-contentstack.md)\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)\n- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Ghost](https://www.anchorterminal.com/compare/bcms-vs-ghost.md)\n- [BCMS vs Hygraph](https://www.anchorterminal.com/compare/bcms-vs-hygraph.md)\n- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)\n- [BCMS vs Payload](https://www.anchorterminal.com/compare/bcms-vs-payload.md)\n- [BCMS vs Prismic](https://www.anchorterminal.com/compare/bcms-vs-prismic.md)\n- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)\n- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)\n- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)\n- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)\n- [ButterCMS vs Webflow](https://www.anchorterminal.com/compare/buttercms-vs-webflow.md)\n- [Contentstack vs Webflow](https://www.anchorterminal.com/compare/contentstack-vs-webflow.md)\n- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)\n- [DatoCMS vs Webflow](https://www.anchorterminal.com/compare/datocms-vs-webflow.md)\n- [Directus vs Webflow](https://www.anchorterminal.com/compare/directus-vs-webflow.md)\n- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)\n- [Ghost vs Webflow](https://www.anchorterminal.com/compare/ghost-vs-webflow.md)\n- [Hygraph vs Webflow](https://www.anchorterminal.com/compare/hygraph-vs-webflow.md)\n- [Kontent.ai vs Webflow](https://www.anchorterminal.com/compare/kontent-ai-vs-webflow.md)\n- [Payload vs Webflow](https://www.anchorterminal.com/compare/payload-vs-webflow.md)\n- [Prismic vs Webflow](https://www.anchorterminal.com/compare/prismic-vs-webflow.md)\n- [Sanity vs Webflow](https://www.anchorterminal.com/compare/sanity-vs-webflow.md)\n- [Storyblok vs Webflow](https://www.anchorterminal.com/compare/storyblok-vs-webflow.md)\n- [Strapi vs Webflow](https://www.anchorterminal.com/compare/strapi-vs-webflow.md)\n- [Webflow vs WordPress](https://www.anchorterminal.com/compare/webflow-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BCMS vs Webflow", "url": "" } ], "description": "Webflow scores 70.4 (BB) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BCMS F 33.5", "Webflow BB 70.4", "scores" ], "h1": "BCMS vs Webflow", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/bcms-vs-webflow", "published": "2026-10-01", "section": "tools", "title": "BCMS vs Webflow for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/bcms-vs-webflow" }, "tokens": { "markdown": 4850, "slim": 3030 }, "version": 1 }