{ "data": { "a": { "slug": "bcms", "name": "BCMS", "vendor": "Becomes tech, LLC", "vendorUrl": "https://www.thebcms.com", "kind": "http-api", "category": "cms", "summary": "BCMS is a hosted headless CMS from Becomes tech, LLC. People edit structured content in a dashboard, and agents work with templates, entries, media and languages through a REST API, a JavaScript client, a CLI and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/bcms", "markdownUrl": "https://www.anchorterminal.com/tools/bcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bcms.json", "dns": "bcms.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.thebcms.com/api/v3/mcp", "packages": [ { "registry": "npm", "name": "@thebcms/client" } ], "auth": "api-key", "authNotes": "Three-part keys (keyId.secret.instanceId) created in the dashboard and scoped to templates and media, with schema tools only for keys allowed them. The MCP endpoint takes the key only as the `mcpKey` query parameter, and the REST examples pass `apiKey` in the query string. The docs advise a key per person, client and environment and regular rotation.", "pricing": "paid", "pricingNotes": "Hobby $5 a month ($4 billed yearly) with 2 seats, 100 entries and 500 MB of media; Pro $50 a month ($33 yearly) with 5 seats, then $15 a seat a month, and unlimited entries; Enterprise by quote. Every plan starts with a 14-day free trial with no card. No self-hosted edition.", "priceSummary": "$5 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the docs, the MCP page or pricing.md (checked 2026-11-06).", "endpoints": [] }, "toolCount": 45, "popularity": { "githubStars": null, "npmWeekly": 396, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.thebcms.com/docs", "llmsTxt": "https://www.thebcms.com/llms.txt", "capabilities": [ "cms.content", "cms.assets", "cms.localisation", "cms.schema", "cms.publish" ], "tags": [ "hosted", "mcp", "remote-mcp", "llms-txt", "no-card", "closed-source", "webhooks", "typescript", "cli" ], "lastRelease": "2026-03-16", "graded": true, "anchor": { "graded": true, "score": 33.5, "grade": "F", "agentReady": false, "rank": 1383, "ranked": true, "rankOf": 1486, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "bestFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "strengths": [ "Remote MCP server covering templates, entries, statuses, entry history, media, languages and trash", "Keys scoped to the templates and media an agent needs, with schema tools gated separately", "llms.txt that says when to use BCMS and when not to, plus a public SKILL.md", "Entry history and trash readable through MCP, so an agent can trace and recover changes", "14-day trial with no card, then plans from $5 a month" ], "weaknesses": [ "The MCP key is accepted only as a URL query parameter", "No status page, documented rate limits, SLA or changelog found", "No security.txt, disclosure policy or certification found", "The JavaScript client hasn't been released since March 2026", "No self-hosted edition; the open-source repository has been unmaintained since October 2024" ], "agentNotes": [ "Keep the MCP URL out of logs and shared config, since the key is inside it", "Call get-all-templates first and mutate only once you have template and entry ids", "Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model", "List and confirm entry ids with the user before calling delete-entries", "Use the bcms-content CLI for scripted runs that need JSON output and exit codes" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 33.5 } ], "editorialScores": { "ergonomics": 36, "maintenance": 16, "payments": 30, "reliability": 15, "schema": 50, "security": 39, "transparency": 48 }, "provenanceScore": 56, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @thebcms/client", "claudeCode": "claude mcp add --transport http bcms \"https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE\"", "config": { "mcpServers": { "bcms": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/bcms" }, "area": "business", "unitPrices": [ { "item": "Hobby plan", "unit": "month", "usd": 5, "note": "$4 a month billed yearly; 2 seats, 100 entries" }, { "item": "Pro plan", "unit": "month", "usd": 50, "note": "$33 a month billed yearly; 5 seats" }, { "item": "Extra Pro seat", "unit": "seat-month", "usd": 15, "note": "$120 a year on yearly billing" } ], "provenance": { "legalEntity": "Becomes tech, LLC", "domain": "thebcms.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.thebcms.com/terms-of-use/", "privacy": "https://www.thebcms.com/privacy-policy/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both effective 30 July 2026, name Becomes tech, LLC, a Delaware LLC. The terms forbid scraping or crawling that burdens or abuses the services, except through the documented APIs within rate limits.", "www.thebcms.com/robots.txt allows all. app.thebcms.com/robots.txt disallows all paths.", "www.thebcms.com/.well-known/security.txt returned 404 and no status page was found.", "RDAP gave no registration date for thebcms.com through rdap.org." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bcms.json", "live": { "slug": "bcms", "probe": { "target": "https://app.thebcms.com/api/v3/mcp", "method": "get", "lastAt": "2026-11-07T18:20:13.025269198Z", "lastOk": true, "lastStatus": 400, "lastMs": 197, "authRequired": false, "uptime24h": 99.5, "uptime30d": 99.5, "p50ms24h": 141, "p95ms24h": 393, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 186 } ] }, "versions": [ { "registry": "npm", "name": "@thebcms/client", "version": "2.0.3", "seenAt": "2026-11-06T23:10:32.023184196Z" } ], "npmWeekly": 396, "securityTxt": { "url": "https://thebcms.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:49.817334601Z" }, "llmsTxt": { "url": "https://www.thebcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:42.21650798Z" }, "pages": [ { "url": "https://www.thebcms.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:35:35.490295236Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "abae80fa615e" }, { "url": "https://www.thebcms.com/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:35:37.777884178Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "58d8ef9074aa" } ], "mcpTools": { "url": "https://app.thebcms.com/api/v3/mcp?mcpKey=YOUR_MCP_KEY_HERE", "checkedAt": "2026-11-07T01:42:42.874889438Z", "status": "error", "note": "initialize: no JSON-RPC answer", "changedAt": "2026-11-07T01:42:42.874889438Z" }, "updatedAt": "2026-11-07T18:20:13.025269198Z" } }, "answer": "WordPress scores 58.8 (C) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.", "b": { "slug": "wordpress", "name": "WordPress", "vendor": "WordPress.org (open-source project)", "vendorUrl": "https://wordpress.org", "kind": "http-api", "category": "cms", "summary": "WordPress is an open-source content management system that its owner hosts. Agents create, revise and publish posts, pages and media through the built-in REST API, WP-CLI or the MCP Adapter, a canonical plugin in the WordPress.org directory.", "url": "https://www.anchorterminal.com/tools/wordpress", "markdownUrl": "https://www.anchorterminal.com/tools/wordpress.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/wordpress.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/wordpress.json", "dns": "wordpress.grade.anchorterminal.com", "repo": "https://github.com/WordPress/wordpress-develop", "license": "GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too", "transports": [ "http", "stdio" ], "packages": [], "auth": "api-key", "authNotes": "Self-serve on your own site, with no app review or approval by WordPress.org. A user creates an Application Password on their profile, through `/wp/v2/users/\u003cid\u003e/application-passwords` or with `wp user application-password create`, and the agent sends it as Basic auth over HTTPS. A password has no scopes or expiry and carries every capability of its user, so access is set by the user's role. Each password can be revoked on its own. The MCP Adapter's HTTP transport takes the same credential, and its STDIO transport runs as the user named in `--user`.", "pricing": "free", "pricingNotes": "Free software with nothing to buy from WordPress.org, so an agent can start without a contract or a card. The owner pays for their own hosting. WordPress.com and other hosts sell hosted WordPress under their own prices, which aren't graded here (checked 2026-10-08).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the REST API handbook, wordpress.org/llms.txt or the core and MCP Adapter repositories (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 21460, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://developer.wordpress.org/rest-api/", "llmsTxt": "https://wordpress.org/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets" ], "tags": [ "open-source", "self-hosted", "rest", "mcp", "cli", "php", "llms-txt", "security-txt", "bug-bounty" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 58.8, "grade": "C", "agentReady": false, "rank": 723, "ranked": true, "rankOf": 1486, "categoryRank": 10, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 83, "payments": 60, "reliability": 78, "schema": 65, "security": 62, "transparency": 69 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -11, "negativeNotes": [ "Advisories in WordPress core in the last 12 months, counted per advisory. CVE-2026-87902 (GHSA-7hp8-65ch-5whp, CVSS 8.1 High, called critical in the release post), unauthenticated local file inclusion through page-template resolution that can reach remote code execution, fixed in 7.1.2 on 22 September 2026, under two months old (2). CVE-2026-63030 (GHSA-ff9f-jf42-662q, 9.8 Critical, REST API batch-route confusion leading to SQL injection and remote code execution, fixed in 7.0.2 in July 2026) (1). CVE-2026-60137 (GHSA-fpp7-x2x2-2mjf, 5.9 Medium, SQL injection through `author__not_in`, fixed in 7.0.2, published by the project) (1). CVE-2026-64638 (8.9 High, pre-auth reflected XSS on the login screen, fixed in 7.0.3, published 7 August 2026) (1). CVE-2026-65640 (8.8 High, remote code execution through a PostScript upload by an Author, fixed in 7.0.4, published 17 August 2026) (1). CVE-2026-119977 (8.1 High, filed by Wordfence on 31 October 2026, unauthenticated code execution through predictable staging paths during a full core upgrade, versions 4.7 through 7.1.3, fixed in 7.1.4 on 28 October 2026), under two months old (2). CVE-2026-3906 (4.3 Medium, filed by Wordfence, note creation by Subscribers, fixed in 6.9.2) and CVE-2026-114570 (4.9 Medium, filed by Wordfence on 22 October 2026, stored XSS through Quick Edit, fixed in 7.0.3) are third-party records of fixed Mediums with no advisory from the project (0 each). CISA's Known Exploited Vulnerabilities catalogue lists CVE-2026-87902 (added 25 September 2026), CVE-2026-63030 and CVE-2026-60137 (added 21 July 2026). All are fixed and backported to 4.7. Total 8. https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-87902 ; https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ ; https://wordpress.org/news/2026/08/wordpress-7-0-4-release/ ; https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=WordPress%20core\u0026keywordExactMatch\u0026pubStartDate=2026-10-25T00:00:00.000\u0026pubEndDate=2026-11-02T23:59:59.999", "17 September, 6 October and 28 October 2026. 7.1.1, 7.1.3 and 7.1.4 fixed flaws their release posts describe (7.1.4 alone lists several stored XSS issues, unpublished customizer changesets readable without login and notes readable by users without edit access), and none of the 7.1 branch commits or the posts cite a CVE or GHSA identifier. The 7.1.4 upgrade-window flaw now has a Wordfence record and is counted with the advisories above, not here. Most fixes in 6.9.2 (10 March 2026) and 7.0.3 (6 August 2026) were also described only in their posts, and fold into the same term. Release prose isn't an advisory, so one folded term (3). https://wordpress.org/news/2026/10/wordpress-7-1-4/ ; https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/" ], "verdict": "The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Three core flaws fixed since July 2026 are on CISA's exploited list, and 7.1.4 shipped 12 security fixes on 28 October.", "bestFor": "Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes.", "strengths": [ "Posts created without `status` are saved as drafts, and DELETE moves a post to the Trash unless `force=true` is passed", "Every REST or WP-CLI update to a post writes a revision that `/wp/v2/posts/\u003cid\u003e/revisions` lists with author and date", "`_fields` trims responses down to nested properties, with `per_page` up to 100 and X-WP-Total headers on every list", "Seven stable releases between 6 August and 28 October 2026, and security fixes backported to 4.7", "GPL-2.0-or-later, free to self-host, with a valid security.txt and a HackerOne programme for core" ], "weaknesses": [ "Application Passwords have no scopes or expiry. Each one carries every capability of its user", "The revisions route supports GET and DELETE only, so a rollback means writing the old content back as a new update", "Core has no rate limit, no idempotency keys and no log of API calls beyond revisions and a password's last use", "CISA lists three core flaws as exploited, among them CVE-2026-87902, fixed in 7.1.2 on 22 September 2026, which allowed remote code execution under certain conditions", "No published OpenAPI file. Each site describes its own routes at `/wp-json`, and core has no content localisation" ], "agentNotes": [ "Ask the owner for a dedicated user with the lowest role that fits. A Contributor can draft and edit its own posts but can't publish them", "Send the Application Password as Basic auth over HTTPS only. For the MCP Adapter, put it in an `Authorization` header to /wp-json/mcp/mcp-adapter-default-server, since there is no OAuth sign-in", "Upload a file with POST `/wp-json/wp/v2/media` first, then set `featured_media` or reference the returned URL in the post content", "To roll back, GET `/wp/v2/posts/\u003cid\u003e/revisions/\u003crev\u003e?context=edit` and POST its title and content to the post. There's no restore route", "Pass `_fields=id,status,link,modified` on lists and read X-WP-TotalPages. `per_page` stops at 100", "Check the site runs 7.1.4 or later before writing to it. Three core flaws fixed since July 2026 are known to be exploited" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.8 } ], "editorialScores": { "ergonomics": 74, "maintenance": 83, "payments": 60, "reliability": 78, "schema": 65, "security": 62, "transparency": 72 }, "provenanceScore": 65, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "wp core download \u0026\u0026 wp core install --url=\u003curl\u003e --title=\u003ctitle\u003e --admin_user=\u003cuser\u003e --admin_email=\u003cemail\u003e", "http": "curl --user \"USERNAME:PASSWORD\" https://HOSTNAME/wp-json/wp/v2/users?context=edit", "claudeCode": "claude mcp add --transport http my-wordpress-site https://example.com/wp-json/mcp/mcp-adapter-default-server --header \"Authorization: Basic PASTE_THE_BASE64_HERE\"", "config": { "mcpServers": { "wordpress": { "args": [ "--path=/path/to/your/wordpress/site", "mcp-adapter", "serve", "--server=mcp-adapter-default-server", "--user=admin" ], "command": "wp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/wordpress" }, "area": "business", "unitPrices": [ { "item": "WordPress, self-hosted", "unit": "month", "usd": 0, "note": "GPL, you pay for your own hosting" } ], "provenance": { "legalEntity": "WordPress.org, an open-source project. The WordPress trademark belongs to the WordPress Foundation", "domain": "wordpress.org", "domainRegistered": "2003-03-28", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://wordpress.org/about/privacy/", "statusPage": "", "changelog": "https://wordpress.org/news/category/releases/", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "No terms of service govern the software. It is licensed under GPL version 2 or later, and no service agreement or API terms were found, so `terms` is left out.", "The privacy policy covers the WordPress.org websites and names api.wordpress.org, the service installations call to check for updates. It names no company, and gives dpo@wordpress.org as the contact. It doesn't cover content held on a self-hosted site.", "The REST API answers on each owner's own domain.", "https://wordpress.org/.well-known/security.txt returned 200 with Contact https://hackerone.com/wordpress and Expires 2027-06-30.", "RDAP for wordpress.org gives a registration date of 2003-03-28.", "The make.wordpress.org footer says the WordPress trademark is the intellectual property of the WordPress Foundation. `license.txt` gives copyright to the contributors.", "No status page applies to self-hosted software." ], "score": 65 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/wordpress.json", "live": { "slug": "wordpress", "githubStars": 3505, "securityTxt": { "url": "https://wordpress.org/.well-known/security.txt", "state": "valid", "expires": "2027-06-30T15:00:00.000Z", "checkedAt": "2026-11-07T15:59:42.224004236Z" }, "llmsTxt": { "url": "https://wordpress.org/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:23.686573245Z" }, "domain": { "domain": "wordpress.org", "registered": "2003-03-28", "source": "https://rdap.publicinterestregistry.org/rdap/domain/wordpress.org", "checkedAt": "2026-11-01T14:22:30.271426867Z" }, "pages": [ { "url": "https://wordpress.org/news/category/releases/", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:24:05.147954844Z", "changedAt": "2026-11-04T08:36:28.182060093Z", "fingerprint": "274eab3b5410" }, { "url": "https://wordpress.org/about/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:24:02.394392909Z", "changedAt": "2026-10-14T21:09:37.555180449Z", "fingerprint": "89f04a047363" } ], "github": { "repo": "wordpress/wordpress-develop", "checkedAt": "2026-11-02T09:39:02.673874342Z", "stars": 3501, "archived": false, "issuesEnabled": false, "pushedAt": "2026-11-01T23:50:09Z", "openIssues": 0, "openPRs": 3502, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "trunk", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-01T23:50:22Z" }, "advisories": [ { "ghsa": "GHSA-4w3m-c66w-69mg", "severity": "low", "published": "2026-10-29T19:12:01Z" }, { "ghsa": "GHSA-p2r6-rwjp-phv3", "severity": "medium", "published": "2026-10-29T19:10:17Z" }, { "ghsa": "GHSA-vchg-92fx-636p", "severity": "low", "published": "2026-10-29T19:08:53Z" }, { "ghsa": "GHSA-mqjw-vvgg-xfvf", "severity": "low", "published": "2026-10-29T19:08:30Z" }, { "ghsa": "GHSA-j3rg-rwgx-7wx7", "severity": "low", "published": "2026-10-29T19:08:09Z" }, { "ghsa": "GHSA-9vrg-x932-q57q", "severity": "medium", "published": "2026-10-29T19:05:06Z" }, { "ghsa": "GHSA-j255-3x8q-7q7g", "severity": "medium", "published": "2026-10-29T19:03:53Z" }, { "ghsa": "GHSA-wjwj-p342-9fq7", "severity": "medium", "published": "2026-10-29T19:03:31Z" }, { "ghsa": "GHSA-7q86-3j97-744j", "severity": "medium", "published": "2026-10-29T19:02:55Z" }, { "ghsa": "GHSA-2p22-wv7j-cvfv", "severity": "medium", "published": "2026-10-29T19:02:35Z" }, { "ghsa": "GHSA-83c2-c4pc-wmp3", "severity": "high", "published": "2026-10-29T19:00:39Z" }, { "ghsa": "GHSA-7hp8-65ch-5whp", "cve": "CVE-2026-87902", "severity": "critical", "published": "2026-09-22T13:57:27Z" }, { "ghsa": "GHSA-rmpv-w5v9-rqh5", "severity": "low", "published": "2026-09-18T18:12:46Z" }, { "ghsa": "GHSA-76jg-r2qr-v77f", "severity": "medium", "published": "2026-09-18T17:59:57Z" }, { "ghsa": "GHSA-5qf7-2r5p-ppj8", "severity": "medium", "published": "2026-09-18T17:59:48Z" }, { "ghsa": "GHSA-mgvw-845h-9qgq", "severity": "low", "published": "2026-09-18T17:59:36Z" }, { "ghsa": "GHSA-xhp5-863h-rhfr", "severity": "medium", "published": "2026-09-18T17:59:30Z" }, { "ghsa": "GHSA-w57f-v787-qhpf", "severity": "medium", "published": "2026-09-18T17:59:19Z" }, { "ghsa": "GHSA-qg7r-fjh2-wvx8", "severity": "high", "published": "2026-09-18T17:58:59Z" }, { "ghsa": "GHSA-f522-h982-63mg", "severity": "low", "published": "2026-09-18T17:58:47Z" }, { "ghsa": "GHSA-cjfg-q57r-mq45", "severity": "medium", "published": "2026-09-18T17:57:32Z" }, { "ghsa": "GHSA-33wf-p63q-w25f", "severity": "medium", "published": "2026-09-18T17:57:08Z" }, { "ghsa": "GHSA-32m5-wc28-ghrr", "severity": "medium", "published": "2026-09-18T17:56:14Z" }, { "ghsa": "GHSA-8vr3-7mxf-gx8w", "cve": "CVE-2026-65640", "severity": "high", "published": "2026-08-12T14:44:42Z" }, { "ghsa": "GHSA-52p2-r8wf-jcrf", "cve": "CVE-2026-64638", "severity": "high", "published": "2026-08-06T18:54:17Z" }, { "ghsa": "GHSA-fpp7-x2x2-2mjf", "cve": "CVE-2026-60137", "severity": "medium", "published": "2026-07-17T19:00:52Z" }, { "ghsa": "GHSA-ff9f-jf42-662q", "cve": "CVE-2026-63030", "severity": "critical", "published": "2026-07-17T19:00:46Z" }, { "ghsa": "GHSA-m257-q4m5-j653", "cve": "CVE-2024-31211", "severity": "medium", "published": "2024-04-03T22:49:48Z" }, { "ghsa": "GHSA-x79f-xrjv-jx5r", "cve": "CVE-2024-31210", "severity": "high", "published": "2024-04-03T22:25:47Z" }, { "ghsa": "GHSA-6676-cqfm-gw84", "cve": "CVE-2022-21661", "severity": "high", "published": "2022-01-06T21:12:48Z" }, { "ghsa": "GHSA-699q-3hj9-889w", "cve": "CVE-2022-21662", "severity": "medium", "published": "2022-01-06T21:12:28Z" }, { "ghsa": "GHSA-jmmq-m8p8-332h", "cve": "CVE-2022-21663", "severity": "low", "published": "2022-01-06T21:12:14Z" }, { "ghsa": "GHSA-jp3p-gw8h-6x86", "cve": "CVE-2022-21664", "severity": "medium", "published": "2022-01-06T21:11:52Z" }, { "ghsa": "GHSA-wh69-25hr-h94v", "cve": "CVE-2021-39201", "severity": "medium", "published": "2021-09-09T17:03:09Z" }, { "ghsa": "GHSA-qxvw-qxm9-qvg6", "cve": "CVE-2021-39203", "severity": "medium", "published": "2021-09-09T17:02:24Z" }, { "ghsa": "GHSA-m9hc-7v5q-x8q5", "cve": "CVE-2021-39200", "severity": "medium", "published": "2021-09-09T17:02:08Z" }, { "ghsa": "GHSA-fr6h-3855-j297", "cve": "CVE-2021-39202", "severity": "low", "published": "2021-09-09T17:01:42Z" }, { "ghsa": "GHSA-rv47-pc52-qrhh", "cve": "CVE-2021-29447", "severity": "medium", "published": "2021-04-15T10:14:33Z" }, { "ghsa": "GHSA-pmmh-2f36-wvhq", "cve": "CVE-2021-29450", "severity": "medium", "published": "2021-04-15T10:14:22Z" }, { "ghsa": "GHSA-rpwf-hrh2-39jf", "cve": "CVE-2020-4046", "severity": "medium", "published": "2020-06-12T05:31:41Z" }, { "ghsa": "GHSA-8q2w-5m27-wm27", "cve": "CVE-2020-4047", "severity": "medium", "published": "2020-06-12T05:31:34Z" }, { "ghsa": "GHSA-q6pw-gvf4-5fj5", "cve": "CVE-2020-4048", "severity": "low", "published": "2020-06-12T05:31:29Z" }, { "ghsa": "GHSA-87h4-phjv-rm6p", "cve": "CVE-2020-4049", "severity": "low", "published": "2020-06-12T05:31:25Z" }, { "ghsa": "GHSA-4vpv-fgg2-gcqc", "cve": "CVE-2020-4050", "severity": "medium", "published": "2020-06-12T05:31:18Z" }, { "ghsa": "GHSA-4mhg-j6fx-5g3c", "cve": "CVE-2020-11025", "severity": "low", "published": "2020-04-30T00:07:33Z" }, { "ghsa": "GHSA-3gw2-4656-pfr2", "cve": "CVE-2020-11026", "severity": "medium", "published": "2020-04-30T00:07:10Z" }, { "ghsa": "GHSA-ww7v-jg8c-q6jw", "cve": "CVE-2020-11027", "severity": "medium", "published": "2020-04-30T00:06:57Z" }, { "ghsa": "GHSA-xhx9-759f-6p2w", "cve": "CVE-2020-11028", "severity": "low", "published": "2020-04-30T00:06:41Z" }, { "ghsa": "GHSA-568w-8m88-8g2c", "cve": "CVE-2020-11029", "severity": "medium", "published": "2020-04-30T00:06:28Z" }, { "ghsa": "GHSA-vccm-6gmc-qhjh", "cve": "CVE-2020-11030", "severity": "low", "published": "2020-04-30T00:06:20Z" }, { "ghsa": "GHSA-g7rg-hchx-c2gw", "cve": "CVE-2019-16788", "severity": "low", "published": "2020-01-08T17:15:37Z" }, { "ghsa": "GHSA-xvg2-m2f4-83m7", "cve": "CVE-2019-16773", "severity": "high", "published": "2020-01-08T16:11:05Z" }, { "ghsa": "GHSA-pg4x-64rh-3c9v", "cve": "CVE-2019-16781", "severity": "medium", "published": "2019-12-20T23:12:56Z" }, { "ghsa": "GHSA-x3wp-h3qx-9w94", "cve": "CVE-2019-16780", "severity": "medium", "published": "2019-12-20T23:12:22Z" } ] }, "updatedAt": "2026-11-07T15:59:42.224004236Z" } }, "edges": [ { "by": 67, "category": "maintenance", "leads": "wordpress", "name": "Maintenance \u0026 community", "reasons": { "a": "@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.", "b": "7.1.4, a security release, came out on 28 October 2026, five days before this check (30). Seven stable releases in the 90 days from 4 August 2026 (7.0.3 on 6 August, 7.0.4, 7.1, 7.1.1, 7.1.2, 7.1.3 and 7.1.4), with 7.2 Beta 1 and Beta 2 on 20 and 27 October (20). Trac refused our request, so ticket handling is unread. Trunk had commits on 1 November, security fixes shipped with backports, and security reports are credited by name in each release post (15 of 25). The MCP Adapter reached v0.7.1 (changelog 15 October 2026, tag 16 October) and is in the WordPress.org plugin directory. WP-CLI's newest tag is still v2.12.0 of 7 May 2025. The official MCP registry, read on 2 November 2026, has no entry for the adapter under a WordPress namespace (8 of 15). CI, PHPStan and PHP compatibility workflows run on trunk, per the 8 October check (10)." }, "scores": { "a": 16, "b": 83 } }, { "by": 63, "category": "reliability", "leads": "wordpress", "name": "Reliability", "reasons": { "a": "Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.", "b": "Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org, and the requirements page states PHP 7.4 and MySQL 5.5.5 as the legacy minimum, with PHP 8.3 and MySQL 8.0 or MariaDB 10.11 recommended (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop showed passing on trunk on 8 October 2026, per the 8 October check, not re-read on 2 November because github.com refuses our requests; the clone shows trunk commits through 1 November (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.4 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score." }, "scores": { "a": 15, "b": 78 } }, { "by": 38, "category": "ergonomics", "leads": "wordpress", "name": "Agent ergonomics", "reasons": { "a": "45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.", "b": "`_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15)." }, "scores": { "a": 36, "b": 74 } }, { "by": 30, "category": "payments", "leads": "wordpress", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.", "b": "Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses." }, "scores": { "a": 30, "b": 60 } }, { "by": 23, "category": "security", "leads": "wordpress", "name": "Security \u0026 auth", "reasons": { "a": "Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.", "b": "Application Passwords are per application, revocable one at a time, sent only in the Authorization header and refused on plain HTTP outside a local environment. They have no scopes or expiry and carry every capability of their user, so we scored plain revocable keys plus 2 for role-based limits (22 of 30). A Contributor account can draft but not publish, deletes go to the Trash by default, and MCP abilities are private unless marked public. Nothing asks a person to approve a publish by a user who holds that capability (14 of 20). Posts and comments hold text written by other people, and no prompt-injection guidance was found in the REST handbook or the MCP Adapter docs (3 of 15). Revisions record author and date, and each password records its last use and IP. Core has no log of API calls (6 of 15). security.txt, re-read on 2 November 2026, is valid until 30 June 2027 and points reports to HackerOne. Some fixes are published with CVE and GHSA identifiers (CVE-2026-87902, CVE-2026-63030), many others only in release posts, and fixes are backported to 4.7. Certifications don't apply to self-hosted software (17 of 20)." }, "scores": { "a": 39, "b": 62 } }, { "by": 17, "category": "transparency", "leads": "wordpress", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.", "b": "GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20)." }, "scores": { "a": 52, "b": 69 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Becomes tech, LLC", "b": "WordPress.org (open-source project)", "name": "Vendor" }, { "a": "https://app.thebcms.com/api/v3/mcp", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, stdio", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Paid", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too", "name": "Licence" }, { "a": "45", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-03-16", "b": "2026-10-28", "name": "Last release" }, { "a": "2026-07-30", "b": "no document linked", "name": "Terms last updated" }, { "a": "2026-07-30", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "yes", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "396 npm/wk", "b": "21k stars", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "WordPress scores 58.8 (C) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.", "question": "Which is better for AI agents, BCMS or WordPress?" }, { "answer": "Both need an API key.", "question": "Do BCMS and WordPress need an API key?" }, { "answer": "BCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp. WordPress runs on your own machine, with no hosted endpoint listed.", "question": "Can an agent call BCMS and WordPress without installing anything?" }, { "answer": "No open-source release is listed for BCMS. WordPress is open source (GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too).", "question": "Are BCMS and WordPress open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card", "No incidents deducted, where WordPress loses 11 points for them" ], "goodFor": "Small sites and agencies that want a cheap hosted CMS an agent can edit.", "slug": "bcms", "watchFor": "The MCP key is accepted only as a URL query parameter" }, { "aheadOn": [ "Reliability, 78 against 15", "Schema \u0026 documentation, 65 against 50", "Agent ergonomics, 74 against 36", "Security \u0026 auth, 62 against 39", "Payments \u0026 pricing, 60 against 30", "Maintenance \u0026 community, 83 against 16", "Transparency \u0026 trust, 69 against 52" ], "also": [ "Runs on your own machine", "Open source" ], "goodFor": "Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes.", "slug": "wordpress", "watchFor": "Application Passwords have no scopes or expiry. Each one carries every capability of its user" } ], "history": { "bcms": null, "wordpress": [ { "causes": [ "correction" ], "date": "2026-11-02", "delta": -6, "from": 64.8, "fromGrade": "B", "to": 58.8, "toGrade": "C" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0, "from": 64.8, "fromGrade": "B", "to": 64.8, "toGrade": "B" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-buttercms.json", "title": "BCMS vs ButterCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-buttercms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-contentstack.json", "title": "BCMS vs Contentstack", "url": "https://www.anchorterminal.com/compare/bcms-vs-contentstack" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-datocms.json", "title": "BCMS vs DatoCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-directus.json", "title": "BCMS vs Directus", "url": "https://www.anchorterminal.com/compare/bcms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-ghost.json", "title": "BCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/bcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-hygraph.json", "title": "BCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/bcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.json", "title": "BCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/bcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-payload.json", "title": "BCMS vs Payload", "url": "https://www.anchorterminal.com/compare/bcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-prismic.json", "title": "BCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/bcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-sanity.json", "title": "BCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/bcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-storyblok.json", "title": "BCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/bcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-strapi.json", "title": "BCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/bcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-webflow.json", "title": "BCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/bcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-wordpress.json", "title": "ButterCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/buttercms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-wordpress.json", "title": "Contentstack vs WordPress", "url": "https://www.anchorterminal.com/compare/contentstack-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json", "title": "Cosmic vs WordPress", "url": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-wordpress.json", "title": "DatoCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/datocms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-wordpress.json", "title": "Directus vs WordPress", "url": "https://www.anchorterminal.com/compare/directus-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress.json", "title": "dotCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-wordpress.json", "title": "Ghost vs WordPress", "url": "https://www.anchorterminal.com/compare/ghost-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-wordpress.json", "title": "Hygraph vs WordPress", "url": "https://www.anchorterminal.com/compare/hygraph-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-wordpress.json", "title": "Kontent.ai vs WordPress", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-wordpress.json", "title": "Payload vs WordPress", "url": "https://www.anchorterminal.com/compare/payload-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/prismic-vs-wordpress.json", "title": "Prismic vs WordPress", "url": "https://www.anchorterminal.com/compare/prismic-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-wordpress.json", "title": "Sanity vs WordPress", "url": "https://www.anchorterminal.com/compare/sanity-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-wordpress.json", "title": "Storyblok vs WordPress", "url": "https://www.anchorterminal.com/compare/storyblok-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-wordpress.json", "title": "Strapi vs WordPress", "url": "https://www.anchorterminal.com/compare/strapi-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/webflow-vs-wordpress.json", "title": "Webflow vs WordPress", "url": "https://www.anchorterminal.com/compare/webflow-vs-wordpress" } ], "panel": null, "scores": [ { "bcms": 15, "by": 63, "edge": "wordpress", "key": "reliability", "name": "Reliability", "weight": 16, "wordpress": 78 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "bcms": 50, "by": 15, "edge": "wordpress", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "wordpress": 65 }, { "bcms": 36, "by": 38, "edge": "wordpress", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "wordpress": 74 }, { "bcms": 39, "by": 23, "edge": "wordpress", "key": "security", "name": "Security \u0026 auth", "weight": 14, "wordpress": 62 }, { "bcms": 30, "by": 30, "edge": "wordpress", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "wordpress": 60 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "bcms": 16, "by": 67, "edge": "wordpress", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "wordpress": 83 }, { "bcms": 52, "by": 17, "edge": "wordpress", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "wordpress": 69 } ], "summary": "WordPress scores 58.8 (C) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "bcms": "BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.", "wordpress": "The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Three core flaws fixed since July 2026 are on CISA's exploited list, and 7.1.4 shipped 12 security fixes on 28 October." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/bcms-vs-wordpress", "json": "https://www.anchorterminal.com/compare/bcms-vs-wordpress.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/bcms-vs-wordpress.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/bcms-vs-wordpress.min.md" }, "markdown": "WordPress scores 58.8 (C) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.\n\n- BCMS: grade F, 33.5/100, rank #1383 of 1486. Markdown https://www.anchorterminal.com/tools/bcms.md · JSON https://www.anchorterminal.com/api/v1/tools/bcms.json\n- WordPress: grade C, 58.8/100, rank #723 of 1486. Markdown https://www.anchorterminal.com/tools/wordpress.md · JSON https://www.anchorterminal.com/api/v1/tools/wordpress.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### BCMS (F)\n\nGood for: Small sites and agencies that want a cheap hosted CMS an agent can edit.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n- No incidents deducted, where WordPress loses 11 points for them\n\nWatch for: The MCP key is accepted only as a URL query parameter\n\n### WordPress (C)\n\nGood for: Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes.\n\nAhead on:\n- Reliability, 78 against 15\n- Schema \u0026 documentation, 65 against 50\n- Agent ergonomics, 74 against 36\n- Security \u0026 auth, 62 against 39\n- Payments \u0026 pricing, 60 against 30\n- Maintenance \u0026 community, 83 against 16\n- Transparency \u0026 trust, 69 against 52\n\nAlso in its favour:\n- Runs on your own machine\n- Open source\n\nWatch for: Application Passwords have no scopes or expiry. Each one carries every capability of its user\n\n\n## Why the edge\n\n### Maintenance \u0026 community: WordPress +67\n\n- BCMS (16): @thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.\n- WordPress (83): 7.1.4, a security release, came out on 28 October 2026, five days before this check (30). Seven stable releases in the 90 days from 4 August 2026 (7.0.3 on 6 August, 7.0.4, 7.1, 7.1.1, 7.1.2, 7.1.3 and 7.1.4), with 7.2 Beta 1 and Beta 2 on 20 and 27 October (20). Trac refused our request, so ticket handling is unread. Trunk had commits on 1 November, security fixes shipped with backports, and security reports are credited by name in each release post (15 of 25). The MCP Adapter reached v0.7.1 (changelog 15 October 2026, tag 16 October) and is in the WordPress.org plugin directory. WP-CLI's newest tag is still v2.12.0 of 7 May 2025. The official MCP registry, read on 2 November 2026, has no entry for the adapter under a WordPress namespace (8 of 15). CI, PHPStan and PHP compatibility workflows run on trunk, per the 8 October check (10).\n\n### Reliability: WordPress +63\n\n- BCMS (15): Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.\n- WordPress (78): Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org, and the requirements page states PHP 7.4 and MySQL 5.5.5 as the legacy minimum, with PHP 8.3 and MySQL 8.0 or MariaDB 10.11 recommended (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop showed passing on trunk on 8 October 2026, per the 8 October check, not re-read on 2 November because github.com refuses our requests; the clone shows trunk commits through 1 November (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.4 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score.\n\n### Agent ergonomics: WordPress +38\n\n- BCMS (36): 45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.\n- WordPress (74): `_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15).\n\n### Payments \u0026 pricing: WordPress +30\n\n- BCMS (30): No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.\n- WordPress (60): Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses.\n\n### Security \u0026 auth: WordPress +23\n\n- BCMS (39): Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.\n- WordPress (62): Application Passwords are per application, revocable one at a time, sent only in the Authorization header and refused on plain HTTP outside a local environment. They have no scopes or expiry and carry every capability of their user, so we scored plain revocable keys plus 2 for role-based limits (22 of 30). A Contributor account can draft but not publish, deletes go to the Trash by default, and MCP abilities are private unless marked public. Nothing asks a person to approve a publish by a user who holds that capability (14 of 20). Posts and comments hold text written by other people, and no prompt-injection guidance was found in the REST handbook or the MCP Adapter docs (3 of 15). Revisions record author and date, and each password records its last use and IP. Core has no log of API calls (6 of 15). security.txt, re-read on 2 November 2026, is valid until 30 June 2027 and points reports to HackerOne. Some fixes are published with CVE and GHSA identifiers (CVE-2026-87902, CVE-2026-63030), many others only in release posts, and fixes are backported to 4.7. Certifications don't apply to self-hosted software (17 of 20).\n\n### Transparency \u0026 trust: WordPress +17\n\n- BCMS (52): A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.\n- WordPress (69): GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20).\n\n## Score by category\n\n| Category | Weight | BCMS | WordPress | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 78 | WordPress +63 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 50 | 65 | WordPress +15 |\n| Agent ergonomics | 13% (16.2 this run) | 36 | 74 | WordPress +38 |\n| Security \u0026 auth | 14% (17.5 this run) | 39 | 62 | WordPress +23 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 60 | WordPress +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 16 | 83 | WordPress +67 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 69 | WordPress +17 |\n| Negative events | ≤15 | 0 | -11 | |\n| **Total** | | **33.5 · F** | **58.8 · C** | |\n\n## Facts side by side\n\n| Fact | BCMS | WordPress |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Becomes tech, LLC | WordPress.org (open-source project) |\n| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | no (local only) |\n| Transports | HTTP, Streamable HTTP | HTTP, stdio |\n| Auth | API key | API key |\n| Pricing | Paid | Free |\n| x402 | no | no |\n| Licence | none | GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too |\n| Tools exposed | 45 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-03-16 | 2026-10-28 |\n| Terms last updated | 2026-07-30 | no document linked |\n| Privacy policy last updated | 2026-07-30 | no date given |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | yes | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n| Popularity | 396 npm/wk | 21k stars |\n| Agent reviews | none | 3.5/5 (4) |\n\n## How the scores have moved\n\n### BCMS\n\nNo score change since it was listed.\n\n### WordPress\n\n- -6.0 on 2 November 2026 (B to C): correction\n- no change on 27 October 2026: new evidence\n\n## Verdicts\n\n**BCMS.** BCMS gives agents 45 MCP tools over templates, entries, statuses, history and media, with keys scoped per template and agent guidance in llms.txt, from $5 a month. The MCP key can only travel in the URL, and no status page, rate limits, changelog or security policy were found.\n\n**WordPress.** The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Three core flaws fixed since July 2026 are on CISA's exploited list, and 7.1.4 shipped 12 security fixes on 28 October.\n\n## Before you call either\n\n### BCMS\n\n1. Keep the MCP URL out of logs and shared config, since the key is inside it\n2. Call get-all-templates first and mutate only once you have template and entry ids\n3. Ask for a key scoped to the templates the task needs, without schema permission unless it changes the model\n4. List and confirm entry ids with the user before calling delete-entries\n5. Use the bcms-content CLI for scripted runs that need JSON output and exit codes\n\n### WordPress\n\n1. Ask the owner for a dedicated user with the lowest role that fits. A Contributor can draft and edit its own posts but can't publish them\n2. Send the Application Password as Basic auth over HTTPS only. For the MCP Adapter, put it in an `Authorization` header to /wp-json/mcp/mcp-adapter-default-server, since there is no OAuth sign-in\n3. Upload a file with POST `/wp-json/wp/v2/media` first, then set `featured_media` or reference the returned URL in the post content\n4. To roll back, GET `/wp/v2/posts/\u003cid\u003e/revisions/\u003crev\u003e?context=edit` and POST its title and content to the post. There's no restore route\n5. Pass `_fields=id,status,link,modified` on lists and read X-WP-TotalPages. `per_page` stops at 100\n6. Check the site runs 7.1.4 or later before writing to it. Three core flaws fixed since July 2026 are known to be exploited\n\n## Questions\n\n### Which is better for AI agents, BCMS or WordPress?\n\nWordPress scores 58.8 (C) on agent readiness against BCMS's 33.5 (F), and leads in every scored category.\n\n### Do BCMS and WordPress need an API key?\n\nBoth need an API key.\n\n### Can an agent call BCMS and WordPress without installing anything?\n\nBCMS has a hosted endpoint at https://app.thebcms.com/api/v3/mcp. WordPress runs on your own machine, with no hosted endpoint listed.\n\n### Are BCMS and WordPress open source?\n\nNo open-source release is listed for BCMS. WordPress is open source (GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/bcms-vs-wordpress.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bcms-vs-wordpress.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"bcms\", \"b\": \"wordpress\"}`. From a terminal: `anchor compare bcms wordpress`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bcms.json and https://www.anchorterminal.com/api/v1/tools/wordpress.json\n\n## Other comparisons with BCMS or WordPress\n\n- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)\n- [BCMS vs Contentstack](https://www.anchorterminal.com/compare/bcms-vs-contentstack.md)\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)\n- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Ghost](https://www.anchorterminal.com/compare/bcms-vs-ghost.md)\n- [BCMS vs Hygraph](https://www.anchorterminal.com/compare/bcms-vs-hygraph.md)\n- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)\n- [BCMS vs Payload](https://www.anchorterminal.com/compare/bcms-vs-payload.md)\n- [BCMS vs Prismic](https://www.anchorterminal.com/compare/bcms-vs-prismic.md)\n- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)\n- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)\n- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)\n- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)\n- [ButterCMS vs WordPress](https://www.anchorterminal.com/compare/buttercms-vs-wordpress.md)\n- [Contentstack vs WordPress](https://www.anchorterminal.com/compare/contentstack-vs-wordpress.md)\n- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)\n- [DatoCMS vs WordPress](https://www.anchorterminal.com/compare/datocms-vs-wordpress.md)\n- [Directus vs WordPress](https://www.anchorterminal.com/compare/directus-vs-wordpress.md)\n- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)\n- [Ghost vs WordPress](https://www.anchorterminal.com/compare/ghost-vs-wordpress.md)\n- [Hygraph vs WordPress](https://www.anchorterminal.com/compare/hygraph-vs-wordpress.md)\n- [Kontent.ai vs WordPress](https://www.anchorterminal.com/compare/kontent-ai-vs-wordpress.md)\n- [Payload vs WordPress](https://www.anchorterminal.com/compare/payload-vs-wordpress.md)\n- [Prismic vs WordPress](https://www.anchorterminal.com/compare/prismic-vs-wordpress.md)\n- [Sanity vs WordPress](https://www.anchorterminal.com/compare/sanity-vs-wordpress.md)\n- [Storyblok vs WordPress](https://www.anchorterminal.com/compare/storyblok-vs-wordpress.md)\n- [Strapi vs WordPress](https://www.anchorterminal.com/compare/strapi-vs-wordpress.md)\n- [Webflow vs WordPress](https://www.anchorterminal.com/compare/webflow-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BCMS vs WordPress", "url": "" } ], "description": "WordPress scores 58.8 (C) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BCMS F 33.5", "WordPress C 58.8", "scores" ], "h1": "BCMS vs WordPress", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/bcms-vs-wordpress", "published": "2026-10-01", "section": "tools", "title": "BCMS vs WordPress for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/bcms-vs-wordpress" }, "tokens": { "markdown": 4500, "slim": 2680 }, "version": 1 }