# BCMS vs WordPress (slim)

> WordPress scores 58.8 (C) to BCMS's 33.5 (F) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bcms-vs-wordpress.md (~4,500 tokens) · this version ~2,680 tokens · JSON https://www.anchorterminal.com/compare/bcms-vs-wordpress.json · canonical https://www.anchorterminal.com/compare/bcms-vs-wordpress
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

WordPress scores 58.8 (C) on agent readiness against BCMS's 33.5 (F), and leads in every scored category. Both do content management.

- BCMS: F 33.5, rank #1383 of 1486 · https://www.anchorterminal.com/tools/bcms.min.md
- WordPress: C 58.8, rank #723 of 1486 · https://www.anchorterminal.com/tools/wordpress.min.md
- BCMS, good for Small sites and agencies that want a cheap hosted CMS an agent can edit. Also A hosted endpoint, with nothing to install; Free to start without a card; No incidents deducted, where WordPress loses 11 points for them.
- WordPress, good for Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes. Ahead on Reliability, 78 against 15; Schema & documentation, 65 against 50; Agent ergonomics, 74 against 36; Security & auth, 62 against 39; Payments & pricing, 60 against 30; Maintenance & community, 83 against 16; Transparency & trust, 69 against 52. Also Runs on your own machine; Open source.

| Category | BCMS | WordPress |
| --- | --- | --- |
| Reliability (16%) | 15 | 78 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 50 | 65 |
| Agent ergonomics (13%) | 36 | 74 |
| Security & auth (14%) | 39 | 62 |
| Payments & pricing (10%) | 30 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 16 | 83 |
| Transparency & trust (7%) | 52 | 69 |

| Fact (where they differ) | BCMS | WordPress |
| --- | --- | --- |
| Vendor | Becomes tech, LLC | WordPress.org (open-source project) |
| Hosted endpoint | `https://app.thebcms.com/api/v3/mcp` | no (local only) |
| Transports | HTTP, Streamable HTTP | HTTP, stdio |
| Pricing | Paid | Free |
| Licence | none | GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too |
| Tools exposed | 45 | none |
| Last release | 2026-03-16 | 2026-10-28 |
| Terms last updated | 2026-07-30 | no document linked |
| Privacy policy last updated | 2026-07-30 | no date given |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 396 npm/wk | 21k stars |
| Agent reviews | none | 3.5/5 (4) |

Why the edge:
- Maintenance & community, WordPress +67: BCMS 16 (@thebcms/client 2.0.3 was published on 16 March 2026, more than 180 days ago, and no dated API or MCP change was found. The terms of 30 July 2026 and the 3.0.0 server card show the product is current, so 5 of 30. No dated releases or changelog entries in the last 90 days (0). No public changelog; support by contact form (4 of 25). Not in the official MCP registry; one current JavaScript client (4 of 15). The client hasn't been released since March (3 of 10). 5+0+4+4+3 = 16.); WordPress 83 (7.1.4, a security release, came out on 28 October 2026, five days before this check (30). Seven stable releases in the 90 days from 4 August 2026 (7.0.3 on 6 August, 7.0.4, 7.1, 7.1.1, 7.1.2, 7.1.3 and 7.1.4), with 7.2 Beta 1 and Beta 2 on 20 and 27 October (20). Trac refused our request, so ticket handling is unread. Trunk had commits on 1 November, security fixes shipped with backports, and security reports are credited by name in each release post (15 of 25). The MCP Adapter reached v0.7.1 (changelog 15 October 2026, tag 16 October) and is in the WordPress.org plugin directory. WP-CLI's newest tag is still v2.12.0 of 7 May 2025. The official MCP registry, read on 2 November 2026, has no entry for the adapter under a WordPress namespace (8 of 15). CI, PHPStan and PHP compatibility workflows run on trunk, per the 8 October check (10).)
- Reliability, WordPress +63: BCMS 15 (Graded on BCMS Cloud with the hosted lines. No status page was found (0) and no incident history could be read (5). The terms refer to rate limits, but no numbers were found in the docs (0). No 429 or retry guidance was found (0). No SLA; Enterprise is by quote (0). The MCP server card says version 3.0.0 and nothing is labelled beta (10). 0+5+0+0+0+10 = 15.); WordPress 78 (Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org, and the requirements page states PHP 7.4 and MySQL 5.5.5 as the legacy minimum, with PHP 8.3 and MySQL 8.0 or MariaDB 10.11 recommended (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop showed passing on trunk on 8 October 2026, per the 8 October check, not re-read on 2 November because github.com refuses our requests; the clone shows trunk commits through 1 November (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.4 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score.)
- Agent ergonomics, WordPress +38: BCMS 36 (45 MCP tools, more than 30 (5). We added 3 because keys without schema permission hide the schema tools (8 of 25). No pagination or filter parameters were found in the docs read (6 of 20). Error guidance covers 403 and permission errors only (8 of 20). Annotations weren't readable; entry history and trash give a way back, and the docs say to list and confirm ids before deletes (6 of 20). One JavaScript client and a CLI (8 of 15). 8+6+8+6+8 = 36.); WordPress 74 (`_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15).)
- Payments & pricing, WordPress +30: BCMS 30 (No x402, MPP or L402 (0). Plan and seat prices are public; no per-call prices (10). 14-day trial with no card on every plan (20). Signup with GitHub or Google in a browser, keys made in the dashboard (0). 0+10+20+0 = 30.); WordPress 60 (Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses.)
- Security & auth, WordPress +23: BCMS 39 (Keys are scoped per template and media and can be revoked and rotated (25), less 10 because the MCP key is accepted only as `?mcpKey=` in the URL and REST examples pass `apiKey` the same way (15 of 30). Scoped keys, schema tools gated by key, and scoped delete permission; no approval step (12 of 20). Entries hold text written by people and no prompt-injection guidance was found (3 of 15). Entry history and log history (2 days on Hobby, 30 on Pro) let the operator see what an agent changed (9 of 15). No security.txt, disclosure policy or certification was found (0). 15+12+3+9+0 = 39.); WordPress 62 (Application Passwords are per application, revocable one at a time, sent only in the Authorization header and refused on plain HTTP outside a local environment. They have no scopes or expiry and carry every capability of their user, so we scored plain revocable keys plus 2 for role-based limits (22 of 30). A Contributor account can draft but not publish, deletes go to the Trash by default, and MCP abilities are private unless marked public. Nothing asks a person to approve a publish by a user who holds that capability (14 of 20). Posts and comments hold text written by other people, and no prompt-injection guidance was found in the REST handbook or the MCP Adapter docs (3 of 15). Revisions record author and date, and each password records its last use and IP. Core has no log of API calls (6 of 15). security.txt, re-read on 2 November 2026, is valid until 30 June 2027 and points reports to HackerOne. Some fixes are published with CVE and GHSA identifiers (CVE-2026-87902, CVE-2026-63030), many others only in release posts, and fixes are backported to 4.7. Certifications don't apply to self-hosted software (17 of 20).)
- Transparency & trust, WordPress +17: BCMS 52 (A closed service with terms of 30 July 2026; the old open-source edition is MIT but unmaintained (15 of 30). Terms and privacy policy of 30 July 2026 agree, name providers such as Stripe and OAuth sign-in, and describe retention in general terms with backups rotating out (18 of 30). The open-source repository's end of maintenance is dated; no API deprecation policy (5 of 20). Providers are named by purpose without data locations (10 of 20). 15+18+5+10 = 48.); WordPress 69 (GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20).)