ButterCMS vs Cosmic

ButterCMS 17

No dated API changelog was found, and no dated API change in the docs. The docs sitemap's page dates record no change, so they don't set recency. The newest SDK release across the ten official SDKs is buttercms 3.0.3 on 4 September 2025 (Python 2.1.1 on 7 May 2024, .NET 2.1.1 on 16 April 2025, the others older), more than 180 days ago (0 of 30). No three releases or dated changelog entries in 90 days (0). Support by chat and email, a knowledge base and public SDK repositories, with no public changelog (5 of 15). Ten official SDKs are listed and none has a release in the last year (7 of 15, a partial kept). The JavaScript SDK has test and release workflows and moved to trusted publishing in November 2025, with no commits in the last 90 days (5 of 10).

Cosmic 86

MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.

ButterCMS 20

No x402, MPP or L402 (0). Four plans have public dollar prices, the Write API add-on's price is not published and Enterprise is through sales (10). The Free plan needs no card and covers the Read API. Writing needs a paid plan and the add-on, and we did not establish whether the 14-day trial includes it (10 of 20). A person signs up in a browser, and the write token needs a purchase or a request to support (0).

Cosmic 45

No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.

ButterCMS 64

Responses are sized with page_size, a fields selection, exclude_body on posts and levels for reference depth (20 of 25). Page and offset pagination with meta.count, filters on field values and order (20). Errors are documented with causes, but bodies come in three shapes (detail, a field map, error) with no stable codes, and a write answers 202 with status: pending and no identifier, so the result has to be read back (11 of 20). No idempotency keys. Page and post slugs are unique, which limits duplicates, and collection items have no such guard (4 of 20). Writes default to draft, but page creation needs every field key of the page type. Ten SDKs are listed and the docs say to call REST for writes (9 of 15).

Cosmic 82

24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with after, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.

ButterCMS 31

One read token and one write token per account, with no scopes, and the docs say rotation is done by contacting support (20 for plain revocable keys, less the fixed 10 because the read token is documented as an auth_token query parameter, 10 of 30). That token also returns drafts with preview=1. The read token is a read-only credential and writes default to draft. No approval step for API writes was found, and approval workflows are listed on Enterprise (10 of 20). The API returns stored content, and no guidance on treating it as untrusted input was found (3 of 15). Audit logs and access logs are listed as Enterprise functions, and versions record who saved them (6 of 15). A responsible-disclosure section in the docs gives security@buttercms.com and says reports get a prompt response, with no stated time, and the security page describes penetration tests. No security.txt, no bug bounty, and the certifications listed are those of the AWS and Heroku data centres (7 of 20).

Cosmic 47

Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give read_key as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.

ButterCMS 52

Closed service, MIT SDKs. The only published contract is an undated website Terms of Service that names no legal entity and has passages about collaborating on legal documents that do not describe a CMS (8 of 30). The privacy policy, last modified 15 August 2022, covers the website and says nothing about content stored in the CMS. The security page says data is kept as long as the customer needs it, the docs give 30 or more days for backups, and a DPA is on request for Enterprise customers (10 of 30). No deprecation policy or dated notice was found. PUT on pages is kept for backwards compatibility (2 of 20). Heroku, AWS, Fastly, Stripe and TinyMCE are named across the security page and docs. No sub-processor list or hosting region is published (6 of 20).

Cosmic 63

A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.

ButterCMS 78

Public OpenAPI 3.1 files for the whole API, the Read API, the Write API and webhooks, linked from the docs index. The combined file has 28 operations on 4 November 2026, 18 reads and 10 writes (25). A docs llms.txt and a Markdown copy of every docs page (10). All operations have a description, and the write descriptions state field rules, defaults and what the API cannot do. The docs say when to use an SDK and when to call REST (16 of 20). Request bodies have required fields and 40 enums in the combined file, but the fields object depends on each account's page types and no endpoint returns those types (9 of 15). 328 examples in the combined file and a page of status codes with causes and sample bodies (13 of 15). The version is in the /v2 path. No API changelog was found (5 of 15).

Cosmic 88

openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.