{ "data": { "a": { "slug": "buttercms", "name": "ButterCMS", "vendor": "ButterCMS LLC", "vendorUrl": "https://buttercms.com", "kind": "http-api", "category": "cms", "summary": "ButterCMS is a hosted headless CMS with pages, collections and a blog engine. Agents read content through a REST Read API and create, update, publish and delete it through a REST Write API sold as a paid add-on.", "url": "https://www.anchorterminal.com/tools/buttercms", "markdownUrl": "https://www.anchorterminal.com/tools/buttercms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/buttercms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/buttercms.json", "dns": "buttercms.grade.anchorterminal.com", "repo": "https://github.com/ButterCMS/buttercms-js", "license": "Proprietary service under ButterCMS's terms of service. The SDKs and starter projects on GitHub are MIT", "transports": [ "http" ], "remoteUrl": "https://api.buttercms.com/v2", "packages": [ { "registry": "npm", "name": "buttercms" }, { "registry": "pypi", "name": "buttercms-python" } ], "auth": "api-key", "authNotes": "Self-serve for reads, paid add-on for writes. A person signs up in a browser and copies the read token from Settings. The write token exists only after the Write API add-on is bought under Settings, Billing, or enabled by support, and one docs page says this needs verification. The read token goes in the `auth_token` query parameter or an `Authorization: Token` header. The write token is accepted in the header only. There is one token of each kind per account, with no scopes, and the docs say tokens are rotated by contacting support. No OAuth, app review or sales approval for the listed plans.", "pricing": "freemium", "pricingNotes": "The Free plan needs no card and includes 50,000 API calls a month, but not the Write API. Writing needs Advanced ($249 a month, $224 billed yearly) or Professional ($399, $359 billed yearly) plus the Write API add-on, whose price is not published, with 2,000 or 5,000 write calls a month. Enterprise includes it and is sold through sales. Every plan has a 14-day trial (https://buttercms.com/pricing/, checked 2026-10-09).", "priceSummary": "$79 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI files or the pricing page (checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 6929, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://buttercms.com/docs/api/overview", "llmsTxt": "https://buttercms.com/docs/llms.txt", "openapi": "https://buttercms.com/docs/api/openapi/openapi.yaml", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.localisation" ], "tags": [ "official", "hosted", "closed-source", "api-key", "openapi", "llms-txt", "webhooks", "free-tier", "no-card", "status-page", "javascript", "python", "php", "ruby" ], "lastRelease": "2025-09-04", "graded": true, "anchor": { "graded": true, "score": 51.4, "grade": "D", "agentReady": false, "rank": 1021, "ranked": true, "rankOf": 1486, "categoryRank": 14, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 17, "payments": 20, "reliability": 82, "schema": 78, "security": 31, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -2, "negativeNotes": [ "9 October 2026. The docs page on AI tools showed `butter.page.update(...)` as the way to write through the JavaScript SDK, while the published SDK 3.0.3 has list, retrieve and search methods only and the SDK overview says to call REST for writes. By 4 November 2026 the page calls the Write API directly and says the SDK's Page resource is read-only; the term stays within the 12 months, as agentos's corrected claims did (https://buttercms.com/docs/build-your-app/third-party-integrations/ai-tools-integration.md, https://github.com/ButterCMS/buttercms-js). 2 points." ], "verdict": "The Read and Write APIs have a public OpenAPI 3.1 file, Markdown docs and a status page with no incident since October 2025. The Write API is a paid add-on from the $249 plan, capped at 2,000 or 5,000 calls a month. Writes answer 202 with no identifier, and no SDK has had a release since September 2025.", "bestFor": "A team already on a paid ButterCMS plan that wants an agent to draft and publish pages, collection items and blog posts in small volumes.", "strengths": [ "Public OpenAPI 3.1 files for the Read and Write APIs (28 operations in the combined file), a docs llms.txt and a Markdown copy of every docs page", "status.buttercms.com lists three components and no incident since 20 October 2025", "Writes create drafts unless `status` is `published`, and the write token is separate from the read token and accepted only in a header", "Media fields take a URL and the service copies the file into the media library, so one request creates an entry with its image", "Free plan with no card and 50,000 API calls a month for reading, and dollar prices for four plans on the pricing page" ], "weaknesses": [ "The Write API is a paid add-on on Advanced ($249 a month) and Professional ($399), capped at 2,000 and 5,000 write calls a month. Its price is not published", "Create and update calls answer 202 with `{\"status\": \"pending\"}` and no identifier, and there are no idempotency keys", "One read token and one write token per account, with no scopes. The docs say rotation is done by contacting support", "Page types and collections cannot be created through the API, pages cannot be deleted through it, and it has no version or rollback operation", "The terms are an undated website Terms of Service, the privacy policy dates from 15 August 2022 and covers the website, and a DPA is on request for Enterprise only", "No API changelog or deprecation policy was found. No SDK has had a release since JavaScript 3.0.3 on 4 September 2025, and that SDK has no write methods" ], "agentNotes": [ "End every path with a slash. A missing slash returns a 301, and the vendor counts the redirect and the retry as two API calls", "Send the write token only as `Authorization: Token \u003ctoken\u003e`. The `auth_token` query parameter works for reads only", "On page creation send every field key of the page type, with empty strings for fields left blank", "A 202 means queued, not saved. Read the entry back with `preview=1` to confirm, and check a slug exists before retrying a create", "Call the REST API directly for writes. The JavaScript SDK 3.0.3 has list, retrieve and search methods only" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 51.4 } ], "editorialScores": { "ergonomics": 64, "maintenance": 17, "payments": 20, "reliability": 82, "schema": 78, "security": 31, "transparency": 26 }, "provenanceScore": 78, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install buttercms --save", "http": "curl -H \"Authorization: Token your_api_token\" \\\n \"https://api.buttercms.com/v2/posts/\"" }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/buttercms" }, "area": "business", "unitPrices": [ { "item": "Basic", "unit": "month", "usd": 79, "note": "billed monthly, $71 billed yearly, 100,000 API calls, no Write API" }, { "item": "Advanced", "unit": "month", "usd": 249, "note": "billed monthly, $224 billed yearly, 500,000 API calls, Write API add-on priced separately (up to 2,000 write calls)" }, { "item": "Professional", "unit": "month", "usd": 399, "note": "billed monthly, $359 billed yearly, 1M API calls, Write API add-on priced separately (up to 5,000 write calls)" } ], "provenance": { "legalEntity": "ButterCMS LLC", "domain": "buttercms.com", "domainRegistered": "2015-03-24", "endpointOnVendorDomain": true, "terms": "https://buttercms.com/terms/", "privacy": "https://buttercms.com/privacy/", "statusPage": "https://status.buttercms.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The privacy policy (last modified 15 August 2022) names ButterCMS LLC. The terms name only Butter and ButterCMS, carry no date, give a San Francisco postal address for DMCA notices and choose Michigan law.", "The terms are written as website Terms of Service and define the Website to include the services on it. The Write API's OpenAPI file names this page as its licence, so it is the only published contract for the API. No separate service agreement, API terms or SLA document was found.", "The privacy policy covers information collected on the website and says nothing about content stored in the CMS. The docs say a data processing agreement is available to Enterprise customers on request.", "A status page post about a DNS outage on 9 September 2024 says ButterCMS was acquired by Tiugo Technologies, and the site's careers link goes to Tiugo's recruiting page.", "The API answers at api.buttercms.com and the dashboard at app.buttercms.com.", "buttercms.com/.well-known/security.txt returns 404. The docs give security@buttercms.com for vulnerability reports.", "RDAP for buttercms.com gives a registration date of 2015-03-24 and Amazon Registrar, Inc. as registrar.", "No API changelog was found on the site or in the docs index. The JavaScript SDK repository has a CHANGELOG.md." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/buttercms.json", "live": { "slug": "buttercms", "probe": { "target": "https://api.buttercms.com/v2", "method": "get", "lastAt": "2026-11-07T18:20:15.818598204Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "too many redirects", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 239, "samples30d": 7205, "days": [ { "date": "2026-10-09", "probes": 85, "ok": 0 }, { "date": "2026-10-10", "probes": 247, "ok": 0 }, { "date": "2026-10-11", "probes": 247, "ok": 0 }, { "date": "2026-10-12", "probes": 247, "ok": 0 }, { "date": "2026-10-13", "probes": 248, "ok": 0 }, { "date": "2026-10-14", "probes": 249, "ok": 0 }, { "date": "2026-10-15", "probes": 253, "ok": 0 }, { "date": "2026-10-16", "probes": 252, "ok": 0 }, { "date": "2026-10-17", "probes": 253, "ok": 0 }, { "date": "2026-10-18", "probes": 256, "ok": 0 }, { "date": "2026-10-19", "probes": 255, "ok": 0 }, { "date": "2026-10-20", "probes": 252, "ok": 0 }, { "date": "2026-10-21", "probes": 253, "ok": 0 }, { "date": "2026-10-22", "probes": 253, "ok": 0 }, { "date": "2026-10-23", "probes": 248, "ok": 0 }, { "date": "2026-10-24", "probes": 251, "ok": 0 }, { "date": "2026-10-25", "probes": 250, "ok": 0 }, { "date": "2026-10-26", "probes": 252, "ok": 0 }, { "date": "2026-10-27", "probes": 249, "ok": 0 }, { "date": "2026-10-28", "probes": 251, "ok": 0 }, { "date": "2026-10-29", "probes": 249, "ok": 0 }, { "date": "2026-10-30", "probes": 248, "ok": 0 }, { "date": "2026-10-31", "probes": 251, "ok": 0 }, { "date": "2026-11-01", "probes": 249, "ok": 0 }, { "date": "2026-11-02", "probes": 250, "ok": 0 }, { "date": "2026-11-03", "probes": 248, "ok": 0 }, { "date": "2026-11-04", "probes": 246, "ok": 0 }, { "date": "2026-11-05", "probes": 185, "ok": 0 }, { "date": "2026-11-06", "probes": 241, "ok": 0 }, { "date": "2026-11-07", "probes": 187, "ok": 0 } ], "outages": [ { "start": "2026-10-09T15:43:00.096294667Z", "end": "0001-01-01T00:00:00Z", "note": "too many redirects" } ] }, "vendorStatus": { "page": "https://status.buttercms.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:20:37.678717104Z" }, "versions": [ { "registry": "github", "name": "ButterCMS/buttercms-js", "version": "v3.0.3", "released": "2025-09-04", "seenAt": "2026-11-06T23:13:00.320392722Z" }, { "registry": "npm", "name": "buttercms", "version": "3.0.3", "seenAt": "2026-11-06T23:12:59.922427706Z" }, { "registry": "pypi", "name": "buttercms-python", "version": "2.1.1", "released": "2024-05-07", "seenAt": "2026-11-06T23:13:00.12522511Z" } ], "githubStars": 164, "npmWeekly": 9389, "pypiWeekly": 301, "securityTxt": { "url": "https://buttercms.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:49.204405911Z" }, "llmsTxt": { "url": "https://buttercms.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:45.80373153Z" }, "domain": { "domain": "buttercms.com", "registered": "2015-03-24", "source": "https://rdap.verisign.com/com/v1/domain/buttercms.com", "checkedAt": "2026-11-01T14:13:03.897204984Z" }, "pages": [ { "url": "https://buttercms.com/pricing/", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:00:36.294009426Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9ba825b44b86" }, { "url": "https://buttercms.com/privacy/", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:00:38.426465317Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "908b6461f1b9" }, { "url": "https://buttercms.com/terms/", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:00:40.417468366Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8862b63c94a5" } ], "github": { "repo": "buttercms/buttercms-js", "checkedAt": "2026-11-02T08:37:25.410869031Z", "stars": 164, "archived": false, "issuesEnabled": true, "pushedAt": "2025-11-13T15:53:09Z", "openIssues": 2, "openPRs": 1, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "master", "runs": 2, "success": 1, "failure": 0, "other": 1, "latest": "skipped", "latestAt": "2025-11-13T15:53:02Z" }, "replies": { "sampled": 25, "unanswered": 2, "medianDays": 13 } }, "updatedAt": "2026-11-07T18:20:15.818598204Z" } }, "answer": "Cosmic scores 72.5 (BB) on agent readiness against ButterCMS's 51.4 (D), and leads in every scored category.", "b": { "slug": "cosmic", "name": "Cosmic", "vendor": "Cosmic Inc.", "vendorUrl": "https://www.cosmicjs.com", "kind": "http-api", "category": "cms", "summary": "Cosmic is a hosted headless CMS with a REST API, a TypeScript SDK, a CLI and a hosted MCP server. Agents read and write objects, media and object types, generate media, and can create a project by agent signup.", "url": "https://www.anchorterminal.com/tools/cosmic", "markdownUrl": "https://www.anchorterminal.com/tools/cosmic.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cosmic.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cosmic.json", "dns": "cosmic.grade.anchorterminal.com", "repo": "https://github.com/cosmicjs/mcp", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "packages": [ { "registry": "npm", "name": "@cosmicjs/mcp" }, { "registry": "npm", "name": "@cosmicjs/sdk" }, { "registry": "npm", "name": "@cosmicjs/cli" } ], "auth": "api-key", "authNotes": "Each bucket has a read key and a write key, rotatable independently. The hosted MCP server takes `Authorization: Bearer READ_KEY` for read-only tools or `READ_KEY:WRITE_KEY` for full access; the write key can also go in `X-Cosmic-Write-Key`. The REST API takes the read key as `read_key` in the query or as a Bearer token on GET. POST /v3/agents/sign-up on dapi.cosmicjs.com needs no authentication and returns bucket keys for a new unclaimed project tied to a human's email.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 1 bucket, 10,000 objects and 250,000 non-cached API requests a month, no card. Builder $99 a month, Team $299, Business $499, Small Workspace $999 and Large Workspace $2,999, with 10 per cent off yearly; Enterprise by quote. Webhooks, localisation and revision history are paid add-ons. Workspace plans have a 30-day trial.", "priceSummary": "$99 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the OpenAPI spec, the MCP docs or pricing.md (checked 2026-11-06). An unclaimed or over-limit bucket returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 24, "popularity": { "githubStars": null, "npmWeekly": 295, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.cosmicjs.com/docs", "llmsTxt": "https://www.cosmicjs.com/llms.txt", "openapi": "https://www.cosmicjs.com/openapi.json", "registryName": "com.cosmicjs/mcp", "capabilities": [ "cms.content", "cms.assets", "cms.schema", "cms.publish", "cms.localisation" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "mcp-registry", "openapi", "llms-txt", "free-tier", "no-card", "status-page", "webhooks", "typescript", "cli", "closed-source" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 72.5, "grade": "BB", "agentReady": true, "rank": 123, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "bestFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "strengths": [ "Agent signup API provisions a project and bucket with keys, idempotent per email and agent", "24 MCP tools with readOnlyHint and destructiveHint, and descriptions that say when to use each", "Leaving out the write key gives read-only MCP access", "OpenAPI spec, llms.txt and Markdown docs with an error model and per-code retry guidance", "Free plan with no card and published prices and quotas for every paid plan" ], "weaknesses": [ "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement", "The REST API accepts the read key as a URL query parameter", "Revision history, webhooks and localisation are paid add-ons", "The OpenAPI spec covers 21 operations, fewer than the documented API", "Data is kept indefinitely unless deletion is requested" ], "agentNotes": [ "Send only the read key in the Bearer token unless the task needs writes", "Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days", "Fix and don't retry on 400; wait and retry on 429", "Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit", "Confirm with the user before cosmic_objects_delete, which deletes permanently" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.5 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 53 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @cosmicjs/mcp", "http": "curl -X POST https://dapi.cosmicjs.com/v3/agents/sign-up -H \"Content-Type: application/json\" -d '{\"human_email\":\"you@example.com\",\"project_name\":\"Recipe Blog\",\"agent_id\":\"my-agent\"}'", "config": { "mcpServers": { "cosmic": { "headers": { "Authorization": "Bearer your-read-key:your-write-key" }, "url": "https://mcp.cosmicjs.com/v1/buckets/your-bucket-slug" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/cosmic" }, "area": "business", "unitPrices": [ { "item": "Builder plan", "unit": "month", "usd": 99, "note": "3 buckets, 50,000 objects, 1 million non-cached requests; $89 a month yearly" }, { "item": "Team plan", "unit": "month", "usd": 299, "note": "5 buckets, 100,000 objects, 2 million non-cached requests" }, { "item": "Business plan", "unit": "month", "usd": 499, "note": "10 buckets, 250,000 objects, 5 million non-cached requests" } ], "provenance": { "legalEntity": "Cosmic Inc.", "domain": "cosmicjs.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.cosmicjs.com/terms-of-service", "privacy": "https://www.cosmicjs.com/privacy-policy", "statusPage": "https://cosmicstatus.com", "changelog": "https://www.cosmicjs.com/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy were last updated on 13 January 2025 and name Cosmic JS at 3208 Bonniebrook Dr, Plano, Texas. The MCP server's licence names Cosmic Inc.", "The terms forbid using a robot or spider to copy or scrape the website without written permission; recorded as a fact. www.cosmicjs.com/robots.txt allows all crawlers, including ClaudeBot, except /api/, /search, /community/members/ and /v3/.", "www.cosmicjs.com/.well-known/security.txt returned 404. The security page asks for vulnerability reports at support@cosmicjs.com.", "cosmicstatus.com redirects to a Statuspage at cosmicjs.statuspage.io with API and Web Dashboard components." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cosmic.json", "live": { "slug": "cosmic", "probe": { "target": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "method": "get", "lastAt": "2026-11-07T18:20:18.962856282Z", "lastOk": true, "lastStatus": 401, "lastMs": 494, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 452, "p95ms24h": 538, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://cosmicstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:35.290408052Z" }, "versions": [ { "registry": "github", "name": "cosmicjs/mcp", "version": "v1.7.1", "released": "2026-11-02", "seenAt": "2026-11-06T23:17:54.958583794Z" }, { "registry": "mcp-registry", "name": "com.cosmicjs/mcp", "version": "1.6.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@cosmicjs/cli", "version": "1.12.0", "seenAt": "2026-11-06T23:17:52.953736128Z" }, { "registry": "npm", "name": "@cosmicjs/mcp", "version": "1.7.1", "seenAt": "2026-11-06T23:17:50.755872442Z" }, { "registry": "npm", "name": "@cosmicjs/sdk", "version": "2.4.0", "seenAt": "2026-11-06T23:17:51.562341268Z" } ], "githubStars": 1, "npmWeekly": 295, "securityTxt": { "url": "https://cosmicjs.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:42.91283778Z" }, "llmsTxt": { "url": "https://www.cosmicjs.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:12.321724133Z" }, "pages": [ { "url": "https://www.cosmicjs.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:27:27.310794511Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3e45613abe99" }, { "url": "https://www.cosmicjs.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:27:31.923491628Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d4aa3db9a89b" }, { "url": "https://www.cosmicjs.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:27:35.902981274Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3c4a26f1901" } ], "updatedAt": "2026-11-07T18:20:18.962856282Z" } }, "edges": [ { "by": 69, "category": "maintenance", "leads": "cosmic", "name": "Maintenance \u0026 community", "reasons": { "a": "No dated API changelog was found, and no dated API change in the docs. The docs sitemap's page dates record no change, so they don't set recency. The newest SDK release across the ten official SDKs is `buttercms` 3.0.3 on 4 September 2025 (Python 2.1.1 on 7 May 2024, .NET 2.1.1 on 16 April 2025, the others older), more than 180 days ago (0 of 30). No three releases or dated changelog entries in 90 days (0). Support by chat and email, a knowledge base and public SDK repositories, with no public changelog (5 of 15). Ten official SDKs are listed and none has a release in the last year (7 of 15, a partial kept). The JavaScript SDK has test and release workflows and moved to trusted publishing in November 2025, with no commits in the last 90 days (5 of 10).", "b": "MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86." }, "scores": { "a": 17, "b": 86 } }, { "by": 25, "category": "payments", "leads": "cosmic", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Four plans have public dollar prices, the Write API add-on's price is not published and Enterprise is through sales (10). The Free plan needs no card and covers the Read API. Writing needs a paid plan and the add-on, and we did not establish whether the 14-day trial includes it (10 of 20). A person signs up in a browser, and the write token needs a purchase or a request to support (0).", "b": "No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45." }, "scores": { "a": 20, "b": 45 } }, { "by": 18, "category": "ergonomics", "leads": "cosmic", "name": "Agent ergonomics", "reasons": { "a": "Responses are sized with `page_size`, a `fields` selection, `exclude_body` on posts and `levels` for reference depth (20 of 25). Page and offset pagination with `meta.count`, filters on field values and `order` (20). Errors are documented with causes, but bodies come in three shapes (`detail`, a field map, `error`) with no stable codes, and a write answers 202 with `status: pending` and no identifier, so the result has to be read back (11 of 20). No idempotency keys. Page and post slugs are unique, which limits duplicates, and collection items have no such guard (4 of 20). Writes default to draft, but page creation needs every field key of the page type. Ten SDKs are listed and the docs say to call REST for writes (9 of 15).", "b": "24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82." }, "scores": { "a": 64, "b": 82 } }, { "by": 16, "category": "security", "leads": "cosmic", "name": "Security \u0026 auth", "reasons": { "a": "One read token and one write token per account, with no scopes, and the docs say rotation is done by contacting support (20 for plain revocable keys, less the fixed 10 because the read token is documented as an `auth_token` query parameter, 10 of 30). That token also returns drafts with `preview=1`. The read token is a read-only credential and writes default to draft. No approval step for API writes was found, and approval workflows are listed on Enterprise (10 of 20). The API returns stored content, and no guidance on treating it as untrusted input was found (3 of 15). Audit logs and access logs are listed as Enterprise functions, and versions record who saved them (6 of 15). A responsible-disclosure section in the docs gives security@buttercms.com and says reports get a prompt response, with no stated time, and the security page describes penetration tests. No security.txt, no bug bounty, and the certifications listed are those of the AWS and Heroku data centres (7 of 20).", "b": "Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47." }, "scores": { "a": 31, "b": 47 } }, { "by": 11, "category": "transparency", "leads": "cosmic", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service, MIT SDKs. The only published contract is an undated website Terms of Service that names no legal entity and has passages about collaborating on legal documents that do not describe a CMS (8 of 30). The privacy policy, last modified 15 August 2022, covers the website and says nothing about content stored in the CMS. The security page says data is kept as long as the customer needs it, the docs give 30 or more days for backups, and a DPA is on request for Enterprise customers (10 of 30). No deprecation policy or dated notice was found. PUT on pages is kept for backwards compatibility (2 of 20). Heroku, AWS, Fastly, Stripe and TinyMCE are named across the security page and docs. No sub-processor list or hosting region is published (6 of 20).", "b": "A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53." }, "scores": { "a": 52, "b": 63 } }, { "by": 10, "category": "schema", "leads": "cosmic", "name": "Schema \u0026 documentation", "reasons": { "a": "Public OpenAPI 3.1 files for the whole API, the Read API, the Write API and webhooks, linked from the docs index. The combined file has 28 operations on 4 November 2026, 18 reads and 10 writes (25). A docs llms.txt and a Markdown copy of every docs page (10). All operations have a description, and the write descriptions state field rules, defaults and what the API cannot do. The docs say when to use an SDK and when to call REST (16 of 20). Request bodies have required fields and 40 enums in the combined file, but the `fields` object depends on each account's page types and no endpoint returns those types (9 of 15). 328 examples in the combined file and a page of status codes with causes and sample bodies (13 of 15). The version is in the `/v2` path. No API changelog was found (5 of 15).", "b": "openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88." }, "scores": { "a": 78, "b": 88 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "ButterCMS LLC", "b": "Cosmic Inc.", "name": "Vendor" }, { "a": "https://api.buttercms.com/v2", "b": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP, Streamable HTTP, stdio", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under ButterCMS's terms of service. The SDKs and starter projects on GitHub are MIT", "b": "none", "name": "Licence" }, { "a": "none", "b": "24", "name": "Tools exposed" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "com.cosmicjs/mcp", "name": "MCP registry" }, { "a": "2025-09-04", "b": "2026-11-02", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "2022-08-15", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "6.9k npm/wk", "b": "295 npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Cosmic scores 72.5 (BB) on agent readiness against ButterCMS's 51.4 (D), and leads in every scored category.", "question": "Which is better for AI agents, ButterCMS or Cosmic?" }, { "answer": "Both need an API key.", "question": "Do ButterCMS and Cosmic need an API key?" }, { "answer": "Yes. ButterCMS has a hosted endpoint at https://api.buttercms.com/v2 and Cosmic at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}.", "question": "Can an agent call ButterCMS and Cosmic without installing anything?" } ], "goodFor": [ { "aheadOn": null, "also": null, "goodFor": "A team already on a paid ButterCMS plan that wants an agent to draft and publish pages, collection items and blog posts in small volumes.", "slug": "buttercms", "watchFor": "The Write API is a paid add-on on Advanced ($249 a month) and Professional ($399), capped at 2,000 and 5,000 write calls a month. Its price is not published" }, { "aheadOn": [ "Reliability, 90 against 82", "Schema \u0026 documentation, 88 against 78", "Agent ergonomics, 82 against 64", "Security \u0026 auth, 47 against 31", "Payments \u0026 pricing, 45 against 20", "Maintenance \u0026 community, 86 against 17", "Transparency \u0026 trust, 63 against 52" ], "also": [ "Agent-ready, a grade of BB or better", "Runs on your own machine" ], "goodFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "slug": "cosmic", "watchFor": "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement" } ], "history": { "buttercms": [ { "causes": [ "method" ], "date": "2026-11-04", "delta": -2, "from": 53.4, "fromGrade": "D", "to": 51.4, "toGrade": "D" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.1, "from": 53.3, "fromGrade": "D", "to": 53.4, "toGrade": "D" } ], "cosmic": null }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-buttercms.json", "title": "BCMS vs ButterCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-buttercms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-contentstack.json", "title": "ButterCMS vs Contentstack", "url": "https://www.anchorterminal.com/compare/buttercms-vs-contentstack" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-datocms.json", "title": "ButterCMS vs DatoCMS", "url": "https://www.anchorterminal.com/compare/buttercms-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-directus.json", "title": "ButterCMS vs Directus", "url": "https://www.anchorterminal.com/compare/buttercms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms.json", "title": "ButterCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-ghost.json", "title": "ButterCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/buttercms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-hygraph.json", "title": "ButterCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/buttercms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-kontent-ai.json", "title": "ButterCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/buttercms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-payload.json", "title": "ButterCMS vs Payload", "url": "https://www.anchorterminal.com/compare/buttercms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-prismic.json", "title": "ButterCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/buttercms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-sanity.json", "title": "ButterCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/buttercms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-storyblok.json", "title": "ButterCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/buttercms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-strapi.json", "title": "ButterCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/buttercms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-webflow.json", "title": "ButterCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/buttercms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-wordpress.json", "title": "ButterCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/buttercms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic.json", "title": "Contentstack vs Cosmic", "url": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-datocms.json", "title": "Cosmic vs DatoCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-directus.json", "title": "Cosmic vs Directus", "url": "https://www.anchorterminal.com/compare/cosmic-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.json", "title": "Cosmic vs Ghost", "url": "https://www.anchorterminal.com/compare/cosmic-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph.json", "title": "Cosmic vs Hygraph", "url": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.json", "title": "Cosmic vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-payload.json", "title": "Cosmic vs Payload", "url": "https://www.anchorterminal.com/compare/cosmic-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-prismic.json", "title": "Cosmic vs Prismic", "url": "https://www.anchorterminal.com/compare/cosmic-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-sanity.json", "title": "Cosmic vs Sanity", "url": "https://www.anchorterminal.com/compare/cosmic-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok.json", "title": "Cosmic vs Storyblok", "url": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.json", "title": "Cosmic vs Strapi", "url": "https://www.anchorterminal.com/compare/cosmic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.json", "title": "Cosmic vs Webflow", "url": "https://www.anchorterminal.com/compare/cosmic-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json", "title": "Cosmic vs WordPress", "url": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress" } ], "panel": null, "scores": [ { "buttercms": 82, "by": 8, "cosmic": 90, "edge": "cosmic", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "buttercms": 78, "by": 10, "cosmic": 88, "edge": "cosmic", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "buttercms": 64, "by": 18, "cosmic": 82, "edge": "cosmic", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "buttercms": 31, "by": 16, "cosmic": 47, "edge": "cosmic", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "buttercms": 20, "by": 25, "cosmic": 45, "edge": "cosmic", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "buttercms": 17, "by": 69, "cosmic": 86, "edge": "cosmic", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "buttercms": 52, "by": 11, "cosmic": 63, "edge": "cosmic", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Cosmic scores 72.5 (BB) on agent readiness against ButterCMS's 51.4 (D), and leads in every scored category. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "buttercms": "The Read and Write APIs have a public OpenAPI 3.1 file, Markdown docs and a status page with no incident since October 2025. The Write API is a paid add-on from the $249 plan, capped at 2,000 or 5,000 calls a month. Writes answer 202 with no identifier, and no SDK has had a release since September 2025.", "cosmic": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic", "json": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic.min.md" }, "markdown": "Cosmic scores 72.5 (BB) on agent readiness against ButterCMS's 51.4 (D), and leads in every scored category. Both do content management.\n\n- ButterCMS: grade D, 51.4/100, rank #1021 of 1486. Markdown https://www.anchorterminal.com/tools/buttercms.md · JSON https://www.anchorterminal.com/api/v1/tools/buttercms.json\n- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### ButterCMS (D)\n\nGood for: A team already on a paid ButterCMS plan that wants an agent to draft and publish pages, collection items and blog posts in small volumes.\n\nWatch for: The Write API is a paid add-on on Advanced ($249 a month) and Professional ($399), capped at 2,000 and 5,000 write calls a month. Its price is not published\n\n### Cosmic (BB)\n\nGood for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.\n\nAhead on:\n- Reliability, 90 against 82\n- Schema \u0026 documentation, 88 against 78\n- Agent ergonomics, 82 against 64\n- Security \u0026 auth, 47 against 31\n- Payments \u0026 pricing, 45 against 20\n- Maintenance \u0026 community, 86 against 17\n- Transparency \u0026 trust, 63 against 52\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Runs on your own machine\n\nWatch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Cosmic +69\n\n- ButterCMS (17): No dated API changelog was found, and no dated API change in the docs. The docs sitemap's page dates record no change, so they don't set recency. The newest SDK release across the ten official SDKs is `buttercms` 3.0.3 on 4 September 2025 (Python 2.1.1 on 7 May 2024, .NET 2.1.1 on 16 April 2025, the others older), more than 180 days ago (0 of 30). No three releases or dated changelog entries in 90 days (0). Support by chat and email, a knowledge base and public SDK repositories, with no public changelog (5 of 15). Ten official SDKs are listed and none has a release in the last year (7 of 15, a partial kept). The JavaScript SDK has test and release workflows and moved to trusted publishing in November 2025, with no commits in the last 90 days (5 of 10).\n- Cosmic (86): MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.\n\n### Payments \u0026 pricing: Cosmic +25\n\n- ButterCMS (20): No x402, MPP or L402 (0). Four plans have public dollar prices, the Write API add-on's price is not published and Enterprise is through sales (10). The Free plan needs no card and covers the Read API. Writing needs a paid plan and the add-on, and we did not establish whether the 14-day trial includes it (10 of 20). A person signs up in a browser, and the write token needs a purchase or a request to support (0).\n- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.\n\n### Agent ergonomics: Cosmic +18\n\n- ButterCMS (64): Responses are sized with `page_size`, a `fields` selection, `exclude_body` on posts and `levels` for reference depth (20 of 25). Page and offset pagination with `meta.count`, filters on field values and `order` (20). Errors are documented with causes, but bodies come in three shapes (`detail`, a field map, `error`) with no stable codes, and a write answers 202 with `status: pending` and no identifier, so the result has to be read back (11 of 20). No idempotency keys. Page and post slugs are unique, which limits duplicates, and collection items have no such guard (4 of 20). Writes default to draft, but page creation needs every field key of the page type. Ten SDKs are listed and the docs say to call REST for writes (9 of 15).\n- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.\n\n### Security \u0026 auth: Cosmic +16\n\n- ButterCMS (31): One read token and one write token per account, with no scopes, and the docs say rotation is done by contacting support (20 for plain revocable keys, less the fixed 10 because the read token is documented as an `auth_token` query parameter, 10 of 30). That token also returns drafts with `preview=1`. The read token is a read-only credential and writes default to draft. No approval step for API writes was found, and approval workflows are listed on Enterprise (10 of 20). The API returns stored content, and no guidance on treating it as untrusted input was found (3 of 15). Audit logs and access logs are listed as Enterprise functions, and versions record who saved them (6 of 15). A responsible-disclosure section in the docs gives security@buttercms.com and says reports get a prompt response, with no stated time, and the security page describes penetration tests. No security.txt, no bug bounty, and the certifications listed are those of the AWS and Heroku data centres (7 of 20).\n- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.\n\n### Transparency \u0026 trust: Cosmic +11\n\n- ButterCMS (52): Closed service, MIT SDKs. The only published contract is an undated website Terms of Service that names no legal entity and has passages about collaborating on legal documents that do not describe a CMS (8 of 30). The privacy policy, last modified 15 August 2022, covers the website and says nothing about content stored in the CMS. The security page says data is kept as long as the customer needs it, the docs give 30 or more days for backups, and a DPA is on request for Enterprise customers (10 of 30). No deprecation policy or dated notice was found. PUT on pages is kept for backwards compatibility (2 of 20). Heroku, AWS, Fastly, Stripe and TinyMCE are named across the security page and docs. No sub-processor list or hosting region is published (6 of 20).\n- Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.\n\n### Schema \u0026 documentation: Cosmic +10\n\n- ButterCMS (78): Public OpenAPI 3.1 files for the whole API, the Read API, the Write API and webhooks, linked from the docs index. The combined file has 28 operations on 4 November 2026, 18 reads and 10 writes (25). A docs llms.txt and a Markdown copy of every docs page (10). All operations have a description, and the write descriptions state field rules, defaults and what the API cannot do. The docs say when to use an SDK and when to call REST (16 of 20). Request bodies have required fields and 40 enums in the combined file, but the `fields` object depends on each account's page types and no endpoint returns those types (9 of 15). 328 examples in the combined file and a page of status codes with causes and sample bodies (13 of 15). The version is in the `/v2` path. No API changelog was found (5 of 15).\n- Cosmic (88): openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.\n\n## Score by category\n\n| Category | Weight | ButterCMS | Cosmic | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 82 | 90 | Cosmic +8 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 78 | 88 | Cosmic +10 |\n| Agent ergonomics | 13% (16.2 this run) | 64 | 82 | Cosmic +18 |\n| Security \u0026 auth | 14% (17.5 this run) | 31 | 47 | Cosmic +16 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 45 | Cosmic +25 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 17 | 86 | Cosmic +69 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 63 | Cosmic +11 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **51.4 · D** | **72.5 · BB** | |\n\n## Facts side by side\n\n| Fact | ButterCMS | Cosmic |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | ButterCMS LLC | Cosmic Inc. |\n| Hosted endpoint | `https://api.buttercms.com/v2` | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` |\n| Transports | HTTP | HTTP, Streamable HTTP, stdio |\n| Auth | API key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service under ButterCMS's terms of service. The SDKs and starter projects on GitHub are MIT | none |\n| Tools exposed | none | 24 |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `com.cosmicjs/mcp` |\n| Last release | 2025-09-04 | 2026-11-02 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | 2022-08-15 | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 6.9k npm/wk | 295 npm/wk |\n\n## How the scores have moved\n\n### ButterCMS\n\n- -2.0 on 4 November 2026: checklist\n- +0.1 on 28 October 2026: new evidence\n\n### Cosmic\n\nNo score change since it was listed.\n\n## Verdicts\n\n**ButterCMS.** The Read and Write APIs have a public OpenAPI 3.1 file, Markdown docs and a status page with no incident since October 2025. The Write API is a paid add-on from the $249 plan, capped at 2,000 or 5,000 calls a month. Writes answer 202 with no identifier, and no SDK has had a release since September 2025.\n\n**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.\n\n## Before you call either\n\n### ButterCMS\n\n1. End every path with a slash. A missing slash returns a 301, and the vendor counts the redirect and the retry as two API calls\n2. Send the write token only as `Authorization: Token \u003ctoken\u003e`. The `auth_token` query parameter works for reads only\n3. On page creation send every field key of the page type, with empty strings for fields left blank\n4. A 202 means queued, not saved. Read the entry back with `preview=1` to confirm, and check a slug exists before retrying a create\n5. Call the REST API directly for writes. The JavaScript SDK 3.0.3 has list, retrieve and search methods only\n\n### Cosmic\n\n1. Send only the read key in the Bearer token unless the task needs writes\n2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days\n3. Fix and don't retry on 400; wait and retry on 429\n4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit\n5. Confirm with the user before cosmic_objects_delete, which deletes permanently\n\n## Questions\n\n### Which is better for AI agents, ButterCMS or Cosmic?\n\nCosmic scores 72.5 (BB) on agent readiness against ButterCMS's 51.4 (D), and leads in every scored category.\n\n### Do ButterCMS and Cosmic need an API key?\n\nBoth need an API key.\n\n### Can an agent call ButterCMS and Cosmic without installing anything?\n\nYes. ButterCMS has a hosted endpoint at https://api.buttercms.com/v2 and Cosmic at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/buttercms-vs-cosmic.json, and with the fewest tokens: https://www.anchorterminal.com/compare/buttercms-vs-cosmic.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"buttercms\", \"b\": \"cosmic\"}`. From a terminal: `anchor compare buttercms cosmic`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/buttercms.json and https://www.anchorterminal.com/api/v1/tools/cosmic.json\n\n## Other comparisons with ButterCMS or Cosmic\n\n- [BCMS vs ButterCMS](https://www.anchorterminal.com/compare/bcms-vs-buttercms.md)\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [ButterCMS vs Contentstack](https://www.anchorterminal.com/compare/buttercms-vs-contentstack.md)\n- [ButterCMS vs DatoCMS](https://www.anchorterminal.com/compare/buttercms-vs-datocms.md)\n- [ButterCMS vs Directus](https://www.anchorterminal.com/compare/buttercms-vs-directus.md)\n- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)\n- [ButterCMS vs Ghost](https://www.anchorterminal.com/compare/buttercms-vs-ghost.md)\n- [ButterCMS vs Hygraph](https://www.anchorterminal.com/compare/buttercms-vs-hygraph.md)\n- [ButterCMS vs Kontent.ai](https://www.anchorterminal.com/compare/buttercms-vs-kontent-ai.md)\n- [ButterCMS vs Payload](https://www.anchorterminal.com/compare/buttercms-vs-payload.md)\n- [ButterCMS vs Prismic](https://www.anchorterminal.com/compare/buttercms-vs-prismic.md)\n- [ButterCMS vs Sanity](https://www.anchorterminal.com/compare/buttercms-vs-sanity.md)\n- [ButterCMS vs Storyblok](https://www.anchorterminal.com/compare/buttercms-vs-storyblok.md)\n- [ButterCMS vs Strapi](https://www.anchorterminal.com/compare/buttercms-vs-strapi.md)\n- [ButterCMS vs Webflow](https://www.anchorterminal.com/compare/buttercms-vs-webflow.md)\n- [ButterCMS vs WordPress](https://www.anchorterminal.com/compare/buttercms-vs-wordpress.md)\n- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)\n- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)\n- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)\n- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)\n- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)\n- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)\n- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)\n- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)\n- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)\n- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)\n- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)\n- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "ButterCMS vs Cosmic", "url": "" } ], "description": "Cosmic scores 72.5 (BB) to ButterCMS's 51.4 (D) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "ButterCMS D 51.4", "Cosmic BB 72.5", "scores" ], "h1": "ButterCMS vs Cosmic", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/buttercms-vs-cosmic", "published": "2026-10-01", "section": "tools", "title": "ButterCMS vs Cosmic for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic" }, "tokens": { "markdown": 4500, "slim": 2630 }, "version": 1 }