ButterCMS vs dotCMS

ButterCMS 17

No dated API changelog was found, and no dated API change in the docs. The docs sitemap's page dates record no change, so they don't set recency. The newest SDK release across the ten official SDKs is buttercms 3.0.3 on 4 September 2025 (Python 2.1.1 on 7 May 2024, .NET 2.1.1 on 16 April 2025, the others older), more than 180 days ago (0 of 30). No three releases or dated changelog entries in 90 days (0). Support by chat and email, a knowledge base and public SDK repositories, with no public changelog (5 of 15). Ten official SDKs are listed and none has a release in the last year (7 of 15, a partial kept). The JavaScript SDK has test and release workflows and moved to trusted publishing in November 2025, with no commits in the last 90 days (5 of 10).

dotCMS 75

dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.

ButterCMS 82

Graded on the hosted Read and Write APIs. Public status page on Atlassian Statuspage with CDN, API and Login Page components and a history feed (20). The feed's newest incidents are two on 20 October 2025, so the 90 days to 4 November 2026 are clean (30). Limits are published as monthly quotas by plan, from 50,000 calls on Free to 1M on Professional, with 2,000 or 5,000 write calls on the add-on. No per-second limit is published (10 of 15, a partial kept from the 9 October check). Free and trial accounts get a 429 that the docs say may carry Retry-After, the docs show exponential backoff for 5xx errors, and the bulk-operations page says to check whether content exists before creating it to avoid duplicates during retries. There are no idempotency keys, so safe-retry guidance without keys (12). The pricing page lists an SLA on Enterprise with no SLA document or figure, which this run reads as 0. The v2 API is generally available (10).

dotCMS 47

Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.

ButterCMS 31

One read token and one write token per account, with no scopes, and the docs say rotation is done by contacting support (20 for plain revocable keys, less the fixed 10 because the read token is documented as an auth_token query parameter, 10 of 30). That token also returns drafts with preview=1. The read token is a read-only credential and writes default to draft. No approval step for API writes was found, and approval workflows are listed on Enterprise (10 of 20). The API returns stored content, and no guidance on treating it as untrusted input was found (3 of 15). Audit logs and access logs are listed as Enterprise functions, and versions record who saved them (6 of 15). A responsible-disclosure section in the docs gives security@buttercms.com and says reports get a prompt response, with no stated time, and the security page describes penetration tests. No security.txt, no bug bounty, and the certifications listed are those of the AWS and Heroku data centres (7 of 20).

dotCMS 63

JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.

ButterCMS 20

No x402, MPP or L402 (0). Four plans have public dollar prices, the Write API add-on's price is not published and Enterprise is through sales (10). The Free plan needs no card and covers the Read API. Writing needs a paid plan and the add-on, and we did not establish whether the 14-day trial includes it (10 of 20). A person signs up in a browser, and the write token needs a purchase or a request to support (0).

dotCMS 35

Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.

ButterCMS 78

Public OpenAPI 3.1 files for the whole API, the Read API, the Write API and webhooks, linked from the docs index. The combined file has 28 operations on 4 November 2026, 18 reads and 10 writes (25). A docs llms.txt and a Markdown copy of every docs page (10). All operations have a description, and the write descriptions state field rules, defaults and what the API cannot do. The docs say when to use an SDK and when to call REST (16 of 20). Request bodies have required fields and 40 enums in the combined file, but the fields object depends on each account's page types and no endpoint returns those types (9 of 15). 328 examples in the combined file and a page of status codes with causes and sample bodies (13 of 15). The version is in the /v2 path. No API changelog was found (5 of 15).

dotCMS 65

The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.