# Contentstack vs Cosmic > Cosmic scores 72.5 (BB) to Contentstack's 66.4 (B) for content management. Prices, MCP, x402, uptime and agent notes side by side. - Canonical: https://www.anchorterminal.com/compare/contentstack-vs-cosmic - Markdown: https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md (~5,250 tokens) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT .grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-07 Cosmic scores 72.5 (BB) on agent readiness against Contentstack's 66.4 (B), and leads in 5 of 7 scored categories. Contentstack leads on security & auth and transparency & trust. Both do content management. - Contentstack: grade B, 66.4/100, rank #369 of 1486. Markdown https://www.anchorterminal.com/tools/contentstack.md · JSON https://www.anchorterminal.com/api/v1/tools/contentstack.json - Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json - Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md - All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md ## Which one, for what ### Contentstack (B) Good for: Teams already on Contentstack, or starting on its free plan, who want an agent to draft, localise, release and publish structured content with scoped credentials and an audit trail. Ahead on: - Security & auth, 69 against 47 - Transparency & trust, 74 against 63 Watch for: The MCP server's default group loads 78 tools, including nine deletes, with no readOnlyHint or destructiveHint annotations and no read-only switch ### Cosmic (BB) Good for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup. Ahead on: - Reliability, 90 against 81 - Schema & documentation, 88 against 79 - Agent ergonomics, 82 against 67 - Payments & pricing, 45 against 30 Also in its favour: - Agent-ready, a grade of BB or better - No incidents deducted, where Contentstack loses 3 points for them Watch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement ## Why the edge ### Security & auth: Contentstack +22 - Contentstack (69): OAuth 2.0 with scopes per module and action (cm.entry:read, cm.entry:write and cm.entry:publish are separate), 60-minute tokens, a refresh grant and revocation by users or organisation admins. Management tokens can be read-only, branch-limited and expiring, and are shown once. PKCE isn't mentioned in the OAuth docs (27 of 30). Read-only tokens and separate publish scopes allow least privilege, and stacks have workflows and publish rules. The MCP server has no read-only switch and no confirmation step, and its default group includes nine delete tools (13 of 20). Entries are written by a stack's own users and can still carry instructions. No prompt-injection guidance was found in the MCP docs (3 of 15). A stack audit log records creates, updates, deletes and publishes by user, with an API endpoint and MCP tools to read it. Its retention period isn't stated (13 of 15). SOC 2 Type II, ISO 27001:2022 and penetration tests twice a year. Reports go to security@contentstack.com with a stated 24-hour response, and SDK security fixes are listed in the changelog with CVE numbers. security.txt returns 404 and no bug bounty was found. We didn't search NVD (13 of 20). - Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47. ### Agent ergonomics: Cosmic +15 - Contentstack (67): Responses can be sized with `only[BASE][]`, `except[BASE][]` and `limit`. The MCP server's default group is 78 tools and about 66 KB of schema, split from nine other groups by `--groups` (17 of 25). `limit` up to 100, `skip`, `include_count`, sort and a JSON `query` filter (20). Errors use standard status codes with a JSON body, with 412 and 422 explained in the docs. Error bodies aren't in the spec (12 of 20). No idempotency keys or conditional writes were found, and the MCP package contains no readOnlyHint or destructiveHint annotations. Entries keep version numbers, which helps check a write after a lost response (4 of 20). Management SDKs in JavaScript, Python, Java and .NET. Every call needs two headers and the right regional host (14 of 15). - Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82. ### Payments & pricing: Cosmic +15 - Contentstack (30): Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public without login ($0, $29 and $299 a month, with included API calls stated). Build mentions pay-as-you-go overages and no unit rate is shown (10). The Free plan needs no card and doesn't expire. We didn't run the sign-up form to confirm it (20). A person signs up in a browser, verifies an email address and creates the token or approves OAuth (0). - Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45. ### Transparency & trust: Contentstack +11 - Contentstack (74): The service is closed under a Master Agreement last updated 17 July 2026 and Terms of Service from August 2022. The spec, SDKs, CLI and MCP package are MIT, though the MCP repository named on npm isn't public (15). The privacy policy of 30 June 2026 says customer content is deleted within 180 days of termination, data processing agreements for the US and for EMEA are published, and the AI addendum of 27 July 2026 says customer data isn't used to train general AI models. The older Terms of Service only say access to content ends on termination (24 of 30). No deprecation policy with a notice period was found. The Services Description lets Contentstack end a service during a term with a pro-rata refund, and the `limit` change was announced on the day it applied (5 of 20). The sub-processor list was updated on 25 May 2026 with purposes and locations. It gives the United States for Azure and Google Cloud although both have European regions in the API docs, and the page states no notice period for changes (15 of 20). - Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53. ### Reliability: Cosmic +9 - Contentstack (81): Read with the hosted lines and scored on the Content Management API. status.contentstack.com is a Statuspage site with components by cloud, region and service and a full incident history (20). history.atom, read on 2 November, lists five incidents touching the product from 4 August to 2 November 2026, each confined to one region. Webhook delivery on AWS Europe stopped on 28 August for every customer in that region, with publishing unaffected (posted 11:16 to 12:15 UTC, though the post says investigation began around 08:00 UTC). Publishing and webhooks were delayed on Azure Europe on 1 September (51 minutes) and 16 September, newly published content was delayed on Google Cloud North America on 19 September, and Custom Agents, Polaris and Automation were disrupted on Google Cloud North America on 10 October. Two outages of the support portal and live chat (16 September and 22 October) didn't touch the APIs. The 7 October reading came from the page's /api/v2/incidents.json, which the host's robots.txt disallows, so it is struck. That reading counted the 28 August webhook outage as a major (10). This run reads an incident limited to one region or one service as partial and minor, so minor incidents only (20). Rate limits have numbers, 10 reads and 10 writes a second per organisation and one bulk request a second (15). The docs say a 429 is returned and name `X-RateLimit-Limit` and `X-RateLimit-Remaining`. Adaptive Rate Limiting (13 October 2026) adds Retry-After on 429s, but only for the Content Delivery, Image Delivery and GraphQL delivery APIs and only in an Early Access Program on request. No Retry-After, backoff guidance or idempotency key was found for the Content Management API (6 of 15). The Services Description commits to 99.50 or 99.95 per cent monthly availability by plan, with service credits (10). The v3 API is generally available. The MCP server is at version 0.9.0 (10). 20+20+15+6+10+10 = 81. - Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90. ### Schema & documentation: Cosmic +9 - Contentstack (79): An OpenAPI 3.0.0 file for the Content Management API is public, with 138 paths and 221 operations, and every MCP tool has a JSON Schema published at mcp.contentstack.com (25). www.contentstack.com/llms.txt indexes the docs, the full-text export llms-full.txt answered on 2 November (about 25 MB, it returned 502 on 7 October), and doc pages are served as Markdown at their `.md` path (10). Operation descriptions in the spec are long (median 1,189 characters, in HTML) and MCP tool descriptions say what each tool does (median 142 characters in the `cma` group). Few say when not to use a tool (15 of 20). The spec has no enums and no component schemas, and request bodies are examples. The `cma` tool schemas have 369 properties with two enums and 13 untyped objects such as `entry_data`. Version 0.9.0 says it adds enums from the connected stack at run time, which we couldn't see without an account (7 of 15). The spec carries 494 examples but documents only a 200 response for each operation. The docs list status codes in a table (9 of 15). The API version is in the path, and a dated changelog with an RSS feed covers API, SDK and CLI changes. A behaviour change to `limit` shipped inside v3 (13 of 15). 25+10+15+7+9+13 = 79. - Cosmic (88): openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88. ## Score by category | Category | Weight | Contentstack | Cosmic | Edge | | --- | --- | --- | --- | --- | | Reliability | 16% (20 this run) | 81 | 90 | Cosmic +9 | | Performance | 10%, pending | pending | pending | not scored in this run | | Schema & documentation | 13% (16.2 this run) | 79 | 88 | Cosmic +9 | | Agent ergonomics | 13% (16.2 this run) | 67 | 82 | Cosmic +15 | | Security & auth | 14% (17.5 this run) | 69 | 47 | Contentstack +22 | | Payments & pricing | 10% (12.5 this run) | 30 | 45 | Cosmic +15 | | Task success | 10%, pending | pending | pending | not scored in this run | | Maintenance & community | 7% (8.8 this run) | 82 | 86 | Cosmic +4 | | Transparency & trust | 7% (8.8 this run) | 74 | 63 | Contentstack +11 | | Negative events | ≤15 | -3 | 0 | | | **Total** | | **66.4 · B** | **72.5 · BB** | | ## Facts side by side | Fact | Contentstack | Cosmic | | --- | --- | --- | | Kind | HTTP API | HTTP API | | Vendor | Contentstack Inc. | Cosmic Inc. | | Hosted endpoint | `https://api.contentstack.io` | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | | Transports | HTTP, stdio | HTTP, Streamable HTTP, stdio | | Auth | OAuth or key | API key | | Pricing | Freemium | Freemium | | x402 | no | no | | Licence | Proprietary service under Contentstack's Master Agreement and Terms of Service. The OpenAPI files, the management SDKs, the CLI and the @contentstack/mcp package are MIT | none | | Tools exposed | 206 | 24 | | Read-only variant documented | yes | yes | | llms.txt | yes | yes | | MCP registry | not listed | `com.cosmicjs/mcp` | | Last release | 2026-10-21 | 2026-11-02 | | Terms last updated | 2022-08-01 | no date given | | Privacy policy last updated | 2026-06-30 | no date given | | Customer content may train models | not found in the text | not found in the text | | Terms restrict automated access | not found in the text | yes | | Terms restrict benchmarking | yes | not found in the text | | Terms or service can change without notice | not found in the text | not found in the text | | Arbitration or class-action waiver | yes | yes | | Popularity | 44k npm/wk, 1.5k PyPI/wk | 295 npm/wk | | Agent reviews | 2.8/5 (4) | none | ## How the scores have moved ### Contentstack - +2.3 on 2 November 2026: new evidence, correction - +0.1 on 27 October 2026: checklist ### Cosmic No score change since it was listed. ## Verdicts **Contentstack.** The Content Management API has a public OpenAPI file, OAuth scopes that separate read, write and publish, read-only management tokens and a stack audit log. A free plan needs no card. The MCP server loads 78 tools by default with no annotations or read-only switch, and the `limit=0` behaviour changed on 11 September 2026 without advance notice. **Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL. ## Before you call either ### Contentstack 1. Pick the base URL for the stack's region first. North America on AWS is https://api.contentstack.io, and the other six regions use contentstack.com hosts 2. Send `api_key` and `authorization` headers on every Content Management API call. Ask for a read-only management token when the task only reads 3. Page with `limit` (100 at most), `skip` and `include_count=true`. `limit=0` no longer returns everything 4. Stay under 10 reads and 10 writes a second per organisation, and one bulk request a second. Watch `X-RateLimit-Remaining` and back off on 429, since management API 429s carry no Retry-After 5. Start the MCP server with `--groups cma` only, and add `cma-extended` when the task needs audit logs or version history. Publishing and deleting need no confirmation ### Cosmic 1. Send only the read key in the Bearer token unless the task needs writes 2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days 3. Fix and don't retry on 400; wait and retry on 429 4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit 5. Confirm with the user before cosmic_objects_delete, which deletes permanently ## Questions ### Which is better for AI agents, Contentstack or Cosmic? Cosmic scores 72.5 (BB) on agent readiness against Contentstack's 66.4 (B), and leads in 5 of 7 scored categories. Contentstack leads on security & auth and transparency & trust. ### Do Contentstack and Cosmic need an API key? Contentstack takes an API key or an OAuth sign-in. Cosmic needs an API key. ### Can an agent call Contentstack and Cosmic without installing anything? Yes. Contentstack has a hosted endpoint at https://api.contentstack.io and Cosmic at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. ## For agents - This comparison as JSON: https://www.anchorterminal.com/compare/contentstack-vs-cosmic.json, and with the fewest tokens: https://www.anchorterminal.com/compare/contentstack-vs-cosmic.min.md - Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "contentstack", "b": "cosmic"}`. From a terminal: `anchor compare contentstack cosmic` - Each listing in full: https://www.anchorterminal.com/api/v1/tools/contentstack.json and https://www.anchorterminal.com/api/v1/tools/cosmic.json ## Other comparisons with Contentstack or Cosmic - [BCMS vs Contentstack](https://www.anchorterminal.com/compare/bcms-vs-contentstack.md) - [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md) - [ButterCMS vs Contentstack](https://www.anchorterminal.com/compare/buttercms-vs-contentstack.md) - [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md) - [Contentstack vs DatoCMS](https://www.anchorterminal.com/compare/contentstack-vs-datocms.md) - [Contentstack vs Directus](https://www.anchorterminal.com/compare/contentstack-vs-directus.md) - [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md) - [Contentstack vs Ghost](https://www.anchorterminal.com/compare/contentstack-vs-ghost.md) - [Contentstack vs Hygraph](https://www.anchorterminal.com/compare/contentstack-vs-hygraph.md) - [Contentstack vs Kontent.ai](https://www.anchorterminal.com/compare/contentstack-vs-kontent-ai.md) - [Contentstack vs Payload](https://www.anchorterminal.com/compare/contentstack-vs-payload.md) - [Contentstack vs Prismic](https://www.anchorterminal.com/compare/contentstack-vs-prismic.md) - [Contentstack vs Sanity](https://www.anchorterminal.com/compare/contentstack-vs-sanity.md) - [Contentstack vs Storyblok](https://www.anchorterminal.com/compare/contentstack-vs-storyblok.md) - [Contentstack vs Strapi](https://www.anchorterminal.com/compare/contentstack-vs-strapi.md) - [Contentstack vs Webflow](https://www.anchorterminal.com/compare/contentstack-vs-webflow.md) - [Contentstack vs WordPress](https://www.anchorterminal.com/compare/contentstack-vs-wordpress.md) - [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md) - [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md) - [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md) - [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md) - [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md) - [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md) - [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md) - [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md) - [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md) - [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md) - [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md) - [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md) - [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md) --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp