Contentstack vs dotCMS

Contentstack 81

Read with the hosted lines and scored on the Content Management API. status.contentstack.com is a Statuspage site with components by cloud, region and service and a full incident history (20). history.atom, read on 2 November, lists five incidents touching the product from 4 August to 2 November 2026, each confined to one region. Webhook delivery on AWS Europe stopped on 28 August for every customer in that region, with publishing unaffected (posted 11:16 to 12:15 UTC, though the post says investigation began around 08:00 UTC). Publishing and webhooks were delayed on Azure Europe on 1 September (51 minutes) and 16 September, newly published content was delayed on Google Cloud North America on 19 September, and Custom Agents, Polaris and Automation were disrupted on Google Cloud North America on 10 October. Two outages of the support portal and live chat (16 September and 22 October) didn't touch the APIs. The 7 October reading came from the page's /api/v2/incidents.json, which the host's robots.txt disallows, so it is struck. That reading counted the 28 August webhook outage as a major (10). This run reads an incident limited to one region or one service as partial and minor, so minor incidents only (20). Rate limits have numbers, 10 reads and 10 writes a second per organisation and one bulk request a second (15). The docs say a 429 is returned and name X-RateLimit-Limit and X-RateLimit-Remaining. Adaptive Rate Limiting (13 October 2026) adds Retry-After on 429s, but only for the Content Delivery, Image Delivery and GraphQL delivery APIs and only in an Early Access Program on request. No Retry-After, backoff guidance or idempotency key was found for the Content Management API (6 of 15). The Services Description commits to 99.50 or 99.95 per cent monthly availability by plan, with service credits (10). The v3 API is generally available. The MCP server is at version 0.9.0 (10). 20+20+15+6+10+10 = 81.

dotCMS 47

Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.

Contentstack 74

The service is closed under a Master Agreement last updated 17 July 2026 and Terms of Service from August 2022. The spec, SDKs, CLI and MCP package are MIT, though the MCP repository named on npm isn't public (15). The privacy policy of 30 June 2026 says customer content is deleted within 180 days of termination, data processing agreements for the US and for EMEA are published, and the AI addendum of 27 July 2026 says customer data isn't used to train general AI models. The older Terms of Service only say access to content ends on termination (24 of 30). No deprecation policy with a notice period was found. The Services Description lets Contentstack end a service during a term with a pro-rata refund, and the limit change was announced on the day it applied (5 of 20). The sub-processor list was updated on 25 May 2026 with purposes and locations. It gives the United States for Azure and Google Cloud although both have European regions in the API docs, and the page states no notice period for changes (15 of 20).

dotCMS 54

dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.

Contentstack 79

An OpenAPI 3.0.0 file for the Content Management API is public, with 138 paths and 221 operations, and every MCP tool has a JSON Schema published at mcp.contentstack.com (25). www.contentstack.com/llms.txt indexes the docs, the full-text export llms-full.txt answered on 2 November (about 25 MB, it returned 502 on 7 October), and doc pages are served as Markdown at their .md path (10). Operation descriptions in the spec are long (median 1,189 characters, in HTML) and MCP tool descriptions say what each tool does (median 142 characters in the cma group). Few say when not to use a tool (15 of 20). The spec has no enums and no component schemas, and request bodies are examples. The cma tool schemas have 369 properties with two enums and 13 untyped objects such as entry_data. Version 0.9.0 says it adds enums from the connected stack at run time, which we couldn't see without an account (7 of 15). The spec carries 494 examples but documents only a 200 response for each operation. The docs list status codes in a table (9 of 15). The API version is in the path, and a dated changelog with an RSS feed covers API, SDK and CLI changes. A behaviour change to limit shipped inside v3 (13 of 15). 25+10+15+7+9+13 = 79.

dotCMS 65

The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.

Contentstack 82

The changelog's newest entry is 30 October 2026 (Polaris in the Visual Editor), after CLI 2.0.2 and 1.69.0 on 21 October with bug fixes, and the JavaScript management SDK 1.31.2 (changelog 22 September, tag 5 October) only resolved dependency vulnerabilities (30). Dated entries from 4 August to 2 November include the limit change on 11 September, recursive embedded items on 7 September, Adaptive Rate Limiting on 13 October, Java management SDK 1.13.1, 1.14.0 and 1.14.1 (17, 24 and 31 August) and Python management SDK 1.11.2 (10 August) (20). Closed service with a public changelog and RSS feed, email support and a Discord community. We didn't test a support channel (10 of 15). Official management SDKs in four languages, all with releases since 27 July 2026. The MCP server isn't in the official MCP registry (15). The JavaScript SDK repository has unit-test, CodeQL and dependency-scan workflows, and its changelog shows regular dependency fixes. We didn't see the CI results (7 of 10). 30+20+10+15+7 = 82.

dotCMS 75

dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.

Contentstack 69

OAuth 2.0 with scopes per module and action (cm.entry:read, cm.entry:write and cm.entry:publish are separate), 60-minute tokens, a refresh grant and revocation by users or organisation admins. Management tokens can be read-only, branch-limited and expiring, and are shown once. PKCE isn't mentioned in the OAuth docs (27 of 30). Read-only tokens and separate publish scopes allow least privilege, and stacks have workflows and publish rules. The MCP server has no read-only switch and no confirmation step, and its default group includes nine delete tools (13 of 20). Entries are written by a stack's own users and can still carry instructions. No prompt-injection guidance was found in the MCP docs (3 of 15). A stack audit log records creates, updates, deletes and publishes by user, with an API endpoint and MCP tools to read it. Its retention period isn't stated (13 of 15). SOC 2 Type II, ISO 27001:2022 and penetration tests twice a year. Reports go to security@contentstack.com with a stated 24-hour response, and SDK security fixes are listed in the changelog with CVE numbers. security.txt returns 404 and no bug bounty was found. We didn't search NVD (13 of 20).

dotCMS 63

JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.

Contentstack 30

Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public without login ($0, $29 and $299 a month, with included API calls stated). Build mentions pay-as-you-go overages and no unit rate is shown (10). The Free plan needs no card and doesn't expire. We didn't run the sign-up form to confirm it (20). A person signs up in a browser, verifies an email address and creates the token or approves OAuth (0).

dotCMS 35

Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.