Cosmic vs DatoCMS

Cosmic 47

Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give read_key as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.

DatoCMS 77

API tokens bound to custom roles, revocable and rotatable by API, sent only as a Bearer header. The MCP server uses OAuth with PKCE S256, dynamic client registration and revocation, with projects and one of three access levels chosen on the consent screen. The OAuth metadata lists three coarse scopes, per the 8 October check, not re-read since because oauth.datocms.com's robots.txt disallows every path (28). Every project starts with a read-only token, roles limit by model, action and environment, and the MCP read-only level is enforced by the runner and by the API through X-Abort-If-Destructive-Request. Read-write scripts ask the user to confirm (18). The MCP docs treat model-written code as untrusted, with restricted network egress, credential brokering and static checks. No guidance on treating stored content as untrusted input was found (11). Audit logs are Enterprise only with two months of retention by default. Record versions name the editor on every plan (8). ISO 27001, a security.txt with a PGP key and a disclosure address, re-read on 1 November and still without an Expires field. No bug bounty or SOC 2 report of its own found (12).

Cosmic 63

A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.

DatoCMS 80

Closed service with published terms for the Free and Professional plans, per the 8 October check, not re-read on 17 October or 1 November because www.datocms.com's robots.txt disallows /legal/ for every agent, and MIT clients and CLI. The Enterprise agreement isn't published (15). Per the same check, the privacy policy, a GDPR page updated on 3 June 2026 and the security page state EU hosting, 14 days of database backups and deletion of content within 4 days of termination. No data processing agreement was found on the legal pages (20). A written rule that breaking changes come only with a new API version, and one dated notice (30 days for legacy upload endpoints in 2025). The terms also reserve the right to modify or discontinue API access with or without notice (12). The GDPR page, per the 8 October check, lists 22 third-party services with the data each receives, and names AWS in Ireland, backups in France and Cloudflare R2 in the EU (18).

Cosmic 90

Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.

DatoCMS 80

Graded on the Content Management API, with the hosted MCP server noted. Public status page at status.datocms.com with the Content Management API as a named component and incident history back to 2023 (20). In the 90 days to 1 November 2026 the JSON history feed, re-read on 1 November, lists two email delivery faults (9 to 10 August, 27 to 28 September), a partial outage of the upstream image provider on 1 September, and a scheduled database upgrade on 19 September that kept every project read-only from 05:30 to about 09:43 UTC against a three-hour window, with writes returning 503. No unplanned API outage in the period and still no entry after 27 September, so 18 of 30. An API outage on 2 December 2025 falls outside the 90 days. Rate limit published as 60 requests every 3 seconds, re-read on 1 November (15). 429 responses carry x-ratelimit-reset, errors carry a transient flag and the official client retries both. No idempotency keys, though updates take optimistic locking (12). The pricing page lists guaranteed uptime SLAs on Enterprise with no figure (5). API version 3 is generally available. The MCP docs describe their limits as those of an initial beta phase (10).

Cosmic 45

No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.

DatoCMS 35

No x402, MPP or L402 (0). Prices are public in euros, re-read on 1 November, €199 a month for Professional or €149 billed yearly, with unit overage such as €9 per extra 100,000 management API calls. Enterprise is priced through sales (15). The Free plan needs no card and includes 25,000 management API calls a month (20). A person signs up in a browser and creates the token or approves the OAuth consent screen, and the terms bar accounts created by bots (0).

Cosmic 86

MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.

DatoCMS 81

@datocms/cma-client 6.8.0 of 1 October 2026 is still the latest client tag on 1 November, and the product changelog's newest entry is dated the same day. The same repository tagged @datocms/dashboard-client 6.10.0 on 14 October and @datocms/rest-client-utils 6.10.1, the HTTP layer under the clients, on 23 October (30). Ten changelog entries from 24 August to 1 October and 37 client tags in the 90 days from 3 August, nine of them cma-client releases (20). Public changelog, a community forum, a Slack community and support by email. Per the 8 October check, not re-read since, the client repository had 14 issues in all, three open, the oldest from 2023 (11 of 15). Current official client and CLI. The official MCP registry still returned no DatoCMS entry on 1 November (13). The client and CLI repositories have CI and release workflows, and both had commits on 26 October. The CLI's last tags are from 31 August. We couldn't check that CI passes (7).