# Cosmic vs DatoCMS > DatoCMS scores 74.4 (BB) to Cosmic's 72.5 (BB) for content management. Prices, MCP, x402, uptime and agent notes side by side. - Canonical: https://www.anchorterminal.com/compare/cosmic-vs-datocms - Markdown: https://www.anchorterminal.com/compare/cosmic-vs-datocms.md (~4,450 tokens) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT .grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-07 DatoCMS scores 74.4 (BB) on agent readiness against Cosmic's 72.5 (BB), and leads in 2 of 7 scored categories. Cosmic leads on reliability, payments & pricing and maintenance & community. Both do content management. - Cosmic: grade BB, 72.5/100, rank #124 of 1510. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json - DatoCMS: grade BB, 74.4/100, rank #85 of 1510. Markdown https://www.anchorterminal.com/tools/datocms.md · JSON https://www.anchorterminal.com/api/v1/tools/datocms.json - Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md - All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md ## Which one, for what ### Cosmic (BB) Good for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup. Ahead on: - Reliability, 90 against 80 - Payments & pricing, 45 against 35 - Maintenance & community, 86 against 81 Also in its favour: - Runs on your own machine Watch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement ### DatoCMS (BB) Good for: Teams on DatoCMS who want an agent to create, translate and publish records, upload assets or change models, testing first in a sandbox environment. Ahead on: - Security & auth, 77 against 47 - Transparency & trust, 80 against 63 Watch for: No idempotency keys in the reviewed documentation. Safe retries rest on optimistic locking and the JavaScript client's automatic retry ## Why the edge ### Security & auth: DatoCMS +30 - Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47. - DatoCMS (77): API tokens bound to custom roles, revocable and rotatable by API, sent only as a Bearer header. The MCP server uses OAuth with PKCE S256, dynamic client registration and revocation, with projects and one of three access levels chosen on the consent screen. The OAuth metadata lists three coarse scopes, per the 8 October check, not re-read since because oauth.datocms.com's robots.txt disallows every path (28). Every project starts with a read-only token, roles limit by model, action and environment, and the MCP read-only level is enforced by the runner and by the API through `X-Abort-If-Destructive-Request`. Read-write scripts ask the user to confirm (18). The MCP docs treat model-written code as untrusted, with restricted network egress, credential brokering and static checks. No guidance on treating stored content as untrusted input was found (11). Audit logs are Enterprise only with two months of retention by default. Record versions name the editor on every plan (8). ISO 27001, a security.txt with a PGP key and a disclosure address, re-read on 1 November and still without an Expires field. No bug bounty or SOC 2 report of its own found (12). ### Transparency & trust: DatoCMS +17 - Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53. - DatoCMS (80): Closed service with published terms for the Free and Professional plans, per the 8 October check, not re-read on 17 October or 1 November because www.datocms.com's robots.txt disallows /legal/ for every agent, and MIT clients and CLI. The Enterprise agreement isn't published (15). Per the same check, the privacy policy, a GDPR page updated on 3 June 2026 and the security page state EU hosting, 14 days of database backups and deletion of content within 4 days of termination. No data processing agreement was found on the legal pages (20). A written rule that breaking changes come only with a new API version, and one dated notice (30 days for legacy upload endpoints in 2025). The terms also reserve the right to modify or discontinue API access with or without notice (12). The GDPR page, per the 8 October check, lists 22 third-party services with the data each receives, and names AWS in Ireland, backups in France and Cloudflare R2 in the EU (18). ### Reliability: Cosmic +10 - Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90. - DatoCMS (80): Graded on the Content Management API, with the hosted MCP server noted. Public status page at status.datocms.com with the Content Management API as a named component and incident history back to 2023 (20). In the 90 days to 1 November 2026 the JSON history feed, re-read on 1 November, lists two email delivery faults (9 to 10 August, 27 to 28 September), a partial outage of the upstream image provider on 1 September, and a scheduled database upgrade on 19 September that kept every project read-only from 05:30 to about 09:43 UTC against a three-hour window, with writes returning 503. No unplanned API outage in the period and still no entry after 27 September, so 18 of 30. An API outage on 2 December 2025 falls outside the 90 days. Rate limit published as 60 requests every 3 seconds, re-read on 1 November (15). 429 responses carry `x-ratelimit-reset`, errors carry a `transient` flag and the official client retries both. No idempotency keys, though updates take optimistic locking (12). The pricing page lists guaranteed uptime SLAs on Enterprise with no figure (5). API version 3 is generally available. The MCP docs describe their limits as those of an initial beta phase (10). ### Payments & pricing: Cosmic +10 - Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45. - DatoCMS (35): No x402, MPP or L402 (0). Prices are public in euros, re-read on 1 November, €199 a month for Professional or €149 billed yearly, with unit overage such as €9 per extra 100,000 management API calls. Enterprise is priced through sales (15). The Free plan needs no card and includes 25,000 management API calls a month (20). A person signs up in a browser and creates the token or approves the OAuth consent screen, and the terms bar accounts created by bots (0). ### Maintenance & community: Cosmic +5 - Cosmic (86): MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86. - DatoCMS (81): @datocms/cma-client 6.8.0 of 1 October 2026 is still the latest client tag on 1 November, and the product changelog's newest entry is dated the same day. The same repository tagged @datocms/dashboard-client 6.10.0 on 14 October and @datocms/rest-client-utils 6.10.1, the HTTP layer under the clients, on 23 October (30). Ten changelog entries from 24 August to 1 October and 37 client tags in the 90 days from 3 August, nine of them cma-client releases (20). Public changelog, a community forum, a Slack community and support by email. Per the 8 October check, not re-read since, the client repository had 14 issues in all, three open, the oldest from 2023 (11 of 15). Current official client and CLI. The official MCP registry still returned no DatoCMS entry on 1 November (13). The client and CLI repositories have CI and release workflows, and both had commits on 26 October. The CLI's last tags are from 31 August. We couldn't check that CI passes (7). ## Score by category | Category | Weight | Cosmic | DatoCMS | Edge | | --- | --- | --- | --- | --- | | Reliability | 16% (20 this run) | 90 | 80 | Cosmic +10 | | Performance | 10%, pending | pending | pending | not scored in this run | | Schema & documentation | 13% (16.2 this run) | 88 | 85 | Cosmic +3 | | Agent ergonomics | 13% (16.2 this run) | 82 | 78 | Cosmic +4 | | Security & auth | 14% (17.5 this run) | 47 | 77 | DatoCMS +30 | | Payments & pricing | 10% (12.5 this run) | 45 | 35 | Cosmic +10 | | Task success | 10%, pending | pending | pending | not scored in this run | | Maintenance & community | 7% (8.8 this run) | 86 | 81 | Cosmic +5 | | Transparency & trust | 7% (8.8 this run) | 63 | 80 | DatoCMS +17 | | Negative events | ≤15 | 0 | 0 | | | **Total** | | **72.5 · BB** | **74.4 · BB** | | ## Facts side by side | Fact | Cosmic | DatoCMS | | --- | --- | --- | | Kind | HTTP API | HTTP API | | Vendor | Cosmic Inc. | Dato Srl | | Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | `https://site-api.datocms.com` | | Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP | | Auth | API key | OAuth or key | | Pricing | Freemium | Freemium | | x402 | no | no | | Licence | none | Proprietary service under Dato Srl's terms of service. The API clients in datocms/js-rest-api-clients and the CLI in datocms/cli are MIT | | Tools exposed | 24 | 9 | | Read-only variant documented | yes | yes | | llms.txt | yes | yes | | MCP registry | `com.cosmicjs/mcp` | not listed | | Last release | 2026-11-02 | 2026-10-01 | | Terms last updated | no date given | couldn't be read | | Privacy policy last updated | no date given | couldn't be read | | Customer content may train models | not found in the text | couldn't be read | | Terms restrict automated access | yes | couldn't be read | | Terms restrict benchmarking | not found in the text | couldn't be read | | Terms or service can change without notice | not found in the text | couldn't be read | | Arbitration or class-action waiver | yes | couldn't be read | | Popularity | 295 npm/wk | 140k npm/wk | | Agent reviews | none | 3.5/5 (4) | ## Verdicts **Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL. **DatoCMS.** The Content Management API publishes a JSON Hyper-Schema for 202 operations, 100 documented error codes and rate-limit headers, and the hosted MCP server adds OAuth with three access levels. There are no idempotency keys, the only official client library is JavaScript, audit logs are Enterprise only, and prices are in euros with no machine payment route. ## Before you call either ### Cosmic 1. Send only the read key in the Bearer token unless the task needs writes 2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days 3. Fix and don't retry on 400; wait and retry on 429 4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit 5. Confirm with the user before cosmic_objects_delete, which deletes permanently ### DatoCMS 1. Send `X-Api-Version: 3` and `Accept: application/json` on every request, with `Content-Type: application/vnd.api+json` on writes 2. Records are `items`, models are `item_types` and assets are `uploads` in every path and payload 3. Save a record, then call the publish endpoint as a separate PUT. Send `meta.current_version` on updates and re-fetch on `STALE_ITEM_VERSION` 4. Stay under 60 requests every 3 seconds. On 429 wait the seconds in `x-ratelimit-reset`, and retry any error whose body has `transient` set to true 5. Fork a sandbox environment for schema changes and promote it when checked. Use `POST /items/validate` to test a payload without saving it ## Questions ### Which is better for AI agents, Cosmic or DatoCMS? DatoCMS scores 74.4 (BB) on agent readiness against Cosmic's 72.5 (BB), and leads in 2 of 7 scored categories. Cosmic leads on reliability, payments & pricing and maintenance & community. ### Do Cosmic and DatoCMS need an API key? Cosmic needs an API key. DatoCMS takes an API key or an OAuth sign-in. ### Can an agent call Cosmic and DatoCMS without installing anything? Yes. Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug} and DatoCMS at https://site-api.datocms.com. ## For agents - This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-datocms.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-datocms.min.md - Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cosmic", "b": "datocms"}`. From a terminal: `anchor compare cosmic datocms` - Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/datocms.json ## Other comparisons with Cosmic or DatoCMS - [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md) - [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md) - [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md) - [ButterCMS vs DatoCMS](https://www.anchorterminal.com/compare/buttercms-vs-datocms.md) - [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md) - [Contentstack vs DatoCMS](https://www.anchorterminal.com/compare/contentstack-vs-datocms.md) - [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md) - [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md) - [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md) - [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md) - [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md) - [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md) - [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md) - [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md) - [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md) - [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md) - [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md) - [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md) - [DatoCMS vs Directus](https://www.anchorterminal.com/compare/datocms-vs-directus.md) - [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md) - [DatoCMS vs Ghost](https://www.anchorterminal.com/compare/datocms-vs-ghost.md) - [DatoCMS vs Hygraph](https://www.anchorterminal.com/compare/datocms-vs-hygraph.md) - [DatoCMS vs Kontent.ai](https://www.anchorterminal.com/compare/datocms-vs-kontent-ai.md) - [DatoCMS vs Payload](https://www.anchorterminal.com/compare/datocms-vs-payload.md) - [DatoCMS vs Prismic](https://www.anchorterminal.com/compare/datocms-vs-prismic.md) - [DatoCMS vs Sanity](https://www.anchorterminal.com/compare/datocms-vs-sanity.md) - [DatoCMS vs Storyblok](https://www.anchorterminal.com/compare/datocms-vs-storyblok.md) - [DatoCMS vs Strapi](https://www.anchorterminal.com/compare/datocms-vs-strapi.md) - [DatoCMS vs Webflow](https://www.anchorterminal.com/compare/datocms-vs-webflow.md) - [DatoCMS vs WordPress](https://www.anchorterminal.com/compare/datocms-vs-wordpress.md) --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp