Cosmic vs Directus

Cosmic 47

Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give read_key as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.

Directus 68

MCP OAuth uses PKCE with dynamic client registration or client ID metadata documents, issues a token with the single mcp:access scope and the MCP endpoint as audience, and lets administrators revoke clients. Static tokens are one per user, don't expire and are stored in plain text. We scored 26 and took 10 because ?access_token= in the URL is a documented option that the MCP guide uses for three clients (16 of 30). Access policies limit a user by collection, action, field and item rule, the MCP server is off by default, and deletes are refused unless Allow Deletes is on. No server-side approval step for other writes (16 of 20). A security guide for MCP covers prompt injection, mixing servers and auto-approval, with advice only (11 of 15). The activity log records user, action, time, IP address, user agent, collection and item, kept 30 days on Core (11 of 15). A disclosure policy with private GitHub reports and a security address, advisories published in public, and SOC 2 Type 2 with a penetration test report on the trust centre. No bug bounty found, and security.txt returns 404 (14 of 20).

Cosmic 45

No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.

Directus 55

Scored with the self-hosted rule, taking prices from the paid options beside the free tier. No x402, MPP or L402 (0). Core is $0, Team is $499 a month on an annual term or $599 monthly, extra seats are $50 each a month, and Directus Cloud hosting is a $99 a month add-on, all public. Enterprise is priced by sales (20). The Core tier is free to self-host with no card and no account, and Cloud has a 14-day trial (20). ADMIN_EMAIL, ADMIN_PASSWORD and ADMIN_TOKEN create the first administrator and a static token at start-up, so the REST route needs no browser. The docs enable the MCP server only through the Studio settings page, so we took 5 off (15 of 20).

Cosmic 82

24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with after, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.

Directus 73

Default mode lists 12 tools, the 11 to 30 band, but each definition carries its whole instruction file, 78,855 bytes in total at v12.5.0, so we scored 10 and added 8 for registry mode, which lists three tools and loads details on demand (18 of 25). limit (default 100), offset, page, fields, filter, search, sort and aggregate, with QUERY_LIMIT_MAX as a server cap (20). One error shape with a machine-readable extensions.code. Missing items answer FORBIDDEN, not 404, by design (17 of 20). Tools set readOnlyHint and destructiveHint, though one items tool covers reads and writes and is marked destructive. No idempotency keys were found in the reviewed documentation (10 of 20). Few required parameters. One official SDK, @directus/sdk for JavaScript and TypeScript (8 of 15).

Cosmic 90

Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.

Directus 82

Read with the local-software lines, since the graded surface is the self-hosted software on the free Core tier. Directus Cloud's status page isn't scored here. Official Docker image directus/directus and npm package directus 12.6.0, with Node.js 26 or later in engines since 12.6.0 and the supported databases listed (20). The Check workflow passed on the 10 most recent runs on main on 8 October, per the 8 October check, not re-read on 1 November, and separate end-to-end and CodeQL workflows exist (25). 339 open issues. The 15 newest carry labels and one to eight comments, but we couldn't read closed counts, and at least 20 advisories were fixed between June and September 2026 (15 of 25). The docs say releases don't follow semantic versioning and any release may break. Breaking changes are listed per version, and 12.1 to 12.6 each had some (7 of 15). Version 12, and the MCP server isn't marked beta (15).

Cosmic 88

openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.

Directus 81

An OpenAPI file ships in @directus/specs with 70 paths, each instance serves its own at /server/specs/oas, and every MCP tool has a typed input schema. The spec's info.version still reads 10 (22 of 25). llms.txt, llms-full.txt and a raw Markdown copy of every docs page (10). Each tool has a one-sentence description and a prompt.md of instructions with worked examples, up to 13 KB for flows, and a system-prompt tool sets conventions (16 of 20). Actions are enums and validation uses strict unions per action, but item data, filters, deep, and field schema and meta are open records (8 of 15). The errors page lists HTTP statuses and error codes with the response shape, and guides show REST, GraphQL and SDK examples side by side (14 of 15). A monthly changelog, release notes and breaking-change pages per major version. REST paths carry no version and releases aren't semantic (11 of 15).