{ "data": { "a": { "slug": "cosmic", "name": "Cosmic", "vendor": "Cosmic Inc.", "vendorUrl": "https://www.cosmicjs.com", "kind": "http-api", "category": "cms", "summary": "Cosmic is a hosted headless CMS with a REST API, a TypeScript SDK, a CLI and a hosted MCP server. Agents read and write objects, media and object types, generate media, and can create a project by agent signup.", "url": "https://www.anchorterminal.com/tools/cosmic", "markdownUrl": "https://www.anchorterminal.com/tools/cosmic.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cosmic.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cosmic.json", "dns": "cosmic.grade.anchorterminal.com", "repo": "https://github.com/cosmicjs/mcp", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "packages": [ { "registry": "npm", "name": "@cosmicjs/mcp" }, { "registry": "npm", "name": "@cosmicjs/sdk" }, { "registry": "npm", "name": "@cosmicjs/cli" } ], "auth": "api-key", "authNotes": "Each bucket has a read key and a write key, rotatable independently. The hosted MCP server takes `Authorization: Bearer READ_KEY` for read-only tools or `READ_KEY:WRITE_KEY` for full access; the write key can also go in `X-Cosmic-Write-Key`. The REST API takes the read key as `read_key` in the query or as a Bearer token on GET. POST /v3/agents/sign-up on dapi.cosmicjs.com needs no authentication and returns bucket keys for a new unclaimed project tied to a human's email.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 1 bucket, 10,000 objects and 250,000 non-cached API requests a month, no card. Builder $99 a month, Team $299, Business $499, Small Workspace $999 and Large Workspace $2,999, with 10 per cent off yearly; Enterprise by quote. Webhooks, localisation and revision history are paid add-ons. Workspace plans have a 30-day trial.", "priceSummary": "$99 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the OpenAPI spec, the MCP docs or pricing.md (checked 2026-11-06). An unclaimed or over-limit bucket returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 24, "popularity": { "githubStars": null, "npmWeekly": 295, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.cosmicjs.com/docs", "llmsTxt": "https://www.cosmicjs.com/llms.txt", "openapi": "https://www.cosmicjs.com/openapi.json", "registryName": "com.cosmicjs/mcp", "capabilities": [ "cms.content", "cms.assets", "cms.schema", "cms.publish", "cms.localisation" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "mcp-registry", "openapi", "llms-txt", "free-tier", "no-card", "status-page", "webhooks", "typescript", "cli", "closed-source" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 72.5, "grade": "BB", "agentReady": true, "rank": 124, "ranked": true, "rankOf": 1510, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "bestFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "strengths": [ "Agent signup API provisions a project and bucket with keys, idempotent per email and agent", "24 MCP tools with readOnlyHint and destructiveHint, and descriptions that say when to use each", "Leaving out the write key gives read-only MCP access", "OpenAPI spec, llms.txt and Markdown docs with an error model and per-code retry guidance", "Free plan with no card and published prices and quotas for every paid plan" ], "weaknesses": [ "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement", "The REST API accepts the read key as a URL query parameter", "Revision history, webhooks and localisation are paid add-ons", "The OpenAPI spec covers 21 operations, fewer than the documented API", "Data is kept indefinitely unless deletion is requested" ], "agentNotes": [ "Send only the read key in the Bearer token unless the task needs writes", "Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days", "Fix and don't retry on 400; wait and retry on 429", "Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit", "Confirm with the user before cosmic_objects_delete, which deletes permanently" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.5 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 53 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @cosmicjs/mcp", "http": "curl -X POST https://dapi.cosmicjs.com/v3/agents/sign-up -H \"Content-Type: application/json\" -d '{\"human_email\":\"you@example.com\",\"project_name\":\"Recipe Blog\",\"agent_id\":\"my-agent\"}'", "config": { "mcpServers": { "cosmic": { "headers": { "Authorization": "Bearer your-read-key:your-write-key" }, "url": "https://mcp.cosmicjs.com/v1/buckets/your-bucket-slug" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/cosmic" }, "area": "business", "unitPrices": [ { "item": "Builder plan", "unit": "month", "usd": 99, "note": "3 buckets, 50,000 objects, 1 million non-cached requests; $89 a month yearly" }, { "item": "Team plan", "unit": "month", "usd": 299, "note": "5 buckets, 100,000 objects, 2 million non-cached requests" }, { "item": "Business plan", "unit": "month", "usd": 499, "note": "10 buckets, 250,000 objects, 5 million non-cached requests" } ], "provenance": { "legalEntity": "Cosmic Inc.", "domain": "cosmicjs.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.cosmicjs.com/terms-of-service", "privacy": "https://www.cosmicjs.com/privacy-policy", "statusPage": "https://cosmicstatus.com", "changelog": "https://www.cosmicjs.com/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy were last updated on 13 January 2025 and name Cosmic JS at 3208 Bonniebrook Dr, Plano, Texas. The MCP server's licence names Cosmic Inc.", "The terms forbid using a robot or spider to copy or scrape the website without written permission; recorded as a fact. www.cosmicjs.com/robots.txt allows all crawlers, including ClaudeBot, except /api/, /search, /community/members/ and /v3/.", "www.cosmicjs.com/.well-known/security.txt returned 404. The security page asks for vulnerability reports at support@cosmicjs.com.", "cosmicstatus.com redirects to a Statuspage at cosmicjs.statuspage.io with API and Web Dashboard components." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cosmic.json", "live": { "slug": "cosmic", "probe": { "target": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "method": "get", "lastAt": "2026-11-07T22:55:52.753055078Z", "lastOk": true, "lastStatus": 401, "lastMs": 506, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 456, "p95ms24h": 541, "samples24h": 244, "samples30d": 246, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 233, "ok": 233 } ] }, "vendorStatus": { "page": "https://cosmicstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:35.290408052Z" }, "versions": [ { "registry": "github", "name": "cosmicjs/mcp", "version": "v1.7.1", "released": "2026-11-02", "seenAt": "2026-11-06T23:17:54.958583794Z" }, { "registry": "mcp-registry", "name": "com.cosmicjs/mcp", "version": "1.6.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@cosmicjs/cli", "version": "1.12.0", "seenAt": "2026-11-06T23:17:52.953736128Z" }, { "registry": "npm", "name": "@cosmicjs/mcp", "version": "1.7.1", "seenAt": "2026-11-06T23:17:50.755872442Z" }, { "registry": "npm", "name": "@cosmicjs/sdk", "version": "2.4.0", "seenAt": "2026-11-06T23:17:51.562341268Z" } ], "githubStars": 1, "npmWeekly": 295, "securityTxt": { "url": "https://cosmicjs.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:42.91283778Z" }, "llmsTxt": { "url": "https://www.cosmicjs.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:12.321724133Z" }, "pages": [ { "url": "https://www.cosmicjs.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:27:27.310794511Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3e45613abe99" }, { "url": "https://www.cosmicjs.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:27:31.923491628Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d4aa3db9a89b" }, { "url": "https://www.cosmicjs.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:27:35.902981274Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3c4a26f1901" } ], "updatedAt": "2026-11-07T22:55:52.753055078Z" } }, "answer": "Cosmic scores 72.5 (BB) on agent readiness against Directus's 58.1 (C), and leads in 4 of 7 scored categories. Directus leads on security \u0026 auth and payments \u0026 pricing.", "b": { "slug": "directus", "name": "Directus", "vendor": "Monospace Inc. (Directus)", "vendorUrl": "https://directus.com", "kind": "http-api", "category": "cms", "summary": "Directus is a source-available headless CMS and data platform that runs on an SQL database, self-hosted or on a paid cloud. Agents manage items, files and the data model through REST, GraphQL and a built-in MCP server.", "url": "https://www.anchorterminal.com/tools/directus", "markdownUrl": "https://www.anchorterminal.com/tools/directus.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/directus.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/directus.json", "dns": "directus.grade.anchorterminal.com", "repo": "https://github.com/directus/directus", "license": "MSCL-1.0-GPL (Monospace Sustainable Core Licence 1.0), source-available with a licence key for paid tiers, each version converting to GPL-3.0 after four years. `@directus/sdk` is MIT", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "directus" }, { "registry": "npm", "name": "@directus/sdk" }, { "registry": "npm", "name": "@directus/specs" } ], "auth": "mixed", "authNotes": "Self-serve on your own instance, with no app review or partner approval. The MCP server at `/mcp` accepts OAuth (PKCE, with dynamic client registration or client ID metadata documents, both off by default) and issues a token with the `mcp:access` scope that works only on the MCP endpoint. REST, GraphQL and MCP also accept a static token, one per user, which doesn't expire and is sent as `Authorization: Bearer` or as `?access_token=` in the URL. Log-in tokens are short-lived with a refresh token. Every credential acts with its user's access policies, down to collection, action, field and item rule.", "pricing": "freemium", "pricingNotes": "The Core tier is free to self-host with 3 Studio seats, 25 collections and 5 flows, with no card, account or contract, so an agent can start at once. Team is $499 a month on an annual term or $599 monthly with 10 SSO seats, 50 collections and 20 flows, and Enterprise is priced by sales. Directus Cloud hosting adds $89 a month billed yearly or $99 monthly on Core and Team, with a 14-day trial. The Open Innovation Grant lifts the limits for organisations under $5M revenue and 50 employees (checked 2026-11-01).", "priceSummary": "$499 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs index, the pricing page or the repository's MCP source (checked 2026-10-08).", "endpoints": [] }, "toolCount": 12, "popularity": { "githubStars": 38295, "npmWeekly": 22588, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://directus.com/docs", "llmsTxt": "https://directus.com/docs/llms.txt", "openapi": "https://github.com/directus/directus/blob/main/packages/specs/src/openapi.yaml", "capabilities": [ "cms.content", "cms.schema", "cms.assets", "cms.publish", "cms.localisation" ], "tags": [ "source-available", "self-hosted", "hosted", "mcp", "oauth", "openapi", "llms-txt", "graphql", "typescript", "sql", "status-page", "soc2" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 58.1, "grade": "C", "agentReady": false, "rank": 762, "ranked": true, "rankOf": 1510, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 86, "payments": 55, "reliability": 82, "schema": 81, "security": 68, "transparency": 62 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -15, "negativeNotes": [ "Directus publishes its own advisories on GitHub. OSV lists 19 published between 13 November 2025 and 20 July 2026, all fixed in released versions, 8 rated High (six on 4 April 2026, among them path traversal in the file API, GHSA-393c-p46r-7c95, and a TUS upload authorisation bypass, GHSA-qqmv-5p3g-px89, and two on 20 July, among them an unsegmented cache key, GHSA-c6w9-5g5j-jh2p) and 11 Moderate. The 8 October check also read on GitHub at least 20 advisories published between 24 June and 2 September 2026, at least 11 High and one critical (GHSA-97xr-jchp-xm3c, 5 August, WebSocket item access after a failed authentication message, fixed in 12.1.0). Counted per advisory, 1 for each fixed High or Moderate more than two months old, the OSV list alone gives 19, held at the 15-point limit. The 8 October check grouped them at 6. https://api.osv.dev/v1/query ; https://github.com/directus/directus/security/advisories" ], "verdict": "The built-in MCP server runs under the connecting user's permissions, supports OAuth limited to the MCP endpoint and refuses deletes unless an administrator allows them. A licence check caps the free Core tier at 3 seats, 25 collections and 5 flows, and Directus published more than 30 security advisories in the past year.", "bestFor": "Teams that already keep content in an SQL database and want an agent to edit items, files and the data model under a named user's permissions.", "strengths": [ "MCP OAuth with PKCE issues tokens with the `mcp:access` scope and the MCP endpoint as audience, and administrators can revoke registered clients", "Deletes through MCP are refused unless the Allow Deletes setting is on, and the MCP server itself is off by default", "Registry mode at `/mcp?tool_mode=registry` cuts the tool list to `search`, `execute` and `schema`", "Content versioning has REST endpoints to save, compare and promote a version, and revisions record each change", "Seven tagged releases between 18 August and 27 October 2026, with breaking changes listed per version in the docs" ], "weaknesses": [ "Version 12 (10 June 2026) added licence enforcement. The free Core tier allows 3 Studio seats, 25 collections and 5 flows, and an instance over its limits is locked after a grace period", "The licence is MSCL-1.0-GPL, source-available and not OSI approved, with a ban on competing use and on bypassing the licence key", "Static tokens never expire, are stored in plain text in `directus_users`, and the MCP guide shows them in the URL as `?access_token=`", "Releases don't follow semantic versioning, and 12.1 to 12.6 each carried breaking changes", "More than 30 security advisories published in the 12 months to November 2026, at least 18 of them rated High or critical" ], "agentNotes": [ "Connect with OAuth or an `Authorization: Bearer` header. Don't put the token in the URL as `?access_token=`, where it can be logged", "Use `/mcp?tool_mode=registry` when the client loads every tool definition. Default mode sends each tool's full instructions, about 79 KB in total", "Read the `schema` tool before writing. Item payloads are untyped objects, so field names and types come only from the data model", "Publish a version with `POST /versions/{id}/promote` over REST. The MCP `items` tool refuses system collections such as `directus_versions`", "Count translation and junction tables against the 25-collection Core limit before creating collections" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 2.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.1 } ], "editorialScores": { "ergonomics": 73, "maintenance": 86, "payments": 55, "reliability": 82, "schema": 81, "security": 68, "transparency": 55 }, "provenanceScore": 68, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @directus/sdk", "claudeCode": "claude mcp add --transport http directus https://your-directus-url.com/mcp", "config": { "mcpServers": { "directus": { "headers": { "Authorization": "Bearer your-generated-token" }, "url": "https://your-directus-url.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/directus" }, "area": "business", "unitPrices": [ { "item": "Core, self-hosted", "unit": "month", "usd": 0, "note": "3 Studio seats, 25 collections, 5 flows" }, { "item": "Team", "unit": "month", "usd": 499, "note": "annual term, or $599 billed monthly. 10 seats, 50 collections, 20 flows" }, { "item": "Team extra seat", "unit": "seat-month", "usd": 50, "note": "Studio users only" }, { "item": "Directus Cloud hosting add-on", "unit": "month", "usd": 99, "note": "$89 a month billed yearly, $99 monthly, for Core and Team" } ], "provenance": { "legalEntity": "Monospace Inc. (doing business as Directus)", "domain": "directus.com", "domainRegistered": "1997-02-06", "endpointOnVendorDomain": false, "terms": "https://directus.com/license", "privacy": "https://directus.com/privacy", "statusPage": "https://status.directus.cloud", "changelog": "https://github.com/directus/directus/releases", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The privacy policy (last updated 9 June 2026) names Monospace Inc., doing business as Directus, a Delaware corporation, at 223 Bedford Ave STE A #855, Brooklyn, New York. The terms page, dated 28 April 2025, gives the same entity.", "`terms` points at the MSCL-1.0-GPL licence text, which governs a self-hosted install. directus.com/terms reads as website terms of use, and Directus Cloud has separate Cloud policies at directus.com/cloud-policies.", "The privacy policy says personal information processed for customers of the product is handled under customer agreements, not the policy. No public DPA was found.", "A self-hosted install answers on its owner's domain. It contacts licensing.directus.com when a licence key is set and, since 12.6.0, telemetry.directus.com for usage reports (telemetry.directus.io before).", "https://directus.com/.well-known/security.txt returned 404 on 8 October and 1 November 2026. directus.io redirects to directus.com.", "RDAP for directus.com gives a registration date of 1997-02-06, which predates the company's use of the domain.", "The status page runs on Statuspage and covers Directus Cloud regions and the dashboard, not self-hosted installs." ], "score": 68 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/directus.json", "live": { "slug": "directus", "vendorStatus": { "page": "https://status.directus.cloud", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T22:56:52.158907515Z" }, "versions": [ { "registry": "github", "name": "directus/directus", "version": "v12.6.1", "released": "2026-11-04", "seenAt": "2026-11-06T23:21:39.285498358Z" }, { "registry": "npm", "name": "@directus/sdk", "version": "27.1.0", "seenAt": "2026-11-06T23:21:37.036479777Z" }, { "registry": "npm", "name": "@directus/specs", "version": "16.0.0", "seenAt": "2026-11-06T23:21:37.221743318Z" }, { "registry": "npm", "name": "directus", "version": "12.6.1", "seenAt": "2026-11-06T23:21:31.006643999Z" } ], "githubStars": 38674, "npmWeekly": 34551, "securityTxt": { "url": "https://directus.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:42.3191585Z" }, "llmsTxt": { "url": "https://directus.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:17.996845291Z" }, "domain": { "domain": "directus.com", "registered": "1997-02-06", "source": "https://rdap.verisign.com/com/v1/domain/directus.com", "checkedAt": "2026-11-01T14:14:09.125793328Z" }, "pages": [ { "url": "https://directus.com/docs/releases/breaking-changes/version-12", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:04:50.68273308Z", "changedAt": "2026-11-06T13:27:20.765253652Z", "fingerprint": "a9e62fddd0f7" }, { "url": "https://directus.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:04:55.013379319Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "316eed4e388b" }, { "url": "https://directus.com/license", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:04:52.783466902Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "665a299857ad" } ], "github": { "repo": "directus/directus", "checkedAt": "2026-11-02T08:44:28.302940541Z", "stars": 38785, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T16:49:43Z", "openIssues": 302, "openPRs": 59, "issuesOpened90d": 100, "issuesClosed90d": 153, "prsMerged90d": 180, "ci": { "branch": "main", "runs": 50, "success": 37, "failure": 8, "other": 5, "latest": "success", "latestAt": "2026-10-30T11:04:43Z" }, "advisories": [ { "ghsa": "GHSA-jvxj-w2qp-5vmx", "severity": "medium", "published": "2026-10-30T15:11:35Z" }, { "ghsa": "GHSA-95f8-mvw7-gpj9", "severity": "medium", "published": "2026-10-30T15:00:21Z" }, { "ghsa": "GHSA-32cw-mf7w-gpqr", "severity": "high", "published": "2026-10-30T14:50:56Z" }, { "ghsa": "GHSA-xf86-hfpm-92xr", "severity": "low", "published": "2026-10-19T20:37:26Z" }, { "ghsa": "GHSA-2xcm-7h22-3m66", "severity": "medium", "published": "2026-10-19T19:24:53Z" }, { "ghsa": "GHSA-8xp8-xrh2-88vr", "severity": "medium", "published": "2026-09-02T15:07:13Z" }, { "ghsa": "GHSA-7h45-q5jx-7r87", "severity": "medium", "published": "2026-09-02T15:02:48Z" }, { "ghsa": "GHSA-gwvv-rr68-cmv6", "severity": "high", "published": "2026-08-20T16:44:55Z" }, { "ghsa": "GHSA-4jw7-6mqj-vrhq", "severity": "high", "published": "2026-08-20T16:30:17Z" }, { "ghsa": "GHSA-7vcx-mhxq-9j96", "severity": "high", "published": "2026-08-20T16:17:22Z" }, { "ghsa": "GHSA-r9xq-xp38-j4j3", "severity": "medium", "published": "2026-08-20T16:05:34Z" }, { "ghsa": "GHSA-fq27-7m2r-q6vm", "severity": "medium", "published": "2026-08-20T15:52:55Z" }, { "ghsa": "GHSA-3742-46gx-c8cc", "severity": "high", "published": "2026-08-05T16:36:32Z" }, { "ghsa": "GHSA-xw72-c69j-h2rj", "severity": "high", "published": "2026-08-05T16:27:16Z" }, { "ghsa": "GHSA-6hpw-rhhq-6xq3", "severity": "medium", "published": "2026-08-05T16:15:09Z" }, { "ghsa": "GHSA-mww8-4gwh-rjfw", "severity": "high", "published": "2026-08-05T16:09:04Z" }, { "ghsa": "GHSA-5h38-6755-g83w", "severity": "medium", "published": "2026-08-05T15:58:01Z" }, { "ghsa": "GHSA-p623-wgx3-wxp8", "severity": "medium", "published": "2026-08-05T15:43:00Z" }, { "ghsa": "GHSA-788p-cvgf-q973", "severity": "medium", "published": "2026-08-05T15:24:54Z" }, { "ghsa": "GHSA-xjxq-pj7h-g676", "severity": "high", "published": "2026-08-05T15:13:43Z" }, { "ghsa": "GHSA-ff8w-8crv-9rcf", "severity": "medium", "published": "2026-08-05T14:59:23Z" }, { "ghsa": "GHSA-chfm-g7r3-vv42", "cve": "CVE-2026-10716", "severity": "high", "published": "2026-08-05T14:49:54Z" }, { "ghsa": "GHSA-g293-vf99-xv36", "severity": "high", "published": "2026-08-05T14:37:34Z" }, { "ghsa": "GHSA-97xr-jchp-xm3c", "severity": "critical", "published": "2026-08-05T14:10:57Z" }, { "ghsa": "GHSA-c6w9-5g5j-jh2p", "cve": "CVE-2026-61836", "severity": "high", "published": "2026-06-24T16:40:53Z" }, { "ghsa": "GHSA-j5h6-vqc3-phqh", "cve": "CVE-2026-61835", "severity": "high", "published": "2026-06-24T16:35:02Z" }, { "ghsa": "GHSA-38hg-ww64-rrwc", "cve": "CVE-2026-35442", "severity": "high", "published": "2026-04-02T16:44:49Z" }, { "ghsa": "GHSA-ph52-67fq-75wj", "cve": "CVE-2026-35441", "severity": "medium", "published": "2026-04-02T16:44:31Z" }, { "ghsa": "GHSA-6q22-g298-grjh", "cve": "CVE-2026-35441", "severity": "high", "published": "2026-04-02T16:44:26Z" }, { "ghsa": "GHSA-mvv8-v4jj-g47j", "cve": "CVE-2026-39943", "severity": "medium", "published": "2026-04-02T16:31:52Z" }, { "ghsa": "GHSA-qqmv-5p3g-px89", "cve": "CVE-2026-35412", "severity": "high", "published": "2026-04-02T16:27:03Z" }, { "ghsa": "GHSA-wv3h-5fx7-966h", "cve": "CVE-2026-35409", "severity": "high", "published": "2026-04-02T16:26:22Z" }, { "ghsa": "GHSA-wxwm-3fxv-mrvx", "cve": "CVE-2026-35413", "severity": "medium", "published": "2026-04-02T16:26:04Z" }, { "ghsa": "GHSA-cf45-hxwj-4cfj", "cve": "CVE-2026-35410", "severity": "medium", "published": "2026-04-02T16:18:19Z" }, { "ghsa": "GHSA-q75c-4gmv-mg9x", "cve": "CVE-2026-35411", "severity": "medium", "published": "2026-04-02T16:18:03Z" }, { "ghsa": "GHSA-393c-p46r-7c95", "cve": "CVE-2026-39942", "severity": "high", "published": "2026-04-02T16:03:30Z" }, { "ghsa": "GHSA-8m32-p958-jg99", "cve": "CVE-2026-35408", "severity": "high", "published": "2026-04-02T16:01:08Z" }, { "ghsa": "GHSA-jr94-gj3h-c8rf", "cve": "CVE-2026-26185", "severity": "medium", "published": "2026-02-12T16:47:36Z" }, { "ghsa": "GHSA-3573-4c68-g8cc", "cve": "CVE-2026-22032", "severity": "medium", "published": "2026-01-06T18:55:01Z" }, { "ghsa": "GHSA-cph6-524f-3hgr", "cve": "CVE-2025-64749", "severity": "medium", "published": "2025-11-13T15:00:02Z" }, { "ghsa": "GHSA-8jpw-gpr4-8cmh", "cve": "CVE-2025-64748", "severity": "medium", "published": "2025-11-13T14:59:18Z" }, { "ghsa": "GHSA-vv2v-pw69-8crf", "cve": "CVE-2025-64747", "severity": "medium", "published": "2025-11-13T14:49:53Z" }, { "ghsa": "GHSA-9x5g-62gj-wqf2", "cve": "CVE-2025-64746", "severity": "medium", "published": "2025-11-13T14:48:27Z" }, { "ghsa": "GHSA-mv33-9f6j-pfmc", "cve": "CVE-2025-55746", "severity": "critical", "published": "2025-08-20T06:38:22Z" }, { "ghsa": "GHSA-7cvf-pxgp-42fc", "cve": "CVE-2025-53889", "severity": "medium", "published": "2025-07-14T18:38:08Z" }, { "ghsa": "GHSA-rmjh-cf9q-pv7q", "cve": "CVE-2025-53887", "severity": "medium", "published": "2025-07-14T16:23:03Z" }, { "ghsa": "GHSA-f24x-rm6g-3w5v", "cve": "CVE-2025-53886", "severity": "medium", "published": "2025-07-14T16:12:20Z" }, { "ghsa": "GHSA-x3vm-88hf-gpxp", "cve": "CVE-2025-53885", "severity": "medium", "published": "2025-07-14T15:48:10Z" }, { "ghsa": "GHSA-fm3h-p9wm-h74h", "cve": "CVE-2025-30353", "severity": "high", "published": "2025-03-26T15:20:25Z" }, { "ghsa": "GHSA-7wq3-jr35-275c", "cve": "CVE-2025-30352", "severity": "medium", "published": "2025-03-26T15:04:58Z" }, { "ghsa": "GHSA-56p6-qw3c-fq2g", "cve": "CVE-2025-30351", "severity": "low", "published": "2025-03-26T14:56:51Z" }, { "ghsa": "GHSA-rv78-qqrq-73m5", "cve": "CVE-2025-30350", "severity": "medium", "published": "2025-03-26T14:52:55Z" }, { "ghsa": "GHSA-j8xj-7jff-46mx", "cve": "CVE-2025-30225", "severity": "medium", "published": "2025-03-26T14:46:27Z" }, { "ghsa": "GHSA-99vm-5v2h-h6r6", "cve": "CVE-2025-27089", "severity": "medium", "published": "2025-02-19T15:33:20Z" }, { "ghsa": "GHSA-9qrm-48qf-r2rw", "cve": "CVE-2024-6533", "severity": "low", "published": "2025-01-23T16:08:13Z" }, { "ghsa": "GHSA-pmf4-v838-29hg", "cve": "CVE-2025-24353", "severity": "medium", "published": "2025-01-23T15:54:02Z" }, { "ghsa": "GHSA-849r-qrwj-8rv4", "cve": "CVE-2024-54151", "severity": "high", "published": "2024-12-09T14:47:46Z" }, { "ghsa": "GHSA-r6wx-627v-gh2f", "cve": "CVE-2024-54128", "severity": "medium", "published": "2024-12-05T15:42:01Z" }, { "ghsa": "GHSA-vw58-ph65-6rxp", "cve": "CVE-2024-47822", "severity": "medium", "published": "2024-10-08T12:52:21Z" }, { "ghsa": "GHSA-68g8-c275-xf2m", "cve": "CVE-2024-46990", "severity": "medium", "published": "2024-09-18T16:19:10Z" }, { "ghsa": "GHSA-cff8-x7jv-4fm8", "cve": "CVE-2024-45596", "severity": "high", "published": "2024-09-10T18:11:49Z" }, { "ghsa": "GHSA-3fff-gqw3-vj86", "cve": "CVE-2024-6534", "severity": "medium", "published": "2024-08-27T16:12:08Z" }, { "ghsa": "GHSA-jgf4-vwc3-r46v", "cve": "CVE-2024-39896", "severity": "high", "published": "2024-07-08T17:15:54Z" }, { "ghsa": "GHSA-7hmh-pfrp-vcx4", "cve": "CVE-2024-39895", "severity": "medium", "published": "2024-07-08T16:00:15Z" }, { "ghsa": "GHSA-hxgm-ghmv-xjjm", "cve": "CVE-2024-39701", "severity": "medium", "published": "2024-07-08T15:47:55Z" }, { "ghsa": "GHSA-8p72-rcq4-h6pw", "cve": "CVE-2024-39699", "severity": "medium", "published": "2024-07-08T12:27:48Z" }, { "ghsa": "GHSA-632p-p495-25m5", "cve": "CVE-2024-36128", "severity": "high", "published": "2024-06-03T14:30:39Z" }, { "ghsa": "GHSA-g65h-35f3-x2w3", "cve": "CVE-2024-34709", "severity": "medium", "published": "2024-05-13T18:36:42Z" }, { "ghsa": "GHSA-p8v3-m643-4xqx", "cve": "CVE-2024-34708", "severity": "medium", "published": "2024-05-13T18:36:31Z" }, { "ghsa": "GHSA-fr3w-2p22-6w7p", "cve": "CVE-2024-28239", "severity": "medium", "published": "2024-03-12T18:29:08Z" }, { "ghsa": "GHSA-2ccr-g2rv-h677", "cve": "CVE-2024-28238", "severity": "low", "published": "2024-03-12T18:28:20Z" }, { "ghsa": "GHSA-5mhg-wv8w-p59j", "cve": "CVE-2024-27296", "severity": "medium", "published": "2024-03-01T12:15:56Z" }, { "ghsa": "GHSA-qw9g-7549-7wg5", "cve": "CVE-2024-27295", "severity": "high", "published": "2024-03-01T12:15:40Z" }, { "ghsa": "GHSA-hmgw-9jrg-hf2m", "cve": "CVE-2023-45820", "severity": "high", "published": "2023-10-19T18:19:43Z" }, { "ghsa": "GHSA-22rr-f3p8-5gf8", "severity": "high", "published": "2023-09-14T11:42:18Z" }, { "ghsa": "GHSA-gggm-66rh-pp98", "cve": "CVE-2023-38503", "severity": "medium", "published": "2023-07-25T21:37:34Z" }, { "ghsa": "GHSA-8vg2-wf3q-mwv7", "cve": "CVE-2023-28443", "severity": "medium", "published": "2023-03-23T18:50:03Z" }, { "ghsa": "GHSA-m5q3-8wgf-x8xf", "cve": "CVE-2023-27481", "severity": "medium", "published": "2023-03-07T11:22:08Z" }, { "ghsa": "GHSA-4hmq-ggrm-qfc6", "cve": "CVE-2023-27474", "severity": "high", "published": "2023-03-06T09:13:24Z" }, { "ghsa": "GHSA-j3rg-3rgm-537h", "cve": "CVE-2023-26492", "severity": "medium", "published": "2023-03-03T18:22:27Z" }, { "ghsa": "GHSA-77qm-wvqq-fg79", "cve": "CVE-2022-36031", "severity": "medium", "published": "2022-08-19T20:03:56Z" }, { "ghsa": "GHSA-g27j-74fp-xfpr", "cve": "CVE-2022-26969", "severity": "high", "published": "2022-04-04T13:33:23Z" }, { "ghsa": "GHSA-xmjj-3c76-5w84", "cve": "CVE-2022-24814", "severity": "high", "published": "2022-04-04T13:32:53Z" } ], "replies": { "sampled": 25, "unanswered": 10, "medianDays": 0.3 } }, "updatedAt": "2026-11-07T22:56:52.158907515Z" } }, "edges": [ { "by": 21, "category": "security", "leads": "directus", "name": "Security \u0026 auth", "reasons": { "a": "Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.", "b": "MCP OAuth uses PKCE with dynamic client registration or client ID metadata documents, issues a token with the single `mcp:access` scope and the MCP endpoint as audience, and lets administrators revoke clients. Static tokens are one per user, don't expire and are stored in plain text. We scored 26 and took 10 because `?access_token=` in the URL is a documented option that the MCP guide uses for three clients (16 of 30). Access policies limit a user by collection, action, field and item rule, the MCP server is off by default, and deletes are refused unless Allow Deletes is on. No server-side approval step for other writes (16 of 20). A security guide for MCP covers prompt injection, mixing servers and auto-approval, with advice only (11 of 15). The activity log records user, action, time, IP address, user agent, collection and item, kept 30 days on Core (11 of 15). A disclosure policy with private GitHub reports and a security address, advisories published in public, and SOC 2 Type 2 with a penetration test report on the trust centre. No bug bounty found, and security.txt returns 404 (14 of 20)." }, "scores": { "a": 47, "b": 68 } }, { "by": 10, "category": "payments", "leads": "directus", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.", "b": "Scored with the self-hosted rule, taking prices from the paid options beside the free tier. No x402, MPP or L402 (0). Core is $0, Team is $499 a month on an annual term or $599 monthly, extra seats are $50 each a month, and Directus Cloud hosting is a $99 a month add-on, all public. Enterprise is priced by sales (20). The Core tier is free to self-host with no card and no account, and Cloud has a 14-day trial (20). `ADMIN_EMAIL`, `ADMIN_PASSWORD` and `ADMIN_TOKEN` create the first administrator and a static token at start-up, so the REST route needs no browser. The docs enable the MCP server only through the Studio settings page, so we took 5 off (15 of 20)." }, "scores": { "a": 45, "b": 55 } }, { "by": 9, "category": "ergonomics", "leads": "cosmic", "name": "Agent ergonomics", "reasons": { "a": "24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.", "b": "Default mode lists 12 tools, the 11 to 30 band, but each definition carries its whole instruction file, 78,855 bytes in total at v12.5.0, so we scored 10 and added 8 for registry mode, which lists three tools and loads details on demand (18 of 25). `limit` (default 100), `offset`, `page`, `fields`, `filter`, `search`, `sort` and `aggregate`, with `QUERY_LIMIT_MAX` as a server cap (20). One error shape with a machine-readable `extensions.code`. Missing items answer `FORBIDDEN`, not 404, by design (17 of 20). Tools set `readOnlyHint` and `destructiveHint`, though one `items` tool covers reads and writes and is marked destructive. No idempotency keys were found in the reviewed documentation (10 of 20). Few required parameters. One official SDK, `@directus/sdk` for JavaScript and TypeScript (8 of 15)." }, "scores": { "a": 82, "b": 73 } }, { "by": 8, "category": "reliability", "leads": "cosmic", "name": "Reliability", "reasons": { "a": "Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.", "b": "Read with the local-software lines, since the graded surface is the self-hosted software on the free Core tier. Directus Cloud's status page isn't scored here. Official Docker image `directus/directus` and npm package `directus` 12.6.0, with Node.js 26 or later in `engines` since 12.6.0 and the supported databases listed (20). The Check workflow passed on the 10 most recent runs on main on 8 October, per the 8 October check, not re-read on 1 November, and separate end-to-end and CodeQL workflows exist (25). 339 open issues. The 15 newest carry labels and one to eight comments, but we couldn't read closed counts, and at least 20 advisories were fixed between June and September 2026 (15 of 25). The docs say releases don't follow semantic versioning and any release may break. Breaking changes are listed per version, and 12.1 to 12.6 each had some (7 of 15). Version 12, and the MCP server isn't marked beta (15)." }, "scores": { "a": 90, "b": 82 } }, { "by": 7, "category": "schema", "leads": "cosmic", "name": "Schema \u0026 documentation", "reasons": { "a": "openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.", "b": "An OpenAPI file ships in `@directus/specs` with 70 paths, each instance serves its own at `/server/specs/oas`, and every MCP tool has a typed input schema. The spec's `info.version` still reads 10 (22 of 25). llms.txt, llms-full.txt and a raw Markdown copy of every docs page (10). Each tool has a one-sentence description and a `prompt.md` of instructions with worked examples, up to 13 KB for flows, and a `system-prompt` tool sets conventions (16 of 20). Actions are enums and validation uses strict unions per action, but item data, filters, `deep`, and field `schema` and `meta` are open records (8 of 15). The errors page lists HTTP statuses and error codes with the response shape, and guides show REST, GraphQL and SDK examples side by side (14 of 15). A monthly changelog, release notes and breaking-change pages per major version. REST paths carry no version and releases aren't semantic (11 of 15)." }, "scores": { "a": 88, "b": 81 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Cosmic Inc.", "b": "Monospace Inc. (Directus)", "name": "Vendor" }, { "a": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "MSCL-1.0-GPL (Monospace Sustainable Core Licence 1.0), source-available with a licence key for paid tiers, each version converting to GPL-3.0 after four years. `@directus/sdk` is MIT", "name": "Licence" }, { "a": "24", "b": "12", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.cosmicjs/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-11-02", "b": "2026-10-27", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-06-09", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "295 npm/wk", "b": "38k stars, 23k npm/wk", "name": "Popularity" }, { "a": "none", "b": "2.8/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cosmic scores 72.5 (BB) on agent readiness against Directus's 58.1 (C), and leads in 4 of 7 scored categories. Directus leads on security \u0026 auth and payments \u0026 pricing.", "question": "Which is better for AI agents, Cosmic or Directus?" }, { "answer": "Cosmic needs an API key. Directus takes an API key or an OAuth sign-in.", "question": "Do Cosmic and Directus need an API key?" }, { "answer": "Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. No hosted endpoint is listed for Directus.", "question": "Can an agent call Cosmic and Directus without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 90 against 82", "Schema \u0026 documentation, 88 against 81", "Agent ergonomics, 82 against 73" ], "also": [ "Agent-ready, a grade of BB or better", "A hosted endpoint, with nothing to install", "Runs on your own machine", "Free to start without a card", "No incidents deducted, where Directus loses 15 points for them" ], "goodFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "slug": "cosmic", "watchFor": "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement" }, { "aheadOn": [ "Security \u0026 auth, 68 against 47", "Payments \u0026 pricing, 55 against 45" ], "also": null, "goodFor": "Teams that already keep content in an SQL database and want an agent to edit items, files and the data model under a named user's permissions.", "slug": "directus", "watchFor": "Version 12 (10 June 2026) added licence enforcement. The free Core tier allows 3 Studio seats, 25 collections and 5 flows, and an instance over its limits is locked after a grace period" } ], "history": { "cosmic": null, "directus": [ { "causes": [ "correction" ], "date": "2026-11-01", "delta": -9, "from": 67.1, "fromGrade": "B", "to": 58.1, "toGrade": "C" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": -0.1, "from": 67.2, "fromGrade": "B", "to": 67.1, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 67.1, "fromGrade": "B", "to": 67.2, "toGrade": "B" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-directus.json", "title": "BCMS vs Directus", "url": "https://www.anchorterminal.com/compare/bcms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic.json", "title": "ButterCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-directus.json", "title": "ButterCMS vs Directus", "url": "https://www.anchorterminal.com/compare/buttercms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic.json", "title": "Contentstack vs Cosmic", "url": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-directus.json", "title": "Contentstack vs Directus", "url": "https://www.anchorterminal.com/compare/contentstack-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-datocms.json", "title": "Cosmic vs DatoCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.json", "title": "Cosmic vs Ghost", "url": "https://www.anchorterminal.com/compare/cosmic-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph.json", "title": "Cosmic vs Hygraph", "url": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.json", "title": "Cosmic vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-payload.json", "title": "Cosmic vs Payload", "url": "https://www.anchorterminal.com/compare/cosmic-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-prismic.json", "title": "Cosmic vs Prismic", "url": "https://www.anchorterminal.com/compare/cosmic-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-sanity.json", "title": "Cosmic vs Sanity", "url": "https://www.anchorterminal.com/compare/cosmic-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok.json", "title": "Cosmic vs Storyblok", "url": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.json", "title": "Cosmic vs Strapi", "url": "https://www.anchorterminal.com/compare/cosmic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.json", "title": "Cosmic vs Webflow", "url": "https://www.anchorterminal.com/compare/cosmic-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json", "title": "Cosmic vs WordPress", "url": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-directus.json", "title": "DatoCMS vs Directus", "url": "https://www.anchorterminal.com/compare/datocms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-dotcms.json", "title": "Directus vs dotCMS", "url": "https://www.anchorterminal.com/compare/directus-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-ghost.json", "title": "Directus vs Ghost", "url": "https://www.anchorterminal.com/compare/directus-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-hygraph.json", "title": "Directus vs Hygraph", "url": "https://www.anchorterminal.com/compare/directus-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-kontent-ai.json", "title": "Directus vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/directus-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-payload.json", "title": "Directus vs Payload", "url": "https://www.anchorterminal.com/compare/directus-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-prismic.json", "title": "Directus vs Prismic", "url": "https://www.anchorterminal.com/compare/directus-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-sanity.json", "title": "Directus vs Sanity", "url": "https://www.anchorterminal.com/compare/directus-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-storyblok.json", "title": "Directus vs Storyblok", "url": "https://www.anchorterminal.com/compare/directus-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-strapi.json", "title": "Directus vs Strapi", "url": "https://www.anchorterminal.com/compare/directus-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-webflow.json", "title": "Directus vs Webflow", "url": "https://www.anchorterminal.com/compare/directus-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-wordpress.json", "title": "Directus vs WordPress", "url": "https://www.anchorterminal.com/compare/directus-vs-wordpress" } ], "panel": null, "scores": [ { "by": 8, "cosmic": 90, "directus": 82, "edge": "cosmic", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 7, "cosmic": 88, "directus": 81, "edge": "cosmic", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 9, "cosmic": 82, "directus": 73, "edge": "cosmic", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 21, "cosmic": 47, "directus": 68, "edge": "directus", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 10, "cosmic": 45, "directus": 55, "edge": "directus", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 0, "cosmic": 86, "directus": 86, "edge": "", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 1, "cosmic": 63, "directus": 62, "edge": "cosmic", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Cosmic scores 72.5 (BB) on agent readiness against Directus's 58.1 (C), and leads in 4 of 7 scored categories. Directus leads on security \u0026 auth and payments \u0026 pricing. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "cosmic": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "directus": "The built-in MCP server runs under the connecting user's permissions, supports OAuth limited to the MCP endpoint and refuses deletes unless an administrator allows them. A licence check caps the free Core tier at 3 seats, 25 collections and 5 flows, and Directus published more than 30 security advisories in the past year." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cosmic-vs-directus", "json": "https://www.anchorterminal.com/compare/cosmic-vs-directus.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cosmic-vs-directus.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cosmic-vs-directus.min.md" }, "markdown": "Cosmic scores 72.5 (BB) on agent readiness against Directus's 58.1 (C), and leads in 4 of 7 scored categories. Directus leads on security \u0026 auth and payments \u0026 pricing. Both do content management.\n\n- Cosmic: grade BB, 72.5/100, rank #124 of 1510. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json\n- Directus: grade C, 58.1/100, rank #762 of 1510. Markdown https://www.anchorterminal.com/tools/directus.md · JSON https://www.anchorterminal.com/api/v1/tools/directus.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### Cosmic (BB)\n\nGood for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.\n\nAhead on:\n- Reliability, 90 against 82\n- Schema \u0026 documentation, 88 against 81\n- Agent ergonomics, 82 against 73\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- Free to start without a card\n- No incidents deducted, where Directus loses 15 points for them\n\nWatch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement\n\n### Directus (C)\n\nGood for: Teams that already keep content in an SQL database and want an agent to edit items, files and the data model under a named user's permissions.\n\nAhead on:\n- Security \u0026 auth, 68 against 47\n- Payments \u0026 pricing, 55 against 45\n\nWatch for: Version 12 (10 June 2026) added licence enforcement. The free Core tier allows 3 Studio seats, 25 collections and 5 flows, and an instance over its limits is locked after a grace period\n\n\n## Why the edge\n\n### Security \u0026 auth: Directus +21\n\n- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.\n- Directus (68): MCP OAuth uses PKCE with dynamic client registration or client ID metadata documents, issues a token with the single `mcp:access` scope and the MCP endpoint as audience, and lets administrators revoke clients. Static tokens are one per user, don't expire and are stored in plain text. We scored 26 and took 10 because `?access_token=` in the URL is a documented option that the MCP guide uses for three clients (16 of 30). Access policies limit a user by collection, action, field and item rule, the MCP server is off by default, and deletes are refused unless Allow Deletes is on. No server-side approval step for other writes (16 of 20). A security guide for MCP covers prompt injection, mixing servers and auto-approval, with advice only (11 of 15). The activity log records user, action, time, IP address, user agent, collection and item, kept 30 days on Core (11 of 15). A disclosure policy with private GitHub reports and a security address, advisories published in public, and SOC 2 Type 2 with a penetration test report on the trust centre. No bug bounty found, and security.txt returns 404 (14 of 20).\n\n### Payments \u0026 pricing: Directus +10\n\n- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.\n- Directus (55): Scored with the self-hosted rule, taking prices from the paid options beside the free tier. No x402, MPP or L402 (0). Core is $0, Team is $499 a month on an annual term or $599 monthly, extra seats are $50 each a month, and Directus Cloud hosting is a $99 a month add-on, all public. Enterprise is priced by sales (20). The Core tier is free to self-host with no card and no account, and Cloud has a 14-day trial (20). `ADMIN_EMAIL`, `ADMIN_PASSWORD` and `ADMIN_TOKEN` create the first administrator and a static token at start-up, so the REST route needs no browser. The docs enable the MCP server only through the Studio settings page, so we took 5 off (15 of 20).\n\n### Agent ergonomics: Cosmic +9\n\n- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.\n- Directus (73): Default mode lists 12 tools, the 11 to 30 band, but each definition carries its whole instruction file, 78,855 bytes in total at v12.5.0, so we scored 10 and added 8 for registry mode, which lists three tools and loads details on demand (18 of 25). `limit` (default 100), `offset`, `page`, `fields`, `filter`, `search`, `sort` and `aggregate`, with `QUERY_LIMIT_MAX` as a server cap (20). One error shape with a machine-readable `extensions.code`. Missing items answer `FORBIDDEN`, not 404, by design (17 of 20). Tools set `readOnlyHint` and `destructiveHint`, though one `items` tool covers reads and writes and is marked destructive. No idempotency keys were found in the reviewed documentation (10 of 20). Few required parameters. One official SDK, `@directus/sdk` for JavaScript and TypeScript (8 of 15).\n\n### Reliability: Cosmic +8\n\n- Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.\n- Directus (82): Read with the local-software lines, since the graded surface is the self-hosted software on the free Core tier. Directus Cloud's status page isn't scored here. Official Docker image `directus/directus` and npm package `directus` 12.6.0, with Node.js 26 or later in `engines` since 12.6.0 and the supported databases listed (20). The Check workflow passed on the 10 most recent runs on main on 8 October, per the 8 October check, not re-read on 1 November, and separate end-to-end and CodeQL workflows exist (25). 339 open issues. The 15 newest carry labels and one to eight comments, but we couldn't read closed counts, and at least 20 advisories were fixed between June and September 2026 (15 of 25). The docs say releases don't follow semantic versioning and any release may break. Breaking changes are listed per version, and 12.1 to 12.6 each had some (7 of 15). Version 12, and the MCP server isn't marked beta (15).\n\n### Schema \u0026 documentation: Cosmic +7\n\n- Cosmic (88): openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.\n- Directus (81): An OpenAPI file ships in `@directus/specs` with 70 paths, each instance serves its own at `/server/specs/oas`, and every MCP tool has a typed input schema. The spec's `info.version` still reads 10 (22 of 25). llms.txt, llms-full.txt and a raw Markdown copy of every docs page (10). Each tool has a one-sentence description and a `prompt.md` of instructions with worked examples, up to 13 KB for flows, and a `system-prompt` tool sets conventions (16 of 20). Actions are enums and validation uses strict unions per action, but item data, filters, `deep`, and field `schema` and `meta` are open records (8 of 15). The errors page lists HTTP statuses and error codes with the response shape, and guides show REST, GraphQL and SDK examples side by side (14 of 15). A monthly changelog, release notes and breaking-change pages per major version. REST paths carry no version and releases aren't semantic (11 of 15).\n\n## Score by category\n\n| Category | Weight | Cosmic | Directus | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 90 | 82 | Cosmic +8 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 88 | 81 | Cosmic +7 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 73 | Cosmic +9 |\n| Security \u0026 auth | 14% (17.5 this run) | 47 | 68 | Directus +21 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 55 | Directus +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 86 | 86 | even |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 62 | Cosmic +1 |\n| Negative events | ≤15 | 0 | -15 | |\n| **Total** | | **72.5 · BB** | **58.1 · C** | |\n\n## Facts side by side\n\n| Fact | Cosmic | Directus |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Cosmic Inc. | Monospace Inc. (Directus) |\n| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | no (local only) |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | none | MSCL-1.0-GPL (Monospace Sustainable Core Licence 1.0), source-available with a licence key for paid tiers, each version converting to GPL-3.0 after four years. `@directus/sdk` is MIT |\n| Tools exposed | 24 | 12 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.cosmicjs/mcp` | not listed |\n| Last release | 2026-11-02 | 2026-10-27 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | no date given | 2026-06-09 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 295 npm/wk | 38k stars, 23k npm/wk |\n| Agent reviews | none | 2.8/5 (4) |\n\n## How the scores have moved\n\n### Cosmic\n\nNo score change since it was listed.\n\n### Directus\n\n- -9.0 on 1 November 2026 (B to C): correction\n- -0.1 on 28 October 2026: correction\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.\n\n**Directus.** The built-in MCP server runs under the connecting user's permissions, supports OAuth limited to the MCP endpoint and refuses deletes unless an administrator allows them. A licence check caps the free Core tier at 3 seats, 25 collections and 5 flows, and Directus published more than 30 security advisories in the past year.\n\n## Before you call either\n\n### Cosmic\n\n1. Send only the read key in the Bearer token unless the task needs writes\n2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days\n3. Fix and don't retry on 400; wait and retry on 429\n4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit\n5. Confirm with the user before cosmic_objects_delete, which deletes permanently\n\n### Directus\n\n1. Connect with OAuth or an `Authorization: Bearer` header. Don't put the token in the URL as `?access_token=`, where it can be logged\n2. Use `/mcp?tool_mode=registry` when the client loads every tool definition. Default mode sends each tool's full instructions, about 79 KB in total\n3. Read the `schema` tool before writing. Item payloads are untyped objects, so field names and types come only from the data model\n4. Publish a version with `POST /versions/{id}/promote` over REST. The MCP `items` tool refuses system collections such as `directus_versions`\n5. Count translation and junction tables against the 25-collection Core limit before creating collections\n\n## Questions\n\n### Which is better for AI agents, Cosmic or Directus?\n\nCosmic scores 72.5 (BB) on agent readiness against Directus's 58.1 (C), and leads in 4 of 7 scored categories. Directus leads on security \u0026 auth and payments \u0026 pricing.\n\n### Do Cosmic and Directus need an API key?\n\nCosmic needs an API key. Directus takes an API key or an OAuth sign-in.\n\n### Can an agent call Cosmic and Directus without installing anything?\n\nCosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. No hosted endpoint is listed for Directus.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-directus.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-directus.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cosmic\", \"b\": \"directus\"}`. From a terminal: `anchor compare cosmic directus`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/directus.json\n\n## Other comparisons with Cosmic or Directus\n\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs Directus](https://www.anchorterminal.com/compare/bcms-vs-directus.md)\n- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)\n- [ButterCMS vs Directus](https://www.anchorterminal.com/compare/buttercms-vs-directus.md)\n- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)\n- [Contentstack vs Directus](https://www.anchorterminal.com/compare/contentstack-vs-directus.md)\n- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)\n- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)\n- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)\n- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)\n- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)\n- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)\n- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)\n- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)\n- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)\n- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)\n- [DatoCMS vs Directus](https://www.anchorterminal.com/compare/datocms-vs-directus.md)\n- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)\n- [Directus vs Ghost](https://www.anchorterminal.com/compare/directus-vs-ghost.md)\n- [Directus vs Hygraph](https://www.anchorterminal.com/compare/directus-vs-hygraph.md)\n- [Directus vs Kontent.ai](https://www.anchorterminal.com/compare/directus-vs-kontent-ai.md)\n- [Directus vs Payload](https://www.anchorterminal.com/compare/directus-vs-payload.md)\n- [Directus vs Prismic](https://www.anchorterminal.com/compare/directus-vs-prismic.md)\n- [Directus vs Sanity](https://www.anchorterminal.com/compare/directus-vs-sanity.md)\n- [Directus vs Storyblok](https://www.anchorterminal.com/compare/directus-vs-storyblok.md)\n- [Directus vs Strapi](https://www.anchorterminal.com/compare/directus-vs-strapi.md)\n- [Directus vs Webflow](https://www.anchorterminal.com/compare/directus-vs-webflow.md)\n- [Directus vs WordPress](https://www.anchorterminal.com/compare/directus-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cosmic vs Directus", "url": "" } ], "description": "Cosmic scores 72.5 (BB) to Directus's 58.1 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cosmic BB 72.5", "Directus C 58.1", "scores" ], "h1": "Cosmic vs Directus", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cosmic-vs-directus", "published": "2026-10-01", "section": "tools", "title": "Cosmic vs Directus for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cosmic-vs-directus" }, "tokens": { "markdown": 4500, "slim": 2630 }, "version": 1 }