# Cosmic vs dotCMS

> Cosmic scores 72.5 (BB) to dotCMS's 57.7 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/cosmic-vs-dotcms
- Markdown: https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md (~4,050 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cosmic scores 72.5 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. dotCMS leads on security & auth. Both do content management.

- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json
- dotCMS: grade C, 57.7/100, rank #780 of 1486. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### Cosmic (BB)

Good for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.

Ahead on:
- Reliability, 90 against 47
- Schema & documentation, 88 against 65
- Agent ergonomics, 82 against 68
- Payments & pricing, 45 against 35
- Maintenance & community, 86 against 75
- Transparency & trust, 63 against 54

Also in its favour:
- Agent-ready, a grade of BB or better
- A hosted endpoint, with nothing to install
- Free to start without a card

Watch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement

### dotCMS (C)

Good for: Enterprises already on dotCMS who want an agent to manage content and pages.

Ahead on:
- Security & auth, 63 against 47

Watch for: Pre-1.0 package, with the dev docs still pointing at the beta tag


## Why the edge

### Reliability: Cosmic +43

- Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.
- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.

### Schema & documentation: Cosmic +23

- Cosmic (88): openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.
- dotCMS (65): The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.

### Security & auth: dotCMS +16

- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.
- dotCMS (63): JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.

### Agent ergonomics: Cosmic +14

- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.
- dotCMS (68): 7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.

### Maintenance & community: Cosmic +11

- Cosmic (86): MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.
- dotCMS (75): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.

### Payments & pricing: Cosmic +10

- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.
- dotCMS (35): Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.

## Score by category

| Category | Weight | Cosmic | dotCMS | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 90 | 47 | Cosmic +43 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 88 | 65 | Cosmic +23 |
| Agent ergonomics | 13% (16.2 this run) | 82 | 68 | Cosmic +14 |
| Security & auth | 14% (17.5 this run) | 47 | 63 | dotCMS +16 |
| Payments & pricing | 10% (12.5 this run) | 45 | 35 | Cosmic +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 86 | 75 | Cosmic +11 |
| Transparency & trust | 7% (8.8 this run) | 63 | 54 | Cosmic +9 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **72.5 · BB** | **57.7 · C** | |

## Facts side by side

| Fact | Cosmic | dotCMS |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Cosmic Inc. | dotCMS LLC |
| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | no (local only) |
| Transports | HTTP, Streamable HTTP, stdio | stdio |
| Auth | API key | API key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | none | BUSL-1.1 |
| Tools exposed | 24 | 7 |
| Read-only variant documented | yes | no |
| llms.txt | yes | yes |
| MCP registry | `com.cosmicjs/mcp` | not listed |
| Last release | 2026-11-02 | 2026-09-02 |
| Terms last updated | no date given | no date given |
| Privacy policy last updated | no date given | 2026-09-08 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 295 npm/wk | 43 npm/wk |

## Verdicts

**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.

**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.

## Before you call either

### Cosmic

1. Send only the read key in the Bearer token unless the task needs writes
2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days
3. Fix and don't retry on 400; wait and retry on 429
4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit
5. Confirm with the user before cosmic_objects_delete, which deletes permanently

### dotCMS

1. Search the spec with `search` before writing an `execute` call, and return only the fields you need
2. Use a token for a dedicated user and role, not an administrator's
3. Confirm with the user before execute calls that publish, archive or delete content
4. Keep results small with pick and first, since output is capped at about 25,000 characters
5. Use download_assets for theme folders so files land on disk instead of in context

## Questions

### Which is better for AI agents, Cosmic or dotCMS?

Cosmic scores 72.5 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. dotCMS leads on security & auth.

### Do Cosmic and dotCMS need an API key?

Both need an API key.

### Can an agent call Cosmic and dotCMS without installing anything?

Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. dotCMS runs on your own machine, with no hosted endpoint listed.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-dotcms.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cosmic", "b": "dotcms"}`. From a terminal: `anchor compare cosmic dotcms`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/dotcms.json

## Other comparisons with Cosmic or dotCMS

- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)
- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)
- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)
- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)
- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)
- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)
- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)
- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)
- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)
- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)
- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)
- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)
- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)
- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)
- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)
- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)
- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)
- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)
- [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md)
- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)
- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)
- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)
- [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md)
- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)
- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)
- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)
- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)
- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)
- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)
- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp