{ "data": { "a": { "slug": "cosmic", "name": "Cosmic", "vendor": "Cosmic Inc.", "vendorUrl": "https://www.cosmicjs.com", "kind": "http-api", "category": "cms", "summary": "Cosmic is a hosted headless CMS with a REST API, a TypeScript SDK, a CLI and a hosted MCP server. Agents read and write objects, media and object types, generate media, and can create a project by agent signup.", "url": "https://www.anchorterminal.com/tools/cosmic", "markdownUrl": "https://www.anchorterminal.com/tools/cosmic.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cosmic.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cosmic.json", "dns": "cosmic.grade.anchorterminal.com", "repo": "https://github.com/cosmicjs/mcp", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "packages": [ { "registry": "npm", "name": "@cosmicjs/mcp" }, { "registry": "npm", "name": "@cosmicjs/sdk" }, { "registry": "npm", "name": "@cosmicjs/cli" } ], "auth": "api-key", "authNotes": "Each bucket has a read key and a write key, rotatable independently. The hosted MCP server takes `Authorization: Bearer READ_KEY` for read-only tools or `READ_KEY:WRITE_KEY` for full access; the write key can also go in `X-Cosmic-Write-Key`. The REST API takes the read key as `read_key` in the query or as a Bearer token on GET. POST /v3/agents/sign-up on dapi.cosmicjs.com needs no authentication and returns bucket keys for a new unclaimed project tied to a human's email.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 1 bucket, 10,000 objects and 250,000 non-cached API requests a month, no card. Builder $99 a month, Team $299, Business $499, Small Workspace $999 and Large Workspace $2,999, with 10 per cent off yearly; Enterprise by quote. Webhooks, localisation and revision history are paid add-ons. Workspace plans have a 30-day trial.", "priceSummary": "$99 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the OpenAPI spec, the MCP docs or pricing.md (checked 2026-11-06). An unclaimed or over-limit bucket returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 24, "popularity": { "githubStars": null, "npmWeekly": 295, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.cosmicjs.com/docs", "llmsTxt": "https://www.cosmicjs.com/llms.txt", "openapi": "https://www.cosmicjs.com/openapi.json", "registryName": "com.cosmicjs/mcp", "capabilities": [ "cms.content", "cms.assets", "cms.schema", "cms.publish", "cms.localisation" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "mcp-registry", "openapi", "llms-txt", "free-tier", "no-card", "status-page", "webhooks", "typescript", "cli", "closed-source" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 72.5, "grade": "BB", "agentReady": true, "rank": 123, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "bestFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "strengths": [ "Agent signup API provisions a project and bucket with keys, idempotent per email and agent", "24 MCP tools with readOnlyHint and destructiveHint, and descriptions that say when to use each", "Leaving out the write key gives read-only MCP access", "OpenAPI spec, llms.txt and Markdown docs with an error model and per-code retry guidance", "Free plan with no card and published prices and quotas for every paid plan" ], "weaknesses": [ "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement", "The REST API accepts the read key as a URL query parameter", "Revision history, webhooks and localisation are paid add-ons", "The OpenAPI spec covers 21 operations, fewer than the documented API", "Data is kept indefinitely unless deletion is requested" ], "agentNotes": [ "Send only the read key in the Bearer token unless the task needs writes", "Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days", "Fix and don't retry on 400; wait and retry on 429", "Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit", "Confirm with the user before cosmic_objects_delete, which deletes permanently" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.5 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 53 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @cosmicjs/mcp", "http": "curl -X POST https://dapi.cosmicjs.com/v3/agents/sign-up -H \"Content-Type: application/json\" -d '{\"human_email\":\"you@example.com\",\"project_name\":\"Recipe Blog\",\"agent_id\":\"my-agent\"}'", "config": { "mcpServers": { "cosmic": { "headers": { "Authorization": "Bearer your-read-key:your-write-key" }, "url": "https://mcp.cosmicjs.com/v1/buckets/your-bucket-slug" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/cosmic" }, "area": "business", "unitPrices": [ { "item": "Builder plan", "unit": "month", "usd": 99, "note": "3 buckets, 50,000 objects, 1 million non-cached requests; $89 a month yearly" }, { "item": "Team plan", "unit": "month", "usd": 299, "note": "5 buckets, 100,000 objects, 2 million non-cached requests" }, { "item": "Business plan", "unit": "month", "usd": 499, "note": "10 buckets, 250,000 objects, 5 million non-cached requests" } ], "provenance": { "legalEntity": "Cosmic Inc.", "domain": "cosmicjs.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.cosmicjs.com/terms-of-service", "privacy": "https://www.cosmicjs.com/privacy-policy", "statusPage": "https://cosmicstatus.com", "changelog": "https://www.cosmicjs.com/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy were last updated on 13 January 2025 and name Cosmic JS at 3208 Bonniebrook Dr, Plano, Texas. The MCP server's licence names Cosmic Inc.", "The terms forbid using a robot or spider to copy or scrape the website without written permission; recorded as a fact. www.cosmicjs.com/robots.txt allows all crawlers, including ClaudeBot, except /api/, /search, /community/members/ and /v3/.", "www.cosmicjs.com/.well-known/security.txt returned 404. The security page asks for vulnerability reports at support@cosmicjs.com.", "cosmicstatus.com redirects to a Statuspage at cosmicjs.statuspage.io with API and Web Dashboard components." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cosmic.json", "live": { "slug": "cosmic", "probe": { "target": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "method": "get", "lastAt": "2026-11-07T18:20:18.962856282Z", "lastOk": true, "lastStatus": 401, "lastMs": 494, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 452, "p95ms24h": 538, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://cosmicstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:35.290408052Z" }, "versions": [ { "registry": "github", "name": "cosmicjs/mcp", "version": "v1.7.1", "released": "2026-11-02", "seenAt": "2026-11-06T23:17:54.958583794Z" }, { "registry": "mcp-registry", "name": "com.cosmicjs/mcp", "version": "1.6.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@cosmicjs/cli", "version": "1.12.0", "seenAt": "2026-11-06T23:17:52.953736128Z" }, { "registry": "npm", "name": "@cosmicjs/mcp", "version": "1.7.1", "seenAt": "2026-11-06T23:17:50.755872442Z" }, { "registry": "npm", "name": "@cosmicjs/sdk", "version": "2.4.0", "seenAt": "2026-11-06T23:17:51.562341268Z" } ], "githubStars": 1, "npmWeekly": 295, "securityTxt": { "url": "https://cosmicjs.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:42.91283778Z" }, "llmsTxt": { "url": "https://www.cosmicjs.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:12.321724133Z" }, "pages": [ { "url": "https://www.cosmicjs.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:27:27.310794511Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3e45613abe99" }, { "url": "https://www.cosmicjs.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:27:31.923491628Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d4aa3db9a89b" }, { "url": "https://www.cosmicjs.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:27:35.902981274Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3c4a26f1901" } ], "updatedAt": "2026-11-07T18:20:18.962856282Z" } }, "answer": "Cosmic scores 72.5 (BB) on agent readiness against Ghost's 51.2 (D), and leads in 4 of 7 scored categories. Ghost leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "ghost", "name": "Ghost", "vendor": "Ghost Foundation", "vendorUrl": "https://ghost.org", "kind": "http-api", "category": "cms", "summary": "Ghost is an open-source publishing platform for websites, newsletters and paid memberships, self-hosted or run by the Ghost Foundation as Ghost(Pro). Agents create, edit and publish posts and pages and upload images through its Admin API.", "url": "https://www.anchorterminal.com/tools/ghost", "markdownUrl": "https://www.anchorterminal.com/tools/ghost.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ghost.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ghost.json", "dns": "ghost.grade.anchorterminal.com", "repo": "https://github.com/TryGhost/Ghost", "license": "MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "ghost" }, { "registry": "npm", "name": "@tryghost/admin-api" }, { "registry": "npm", "name": "ghost-cli" } ], "auth": "api-key", "authNotes": "Self-serve, with no app review or partner approval. An owner or administrator creates a custom integration in Ghost Admin and copies its Admin API key, an id and a hex secret joined by a colon. The client signs an HS256 JSON Web Token with the secret (`kid` the id, `aud` `/admin/`, expiry at most 5 minutes) and sends it as `Authorization: Ghost \u003ctoken\u003e`. Integrations hold one fixed permission set with no scopes. A staff access token from a user's profile works the same way and carries that user's role. Session login with email and password is meant for clients where the user is present. On Ghost(Pro) the Admin API and custom integrations need the Publisher plan or above.", "pricing": "freemium", "pricingNotes": "The software is free under MIT to self-host, so an agent's owner can start without a contract or a card. Ghost(Pro) lists Starter at $18, Publisher at $29 and Business at $199 a month billed yearly for up to 1,000 members, rising with audience size, and Custom through sales. The Admin API isn't included in Starter. Plans show a free trial, and we couldn't read whether it needs a card (checked 2026-10-08).", "priceSummary": "$18 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation index, the pricing page or the repository's file list (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 55500, "npmWeekly": 23628, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.ghost.org/admin-api", "llmsTxt": "https://docs.ghost.org/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets" ], "tags": [ "open-source", "self-hosted", "hosted", "rest", "llms-txt", "webhooks", "newsletter", "memberships", "nodejs", "status-page" ], "lastRelease": "2026-11-03", "graded": true, "anchor": { "graded": true, "score": 51.2, "grade": "D", "agentReady": false, "rank": 1027, "ranked": true, "rankOf": 1486, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 85, "payments": 50, "reliability": 83, "schema": 51, "security": 56, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -15, "negativeNotes": [ "4 November 2025 to 27 October 2026: OSV holds 46 advisories for the `ghost` package published in the 12 months, 2 critical, 13 high, 28 moderate and 3 low, all with fixed versions and published by Ghost on GitHub. Counted one by one by this run's values (a fixed High under two months 2, older Criticals and Highs 1, vendor-published fixed Moderates 1, fixed Lows 0), they pass the floor on the 8 Highs published on 7 October 2026 alone, among them GHSA-788w-68h3-cvxp and GHSA-jj74-hc2q-xrvm (remote code execution through bookmark card images and theme translation files), GHSA-v6q3-xqxm-6f5v (invite token disclosure) and five stored-XSS advisories. Self-hosted-only advisories count, since the listing covers the software and Ghost(Pro). The newest, GHSA-qrh6-cwg3-343x (moderate, comment like authorisation bypass, fixed in 6.44.1), was published on 27 October 2026. -15, the floor (https://api.osv.dev/v1/query, https://github.com/TryGhost/Ghost/security/advisories)" ], "verdict": "A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical.", "bestFor": "A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.", "strengths": [ "Admin API keys sign JSON Web Tokens that last at most 5 minutes and travel in the Authorization header, so the key itself is never sent", "A staff access token carries its user's role, and a Contributor can add and edit drafts but can't change a post's status", "Every PUT must send the post's current `updated_at`, which Ghost uses for collision detection", "Weekly releases, with v6.70.0 to v6.74.0 tagged between 13 October and 3 November 2026", "MIT licence, with llms.txt, llms-full.txt and a Markdown copy of every docs page" ], "weaknesses": [ "No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository", "A custom integration has one fixed permission set covering posts, members, settings, themes and users, with no scopes and no read-only Admin key", "46 advisories published in 12 months to 27 October 2026, 15 high or critical, including remote code execution through bookmark card images", "No content locales or custom content types, and the Admin API has no documented route for restoring a post revision", "On Ghost(Pro) the Admin API and custom integrations start at the Publisher plan, not Starter" ], "agentNotes": [ "Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set `kid` to the key id, `aud` to `/admin/` and `exp` at most 5 minutes ahead", "Set `status` to `draft` on every create unless told to publish, and publish later with a PUT that sets `status` to `published`", "GET the post before each PUT and send its `updated_at` back. Tags and authors in a PUT replace the existing lists", "Send content as a Lexical JSON string, or add `?source=html` and send `html`. The HTML conversion is lossy unless wrapped in an HTML card", "Page through lists with `limit` up to 100 and `page`. Since Ghost 6.0 `limit=all` returns 100 items without an error" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 51.2 } ], "editorialScores": { "ergonomics": 69, "maintenance": 85, "payments": 50, "reliability": 83, "schema": 51, "security": 56, "transparency": 76 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @tryghost/admin-api", "http": "curl -H \"Authorization: Ghost $token\" -H \"Accept-Version: $version\" https://{admin_domain}/ghost/api/admin/{resource}/" }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/ghost" }, "area": "business", "unitPrices": [ { "item": "Self-hosted Ghost", "unit": "month", "usd": 0, "note": "MIT, you pay for your own hosting and email delivery" }, { "item": "Ghost(Pro) Starter", "unit": "month", "usd": 18, "note": "billed yearly, up to 1,000 members, no Admin API" }, { "item": "Ghost(Pro) Publisher", "unit": "month", "usd": 29, "note": "billed yearly, up to 1,000 members, 3 staff users, Admin API included" }, { "item": "Ghost(Pro) Business", "unit": "month", "usd": 199, "note": "billed yearly, up to 1,000 members, 15 staff users" } ], "provenance": { "legalEntity": "Ghost Foundation Ltd", "domain": "ghost.org", "domainRegistered": "2005-06-25", "endpointOnVendorDomain": false, "terms": "https://ghost.org/terms/", "privacy": "https://ghost.org/privacy/", "statusPage": "https://ghoststatus.org", "changelog": "https://github.com/TryGhost/Ghost/releases", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms govern the Ghost.org website, the Ghost software and the hosted service, and name the Ghost Foundation as owner and operator under the law of England and Wales. The privacy policy names Ghost Foundation Ltd. Neither page showed a dated revision that we could read.", "The privacy policy covers Ghost Foundation's own website and services. Content on a self-hosted site stays on its owner's server and isn't covered by it.", "A self-hosted install answers on its owner's domain. Ghost(Pro) sites use a `*.ghost.io` admin domain.", "https://ghost.org/.well-known/security.txt returned 404 on 8 October 2026. SECURITY.md in the repository and https://docs.ghost.org/security give security@ghost.org and a disclosure policy.", "RDAP for ghost.org gives a registration date of 2005-06-25 and a transfer on 2013-09-12.", "status.ghost.org redirects to ghoststatus.org, an incident.io page for Ghost(Pro), not for self-hosted installs. It listed three minor incidents between 10 July and 8 October 2026." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ghost.json", "live": { "slug": "ghost", "vendorStatus": { "page": "https://ghoststatus.org", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:12.785760962Z" }, "versions": [ { "registry": "github", "name": "TryGhost/Ghost", "version": "v6.75.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:28:07.551181612Z" }, { "registry": "npm", "name": "@tryghost/admin-api", "version": "1.14.14", "seenAt": "2026-11-06T23:28:03.481723829Z" }, { "registry": "npm", "name": "ghost", "version": "6.75.0", "seenAt": "2026-11-06T23:28:03.271076255Z" }, { "registry": "npm", "name": "ghost-cli", "version": "1.34.1", "seenAt": "2026-11-06T23:28:05.5408522Z" } ], "githubStars": 55700, "npmWeekly": 27684, "securityTxt": { "url": "https://ghost.org/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:51.111296428Z" }, "llmsTxt": { "url": "https://docs.ghost.org/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:35.412849236Z" }, "domain": { "domain": "ghost.org", "registered": "2005-06-25", "source": "https://rdap.publicinterestregistry.org/rdap/domain/ghost.org", "checkedAt": "2026-11-01T14:09:34.995895353Z" }, "pages": [ { "url": "https://ghost.org/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:10:26.706948154Z", "changedAt": "2026-11-05T12:33:58.2502144Z", "fingerprint": "d7b08147c021" }, { "url": "https://ghost.org/terms/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:10:29.038519001Z", "changedAt": "2026-11-05T12:34:00.703860998Z", "fingerprint": "65e4a1f15699" } ], "github": { "repo": "tryghost/ghost", "checkedAt": "2026-11-02T09:33:05.874117023Z", "stars": 55656, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:28:37Z", "openIssues": 31, "openPRs": 165, "issuesOpened90d": 68, "issuesClosed90d": 67, "prsMerged90d": 2135, "ci": { "branch": "main", "runs": 50, "success": 44, "failure": 1, "other": 5, "latest": "success", "latestAt": "2026-11-02T06:16:34Z" }, "advisories": [ { "ghsa": "GHSA-cr6m-qrr6-q3j8", "cve": "CVE-2026-84383", "severity": "high", "published": "2026-10-01T15:22:42Z" }, { "ghsa": "GHSA-788w-68h3-cvxp", "cve": "CVE-2026-105642", "severity": "high", "published": "2026-10-01T15:22:29Z" }, { "ghsa": "GHSA-69qc-f5m6-889c", "cve": "CVE-2026-105643", "severity": "high", "published": "2026-10-01T15:20:36Z" }, { "ghsa": "GHSA-hqq2-xqr2-fmx2", "cve": "CVE-2026-105644", "severity": "medium", "published": "2026-10-01T15:20:13Z" }, { "ghsa": "GHSA-9m4w-fmjw-fvjq", "cve": "CVE-2026-105645", "severity": "medium", "published": "2026-10-01T15:19:23Z" }, { "ghsa": "GHSA-fwh9-qg68-vxp4", "cve": "CVE-2026-105646", "severity": "medium", "published": "2026-10-01T15:17:44Z" }, { "ghsa": "GHSA-322m-ff4g-9vx9", "cve": "CVE-2026-105647", "severity": "medium", "published": "2026-09-24T14:25:11Z" }, { "ghsa": "GHSA-r7f2-6fj8-6fg2", "cve": "CVE-2026-105648", "severity": "medium", "published": "2026-09-24T14:24:59Z" }, { "ghsa": "GHSA-8575-cr6v-7jh4", "cve": "CVE-2026-105649", "severity": "high", "published": "2026-09-24T14:24:46Z" }, { "ghsa": "GHSA-v3xr-g6p2-fvgv", "cve": "CVE-2026-105650", "severity": "high", "published": "2026-09-17T18:24:59Z" }, { "ghsa": "GHSA-347q-26qq-h2p6", "cve": "CVE-2026-105651", "severity": "high", "published": "2026-09-17T18:23:00Z" }, { "ghsa": "GHSA-53vv-xm9f-mm82", "cve": "CVE-2026-105652", "severity": "low", "published": "2026-09-17T18:21:33Z" }, { "ghsa": "GHSA-v6q3-xqxm-6f5v", "cve": "CVE-2026-105675", "severity": "high", "published": "2026-09-17T18:19:01Z" }, { "ghsa": "GHSA-m382-6jw4-fmp6", "cve": "CVE-2026-105676", "severity": "medium", "published": "2026-09-17T18:17:57Z" }, { "ghsa": "GHSA-jj74-hc2q-xrvm", "cve": "CVE-2026-105677", "severity": "high", "published": "2026-09-17T18:15:14Z" }, { "ghsa": "GHSA-4pvx-fwjj-8gpc", "cve": "CVE-2026-105678", "severity": "medium", "published": "2026-09-17T18:12:05Z" }, { "ghsa": "GHSA-gfjp-2p8f-94qv", "cve": "CVE-2026-105679", "severity": "high", "published": "2026-09-17T18:02:48Z" }, { "ghsa": "GHSA-rcx7-6m7p-xw5c", "severity": "high", "published": "2026-09-11T15:47:08Z" }, { "ghsa": "GHSA-ffmj-3ppp-cj4r", "severity": "high", "published": "2026-09-11T15:46:48Z" }, { "ghsa": "GHSA-rrq6-9r3c-7w26", "severity": "medium", "published": "2026-09-09T00:22:45Z" }, { "ghsa": "GHSA-mp9q-4q6m-44f5", "cve": "CVE-2026-103292", "severity": "high", "published": "2026-09-08T22:49:46Z" }, { "ghsa": "GHSA-q734-xjgc-vpj9", "severity": "critical", "published": "2026-09-03T20:44:38Z" }, { "ghsa": "GHSA-rv92-9vfp-2826", "severity": "medium", "published": "2026-09-03T20:40:32Z" }, { "ghsa": "GHSA-x3mg-q38v-m562", "cve": "CVE-2026-105680", "severity": "medium", "published": "2026-09-03T20:39:42Z" }, { "ghsa": "GHSA-xcgh-2828-cvmx", "severity": "medium", "published": "2026-09-03T20:39:22Z" }, { "ghsa": "GHSA-qppx-rw6v-xjqf", "severity": "high", "published": "2026-09-03T20:36:45Z" }, { "ghsa": "GHSA-ghq6-q78f-2cpg", "severity": "medium", "published": "2026-08-20T16:58:52Z" }, { "ghsa": "GHSA-5ppm-p957-x46r", "severity": "medium", "published": "2026-08-20T16:57:44Z" }, { "ghsa": "GHSA-jj85-wvj2-r86m", "severity": "medium", "published": "2026-08-20T16:57:23Z" }, { "ghsa": "GHSA-6v8p-3jx9-8chr", "severity": "medium", "published": "2026-08-13T15:00:36Z" }, { "ghsa": "GHSA-5pxf-whwv-g54g", "severity": "high", "published": "2026-08-13T15:00:22Z" }, { "ghsa": "GHSA-v9vj-6fq5-99xj", "severity": "medium", "published": "2026-08-13T15:00:10Z" }, { "ghsa": "GHSA-8vhf-xxpj-4qrg", "severity": "high", "published": "2026-08-13T14:59:47Z" }, { "ghsa": "GHSA-5685-hwm9-62cg", "severity": "medium", "published": "2026-08-13T14:59:34Z" }, { "ghsa": "GHSA-vm82-r49m-224q", "severity": "medium", "published": "2026-08-13T14:55:42Z" }, { "ghsa": "GHSA-q55r-w7fh-rmh6", "severity": "high", "published": "2026-08-13T14:55:25Z" }, { "ghsa": "GHSA-mf3j-vxq2-vmc4", "severity": "medium", "published": "2026-08-13T14:55:04Z" }, { "ghsa": "GHSA-q98w-jm4q-wch7", "severity": "medium", "published": "2026-08-12T15:27:09Z" }, { "ghsa": "GHSA-vf9h-87xm-g767", "severity": "medium", "published": "2026-08-12T15:26:22Z" }, { "ghsa": "GHSA-pv24-pfvg-vr83", "severity": "high", "published": "2026-08-11T16:03:10Z" }, { "ghsa": "GHSA-qrh6-cwg3-343x", "severity": "medium", "published": "2026-08-11T16:02:11Z" }, { "ghsa": "GHSA-6q6j-f24j-p477", "cve": "CVE-2026-105681", "severity": "medium", "published": "2026-08-11T16:01:40Z" }, { "ghsa": "GHSA-354h-gmhv-mr9c", "cve": "CVE-2026-105682", "severity": "low", "published": "2026-08-11T16:01:02Z" }, { "ghsa": "GHSA-83rp-q473-j88c", "cve": "CVE-2026-105683", "severity": "low", "published": "2026-08-11T16:00:28Z" }, { "ghsa": "GHSA-4wx2-7gvj-qfq3", "cve": "CVE-2026-70589", "severity": "medium", "published": "2026-07-30T17:38:18Z" }, { "ghsa": "GHSA-7mpp-r37j-x5wh", "cve": "CVE-2026-70594", "severity": "medium", "published": "2026-07-30T17:38:09Z" }, { "ghsa": "GHSA-2gx6-7gx2-wwcf", "cve": "CVE-2026-70588", "severity": "medium", "published": "2026-07-30T17:37:55Z" }, { "ghsa": "GHSA-cjc9-q5gf-327p", "cve": "CVE-2026-70593", "severity": "medium", "published": "2026-07-30T17:37:42Z" }, { "ghsa": "GHSA-x5mm-wm4g-j5xv", "cve": "CVE-2026-70595", "severity": "medium", "published": "2026-07-30T17:37:32Z" }, { "ghsa": "GHSA-pr22-p9rp-2cqv", "cve": "CVE-2026-70596", "severity": "medium", "published": "2026-07-30T17:37:22Z" }, { "ghsa": "GHSA-cj62-hvv2-2q5h", "cve": "CVE-2026-70592", "severity": "medium", "published": "2026-07-30T17:37:04Z" }, { "ghsa": "GHSA-gcvv-72q8-9v76", "cve": "CVE-2026-70591", "severity": "medium", "published": "2026-07-30T17:36:37Z" }, { "ghsa": "GHSA-jm22-3w23-5q7w", "cve": "CVE-2026-70590", "severity": "medium", "published": "2026-07-30T17:36:22Z" }, { "ghsa": "GHSA-xm43-3m56-w3wf", "cve": "CVE-2026-59817", "severity": "medium", "published": "2026-06-23T19:47:17Z" }, { "ghsa": "GHSA-xpp7-93x6-v29m", "cve": "CVE-2026-53950", "severity": "high", "published": "2026-06-10T08:25:13Z" }, { "ghsa": "GHSA-jx35-x7fj-vgpr", "cve": "CVE-2026-53949", "severity": "medium", "published": "2026-06-10T08:24:57Z" }, { "ghsa": "GHSA-944x-pm95-3jpr", "cve": "CVE-2026-53948", "severity": "medium", "published": "2026-06-10T08:24:43Z" }, { "ghsa": "GHSA-chgm-3698-jm42", "cve": "CVE-2026-53947", "severity": "medium", "published": "2026-06-10T08:24:25Z" }, { "ghsa": "GHSA-g366-23fw-ggp6", "cve": "CVE-2026-53946", "severity": "medium", "published": "2026-06-10T08:24:06Z" }, { "ghsa": "GHSA-ch52-px8q-f22j", "cve": "CVE-2026-53945", "severity": "medium", "published": "2026-06-10T08:23:44Z" }, { "ghsa": "GHSA-wvp2-4qqp-4h3r", "cve": "CVE-2026-53944", "severity": "medium", "published": "2026-06-10T08:23:16Z" }, { "ghsa": "GHSA-62q6-4hv4-vjrw", "cve": "CVE-2026-53943", "severity": "critical", "published": "2026-05-28T07:03:25Z" }, { "ghsa": "GHSA-9m84-wc28-w895", "cve": "CVE-2026-29784", "severity": "high", "published": "2026-03-04T17:51:38Z" }, { "ghsa": "GHSA-cgc2-rcrh-qr5x", "cve": "CVE-2026-29053", "severity": "high", "published": "2026-03-02T15:45:46Z" }, { "ghsa": "GHSA-w52v-v783-gw97", "cve": "CVE-2026-26980", "severity": "critical", "published": "2026-02-16T18:04:35Z" }, { "ghsa": "GHSA-gv6q-2m97-882h", "cve": "CVE-2026-24778", "severity": "high", "published": "2026-01-27T12:28:29Z" }, { "ghsa": "GHSA-gjrp-xgmh-x9qq", "cve": "CVE-2026-22596", "severity": "medium", "published": "2026-01-08T14:38:23Z" }, { "ghsa": "GHSA-vmc4-9828-r48r", "cve": "CVE-2026-22597", "severity": "medium", "published": "2026-01-08T14:38:01Z" }, { "ghsa": "GHSA-9xg7-mwmp-xmjx", "cve": "CVE-2026-22595", "severity": "high", "published": "2026-01-08T14:37:41Z" }, { "ghsa": "GHSA-5fp7-g646-ccf4", "cve": "CVE-2026-22594", "severity": "high", "published": "2026-01-08T14:37:08Z" }, { "ghsa": "GHSA-f7qg-xj45-w956", "cve": "CVE-2025-9862", "severity": "medium", "published": "2025-09-14T13:48:18Z" }, { "ghsa": "GHSA-78x2-cwp9-5j42", "cve": "CVE-2024-43409", "severity": "medium", "published": "2024-08-20T14:43:13Z" }, { "ghsa": "GHSA-9c9v-w225-v5rg", "cve": "CVE-2023-40028", "severity": "medium", "published": "2023-08-15T11:36:14Z" }, { "ghsa": "GHSA-r97q-ghch-82j9", "cve": "CVE-2023-31133", "severity": "high", "published": "2023-05-03T12:55:49Z" }, { "ghsa": "GHSA-9gh8-wp53-ccc6", "cve": "CVE-2022-41654", "severity": "high", "published": "2022-11-28T15:06:43Z" }, { "ghsa": "GHSA-7v28-g2pq-ggg8", "cve": "CVE-2022-24785", "severity": "medium", "published": "2022-06-15T03:15:13Z" }, { "ghsa": "GHSA-65p7-pjj8-ggmr", "severity": "medium", "published": "2021-09-23T10:28:44Z" }, { "ghsa": "GHSA-wfrj-qqc2-83cm", "severity": "medium", "published": "2021-09-17T16:10:16Z" }, { "ghsa": "GHSA-j5c2-hm46-wp5c", "cve": "CVE-2021-39192", "severity": "medium", "published": "2021-07-20T15:15:46Z" }, { "ghsa": "GHSA-9fgx-q25h-jxrg", "cve": "CVE-2021-29484", "severity": "high", "published": "2021-04-29T11:19:15Z" } ], "replies": { "sampled": 25, "unanswered": 0, "medianDays": 4.8 } }, "updatedAt": "2026-11-07T18:21:12.785760962Z" } }, "edges": [ { "by": 37, "category": "schema", "leads": "cosmic", "name": "Schema \u0026 documentation", "reasons": { "a": "openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.", "b": "Per the 8 October check, not re-read on 4 November (docs host paused under the terms). No OpenAPI or similar file was found in the docs index or the repository (0 of 25). llms.txt with 177 links, llms-full.txt and a Markdown copy of every page (10). The reference states what each endpoint does and which fields are required, with little on when not to use one (10 of 20). No published schemas. Required fields are named (`title` on create, `updated_at` on edit), and post content is one Lexical JSON string (6 of 15). Request and response examples on each page and token generation in Bash, JavaScript, Ruby and Python. The errors page lists five status codes and the `errorType` and `message` fields, without a list per endpoint (10 of 15). `Accept-Version` header, a stability index per endpoint, a breaking changes page and release notes (15)." }, "scores": { "a": 88, "b": 51 } }, { "by": 13, "category": "ergonomics", "leads": "cosmic", "name": "Agent ergonomics", "reasons": { "a": "24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.", "b": "Per the 8 October check, not re-read on 4 November (docs host paused under the terms). `fields`, `include` and `formats` size a response, and lists return 15 records by default (20 of 25). `page`, `limit` up to 100, `order` and a `filter` query language, with `meta.pagination` on every list (20). Errors are JSON with `message` and `errorType`, and the documented list is short (13 of 20). No idempotency keys. A PUT must carry the current `updated_at` and is refused on a collision, and a repeated POST creates a second post (8 of 20). A create needs only `title`. The one official client is JavaScript, @tryghost/admin-api (8 of 15)." }, "scores": { "a": 82, "b": 69 } }, { "by": 12, "category": "transparency", "leads": "ghost", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.", "b": "MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and `useTinfoil` for all. The default configuration also points `updateCheck` at updates.ghost.org, which that section doesn't list; the 4 November source sends only `ghost_version` in that request (13 of 20)." }, "scores": { "a": 63, "b": 75 } }, { "by": 9, "category": "security", "leads": "ghost", "name": "Security \u0026 auth", "reasons": { "a": "Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.", "b": "An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at `GET /actions`. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20)." }, "scores": { "a": 47, "b": 56 } }, { "by": 7, "category": "reliability", "leads": "cosmic", "name": "Reliability", "reasons": { "a": "Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.", "b": "Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official `ghost` package on npm, with Node.js ^22.23.1 or ^24.20.0 in `engines` in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of `limit=all` documented there (13 of 15). 6.x is the current stable line (15)." }, "scores": { "a": 90, "b": 83 } }, { "by": 5, "category": "payments", "leads": "ghost", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.", "b": "Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10)." }, "scores": { "a": 45, "b": 50 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Cosmic Inc.", "b": "Ghost Foundation", "name": "Vendor" }, { "a": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms", "name": "Licence" }, { "a": "24", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.cosmicjs/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-11-02", "b": "2026-11-03", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "no date given", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "295 npm/wk", "b": "56k stars, 24k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Cosmic scores 72.5 (BB) on agent readiness against Ghost's 51.2 (D), and leads in 4 of 7 scored categories. Ghost leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, Cosmic or Ghost?" }, { "answer": "Both need an API key.", "question": "Do Cosmic and Ghost need an API key?" }, { "answer": "Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. No hosted endpoint is listed for Ghost.", "question": "Can an agent call Cosmic and Ghost without installing anything?" }, { "answer": "No open-source release is listed for Cosmic. Ghost is open source (MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms).", "question": "Are Cosmic and Ghost open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 90 against 83", "Schema \u0026 documentation, 88 against 51", "Agent ergonomics, 82 against 69" ], "also": [ "Agent-ready, a grade of BB or better", "A hosted endpoint, with nothing to install", "Runs on your own machine", "Free to start without a card", "No incidents deducted, where Ghost loses 15 points for them" ], "goodFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "slug": "cosmic", "watchFor": "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement" }, { "aheadOn": [ "Security \u0026 auth, 56 against 47", "Payments \u0026 pricing, 50 against 45", "Transparency \u0026 trust, 75 against 63" ], "also": [ "Open source" ], "goodFor": "A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.", "slug": "ghost", "watchFor": "No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository" } ], "history": { "cosmic": null, "ghost": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-04", "delta": -7.4, "from": 58.6, "fromGrade": "C", "to": 51.2, "toGrade": "D" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.2, "from": 58.4, "fromGrade": "C", "to": 58.6, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 58.3, "fromGrade": "C", "to": 58.4, "toGrade": "C" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-ghost.json", "title": "BCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/bcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic.json", "title": "ButterCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-ghost.json", "title": "ButterCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/buttercms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic.json", "title": "Contentstack vs Cosmic", "url": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-ghost.json", "title": "Contentstack vs Ghost", "url": "https://www.anchorterminal.com/compare/contentstack-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-datocms.json", "title": "Cosmic vs DatoCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-directus.json", "title": "Cosmic vs Directus", "url": "https://www.anchorterminal.com/compare/cosmic-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph.json", "title": "Cosmic vs Hygraph", "url": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.json", "title": "Cosmic vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-payload.json", "title": "Cosmic vs Payload", "url": "https://www.anchorterminal.com/compare/cosmic-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-prismic.json", "title": "Cosmic vs Prismic", "url": "https://www.anchorterminal.com/compare/cosmic-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-sanity.json", "title": "Cosmic vs Sanity", "url": "https://www.anchorterminal.com/compare/cosmic-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok.json", "title": "Cosmic vs Storyblok", "url": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.json", "title": "Cosmic vs Strapi", "url": "https://www.anchorterminal.com/compare/cosmic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.json", "title": "Cosmic vs Webflow", "url": "https://www.anchorterminal.com/compare/cosmic-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json", "title": "Cosmic vs WordPress", "url": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-ghost.json", "title": "DatoCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/datocms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-ghost.json", "title": "Directus vs Ghost", "url": "https://www.anchorterminal.com/compare/directus-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-ghost.json", "title": "dotCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/dotcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-hygraph.json", "title": "Ghost vs Hygraph", "url": "https://www.anchorterminal.com/compare/ghost-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-kontent-ai.json", "title": "Ghost vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/ghost-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-payload.json", "title": "Ghost vs Payload", "url": "https://www.anchorterminal.com/compare/ghost-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-prismic.json", "title": "Ghost vs Prismic", "url": "https://www.anchorterminal.com/compare/ghost-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-sanity.json", "title": "Ghost vs Sanity", "url": "https://www.anchorterminal.com/compare/ghost-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-storyblok.json", "title": "Ghost vs Storyblok", "url": "https://www.anchorterminal.com/compare/ghost-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-strapi.json", "title": "Ghost vs Strapi", "url": "https://www.anchorterminal.com/compare/ghost-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-webflow.json", "title": "Ghost vs Webflow", "url": "https://www.anchorterminal.com/compare/ghost-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-wordpress.json", "title": "Ghost vs WordPress", "url": "https://www.anchorterminal.com/compare/ghost-vs-wordpress" } ], "panel": null, "scores": [ { "by": 7, "cosmic": 90, "edge": "cosmic", "ghost": 83, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 37, "cosmic": 88, "edge": "cosmic", "ghost": 51, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 13, "cosmic": 82, "edge": "cosmic", "ghost": 69, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 9, "cosmic": 47, "edge": "ghost", "ghost": 56, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 5, "cosmic": 45, "edge": "ghost", "ghost": 50, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 1, "cosmic": 86, "edge": "cosmic", "ghost": 85, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 12, "cosmic": 63, "edge": "ghost", "ghost": 75, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Cosmic scores 72.5 (BB) on agent readiness against Ghost's 51.2 (D), and leads in 4 of 7 scored categories. Ghost leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "cosmic": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "ghost": "A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cosmic-vs-ghost", "json": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.min.md" }, "markdown": "Cosmic scores 72.5 (BB) on agent readiness against Ghost's 51.2 (D), and leads in 4 of 7 scored categories. Ghost leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust. Both do content management.\n\n- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json\n- Ghost: grade D, 51.2/100, rank #1027 of 1486. Markdown https://www.anchorterminal.com/tools/ghost.md · JSON https://www.anchorterminal.com/api/v1/tools/ghost.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### Cosmic (BB)\n\nGood for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.\n\nAhead on:\n- Reliability, 90 against 83\n- Schema \u0026 documentation, 88 against 51\n- Agent ergonomics, 82 against 69\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- Free to start without a card\n- No incidents deducted, where Ghost loses 15 points for them\n\nWatch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement\n\n### Ghost (D)\n\nGood for: A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.\n\nAhead on:\n- Security \u0026 auth, 56 against 47\n- Payments \u0026 pricing, 50 against 45\n- Transparency \u0026 trust, 75 against 63\n\nAlso in its favour:\n- Open source\n\nWatch for: No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Cosmic +37\n\n- Cosmic (88): openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.\n- Ghost (51): Per the 8 October check, not re-read on 4 November (docs host paused under the terms). No OpenAPI or similar file was found in the docs index or the repository (0 of 25). llms.txt with 177 links, llms-full.txt and a Markdown copy of every page (10). The reference states what each endpoint does and which fields are required, with little on when not to use one (10 of 20). No published schemas. Required fields are named (`title` on create, `updated_at` on edit), and post content is one Lexical JSON string (6 of 15). Request and response examples on each page and token generation in Bash, JavaScript, Ruby and Python. The errors page lists five status codes and the `errorType` and `message` fields, without a list per endpoint (10 of 15). `Accept-Version` header, a stability index per endpoint, a breaking changes page and release notes (15).\n\n### Agent ergonomics: Cosmic +13\n\n- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.\n- Ghost (69): Per the 8 October check, not re-read on 4 November (docs host paused under the terms). `fields`, `include` and `formats` size a response, and lists return 15 records by default (20 of 25). `page`, `limit` up to 100, `order` and a `filter` query language, with `meta.pagination` on every list (20). Errors are JSON with `message` and `errorType`, and the documented list is short (13 of 20). No idempotency keys. A PUT must carry the current `updated_at` and is refused on a collision, and a repeated POST creates a second post (8 of 20). A create needs only `title`. The one official client is JavaScript, @tryghost/admin-api (8 of 15).\n\n### Transparency \u0026 trust: Ghost +12\n\n- Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.\n- Ghost (75): MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and `useTinfoil` for all. The default configuration also points `updateCheck` at updates.ghost.org, which that section doesn't list; the 4 November source sends only `ghost_version` in that request (13 of 20).\n\n### Security \u0026 auth: Ghost +9\n\n- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.\n- Ghost (56): An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at `GET /actions`. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20).\n\n### Reliability: Cosmic +7\n\n- Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.\n- Ghost (83): Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official `ghost` package on npm, with Node.js ^22.23.1 or ^24.20.0 in `engines` in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of `limit=all` documented there (13 of 15). 6.x is the current stable line (15).\n\n### Payments \u0026 pricing: Ghost +5\n\n- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.\n- Ghost (50): Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10).\n\n## Score by category\n\n| Category | Weight | Cosmic | Ghost | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 90 | 83 | Cosmic +7 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 88 | 51 | Cosmic +37 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 69 | Cosmic +13 |\n| Security \u0026 auth | 14% (17.5 this run) | 47 | 56 | Ghost +9 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 50 | Ghost +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 86 | 85 | Cosmic +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 75 | Ghost +12 |\n| Negative events | ≤15 | 0 | -15 | |\n| **Total** | | **72.5 · BB** | **51.2 · D** | |\n\n## Facts side by side\n\n| Fact | Cosmic | Ghost |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Cosmic Inc. | Ghost Foundation |\n| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | no (local only) |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP |\n| Auth | API key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | none | MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms |\n| Tools exposed | 24 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.cosmicjs/mcp` | not listed |\n| Last release | 2026-11-02 | 2026-11-03 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | no date given | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 295 npm/wk | 56k stars, 24k npm/wk |\n\n## How the scores have moved\n\n### Cosmic\n\nNo score change since it was listed.\n\n### Ghost\n\n- -7.4 on 4 November 2026 (C to D): new evidence, correction\n- +0.2 on 28 October 2026: new evidence\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.\n\n**Ghost.** A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical.\n\n## Before you call either\n\n### Cosmic\n\n1. Send only the read key in the Bearer token unless the task needs writes\n2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days\n3. Fix and don't retry on 400; wait and retry on 429\n4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit\n5. Confirm with the user before cosmic_objects_delete, which deletes permanently\n\n### Ghost\n\n1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set `kid` to the key id, `aud` to `/admin/` and `exp` at most 5 minutes ahead\n2. Set `status` to `draft` on every create unless told to publish, and publish later with a PUT that sets `status` to `published`\n3. GET the post before each PUT and send its `updated_at` back. Tags and authors in a PUT replace the existing lists\n4. Send content as a Lexical JSON string, or add `?source=html` and send `html`. The HTML conversion is lossy unless wrapped in an HTML card\n5. Page through lists with `limit` up to 100 and `page`. Since Ghost 6.0 `limit=all` returns 100 items without an error\n\n## Questions\n\n### Which is better for AI agents, Cosmic or Ghost?\n\nCosmic scores 72.5 (BB) on agent readiness against Ghost's 51.2 (D), and leads in 4 of 7 scored categories. Ghost leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.\n\n### Do Cosmic and Ghost need an API key?\n\nBoth need an API key.\n\n### Can an agent call Cosmic and Ghost without installing anything?\n\nCosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. No hosted endpoint is listed for Ghost.\n\n### Are Cosmic and Ghost open source?\n\nNo open-source release is listed for Cosmic. Ghost is open source (MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-ghost.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-ghost.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cosmic\", \"b\": \"ghost\"}`. From a terminal: `anchor compare cosmic ghost`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/ghost.json\n\n## Other comparisons with Cosmic or Ghost\n\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs Ghost](https://www.anchorterminal.com/compare/bcms-vs-ghost.md)\n- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)\n- [ButterCMS vs Ghost](https://www.anchorterminal.com/compare/buttercms-vs-ghost.md)\n- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)\n- [Contentstack vs Ghost](https://www.anchorterminal.com/compare/contentstack-vs-ghost.md)\n- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)\n- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)\n- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)\n- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)\n- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)\n- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)\n- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)\n- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)\n- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)\n- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)\n- [DatoCMS vs Ghost](https://www.anchorterminal.com/compare/datocms-vs-ghost.md)\n- [Directus vs Ghost](https://www.anchorterminal.com/compare/directus-vs-ghost.md)\n- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)\n- [Ghost vs Hygraph](https://www.anchorterminal.com/compare/ghost-vs-hygraph.md)\n- [Ghost vs Kontent.ai](https://www.anchorterminal.com/compare/ghost-vs-kontent-ai.md)\n- [Ghost vs Payload](https://www.anchorterminal.com/compare/ghost-vs-payload.md)\n- [Ghost vs Prismic](https://www.anchorterminal.com/compare/ghost-vs-prismic.md)\n- [Ghost vs Sanity](https://www.anchorterminal.com/compare/ghost-vs-sanity.md)\n- [Ghost vs Storyblok](https://www.anchorterminal.com/compare/ghost-vs-storyblok.md)\n- [Ghost vs Strapi](https://www.anchorterminal.com/compare/ghost-vs-strapi.md)\n- [Ghost vs Webflow](https://www.anchorterminal.com/compare/ghost-vs-webflow.md)\n- [Ghost vs WordPress](https://www.anchorterminal.com/compare/ghost-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cosmic vs Ghost", "url": "" } ], "description": "Cosmic scores 72.5 (BB) to Ghost's 51.2 (D) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cosmic BB 72.5", "Ghost D 51.2", "scores" ], "h1": "Cosmic vs Ghost", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cosmic-vs-ghost", "published": "2026-10-01", "section": "tools", "title": "Cosmic vs Ghost for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cosmic-vs-ghost" }, "tokens": { "markdown": 4750, "slim": 2830 }, "version": 1 }