# Cosmic vs Ghost (slim)

> Cosmic scores 72.5 (BB) to Ghost's 51.2 (D) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cosmic-vs-ghost.md (~4,750 tokens) · this version ~2,830 tokens · JSON https://www.anchorterminal.com/compare/cosmic-vs-ghost.json · canonical https://www.anchorterminal.com/compare/cosmic-vs-ghost
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Cosmic scores 72.5 (BB) on agent readiness against Ghost's 51.2 (D), and leads in 4 of 7 scored categories. Ghost leads on security & auth, payments & pricing and transparency & trust. Both do content management.

- Cosmic: BB 72.5, rank #123 of 1486 · https://www.anchorterminal.com/tools/cosmic.min.md
- Ghost: D 51.2, rank #1027 of 1486 · https://www.anchorterminal.com/tools/ghost.min.md
- Cosmic, good for Teams that want an agent to set up and fill a hosted CMS end to end, including signup. Ahead on Reliability, 90 against 83; Schema & documentation, 88 against 51; Agent ergonomics, 82 against 69. Also Agent-ready, a grade of BB or better; A hosted endpoint, with nothing to install; Runs on your own machine; Free to start without a card; No incidents deducted, where Ghost loses 15 points for them.
- Ghost, good for A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes. Ahead on Security & auth, 56 against 47; Payments & pricing, 50 against 45; Transparency & trust, 75 against 63. Also Open source.

| Category | Cosmic | Ghost |
| --- | --- | --- |
| Reliability (16%) | 90 | 83 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 88 | 51 |
| Agent ergonomics (13%) | 82 | 69 |
| Security & auth (14%) | 47 | 56 |
| Payments & pricing (10%) | 45 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 86 | 85 |
| Transparency & trust (7%) | 63 | 75 |

| Fact (where they differ) | Cosmic | Ghost |
| --- | --- | --- |
| Vendor | Cosmic Inc. | Ghost Foundation |
| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | no (local only) |
| Transports | HTTP, Streamable HTTP, stdio | HTTP |
| Licence | none | MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms |
| Tools exposed | 24 | none |
| Read-only variant documented | yes | no |
| MCP registry | `com.cosmicjs/mcp` | not listed |
| Last release | 2026-11-02 | 2026-11-03 |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 295 npm/wk | 56k stars, 24k npm/wk |

Why the edge:
- Schema & documentation, Cosmic +37: Cosmic 88 (openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.); Ghost 51 (Per the 8 October check, not re-read on 4 November (docs host paused under the terms). No OpenAPI or similar file was found in the docs index or the repository (0 of 25). llms.txt with 177 links, llms-full.txt and a Markdown copy of every page (10). The reference states what each endpoint does and which fields are required, with little on when not to use one (10 of 20). No published schemas. Required fields are named (`title` on create, `updated_at` on edit), and post content is one Lexical JSON string (6 of 15). Request and response examples on each page and token generation in Bash, JavaScript, Ruby and Python. The errors page lists five status codes and the `errorType` and `message` fields, without a list per endpoint (10 of 15). `Accept-Version` header, a stability index per endpoint, a breaking changes page and release notes (15).)
- Agent ergonomics, Cosmic +13: Cosmic 82 (24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.); Ghost 69 (Per the 8 October check, not re-read on 4 November (docs host paused under the terms). `fields`, `include` and `formats` size a response, and lists return 15 records by default (20 of 25). `page`, `limit` up to 100, `order` and a `filter` query language, with `meta.pagination` on every list (20). Errors are JSON with `message` and `errorType`, and the documented list is short (13 of 20). No idempotency keys. A PUT must carry the current `updated_at` and is refused on a collision, and a repeated POST creates a second post (8 of 20). A create needs only `title`. The one official client is JavaScript, @tryghost/admin-api (8 of 15).)
- Transparency & trust, Ghost +12: Cosmic 63 (A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.); Ghost 75 (MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and `useTinfoil` for all. The default configuration also points `updateCheck` at updates.ghost.org, which that section doesn't list; the 4 November source sends only `ghost_version` in that request (13 of 20).)
- Security & auth, Ghost +9: Cosmic 47 (Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.); Ghost 56 (An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at `GET /actions`. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20).)
- Reliability, Cosmic +7: Cosmic 90 (Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.); Ghost 83 (Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official `ghost` package on npm, with Node.js ^22.23.1 or ^24.20.0 in `engines` in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of `limit=all` documented there (13 of 15). 6.x is the current stable line (15).)
- Payments & pricing, Ghost +5: Cosmic 45 (No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.); Ghost 50 (Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10).)