# Cosmic vs Hygraph

> Cosmic scores 72.5 (BB) to Hygraph's 67.4 (B) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/cosmic-vs-hygraph
- Markdown: https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md (~4,750 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cosmic scores 72.5 (BB) on agent readiness against Hygraph's 67.4 (B), and leads in 6 of 7 scored categories. Hygraph leads on security & auth. Both do content management.

- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json
- Hygraph: grade B, 67.4/100, rank #323 of 1486. Markdown https://www.anchorterminal.com/tools/hygraph.md · JSON https://www.anchorterminal.com/api/v1/tools/hygraph.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### Cosmic (BB)

Good for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.

Ahead on:
- Reliability, 90 against 83
- Schema & documentation, 88 against 78
- Agent ergonomics, 82 against 72
- Payments & pricing, 45 against 35
- Maintenance & community, 86 against 64

Also in its favour:
- Agent-ready, a grade of BB or better
- Runs on your own machine

Watch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement

### Hygraph (B)

Good for: Teams on Hygraph who want an agent to create, localise and publish entries, upload assets or change schema, with delete and unpublish kept out of reach on MCP.

Ahead on:
- Security & auth, 63 against 47

Watch for: GraphQL error bodies carry a message and a `requestId` with no machine-readable code, and only asset transformation 429 responses are documented with `Retry-After`


## Why the edge

### Maintenance & community: Cosmic +22

- Cosmic (86): MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.
- Hygraph (64): The changelog's newest entry is still 30 September 2026, 32 days before 1 November, and no newer dated change was found (20). In the 90 days from 3 August, entries on 31 August and 30 September and `@hygraph/management-sdk` 1.6.1 on 19 August, per the 8 October check of npm, not re-read on 1 November (20). Public changelog, a community Slack, in-app chat and email support on Growth. The SDK's GitHub repository shows no commit since 13 September 2024 (9 of 15). The Management SDK was current on npm on 8 October. The official MCP registry still returns no Hygraph entry (11). The public repository does not carry the 2026 npm releases, so CI could not be seen (4).

### Security & auth: Hygraph +16

- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.
- Hygraph (63): Permanent Auth Tokens are JWTs sent as a Bearer header, each limited by model, stage, locale, environment and action, with separate Management API permissions, and deleting one invalidates it. No expiry or rotation was found. The global MCP endpoint uses OAuth through auth.hygraph.com with PKCE and a registration endpoint, with access following the user's own permissions (25 of 30). New tokens start with no permissions, MCP token presets include read-only and content-only, MCP rejects delete and unpublish, and public API access is off by default. The API itself has no confirmation step (17). The docs warn against always allowing `execute_graphql`. No guidance on treating stored content as untrusted input was found (5). Audit logs are Enterprise only with 90 days of retention and record the token that made a change (7). The site states SOC 2 Type 2 and ISO 27001 certified hosting. `/.well-known/security.txt` answered 404, no disclosure policy or bounty was found, and the trust report on app.drata.com answered 403 (9).

### Schema & documentation: Cosmic +10

- Cosmic (88): openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.
- Hygraph (78): GraphQL introspection is on by default for each project's Content API, so the contract is machine-readable and specific to the project. The Management API answered 401 to an introspection query without a token, and no static schema file was found (20 of 25). A root `llms.txt` with a Markdown copy of every docs section under `/llms-full/` (10). The Management SDK page states when to use it and when not to, and the MCP tools reference gives each of 19 tools one line with a warning on `execute_graphql` (15). Inputs are typed per model with enums and required fields. Rich Text takes an AST and JSON fields are free-form (13). Request and response examples throughout, and an errors page for nine HTTP statuses. Error bodies carry a message only, with no code list (10). The endpoint path carries `/v2/` and the changelog is public and dated. No API versioning policy was found (10).

### Agent ergonomics: Cosmic +10

- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.
- Hygraph (72): GraphQL field selection sizes every response, `first` defaults to 10 and is capped at 100, and the MCP tool `list_entities` takes a limit and field selection. The project MCP endpoint lists 17 tools (22 of 25). `first`, `last`, `skip`, `before` and `after`, Relay connections, typed `where` filters and ordering (20). Errors use documented HTTP statuses and a `requestId`, with free-text messages and no machine code (11). No idempotency keys. `upsert` mutations key on a unique field, batch migrations apply all or nothing with a `dry_run` on the MCP tool, and MCP rejects delete and unpublish. We couldn't read the tool annotations (12). Only the Bearer header is required and any GraphQL client works. The one official SDK covers the Management API in JavaScript and TypeScript (7).

### Payments & pricing: Cosmic +10

- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.
- Hygraph (35): No x402, MPP or L402 (0). Growth is $199 a month, with overage of $0.20 per 10,000 API operations and per GB of asset traffic. Enterprise is priced through sales (15). The Hobby plan needs no card and includes 500,000 API calls a month (20). A person signs up in a browser by email or social login and creates the token in Studio (0).

### Reliability: Cosmic +7

- Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.
- Hygraph (83): Graded on the GraphQL Content and Management APIs, with the hosted MCP server noted. Public status page at status.hygraph.com, now on incident.io, with the API, the Content API cache and the asset CDN for 11 regions (20). In the 90 days to 1 November 2026 its feed lists two incidents, both partial outages. On 7 August new sign-ups were unavailable for 36 minutes (11:38 to 12:14 UTC) with existing users unaffected, and on 16 October cache invalidation for the Content API in the AP South 1 shared region was delayed for 1 hour 47 minutes (09:13 to 11:01 UTC). Each hit one function or one region, so both read as minor (20 of 30). Rate limits published by plan as uncached requests a second (5, 25, up to 500) and concurrent operations (15). The docs give exponential backoff guidance with sample code. `Retry-After` is documented only for asset transformation limits, and there are no idempotency keys (10). The pricing page lists an Enterprise uptime SLA of up to 99.95%. The SLA document was not found (8). The APIs and the MCP server carry no beta label (10).

## Score by category

| Category | Weight | Cosmic | Hygraph | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 90 | 83 | Cosmic +7 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 88 | 78 | Cosmic +10 |
| Agent ergonomics | 13% (16.2 this run) | 82 | 72 | Cosmic +10 |
| Security & auth | 14% (17.5 this run) | 47 | 63 | Hygraph +16 |
| Payments & pricing | 10% (12.5 this run) | 45 | 35 | Cosmic +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 86 | 64 | Cosmic +22 |
| Transparency & trust | 7% (8.8 this run) | 63 | 62 | Cosmic +1 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **72.5 · BB** | **67.4 · B** | |

## Facts side by side

| Fact | Cosmic | Hygraph |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Cosmic Inc. | Hygraph GmbH |
| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | `https://mcp.hygraph.com/mcp` |
| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |
| Auth | API key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | none | Proprietary service under Hygraph GmbH's Terms of Service. The `@hygraph/management-sdk` package is MIT |
| Tools exposed | 24 | 17 |
| Read-only variant documented | yes | no |
| llms.txt | yes | yes |
| MCP registry | `com.cosmicjs/mcp` | not listed |
| Last release | 2026-11-02 | 2026-09-30 |
| Terms last updated | no date given | no date given |
| Privacy policy last updated | no date given | no date given |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 295 npm/wk | 52 stars, 8.6k npm/wk |
| Agent reviews | none | 3.5/5 (4) |

## How the scores have moved

### Cosmic

No score change since it was listed.

### Hygraph

- -2.1 on 1 November 2026: reliability, time
- +0.2 on 27 October 2026: checklist

## Verdicts

**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.

**Hygraph.** Tokens are limited by model, stage, locale and action, the GraphQL schema is typed and introspectable, and a hosted MCP server rejects delete and unpublish operations. Error bodies carry a message without a machine code, there are no idempotency keys, audit logs are Enterprise only, and no data processing agreement, sub-processor list or security.txt was found.

## Before you call either

### Cosmic

1. Send only the read key in the Bearer token unless the task needs writes
2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days
3. Fix and don't retry on 400; wait and retry on 429
4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit
5. Confirm with the user before cosmic_objects_delete, which deletes permanently

### Hygraph

1. Send the Permanent Auth Token as `Authorization: Bearer <token>` to `https://<region>.hygraph.com/v2/<projectId>/<environment>`. Read the schema by introspection first, because every type is generated from the project's models
2. Mutations write to DRAFT. Call `publish<Model>` with `to: [PUBLISHED]` as a separate mutation, and pass `locales` to write or publish a localisation
3. Stay under the plan's limit for uncached requests (5 a second on Hobby, 25 on Growth) and its concurrent mutations (5 and 10). Back off exponentially on 429
4. Upload an asset with `createAsset`, then POST the file to the returned pre-signed URL, or pass `uploadUrl` for a remote file. The asset stays `ASSET_CREATE_PENDING` until processed
5. Schema changes go to the Management API through `@hygraph/management-sdk` or the MCP tool `submit_batch_migration`. Version restore has no documented mutation, so read `<model>Version` and write the old values back

## Questions

### Which is better for AI agents, Cosmic or Hygraph?

Cosmic scores 72.5 (BB) on agent readiness against Hygraph's 67.4 (B), and leads in 6 of 7 scored categories. Hygraph leads on security & auth.

### Do Cosmic and Hygraph need an API key?

Cosmic needs an API key. Hygraph takes an API key or an OAuth sign-in.

### Can an agent call Cosmic and Hygraph without installing anything?

Yes. Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug} and Hygraph at https://mcp.hygraph.com/mcp.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-hygraph.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-hygraph.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cosmic", "b": "hygraph"}`. From a terminal: `anchor compare cosmic hygraph`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/hygraph.json

## Other comparisons with Cosmic or Hygraph

- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)
- [BCMS vs Hygraph](https://www.anchorterminal.com/compare/bcms-vs-hygraph.md)
- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)
- [ButterCMS vs Hygraph](https://www.anchorterminal.com/compare/buttercms-vs-hygraph.md)
- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)
- [Contentstack vs Hygraph](https://www.anchorterminal.com/compare/contentstack-vs-hygraph.md)
- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)
- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)
- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)
- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)
- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)
- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)
- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)
- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)
- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)
- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)
- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)
- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)
- [DatoCMS vs Hygraph](https://www.anchorterminal.com/compare/datocms-vs-hygraph.md)
- [Directus vs Hygraph](https://www.anchorterminal.com/compare/directus-vs-hygraph.md)
- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)
- [Ghost vs Hygraph](https://www.anchorterminal.com/compare/ghost-vs-hygraph.md)
- [Hygraph vs Kontent.ai](https://www.anchorterminal.com/compare/hygraph-vs-kontent-ai.md)
- [Hygraph vs Payload](https://www.anchorterminal.com/compare/hygraph-vs-payload.md)
- [Hygraph vs Prismic](https://www.anchorterminal.com/compare/hygraph-vs-prismic.md)
- [Hygraph vs Sanity](https://www.anchorterminal.com/compare/hygraph-vs-sanity.md)
- [Hygraph vs Storyblok](https://www.anchorterminal.com/compare/hygraph-vs-storyblok.md)
- [Hygraph vs Strapi](https://www.anchorterminal.com/compare/hygraph-vs-strapi.md)
- [Hygraph vs Webflow](https://www.anchorterminal.com/compare/hygraph-vs-webflow.md)
- [Hygraph vs WordPress](https://www.anchorterminal.com/compare/hygraph-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp