Cosmic vs Kontent.ai

Cosmic 47

Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give read_key as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.

Kontent.ai 81

Management API keys have selectable permissions, environment limits, an expiry from 1 minute to 2 years (6 months by default), email reminders before expiry and revocation by regenerating. Keys travel only in the Authorization header, and the hosted MCP server takes a Management API key in that header and rejects personal keys. There is no OAuth (27 of 30). A key can be read-only, the API follows the workflow transition rules, and the MCP server marks 22 tools destructive so a client can prompt. Neither surface has its own confirmation step (15 of 20). Content is written by a project's own users and can carry instructions. The MCP README and, since the hosted server, the MCP docs page warn about prompt injection and recommend a least-privilege key. The API docs say nothing on it (10 of 15). The audit log keeps 90 days and names the API key behind each change, with content item changes included since 2 October 2026. No API for reading it was found (12 of 15). security.txt is valid to 21 July 2027, re-read on 1 November, the disclosure policy has a safe harbour and discretionary rewards, a penetration testing policy lets customers test, and the trust centre lists SOC 2 Type 2 and ISO 27001, 27017, 27018 and 42001. Reports are gated and no public advisories were found. We did not search NVD (17 of 20).

Cosmic 45

No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.

Kontent.ai 20

Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page, re-read on 1 November, publishes no figure. It shows sliders and a form that requests a calculation, and the terms place prices in an order form (0). The trial page says 30 days free with no credit card and full API access. We did not run the sign-up form (20). A person signs up in a browser, enables the Management API and creates the key in the web app (0).

Cosmic 88

openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.

Kontent.ai 74

No OpenAPI file was found on the docs pages read. The reference links a Postman collection in a public workspace, which we did not read, and the MCP server's tools have typed schemas in its source (15 of 25). kontent.ai/llms.txt exists and is an index of marketing and docs pages. No Markdown copies of the docs were found, only PDF downloads (5 of 10). Each endpoint states its purpose and its limits, for example that scheduling a published variant has no effect and which endpoint to use instead (15 of 20). Attributes are typed with required, read-only and write-only flags, formats and length limits. Element values vary by element type (12 of 15). Each operation has request samples in TypeScript, C# and cURL, response status codes and an error object with validation paths (13 of 15). The version is in the path, product updates are dated with an RSS feed, breaking changes can be had by email, and a page lists which changes are not treated as breaking (14 of 15). The reference pages are per the 9 October check, not re-read on 1 November.

Cosmic 63

A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.

Kontent.ai 76

The service is closed under Terms of Service effective 11 September 2026, re-read on 1 November. The SDKs and MCP server are MIT (15). The terms include a Data Processing Addendum and an AI annex that rules out training on customer content, and the privacy policy of 2 June 2025 covers product users. The periods differ by document. Content is kept 30 days after a subscription ends, the addendum says personal data is returned or deleted within 14 days, and the privacy policy keeps account data up to 90 days (23 of 30). No deprecation policy with a notice period was found. Removals are announced with dates, such as Sitemap on 14 July for 30 September 2026, and the terms give 14 days to object to a material change. The hosted MCP docs say only the latest server version runs, so tool names and behaviour can change between versions (13 of 20). The sub-processor page names each vendor with its address, location and the data sent, Anthropic and Microsoft among them, and the four data centre regions are documented, per the 9 October check, not re-read on 1 November (18 of 20).

Cosmic 82

24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with after, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.

Kontent.ai 71

Scored on the API. No field selection on Management API reads was found, and the docs send filtering to the Delivery APIs. A filter endpoint returns references only and a bulk-get endpoint fetches the chosen items. The MCP server at 0.39.0 loads 54 tools. The hosted server's tool list wasn't read, because its robots.txt disallows every path (13 of 25). Lists page by continuation token, and items with variants can be filtered. No page-size control was found (14 of 20). Errors carry a request ID, a code, a message and validation errors with path, line and position (17 of 20). No idempotency keys. Items can be addressed and upserted by external ID or codename, the docs say failed requests are safe to retry, and they advise against parallel requests. All 54 MCP tools in 0.39.0 set readOnlyHint and destructiveHint (13 of 20). Two official SDKs, JavaScript and .NET, and a call needs only the environment ID and a key (14 of 15). The API reference is per the 9 October check, not re-read on 1 November.

Cosmic 90

Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.

Kontent.ai 82

Read with the hosted lines and scored on the Management API. status.kontent.ai is a Statuspage site with components by region, the Management REST API among them, and an incident history (20). Re-read on 1 November, its feed lists three incidents between 3 August and 1 November 2026. The GraphQL service was disrupted for about 31 minutes on 16 September with the Management API unaffected, content item saves failed for about 40 minutes on 24 September for a subset of EU projects using regex validation, and requests to the deprecated *.kenticocloud.com domain pattern failed from 13:30 to 16:06 UTC on 20 October after a registrar change. Each hit one service or a subset of requests, so we read them as minor. The 29 July login incident has left the window (20). Rate limits have numbers, 10 requests a second and 400 a minute per environment, re-read on 1 November (15). A 429 carries Retry-After, the docs call each failed request safe to retry and ask for a retry policy on 5xx. There are no idempotency keys, though the upsert PUT by external ID repeats safely (13 of 15). Annex 4 of the terms defines availability with a refund formula, but the guaranteed level is in each order form and the definition names the administration interface and the Delivery API, not the Management API (4 of 10). Management API v2 is generally available. The open-source MCP server is at 0.39.0, and Kontent.ai has hosted it at manage-mcp.kontent.ai since 22 October (10).