{ "data": { "a": { "slug": "cosmic", "name": "Cosmic", "vendor": "Cosmic Inc.", "vendorUrl": "https://www.cosmicjs.com", "kind": "http-api", "category": "cms", "summary": "Cosmic is a hosted headless CMS with a REST API, a TypeScript SDK, a CLI and a hosted MCP server. Agents read and write objects, media and object types, generate media, and can create a project by agent signup.", "url": "https://www.anchorterminal.com/tools/cosmic", "markdownUrl": "https://www.anchorterminal.com/tools/cosmic.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cosmic.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cosmic.json", "dns": "cosmic.grade.anchorterminal.com", "repo": "https://github.com/cosmicjs/mcp", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "packages": [ { "registry": "npm", "name": "@cosmicjs/mcp" }, { "registry": "npm", "name": "@cosmicjs/sdk" }, { "registry": "npm", "name": "@cosmicjs/cli" } ], "auth": "api-key", "authNotes": "Each bucket has a read key and a write key, rotatable independently. The hosted MCP server takes `Authorization: Bearer READ_KEY` for read-only tools or `READ_KEY:WRITE_KEY` for full access; the write key can also go in `X-Cosmic-Write-Key`. The REST API takes the read key as `read_key` in the query or as a Bearer token on GET. POST /v3/agents/sign-up on dapi.cosmicjs.com needs no authentication and returns bucket keys for a new unclaimed project tied to a human's email.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 1 bucket, 10,000 objects and 250,000 non-cached API requests a month, no card. Builder $99 a month, Team $299, Business $499, Small Workspace $999 and Large Workspace $2,999, with 10 per cent off yearly; Enterprise by quote. Webhooks, localisation and revision history are paid add-ons. Workspace plans have a 30-day trial.", "priceSummary": "$99 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the OpenAPI spec, the MCP docs or pricing.md (checked 2026-11-06). An unclaimed or over-limit bucket returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 24, "popularity": { "githubStars": null, "npmWeekly": 295, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.cosmicjs.com/docs", "llmsTxt": "https://www.cosmicjs.com/llms.txt", "openapi": "https://www.cosmicjs.com/openapi.json", "registryName": "com.cosmicjs/mcp", "capabilities": [ "cms.content", "cms.assets", "cms.schema", "cms.publish", "cms.localisation" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "mcp-registry", "openapi", "llms-txt", "free-tier", "no-card", "status-page", "webhooks", "typescript", "cli", "closed-source" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 72.5, "grade": "BB", "agentReady": true, "rank": 123, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "bestFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "strengths": [ "Agent signup API provisions a project and bucket with keys, idempotent per email and agent", "24 MCP tools with readOnlyHint and destructiveHint, and descriptions that say when to use each", "Leaving out the write key gives read-only MCP access", "OpenAPI spec, llms.txt and Markdown docs with an error model and per-code retry guidance", "Free plan with no card and published prices and quotas for every paid plan" ], "weaknesses": [ "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement", "The REST API accepts the read key as a URL query parameter", "Revision history, webhooks and localisation are paid add-ons", "The OpenAPI spec covers 21 operations, fewer than the documented API", "Data is kept indefinitely unless deletion is requested" ], "agentNotes": [ "Send only the read key in the Bearer token unless the task needs writes", "Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days", "Fix and don't retry on 400; wait and retry on 429", "Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit", "Confirm with the user before cosmic_objects_delete, which deletes permanently" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.5 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 53 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @cosmicjs/mcp", "http": "curl -X POST https://dapi.cosmicjs.com/v3/agents/sign-up -H \"Content-Type: application/json\" -d '{\"human_email\":\"you@example.com\",\"project_name\":\"Recipe Blog\",\"agent_id\":\"my-agent\"}'", "config": { "mcpServers": { "cosmic": { "headers": { "Authorization": "Bearer your-read-key:your-write-key" }, "url": "https://mcp.cosmicjs.com/v1/buckets/your-bucket-slug" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/cosmic" }, "area": "business", "unitPrices": [ { "item": "Builder plan", "unit": "month", "usd": 99, "note": "3 buckets, 50,000 objects, 1 million non-cached requests; $89 a month yearly" }, { "item": "Team plan", "unit": "month", "usd": 299, "note": "5 buckets, 100,000 objects, 2 million non-cached requests" }, { "item": "Business plan", "unit": "month", "usd": 499, "note": "10 buckets, 250,000 objects, 5 million non-cached requests" } ], "provenance": { "legalEntity": "Cosmic Inc.", "domain": "cosmicjs.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.cosmicjs.com/terms-of-service", "privacy": "https://www.cosmicjs.com/privacy-policy", "statusPage": "https://cosmicstatus.com", "changelog": "https://www.cosmicjs.com/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy were last updated on 13 January 2025 and name Cosmic JS at 3208 Bonniebrook Dr, Plano, Texas. The MCP server's licence names Cosmic Inc.", "The terms forbid using a robot or spider to copy or scrape the website without written permission; recorded as a fact. www.cosmicjs.com/robots.txt allows all crawlers, including ClaudeBot, except /api/, /search, /community/members/ and /v3/.", "www.cosmicjs.com/.well-known/security.txt returned 404. The security page asks for vulnerability reports at support@cosmicjs.com.", "cosmicstatus.com redirects to a Statuspage at cosmicjs.statuspage.io with API and Web Dashboard components." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cosmic.json", "live": { "slug": "cosmic", "probe": { "target": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "method": "get", "lastAt": "2026-11-07T18:20:18.962856282Z", "lastOk": true, "lastStatus": 401, "lastMs": 494, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 452, "p95ms24h": 538, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://cosmicstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:35.290408052Z" }, "versions": [ { "registry": "github", "name": "cosmicjs/mcp", "version": "v1.7.1", "released": "2026-11-02", "seenAt": "2026-11-06T23:17:54.958583794Z" }, { "registry": "mcp-registry", "name": "com.cosmicjs/mcp", "version": "1.6.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@cosmicjs/cli", "version": "1.12.0", "seenAt": "2026-11-06T23:17:52.953736128Z" }, { "registry": "npm", "name": "@cosmicjs/mcp", "version": "1.7.1", "seenAt": "2026-11-06T23:17:50.755872442Z" }, { "registry": "npm", "name": "@cosmicjs/sdk", "version": "2.4.0", "seenAt": "2026-11-06T23:17:51.562341268Z" } ], "githubStars": 1, "npmWeekly": 295, "securityTxt": { "url": "https://cosmicjs.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:42.91283778Z" }, "llmsTxt": { "url": "https://www.cosmicjs.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:12.321724133Z" }, "pages": [ { "url": "https://www.cosmicjs.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:27:27.310794511Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3e45613abe99" }, { "url": "https://www.cosmicjs.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:27:31.923491628Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d4aa3db9a89b" }, { "url": "https://www.cosmicjs.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:27:35.902981274Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3c4a26f1901" } ], "updatedAt": "2026-11-07T18:20:18.962856282Z" } }, "answer": "Sanity and Cosmic score within a point of each other on agent readiness, 72.7 (BB) and 72.5 (BB). Cosmic leads on agent ergonomics and payments \u0026 pricing.", "b": { "slug": "sanity", "name": "Sanity", "vendor": "Sanity US Inc. and Sanity AS", "vendorUrl": "https://www.sanity.io", "kind": "http-api", "category": "cms", "summary": "Sanity is a hosted headless CMS. Content is stored as JSON documents in the Content Lake, queried with GROQ and edited in the open-source Sanity Studio. Agents reach it through the HTTP API or the hosted MCP server at mcp.sanity.io.", "url": "https://www.anchorterminal.com/tools/sanity", "markdownUrl": "https://www.anchorterminal.com/tools/sanity.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/sanity.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/sanity.json", "dns": "sanity.grade.anchorterminal.com", "repo": "https://github.com/sanity-io/sanity", "license": "Proprietary hosted service under Sanity's terms of service. Sanity Studio, the CLI, `@sanity/client` and the agent toolkit on GitHub are MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.sanity.io", "packages": [ { "registry": "npm", "name": "@sanity/client" }, { "registry": "npm", "name": "sanity" }, { "registry": "packagist", "name": "sanity/sanity-php" } ], "auth": "mixed", "authNotes": "Self-serve. The HTTP API takes a Bearer token. Robot tokens are created in sanity.io/manage, with the CLI or through the Access API, carry a role (Viewer and Editor tokens on every plan), last until deleted unless given an expiry, and are shown once. Personal tokens last a year and act as the user. The MCP server at mcp.sanity.io uses OAuth with PKCE and dynamic client registration by default, with one scope named `global` and sessions of about 7 days, or accepts a token in the `Authorization` header. Custom roles that limit a token to a dataset or document type are Enterprise only. No app review or sales approval is needed.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with no card, 20 seats, 10,000 documents, 250,000 API requests and 1 million API CDN requests a month, and hard caps that answer 402 when reached. Growth is $15 a seat a month with overage billed per unit. Enterprise is priced by sales. New projects get a Growth trial with Free plan quotas. An agent can start on the Free plan once a person has created the account (checked 2026-10-07).", "priceSummary": "$15 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation (llms-full.txt) or on the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": 58, "popularity": { "githubStars": 6352, "npmWeekly": 4069926, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://www.sanity.io/docs", "llmsTxt": "https://www.sanity.io/docs/llms.txt", "openapi": "https://www.sanity.io/docs/api/openapi", "registryName": "io.sanity.www/mcp", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.schema", "cms.localisation" ], "tags": [ "hosted", "headless-cms", "mcp", "oauth", "openapi", "llms-txt", "groq", "graphql", "javascript", "php", "free-tier", "status-page", "soc2", "open-source-studio" ], "lastRelease": "2026-10-29", "graded": true, "anchor": { "graded": true, "score": 72.7, "grade": "BB", "agentReady": true, "rank": 120, "ranked": true, "rankOf": 1486, "categoryRank": 2, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 89, "payments": 40, "reliability": 87, "schema": 87, "security": 67, "transparency": 87 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "2026-10-16. -3, MCP tool changes shipped with notice only on release day. The hosted server, which clients can't pin, removed `dataset_assets_upload` in v2.41.0 (16 October), dropped `parent` and `rootDirectory` from `media_library_upload_from_url` and shrank `dataset_assets_upload_from_file` results in v2.40.0 (2 October), and turned `media_assets_upload_from_url` into a no-op in v2.39.0 (1 October), each marked breaking only in that day's changelog. One term at the floor, since each names its replacement and v2.43.0 later deprecated `workspaceName` with a migration period. https://www.sanity.io/docs/changelog/9891ca1a-0c21-43e3-93a9-fe68bff824e2.md" ], "verdict": "Sanity publishes 26 OpenAPI specs covering 225 operations, and its hosted MCP server saves edits to drafts or release versions, with publishing as a separate call. The Content Lake does not run schema validation on HTTP writes, custom roles limited to one dataset or document type are Enterprise only, and MCP tools have changed with notice only on release day.", "bestFor": "Teams that model content as structured documents and want an agent to draft, patch and stage changes in releases for a person to publish.", "strengths": [ "26 public OpenAPI specs covering 225 operations at www.sanity.io/docs/api/openapi, plus llms.txt and a Markdown copy of every documentation page", "MCP `patch_documents` saves to a draft or release version, never to published content, and `publish_documents` is a separate tool", "Mutations and actions accept `dryRun`, a caller-set `transactionId` and `ifRevisionID` for optimistic locking", "Free plan with 10,000 documents and 250,000 API requests a month, with Growth overage rates published per unit", "MCP server listed in the official MCP registry as io.sanity.www/mcp, with 34 versions published there between 3 August and 29 October 2026" ], "weaknesses": [ "Schema validation rules run in Sanity Studio and, since October 2026, in MCP writes. The HTTP mutation API accepts a document without checking them", "Custom roles scoped to a dataset or document type are an Enterprise feature. Robot tokens on other plans take a built-in role across the project", "The MCP OAuth server lists one scope, `global`, and the server documents 58 tools with no toolset or read-only mode", "MCP tools were removed or changed in v2.39.0, v2.40.0 and v2.41.0 (1 to 16 October 2026) with notice only in that day's changelog", "The vulnerability disclosure page says the bug bounty pilot has closed and no rewards are paid" ], "agentNotes": [ "Pin a static dated version in every URL, such as `v2025-02-19`. Omitting `apiVersion` in `@sanity/client` falls back to `v1`.", "Validate documents against the schema yourself before an HTTP write, or run `sanity documents validate` afterwards. The Content Lake does not enforce schema rules.", "Back off on 429 for mutations yourself. `@sanity/client` retries queries five times but never retries mutations. The limit is 25 mutations a second per IP.", "Over MCP, call `create_version` before `patch_documents` when editing inside a release, then patch the returned version ID with the same `releaseId`.", "Use GROQ projections and slices to size results. MCP query responses are limited to 64 KiB, and a blocked Free project answers 402 with `plan_limit_reached`.", "Re-read the MCP tool list when a call fails with an unknown tool. Sanity has removed and renamed tools on release day" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.7 } ], "editorialScores": { "ergonomics": 74, "maintenance": 89, "payments": 40, "reliability": 87, "schema": 87, "security": 67, "transparency": 79 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx sanity@latest mcp configure", "http": "curl -H \"Authorization: Bearer \u003ctoken\u003e\" \"https://\u003cproject\u003e.api.sanity.io/v2021-06-07/data/query/production?query=*\"", "claudeCode": "claude mcp add Sanity -t http https://mcp.sanity.io --scope user", "config": { "mcpServers": { "Sanity": { "type": "http", "url": "https://mcp.sanity.io" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/sanity" }, "area": "business", "unitPrices": [ { "item": "Growth", "unit": "seat-month", "usd": 15, "note": "up to 50 seats" }, { "item": "API requests over quota (Growth)", "unit": "1k-requests", "usd": 0.04, "note": "$1 per 25,000, after 250,000 a month included" }, { "item": "API CDN requests over quota (Growth)", "unit": "1k-requests", "usd": 0.004, "note": "$1 per 250,000, after 1 million a month included" }, { "item": "Bandwidth over quota (Growth)", "unit": "gb", "usd": 0.3, "note": "after 100 GB a month included" }, { "item": "Increased quota add-on (Growth)", "unit": "month", "usd": 299, "note": "50,000 documents, 1 million API requests, 5 million API CDN requests" }, { "item": "Extra dataset (Growth)", "unit": "month", "usd": 999, "note": "per dataset" } ], "provenance": { "legalEntity": "Sanity US Inc. (with Sanity AS)", "domain": "sanity.io", "domainRegistered": "2015-01-07", "endpointOnVendorDomain": true, "terms": "https://www.sanity.io/legal/tos", "privacy": "https://www.sanity.io/legal/privacy", "statusPage": "https://www.sanity-status.com", "changelog": "https://www.sanity.io/docs/changelog", "securityTxt": "valid", "checked": "2026-10-07", "notes": [ "The terms of service dated 12 August 2026 are entered into with Sanity US Inc. The privacy policy dated 4 May 2026 is that of Sanity AS and Sanity US Inc. Growth has its own terms at sanity.io/legal/tos-growth, dated 26 March 2026.", "The API answers at https://\u003cprojectId\u003e.api.sanity.io and https://api.sanity.io, and the MCP server at https://mcp.sanity.io.", "www.sanity.io/.well-known/security.txt names security@sanity.io and the disclosure policy at sanity.io/responsible-disclosure, and has no Expires field.", "status.sanity.io answers with the same Statuspage as www.sanity-status.com.", "RDAP for sanity.io gives a registration date of 2015-01-07." ], "score": 95 }, "requirements": { "setupChecked": true, "complianceChecked": true, "card": "unknown", "freeTier": true, "minutes": 5, "credential": "mixed", "hosting": [ "EU", "US" ], "euResidency": "yes", "trainsOnData": "unknown", "zeroRetention": "unknown", "certifications": [ "SOC 2 Type II", "GDPR" ], "dpa": true, "selfHost": "no" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/sanity.json", "live": { "slug": "sanity", "probe": { "target": "https://api.sanity.io", "method": "get", "lastAt": "2026-11-07T18:20:52.243221678Z", "lastOk": true, "lastStatus": 200, "lastMs": 121, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 34, "p95ms24h": 120, "samples24h": 239, "samples30d": 7463, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://www.sanity-status.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:22:00.000716836Z" }, "versions": [ { "registry": "github", "name": "sanity-io/sanity", "version": "v6.22.0", "released": "2026-11-03", "seenAt": "2026-11-07T00:03:02.428633044Z" }, { "registry": "mcp-registry", "name": "io.sanity.www/mcp", "version": "2.46.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@sanity/client", "version": "8.15.0", "seenAt": "2026-11-07T00:03:00.40260288Z" }, { "registry": "npm", "name": "sanity", "version": "6.22.0", "seenAt": "2026-11-07T00:03:00.804181188Z" } ], "githubStars": 6383, "npmWeekly": 4849721, "securityTxt": { "url": "https://sanity.io/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:51.445269104Z" }, "llmsTxt": { "url": "https://www.sanity.io/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:52.131864362Z" }, "domain": { "domain": "sanity.io", "checkedAt": "2026-11-01T14:15:37.670787753Z" }, "pages": [ { "url": "https://www.sanity.io/docs/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:34:00.867557172Z", "changedAt": "2026-11-07T14:34:00.867557172Z", "fingerprint": "8926628e945c" }, { "url": "https://www.sanity.io/docs/changelog/1982ac76-963a-4b47-9415-6aed71979184", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:34:03.123786168Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2fdfeeb3362c" }, { "url": "https://www.sanity.io/docs/changelog/780b66f1-1f8f-40e0-b4bc-1d41764eb533", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:34:05.166947125Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3d35dde87eec" }, { "url": "https://www.sanity.io/docs/changelog/917e9b4b-1999-4d7d-9fe7-360cee1ffa70", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:34:07.085847893Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "32602c89bee6" }, { "url": "https://www.sanity.io/docs/changelog/9891ca1a-0c21-43e3-93a9-fe68bff824e2", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:34:09.165578997Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "7595b79e66c6" }, { "url": "https://www.sanity.io/docs/changelog/context-pkg-Mi4wLjA", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:34:11.022378543Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "56374581b12c" }, { "url": "https://www.sanity.io/docs/changelog/mcp-server-change-2-43-0", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:34:13.17659763Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "423b67f5b40a" }, { "url": "https://www.sanity.io/docs/changelog/studio-Ni4xNC4w", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:34:15.173806774Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "128a2f2d06d8" }, { "url": "https://www.sanity.io/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:34:17.140328308Z", "changedAt": "2026-11-05T13:17:44.149992237Z", "fingerprint": "8365951a42c2" }, { "url": "https://www.sanity.io/legal/tos", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:34:19.015554206Z", "changedAt": "2026-11-05T13:17:46.421152376Z", "fingerprint": "66b117bf981a" } ], "mcpTools": { "url": "https://mcp.sanity.io", "checkedAt": "2026-11-07T01:47:30.289209196Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:47:30.289209196Z" }, "github": { "repo": "sanity-io/sanity", "checkedAt": "2026-11-02T09:23:37.931429079Z", "stars": 6383, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:20:16Z", "openIssues": 75, "openPRs": 249, "issuesOpened90d": 38, "issuesClosed90d": 31, "prsMerged90d": 1256, "ci": { "branch": "main", "runs": 50, "success": 42, "failure": 5, "other": 3, "latest": "success", "latestAt": "2026-10-30T17:14:36Z" }, "replies": { "sampled": 25, "unanswered": 8, "medianDays": 3.8 } }, "updatedAt": "2026-11-07T18:22:00.000716836Z" } }, "edges": [ { "by": 24, "category": "transparency", "leads": "sanity", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.", "b": "Sanity Studio, the CLI and `@sanity/client` are MIT. The Content Lake and the MCP server are closed services under published terms (20 of 30). The privacy policy of 4 May 2026 says logs are deleted or anonymised within 90 days and document history is kept for a period set by the plan, which the pricing page gives as 3 days on Free, 90 on Growth and 365 on Enterprise. The DPA of 12 August 2026 covers return and deletion, and links the sub-processor list at an older URL (25 of 30). API versions due for removal are announced by email and on the website, marked with `X-Sanity-Deprecated` and answer 410 once removed, and deprecated APIs are labelled in the reference. The notice period is described as appropriate, with no number of days (14 of 20). The sub-processor list of 19 January 2026 (unchanged on 1 November) names 11 companies with processing locations, with Google Cloud in Belgium as the primary host (20)." }, "scores": { "a": 63, "b": 87 } }, { "by": 20, "category": "security", "leads": "sanity", "name": "Security \u0026 auth", "reasons": { "a": "Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.", "b": "The MCP server uses OAuth with PKCE, dynamic client registration and a revocation endpoint, but lists one scope, `global`. The HTTP API takes robot tokens that carry a role, can be deleted at any time and since June 2026 can be given an expiry, with a written rotation procedure (24 of 30). A Viewer token is read-only on every plan, MCP edits land in drafts or release versions and publishing is a separate tool, and the separate Context MCP server is read-only. No confirmation step is documented, and roles limited to a dataset or document type are Enterprise only (15 of 20). No prompt-injection guidance found in the MCP documentation. Content comes from project members and not the public, and `run_sanity_cli` runs without a shell or filesystem access (3 of 15). Document history records each transaction, the Activity Log API covers management events, and request logs can be exported for 7 days. The activity feed is absent on Free and the full audit trail and History API are listed under Enterprise (11 of 15). SOC 2 Type 2, a vulnerability disclosure programme and a security.txt without an Expires field. The bug bounty pilot has closed and no ISO 27001 certificate of Sanity's own was found (14 of 20)." }, "scores": { "a": 47, "b": 67 } }, { "by": 8, "category": "ergonomics", "leads": "cosmic", "name": "Agent ergonomics", "reasons": { "a": "24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.", "b": "GROQ projections and slices let a caller choose the fields and the number of results, and MCP query responses are limited to 64 KiB. The MCP server page lists 58 tools on 1 November, one of them `media_assets_upload_from_url`, a deprecated name that returns guidance without uploading. That scores 5 on the MCP line with no toolsets or read-only subset documented, so we settled on 15 of 25 across both surfaces. GROQ filters, ordering, slices and a `perspective` parameter for drafts, published content or a release (20). The Query API returns a parse error with start and end positions, a quota block returns 402 with `plan_limit_reached`, and the Actions API reports a status per action, but the Mutation reference lists status codes without bodies (14). `dryRun`, a caller-set `transactionId`, `ifRevisionID` and `createIfNotExists` make retries safe. The v2.14.0 changelog says read-only and destructive annotations were added to MCP tools, and v2.44.0 (27 October) corrected them on four tools. We couldn't read them without a token (15). Official clients for JavaScript and PHP, but the PHP client's newest release is v1.5.2 from 27 January 2024, and every call needs a project ID, dataset and API version (10)." }, "scores": { "a": 82, "b": 74 } }, { "by": 5, "category": "payments", "leads": "cosmic", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.", "b": "No x402, MPP or L402 in the documentation or on the pricing page (0). Plans and unit prices are public. Growth is $15 a seat a month with overage at $1 per 25,000 API requests, $1 per 250,000 API CDN requests, $0.30 a GB of bandwidth and $0.50 a GB of assets (20). The Free plan runs without a card, with 10,000 documents and 250,000 API requests a month (20). A person has to create the account in a browser. After that, projects, datasets and robot tokens can be created through the API or the MCP server (0)." }, "scores": { "a": 45, "b": 40 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Cosmic Inc.", "b": "Sanity US Inc. and Sanity AS", "name": "Vendor" }, { "a": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "b": "https://api.sanity.io", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary hosted service under Sanity's terms of service. Sanity Studio, the CLI, `@sanity/client` and the agent toolkit on GitHub are MIT", "name": "Licence" }, { "a": "24", "b": "58", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.cosmicjs/mcp", "b": "io.sanity.www/mcp", "name": "MCP registry" }, { "a": "2026-11-02", "b": "2026-10-29", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "no date given", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "295 npm/wk", "b": "6.4k stars, 4.1M npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Sanity and Cosmic score within a point of each other on agent readiness, 72.7 (BB) and 72.5 (BB). Cosmic leads on agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, Cosmic or Sanity?" }, { "answer": "Cosmic needs an API key. Sanity takes an API key or an OAuth sign-in.", "question": "Do Cosmic and Sanity need an API key?" }, { "answer": "Yes. Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug} and Sanity at https://api.sanity.io.", "question": "Can an agent call Cosmic and Sanity without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Agent ergonomics, 82 against 74", "Payments \u0026 pricing, 45 against 40" ], "also": [ "Runs on your own machine", "Free to start without a card", "No incidents deducted, where Sanity loses 3 points for them" ], "goodFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "slug": "cosmic", "watchFor": "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement" }, { "aheadOn": [ "Security \u0026 auth, 67 against 47", "Transparency \u0026 trust, 87 against 63" ], "also": null, "goodFor": "Teams that model content as structured documents and want an agent to draft, patch and stage changes in releases for a person to publish.", "slug": "sanity", "watchFor": "Schema validation rules run in Sanity Studio and, since October 2026, in MCP writes. The HTTP mutation API accepts a document without checking them" } ], "history": { "cosmic": null, "sanity": [ { "causes": [ "event", "time" ], "date": "2026-11-01", "delta": -1, "from": 73.7, "fromGrade": "BB", "to": 72.7, "toGrade": "BB" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-sanity.json", "title": "BCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/bcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic.json", "title": "ButterCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-sanity.json", "title": "ButterCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/buttercms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic.json", "title": "Contentstack vs Cosmic", "url": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-sanity.json", "title": "Contentstack vs Sanity", "url": "https://www.anchorterminal.com/compare/contentstack-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-datocms.json", "title": "Cosmic vs DatoCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-directus.json", "title": "Cosmic vs Directus", "url": "https://www.anchorterminal.com/compare/cosmic-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.json", "title": "Cosmic vs Ghost", "url": "https://www.anchorterminal.com/compare/cosmic-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph.json", "title": "Cosmic vs Hygraph", "url": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.json", "title": "Cosmic vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-payload.json", "title": "Cosmic vs Payload", "url": "https://www.anchorterminal.com/compare/cosmic-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-prismic.json", "title": "Cosmic vs Prismic", "url": "https://www.anchorterminal.com/compare/cosmic-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok.json", "title": "Cosmic vs Storyblok", "url": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.json", "title": "Cosmic vs Strapi", "url": "https://www.anchorterminal.com/compare/cosmic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.json", "title": "Cosmic vs Webflow", "url": "https://www.anchorterminal.com/compare/cosmic-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json", "title": "Cosmic vs WordPress", "url": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-sanity.json", "title": "DatoCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/datocms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-sanity.json", "title": "Directus vs Sanity", "url": "https://www.anchorterminal.com/compare/directus-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-sanity.json", "title": "dotCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/dotcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-sanity.json", "title": "Ghost vs Sanity", "url": "https://www.anchorterminal.com/compare/ghost-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-sanity.json", "title": "Hygraph vs Sanity", "url": "https://www.anchorterminal.com/compare/hygraph-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-sanity.json", "title": "Kontent.ai vs Sanity", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-sanity.json", "title": "Payload vs Sanity", "url": "https://www.anchorterminal.com/compare/payload-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/prismic-vs-sanity.json", "title": "Prismic vs Sanity", "url": "https://www.anchorterminal.com/compare/prismic-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-storyblok.json", "title": "Sanity vs Storyblok", "url": "https://www.anchorterminal.com/compare/sanity-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-strapi.json", "title": "Sanity vs Strapi", "url": "https://www.anchorterminal.com/compare/sanity-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-webflow.json", "title": "Sanity vs Webflow", "url": "https://www.anchorterminal.com/compare/sanity-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-wordpress.json", "title": "Sanity vs WordPress", "url": "https://www.anchorterminal.com/compare/sanity-vs-wordpress" } ], "panel": null, "scores": [ { "by": 3, "cosmic": 90, "edge": "cosmic", "key": "reliability", "name": "Reliability", "sanity": 87, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 1, "cosmic": 88, "edge": "cosmic", "key": "schema", "name": "Schema \u0026 documentation", "sanity": 87, "weight": 13 }, { "by": 8, "cosmic": 82, "edge": "cosmic", "key": "ergonomics", "name": "Agent ergonomics", "sanity": 74, "weight": 13 }, { "by": 20, "cosmic": 47, "edge": "sanity", "key": "security", "name": "Security \u0026 auth", "sanity": 67, "weight": 14 }, { "by": 5, "cosmic": 45, "edge": "cosmic", "key": "payments", "name": "Payments \u0026 pricing", "sanity": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 3, "cosmic": 86, "edge": "sanity", "key": "maintenance", "name": "Maintenance \u0026 community", "sanity": 89, "weight": 7 }, { "by": 24, "cosmic": 63, "edge": "sanity", "key": "transparency", "name": "Transparency \u0026 trust", "sanity": 87, "weight": 7 } ], "summary": "Sanity and Cosmic score within a point of each other on agent readiness, 72.7 (BB) and 72.5 (BB). Cosmic leads on agent ergonomics and payments \u0026 pricing. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "cosmic": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "sanity": "Sanity publishes 26 OpenAPI specs covering 225 operations, and its hosted MCP server saves edits to drafts or release versions, with publishing as a separate call. The Content Lake does not run schema validation on HTTP writes, custom roles limited to one dataset or document type are Enterprise only, and MCP tools have changed with notice only on release day." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cosmic-vs-sanity", "json": "https://www.anchorterminal.com/compare/cosmic-vs-sanity.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cosmic-vs-sanity.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cosmic-vs-sanity.min.md" }, "markdown": "Sanity and Cosmic score within a point of each other on agent readiness, 72.7 (BB) and 72.5 (BB). Cosmic leads on agent ergonomics and payments \u0026 pricing. Both do content management.\n\n- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json\n- Sanity: grade BB, 72.7/100, rank #120 of 1486. Markdown https://www.anchorterminal.com/tools/sanity.md · JSON https://www.anchorterminal.com/api/v1/tools/sanity.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### Cosmic (BB)\n\nGood for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.\n\nAhead on:\n- Agent ergonomics, 82 against 74\n- Payments \u0026 pricing, 45 against 40\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n- No incidents deducted, where Sanity loses 3 points for them\n\nWatch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement\n\n### Sanity (BB)\n\nGood for: Teams that model content as structured documents and want an agent to draft, patch and stage changes in releases for a person to publish.\n\nAhead on:\n- Security \u0026 auth, 67 against 47\n- Transparency \u0026 trust, 87 against 63\n\nWatch for: Schema validation rules run in Sanity Studio and, since October 2026, in MCP writes. The HTTP mutation API accepts a document without checking them\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Sanity +24\n\n- Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.\n- Sanity (87): Sanity Studio, the CLI and `@sanity/client` are MIT. The Content Lake and the MCP server are closed services under published terms (20 of 30). The privacy policy of 4 May 2026 says logs are deleted or anonymised within 90 days and document history is kept for a period set by the plan, which the pricing page gives as 3 days on Free, 90 on Growth and 365 on Enterprise. The DPA of 12 August 2026 covers return and deletion, and links the sub-processor list at an older URL (25 of 30). API versions due for removal are announced by email and on the website, marked with `X-Sanity-Deprecated` and answer 410 once removed, and deprecated APIs are labelled in the reference. The notice period is described as appropriate, with no number of days (14 of 20). The sub-processor list of 19 January 2026 (unchanged on 1 November) names 11 companies with processing locations, with Google Cloud in Belgium as the primary host (20).\n\n### Security \u0026 auth: Sanity +20\n\n- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.\n- Sanity (67): The MCP server uses OAuth with PKCE, dynamic client registration and a revocation endpoint, but lists one scope, `global`. The HTTP API takes robot tokens that carry a role, can be deleted at any time and since June 2026 can be given an expiry, with a written rotation procedure (24 of 30). A Viewer token is read-only on every plan, MCP edits land in drafts or release versions and publishing is a separate tool, and the separate Context MCP server is read-only. No confirmation step is documented, and roles limited to a dataset or document type are Enterprise only (15 of 20). No prompt-injection guidance found in the MCP documentation. Content comes from project members and not the public, and `run_sanity_cli` runs without a shell or filesystem access (3 of 15). Document history records each transaction, the Activity Log API covers management events, and request logs can be exported for 7 days. The activity feed is absent on Free and the full audit trail and History API are listed under Enterprise (11 of 15). SOC 2 Type 2, a vulnerability disclosure programme and a security.txt without an Expires field. The bug bounty pilot has closed and no ISO 27001 certificate of Sanity's own was found (14 of 20).\n\n### Agent ergonomics: Cosmic +8\n\n- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.\n- Sanity (74): GROQ projections and slices let a caller choose the fields and the number of results, and MCP query responses are limited to 64 KiB. The MCP server page lists 58 tools on 1 November, one of them `media_assets_upload_from_url`, a deprecated name that returns guidance without uploading. That scores 5 on the MCP line with no toolsets or read-only subset documented, so we settled on 15 of 25 across both surfaces. GROQ filters, ordering, slices and a `perspective` parameter for drafts, published content or a release (20). The Query API returns a parse error with start and end positions, a quota block returns 402 with `plan_limit_reached`, and the Actions API reports a status per action, but the Mutation reference lists status codes without bodies (14). `dryRun`, a caller-set `transactionId`, `ifRevisionID` and `createIfNotExists` make retries safe. The v2.14.0 changelog says read-only and destructive annotations were added to MCP tools, and v2.44.0 (27 October) corrected them on four tools. We couldn't read them without a token (15). Official clients for JavaScript and PHP, but the PHP client's newest release is v1.5.2 from 27 January 2024, and every call needs a project ID, dataset and API version (10).\n\n### Payments \u0026 pricing: Cosmic +5\n\n- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.\n- Sanity (40): No x402, MPP or L402 in the documentation or on the pricing page (0). Plans and unit prices are public. Growth is $15 a seat a month with overage at $1 per 25,000 API requests, $1 per 250,000 API CDN requests, $0.30 a GB of bandwidth and $0.50 a GB of assets (20). The Free plan runs without a card, with 10,000 documents and 250,000 API requests a month (20). A person has to create the account in a browser. After that, projects, datasets and robot tokens can be created through the API or the MCP server (0).\n\n## Score by category\n\n| Category | Weight | Cosmic | Sanity | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 90 | 87 | Cosmic +3 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 88 | 87 | Cosmic +1 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 74 | Cosmic +8 |\n| Security \u0026 auth | 14% (17.5 this run) | 47 | 67 | Sanity +20 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 40 | Cosmic +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 86 | 89 | Sanity +3 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 87 | Sanity +24 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **72.5 · BB** | **72.7 · BB** | |\n\n## Facts side by side\n\n| Fact | Cosmic | Sanity |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Cosmic Inc. | Sanity US Inc. and Sanity AS |\n| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | `https://api.sanity.io` |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | none | Proprietary hosted service under Sanity's terms of service. Sanity Studio, the CLI, `@sanity/client` and the agent toolkit on GitHub are MIT |\n| Tools exposed | 24 | 58 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.cosmicjs/mcp` | `io.sanity.www/mcp` |\n| Last release | 2026-11-02 | 2026-10-29 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | no date given | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 295 npm/wk | 6.4k stars, 4.1M npm/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### Cosmic\n\nNo score change since it was listed.\n\n### Sanity\n\n- -1.0 on 1 November 2026: negative event, time\n\n## Verdicts\n\n**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.\n\n**Sanity.** Sanity publishes 26 OpenAPI specs covering 225 operations, and its hosted MCP server saves edits to drafts or release versions, with publishing as a separate call. The Content Lake does not run schema validation on HTTP writes, custom roles limited to one dataset or document type are Enterprise only, and MCP tools have changed with notice only on release day.\n\n## Before you call either\n\n### Cosmic\n\n1. Send only the read key in the Bearer token unless the task needs writes\n2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days\n3. Fix and don't retry on 400; wait and retry on 429\n4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit\n5. Confirm with the user before cosmic_objects_delete, which deletes permanently\n\n### Sanity\n\n1. Pin a static dated version in every URL, such as `v2025-02-19`. Omitting `apiVersion` in `@sanity/client` falls back to `v1`.\n2. Validate documents against the schema yourself before an HTTP write, or run `sanity documents validate` afterwards. The Content Lake does not enforce schema rules.\n3. Back off on 429 for mutations yourself. `@sanity/client` retries queries five times but never retries mutations. The limit is 25 mutations a second per IP.\n4. Over MCP, call `create_version` before `patch_documents` when editing inside a release, then patch the returned version ID with the same `releaseId`.\n5. Use GROQ projections and slices to size results. MCP query responses are limited to 64 KiB, and a blocked Free project answers 402 with `plan_limit_reached`.\n6. Re-read the MCP tool list when a call fails with an unknown tool. Sanity has removed and renamed tools on release day\n\n## Questions\n\n### Which is better for AI agents, Cosmic or Sanity?\n\nSanity and Cosmic score within a point of each other on agent readiness, 72.7 (BB) and 72.5 (BB). Cosmic leads on agent ergonomics and payments \u0026 pricing.\n\n### Do Cosmic and Sanity need an API key?\n\nCosmic needs an API key. Sanity takes an API key or an OAuth sign-in.\n\n### Can an agent call Cosmic and Sanity without installing anything?\n\nYes. Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug} and Sanity at https://api.sanity.io.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-sanity.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-sanity.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cosmic\", \"b\": \"sanity\"}`. From a terminal: `anchor compare cosmic sanity`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/sanity.json\n\n## Other comparisons with Cosmic or Sanity\n\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md)\n- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)\n- [ButterCMS vs Sanity](https://www.anchorterminal.com/compare/buttercms-vs-sanity.md)\n- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)\n- [Contentstack vs Sanity](https://www.anchorterminal.com/compare/contentstack-vs-sanity.md)\n- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)\n- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)\n- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)\n- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)\n- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)\n- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)\n- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)\n- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)\n- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)\n- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)\n- [DatoCMS vs Sanity](https://www.anchorterminal.com/compare/datocms-vs-sanity.md)\n- [Directus vs Sanity](https://www.anchorterminal.com/compare/directus-vs-sanity.md)\n- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)\n- [Ghost vs Sanity](https://www.anchorterminal.com/compare/ghost-vs-sanity.md)\n- [Hygraph vs Sanity](https://www.anchorterminal.com/compare/hygraph-vs-sanity.md)\n- [Kontent.ai vs Sanity](https://www.anchorterminal.com/compare/kontent-ai-vs-sanity.md)\n- [Payload vs Sanity](https://www.anchorterminal.com/compare/payload-vs-sanity.md)\n- [Prismic vs Sanity](https://www.anchorterminal.com/compare/prismic-vs-sanity.md)\n- [Sanity vs Storyblok](https://www.anchorterminal.com/compare/sanity-vs-storyblok.md)\n- [Sanity vs Strapi](https://www.anchorterminal.com/compare/sanity-vs-strapi.md)\n- [Sanity vs Webflow](https://www.anchorterminal.com/compare/sanity-vs-webflow.md)\n- [Sanity vs WordPress](https://www.anchorterminal.com/compare/sanity-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cosmic vs Sanity", "url": "" } ], "description": "Sanity and Cosmic score within a point of each other for content management, 72.7 and 72.5 out of 100. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cosmic BB 72.5", "Sanity BB 72.7", "scores" ], "h1": "Cosmic vs Sanity", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cosmic-vs-sanity", "published": "2026-10-01", "section": "tools", "title": "Cosmic vs Sanity for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cosmic-vs-sanity" }, "tokens": { "markdown": 4100, "slim": 2180 }, "version": 1 }