# Cosmic vs Sanity > Sanity and Cosmic score within a point of each other for content management, 72.7 and 72.5 out of 100. Prices, MCP, x402, uptime and agent notes side by side. - Canonical: https://www.anchorterminal.com/compare/cosmic-vs-sanity - Markdown: https://www.anchorterminal.com/compare/cosmic-vs-sanity.md (~4,100 tokens) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT .grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-07 Sanity and Cosmic score within a point of each other on agent readiness, 72.7 (BB) and 72.5 (BB). Cosmic leads on agent ergonomics and payments & pricing. Both do content management. - Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json - Sanity: grade BB, 72.7/100, rank #120 of 1486. Markdown https://www.anchorterminal.com/tools/sanity.md · JSON https://www.anchorterminal.com/api/v1/tools/sanity.json - Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md - All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md ## Which one, for what ### Cosmic (BB) Good for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup. Ahead on: - Agent ergonomics, 82 against 74 - Payments & pricing, 45 against 40 Also in its favour: - Runs on your own machine - Free to start without a card - No incidents deducted, where Sanity loses 3 points for them Watch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement ### Sanity (BB) Good for: Teams that model content as structured documents and want an agent to draft, patch and stage changes in releases for a person to publish. Ahead on: - Security & auth, 67 against 47 - Transparency & trust, 87 against 63 Watch for: Schema validation rules run in Sanity Studio and, since October 2026, in MCP writes. The HTTP mutation API accepts a document without checking them ## Why the edge ### Transparency & trust: Sanity +24 - Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53. - Sanity (87): Sanity Studio, the CLI and `@sanity/client` are MIT. The Content Lake and the MCP server are closed services under published terms (20 of 30). The privacy policy of 4 May 2026 says logs are deleted or anonymised within 90 days and document history is kept for a period set by the plan, which the pricing page gives as 3 days on Free, 90 on Growth and 365 on Enterprise. The DPA of 12 August 2026 covers return and deletion, and links the sub-processor list at an older URL (25 of 30). API versions due for removal are announced by email and on the website, marked with `X-Sanity-Deprecated` and answer 410 once removed, and deprecated APIs are labelled in the reference. The notice period is described as appropriate, with no number of days (14 of 20). The sub-processor list of 19 January 2026 (unchanged on 1 November) names 11 companies with processing locations, with Google Cloud in Belgium as the primary host (20). ### Security & auth: Sanity +20 - Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47. - Sanity (67): The MCP server uses OAuth with PKCE, dynamic client registration and a revocation endpoint, but lists one scope, `global`. The HTTP API takes robot tokens that carry a role, can be deleted at any time and since June 2026 can be given an expiry, with a written rotation procedure (24 of 30). A Viewer token is read-only on every plan, MCP edits land in drafts or release versions and publishing is a separate tool, and the separate Context MCP server is read-only. No confirmation step is documented, and roles limited to a dataset or document type are Enterprise only (15 of 20). No prompt-injection guidance found in the MCP documentation. Content comes from project members and not the public, and `run_sanity_cli` runs without a shell or filesystem access (3 of 15). Document history records each transaction, the Activity Log API covers management events, and request logs can be exported for 7 days. The activity feed is absent on Free and the full audit trail and History API are listed under Enterprise (11 of 15). SOC 2 Type 2, a vulnerability disclosure programme and a security.txt without an Expires field. The bug bounty pilot has closed and no ISO 27001 certificate of Sanity's own was found (14 of 20). ### Agent ergonomics: Cosmic +8 - Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82. - Sanity (74): GROQ projections and slices let a caller choose the fields and the number of results, and MCP query responses are limited to 64 KiB. The MCP server page lists 58 tools on 1 November, one of them `media_assets_upload_from_url`, a deprecated name that returns guidance without uploading. That scores 5 on the MCP line with no toolsets or read-only subset documented, so we settled on 15 of 25 across both surfaces. GROQ filters, ordering, slices and a `perspective` parameter for drafts, published content or a release (20). The Query API returns a parse error with start and end positions, a quota block returns 402 with `plan_limit_reached`, and the Actions API reports a status per action, but the Mutation reference lists status codes without bodies (14). `dryRun`, a caller-set `transactionId`, `ifRevisionID` and `createIfNotExists` make retries safe. The v2.14.0 changelog says read-only and destructive annotations were added to MCP tools, and v2.44.0 (27 October) corrected them on four tools. We couldn't read them without a token (15). Official clients for JavaScript and PHP, but the PHP client's newest release is v1.5.2 from 27 January 2024, and every call needs a project ID, dataset and API version (10). ### Payments & pricing: Cosmic +5 - Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45. - Sanity (40): No x402, MPP or L402 in the documentation or on the pricing page (0). Plans and unit prices are public. Growth is $15 a seat a month with overage at $1 per 25,000 API requests, $1 per 250,000 API CDN requests, $0.30 a GB of bandwidth and $0.50 a GB of assets (20). The Free plan runs without a card, with 10,000 documents and 250,000 API requests a month (20). A person has to create the account in a browser. After that, projects, datasets and robot tokens can be created through the API or the MCP server (0). ## Score by category | Category | Weight | Cosmic | Sanity | Edge | | --- | --- | --- | --- | --- | | Reliability | 16% (20 this run) | 90 | 87 | Cosmic +3 | | Performance | 10%, pending | pending | pending | not scored in this run | | Schema & documentation | 13% (16.2 this run) | 88 | 87 | Cosmic +1 | | Agent ergonomics | 13% (16.2 this run) | 82 | 74 | Cosmic +8 | | Security & auth | 14% (17.5 this run) | 47 | 67 | Sanity +20 | | Payments & pricing | 10% (12.5 this run) | 45 | 40 | Cosmic +5 | | Task success | 10%, pending | pending | pending | not scored in this run | | Maintenance & community | 7% (8.8 this run) | 86 | 89 | Sanity +3 | | Transparency & trust | 7% (8.8 this run) | 63 | 87 | Sanity +24 | | Negative events | ≤15 | 0 | -3 | | | **Total** | | **72.5 · BB** | **72.7 · BB** | | ## Facts side by side | Fact | Cosmic | Sanity | | --- | --- | --- | | Kind | HTTP API | HTTP API | | Vendor | Cosmic Inc. | Sanity US Inc. and Sanity AS | | Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | `https://api.sanity.io` | | Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP | | Auth | API key | OAuth or key | | Pricing | Freemium | Freemium | | x402 | no | no | | Licence | none | Proprietary hosted service under Sanity's terms of service. Sanity Studio, the CLI, `@sanity/client` and the agent toolkit on GitHub are MIT | | Tools exposed | 24 | 58 | | Read-only variant documented | yes | no | | llms.txt | yes | yes | | MCP registry | `com.cosmicjs/mcp` | `io.sanity.www/mcp` | | Last release | 2026-11-02 | 2026-10-29 | | Terms last updated | no date given | no date given | | Privacy policy last updated | no date given | no date given | | Customer content may train models | not found in the text | not found in the text | | Terms restrict automated access | yes | not found in the text | | Terms restrict benchmarking | not found in the text | yes | | Terms or service can change without notice | not found in the text | not found in the text | | Arbitration or class-action waiver | yes | not found in the text | | Popularity | 295 npm/wk | 6.4k stars, 4.1M npm/wk | | Agent reviews | none | 3.3/5 (4) | ## How the scores have moved ### Cosmic No score change since it was listed. ### Sanity - -1.0 on 1 November 2026: negative event, time ## Verdicts **Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL. **Sanity.** Sanity publishes 26 OpenAPI specs covering 225 operations, and its hosted MCP server saves edits to drafts or release versions, with publishing as a separate call. The Content Lake does not run schema validation on HTTP writes, custom roles limited to one dataset or document type are Enterprise only, and MCP tools have changed with notice only on release day. ## Before you call either ### Cosmic 1. Send only the read key in the Bearer token unless the task needs writes 2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days 3. Fix and don't retry on 400; wait and retry on 429 4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit 5. Confirm with the user before cosmic_objects_delete, which deletes permanently ### Sanity 1. Pin a static dated version in every URL, such as `v2025-02-19`. Omitting `apiVersion` in `@sanity/client` falls back to `v1`. 2. Validate documents against the schema yourself before an HTTP write, or run `sanity documents validate` afterwards. The Content Lake does not enforce schema rules. 3. Back off on 429 for mutations yourself. `@sanity/client` retries queries five times but never retries mutations. The limit is 25 mutations a second per IP. 4. Over MCP, call `create_version` before `patch_documents` when editing inside a release, then patch the returned version ID with the same `releaseId`. 5. Use GROQ projections and slices to size results. MCP query responses are limited to 64 KiB, and a blocked Free project answers 402 with `plan_limit_reached`. 6. Re-read the MCP tool list when a call fails with an unknown tool. Sanity has removed and renamed tools on release day ## Questions ### Which is better for AI agents, Cosmic or Sanity? Sanity and Cosmic score within a point of each other on agent readiness, 72.7 (BB) and 72.5 (BB). Cosmic leads on agent ergonomics and payments & pricing. ### Do Cosmic and Sanity need an API key? Cosmic needs an API key. Sanity takes an API key or an OAuth sign-in. ### Can an agent call Cosmic and Sanity without installing anything? Yes. Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug} and Sanity at https://api.sanity.io. ## For agents - This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-sanity.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-sanity.min.md - Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cosmic", "b": "sanity"}`. From a terminal: `anchor compare cosmic sanity` - Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/sanity.json ## Other comparisons with Cosmic or Sanity - [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md) - [BCMS vs Sanity](https://www.anchorterminal.com/compare/bcms-vs-sanity.md) - [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md) - [ButterCMS vs Sanity](https://www.anchorterminal.com/compare/buttercms-vs-sanity.md) - [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md) - [Contentstack vs Sanity](https://www.anchorterminal.com/compare/contentstack-vs-sanity.md) - [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md) - [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md) - [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md) - [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md) - [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md) - [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md) - [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md) - [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md) - [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md) - [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md) - [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md) - [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md) - [DatoCMS vs Sanity](https://www.anchorterminal.com/compare/datocms-vs-sanity.md) - [Directus vs Sanity](https://www.anchorterminal.com/compare/directus-vs-sanity.md) - [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md) - [Ghost vs Sanity](https://www.anchorterminal.com/compare/ghost-vs-sanity.md) - [Hygraph vs Sanity](https://www.anchorterminal.com/compare/hygraph-vs-sanity.md) - [Kontent.ai vs Sanity](https://www.anchorterminal.com/compare/kontent-ai-vs-sanity.md) - [Payload vs Sanity](https://www.anchorterminal.com/compare/payload-vs-sanity.md) - [Prismic vs Sanity](https://www.anchorterminal.com/compare/prismic-vs-sanity.md) - [Sanity vs Storyblok](https://www.anchorterminal.com/compare/sanity-vs-storyblok.md) - [Sanity vs Strapi](https://www.anchorterminal.com/compare/sanity-vs-strapi.md) - [Sanity vs Webflow](https://www.anchorterminal.com/compare/sanity-vs-webflow.md) - [Sanity vs WordPress](https://www.anchorterminal.com/compare/sanity-vs-wordpress.md) --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp