Cosmic vs Storyblok

Cosmic 90

Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.

Storyblok 64

Graded on the Management API and the hosted MCP server. Public UptimeRobot status page at uptime.storyblok.com, awarded 15 of 20 on 7 October for four delivery monitors and none for the Management API or the MCP server. Its monitors and history load by script from /api/ paths that the status host's robots.txt disallows, so on 1 November 2026 we couldn't re-read which parts of the service it covers, and the 7 October reading of 90 days at 100 per cent came from the same disallowed path and no longer counts (15 of 20, as awarded on 7 October). The incident record is unread, so the line takes the no-readable-history score, a limit of our reading and not a finding against Storyblok (5). Rate limits published, 3 requests a second on Starter and 6 on paid plans (15). The docs advise slowing down on 429 and retrying with exponential backoff, and the official client retries on 429. No Retry-After header in the API docs and no idempotency keys found (9). SLA of 97 per cent on Growth and Growth Plus, 99.9 on Premium and 99.99 on Elite, stated for the Content Delivery API (10). Management API v1 is generally available and the MCP docs carry no beta label (10). 15 + 5 + 15 + 9 + 10 + 10 = 64.

Cosmic 47

Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give read_key as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.

Storyblok 73

OAuth with PKCE S256, dynamic client registration, refresh tokens, revocation and 29 scopes on a read, write and publish hierarchy, or personal access tokens with scopes, a space list and an expiry date (30). Less 5 because Content Delivery API tokens travel in the token query parameter. That is a judgement call. Those tokens are read-only and not the graded surface, so we took half the checklist's 10. Scopes separate read, write and publish per space, and execute_destructive needs explicit user confirmation. Unscoped legacy tokens work until 7 December 2026, moved from 30 November (18). The changelog names prompt-injected tokens as a risk that scoping limits, and the MCP page asks users to read plans back before writes. No guidance on treating stored content as untrusted (8). Activity log on every plan with an Activities endpoint, kept 1 day on Starter and 30 days on Growth (11). ISO 27001, TISAX, third-party penetration tests and a security contact address. No security.txt, bug bounty or SOC 2 report found (11).

Cosmic 88

openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.

Storyblok 68

The only public OpenAPI spec is for the Content Delivery API (3.1, 14 operations). The Management API spec that the official client is generated from sits in the private storyblok/openapi-wdx repository, per the monoblok README. The MCP describe tool returns parameter and body schemas per operation to a signed-in client, which we couldn't read (12 of 25). A root llms.txt and a Markdown copy of every docs page at the same URL plus .md (10). The MCP page says when to use the server and when to use the CLI, and names each tool's purpose (16). The reference types every parameter and marks required ones, but story content is a free-form object checked against the space's component schemas (8). Request examples in nine languages on each endpoint. Errors are covered by one line on standard HTTP codes (9). The /v1 path, a dated changelog with an RSS feed, and changes to v1 made in place (13).

Cosmic 63

A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.

Storyblok 81

Closed service with published self-service and enterprise terms, and MIT client libraries (17). DPA effective 22 April 2026, privacy policy effective 6 October 2025, customer content kept up to 90 days after termination, log files 30 days, and AI terms saying input isn't used for training. We found no contradiction between them (25). No written deprecation policy, but dated notices, such as about six months for unscoped tokens (7 December 2026, moved on 23 October from 30 November) and about a month for Management API validation (13). Sub-processors with locations in DPA Annex 3 and data residency in the EU, US, Canada and Australia (18).

Cosmic 45

No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.

Storyblok 35

No x402, MPP or L402 (0). Plan prices are public ($99 and $349 a month) with unit prices for overage on Growth ($10 per million API requests, $15 a seat, $20 a locale). Premium and Elite are priced through sales (15). Starter is free with no card and includes the Management API (20). A person signs up in a browser and creates the token or approves the OAuth consent screen (0).

Cosmic 86

MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.

Storyblok 80

The changelog has an entry on 26 October 2026 and the Management API client 0.11.0 and CLI 4.26.0 were tagged on 30 October 2026 (30). 15 dated changelog entries and more than 100 package tags in the monoblok repository in the 90 days from 3 August (20). Public changelog with RSS, a help centre and a Discord community. Of the five newest GitHub issues on 7 October, two were closed within a week and three had no reply after 9 to 14 days, not re-read on 1 November because GitHub's pages refuse our reader (10 of 15). Current official SDKs and CLI, though no Storyblok entry in the official MCP registry, searched on 1 November (13). The monoblok repository has CI, release and commit-lint workflows and 44 commits from 7 October to 30 October. We didn't check that CI passes (7).