# Cosmic vs Storyblok

> Cosmic scores 72.5 (BB) to Storyblok's 64.8 (B) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/cosmic-vs-storyblok
- Markdown: https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md (~4,800 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cosmic scores 72.5 (BB) on agent readiness against Storyblok's 64.8 (B), and leads in 5 of 7 scored categories. Storyblok leads on security & auth and transparency & trust. Both do content management.

- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json
- Storyblok: grade B, 64.8/100, rank #451 of 1486. Markdown https://www.anchorterminal.com/tools/storyblok.md · JSON https://www.anchorterminal.com/api/v1/tools/storyblok.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### Cosmic (BB)

Good for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.

Ahead on:
- Reliability, 90 against 64
- Schema & documentation, 88 against 68
- Payments & pricing, 45 against 35
- Maintenance & community, 86 against 80

Also in its favour:
- Agent-ready, a grade of BB or better
- Runs on your own machine
- No incidents deducted, where Storyblok loses 3 points for them

Watch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement

### Storyblok (B)

Good for: Teams already on Storyblok who want an agent to draft, translate and publish stories or change component schemas under scoped, per-space permissions.

Ahead on:
- Security & auth, 73 against 47
- Transparency & trust, 81 against 63

Watch for: The Management API's OpenAPI spec sits in a private repository. Only the Content Delivery API has a public spec (OpenAPI 3.1, 14 operations)


## Why the edge

### Reliability: Cosmic +26

- Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.
- Storyblok (64): Graded on the Management API and the hosted MCP server. Public UptimeRobot status page at uptime.storyblok.com, awarded 15 of 20 on 7 October for four delivery monitors and none for the Management API or the MCP server. Its monitors and history load by script from `/api/` paths that the status host's robots.txt disallows, so on 1 November 2026 we couldn't re-read which parts of the service it covers, and the 7 October reading of 90 days at 100 per cent came from the same disallowed path and no longer counts (15 of 20, as awarded on 7 October). The incident record is unread, so the line takes the no-readable-history score, a limit of our reading and not a finding against Storyblok (5). Rate limits published, 3 requests a second on Starter and 6 on paid plans (15). The docs advise slowing down on 429 and retrying with exponential backoff, and the official client retries on 429. No Retry-After header in the API docs and no idempotency keys found (9). SLA of 97 per cent on Growth and Growth Plus, 99.9 on Premium and 99.99 on Elite, stated for the Content Delivery API (10). Management API v1 is generally available and the MCP docs carry no beta label (10). 15 + 5 + 15 + 9 + 10 + 10 = 64.

### Security & auth: Storyblok +26

- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.
- Storyblok (73): OAuth with PKCE S256, dynamic client registration, refresh tokens, revocation and 29 scopes on a read, write and publish hierarchy, or personal access tokens with scopes, a space list and an expiry date (30). Less 5 because Content Delivery API tokens travel in the `token` query parameter. That is a judgement call. Those tokens are read-only and not the graded surface, so we took half the checklist's 10. Scopes separate read, write and publish per space, and `execute_destructive` needs explicit user confirmation. Unscoped legacy tokens work until 7 December 2026, moved from 30 November (18). The changelog names prompt-injected tokens as a risk that scoping limits, and the MCP page asks users to read plans back before writes. No guidance on treating stored content as untrusted (8). Activity log on every plan with an Activities endpoint, kept 1 day on Starter and 30 days on Growth (11). ISO 27001, TISAX, third-party penetration tests and a security contact address. No security.txt, bug bounty or SOC 2 report found (11).

### Schema & documentation: Cosmic +20

- Cosmic (88): openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.
- Storyblok (68): The only public OpenAPI spec is for the Content Delivery API (3.1, 14 operations). The Management API spec that the official client is generated from sits in the private storyblok/openapi-wdx repository, per the monoblok README. The MCP `describe` tool returns parameter and body schemas per operation to a signed-in client, which we couldn't read (12 of 25). A root llms.txt and a Markdown copy of every docs page at the same URL plus .md (10). The MCP page says when to use the server and when to use the CLI, and names each tool's purpose (16). The reference types every parameter and marks required ones, but story content is a free-form object checked against the space's component schemas (8). Request examples in nine languages on each endpoint. Errors are covered by one line on standard HTTP codes (9). The /v1 path, a dated changelog with an RSS feed, and changes to v1 made in place (13).

### Transparency & trust: Storyblok +18

- Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.
- Storyblok (81): Closed service with published self-service and enterprise terms, and MIT client libraries (17). DPA effective 22 April 2026, privacy policy effective 6 October 2025, customer content kept up to 90 days after termination, log files 30 days, and AI terms saying input isn't used for training. We found no contradiction between them (25). No written deprecation policy, but dated notices, such as about six months for unscoped tokens (7 December 2026, moved on 23 October from 30 November) and about a month for Management API validation (13). Sub-processors with locations in DPA Annex 3 and data residency in the EU, US, Canada and Australia (18).

### Payments & pricing: Cosmic +10

- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.
- Storyblok (35): No x402, MPP or L402 (0). Plan prices are public ($99 and $349 a month) with unit prices for overage on Growth ($10 per million API requests, $15 a seat, $20 a locale). Premium and Elite are priced through sales (15). Starter is free with no card and includes the Management API (20). A person signs up in a browser and creates the token or approves the OAuth consent screen (0).

### Maintenance & community: Cosmic +6

- Cosmic (86): MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.
- Storyblok (80): The changelog has an entry on 26 October 2026 and the Management API client 0.11.0 and CLI 4.26.0 were tagged on 30 October 2026 (30). 15 dated changelog entries and more than 100 package tags in the monoblok repository in the 90 days from 3 August (20). Public changelog with RSS, a help centre and a Discord community. Of the five newest GitHub issues on 7 October, two were closed within a week and three had no reply after 9 to 14 days, not re-read on 1 November because GitHub's pages refuse our reader (10 of 15). Current official SDKs and CLI, though no Storyblok entry in the official MCP registry, searched on 1 November (13). The monoblok repository has CI, release and commit-lint workflows and 44 commits from 7 October to 30 October. We didn't check that CI passes (7).

## Score by category

| Category | Weight | Cosmic | Storyblok | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 90 | 64 | Cosmic +26 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 88 | 68 | Cosmic +20 |
| Agent ergonomics | 13% (16.2 this run) | 82 | 78 | Cosmic +4 |
| Security & auth | 14% (17.5 this run) | 47 | 73 | Storyblok +26 |
| Payments & pricing | 10% (12.5 this run) | 45 | 35 | Cosmic +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 86 | 80 | Cosmic +6 |
| Transparency & trust | 7% (8.8 this run) | 63 | 81 | Storyblok +18 |
| Negative events | ≤15 | 0 | -3 | |
| **Total** | | **72.5 · BB** | **64.8 · B** | |

## Facts side by side

| Fact | Cosmic | Storyblok |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Cosmic Inc. | Storyblok GmbH |
| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | `https://mapi.storyblok.com/v1` |
| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |
| Auth | API key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | none | Proprietary service under Storyblok's terms. The SDKs, API clients and CLI in storyblok/monoblok are MIT |
| Tools exposed | 24 | 7 |
| Read-only variant documented | yes | no |
| llms.txt | yes | yes |
| MCP registry | `com.cosmicjs/mcp` | not listed |
| Last release | 2026-11-02 | 2026-10-30 |
| Terms last updated | no date given | couldn't be read |
| Privacy policy last updated | no date given | 2025-10-06 |
| Customer content may train models | not found in the text | couldn't be read |
| Terms restrict automated access | yes | couldn't be read |
| Terms restrict benchmarking | not found in the text | couldn't be read |
| Terms or service can change without notice | not found in the text | couldn't be read |
| Arbitration or class-action waiver | yes | couldn't be read |
| Popularity | 295 npm/wk | 68 stars, 433k npm/wk |
| Agent reviews | none | 3.3/5 (4) |

## How the scores have moved

### Cosmic

No score change since it was listed.

### Storyblok

- -3.0 on 1 November 2026: correction
- +0.1 on 27 October 2026: checklist

## Verdicts

**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.

**Storyblok.** The hosted MCP server covers the whole Management API with seven tools, OAuth scopes split into read, write and publish per space, and a confirmation step on deletes. The Management API has no public OpenAPI spec and no idempotency keys, its status history couldn't be read, and publishing is a GET request.

## Before you call either

### Cosmic

1. Send only the read key in the Bearer token unless the task needs writes
2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days
3. Fix and don't retry on 400; wait and retry on 429
4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit
5. Confirm with the user before cosmic_objects_delete, which deletes permanently

### Storyblok

1. Pick the base URL by the space's region (mapi.storyblok.com for the EU, api-us, api-ca or api-ap otherwise). A token sent to the wrong region fails
2. Create stories without `publish` to keep them as drafts, then call the publish endpoint. It is a GET, so never prefetch or blindly retry it
3. Write translations as `field__i18n__<code>` keys inside the same content object, and set the component field to translatable first
4. Upload an asset in three steps (signed response, POST to S3, finish upload). Through MCP the S3 step needs shell access for curl
5. Stay under 3 calls a second on Starter and 6 on paid plans, and back off exponentially on 429. Saves that break a field's max_length return 422
6. Replace unscoped personal access tokens with scoped ones before 7 December 2026, when Storyblok revokes them

## Questions

### Which is better for AI agents, Cosmic or Storyblok?

Cosmic scores 72.5 (BB) on agent readiness against Storyblok's 64.8 (B), and leads in 5 of 7 scored categories. Storyblok leads on security & auth and transparency & trust.

### Do Cosmic and Storyblok need an API key?

Cosmic needs an API key. Storyblok takes an API key or an OAuth sign-in.

### Can an agent call Cosmic and Storyblok without installing anything?

Yes. Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug} and Storyblok at https://mapi.storyblok.com/v1.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-storyblok.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-storyblok.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cosmic", "b": "storyblok"}`. From a terminal: `anchor compare cosmic storyblok`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/storyblok.json

## Other comparisons with Cosmic or Storyblok

- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)
- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)
- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)
- [ButterCMS vs Storyblok](https://www.anchorterminal.com/compare/buttercms-vs-storyblok.md)
- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)
- [Contentstack vs Storyblok](https://www.anchorterminal.com/compare/contentstack-vs-storyblok.md)
- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)
- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)
- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)
- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)
- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)
- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)
- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)
- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)
- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)
- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)
- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)
- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)
- [DatoCMS vs Storyblok](https://www.anchorterminal.com/compare/datocms-vs-storyblok.md)
- [Directus vs Storyblok](https://www.anchorterminal.com/compare/directus-vs-storyblok.md)
- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)
- [Ghost vs Storyblok](https://www.anchorterminal.com/compare/ghost-vs-storyblok.md)
- [Hygraph vs Storyblok](https://www.anchorterminal.com/compare/hygraph-vs-storyblok.md)
- [Kontent.ai vs Storyblok](https://www.anchorterminal.com/compare/kontent-ai-vs-storyblok.md)
- [Payload vs Storyblok](https://www.anchorterminal.com/compare/payload-vs-storyblok.md)
- [Prismic vs Storyblok](https://www.anchorterminal.com/compare/prismic-vs-storyblok.md)
- [Sanity vs Storyblok](https://www.anchorterminal.com/compare/sanity-vs-storyblok.md)
- [Storyblok vs Strapi](https://www.anchorterminal.com/compare/storyblok-vs-strapi.md)
- [Storyblok vs Webflow](https://www.anchorterminal.com/compare/storyblok-vs-webflow.md)
- [Storyblok vs WordPress](https://www.anchorterminal.com/compare/storyblok-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp