{ "data": { "a": { "slug": "cosmic", "name": "Cosmic", "vendor": "Cosmic Inc.", "vendorUrl": "https://www.cosmicjs.com", "kind": "http-api", "category": "cms", "summary": "Cosmic is a hosted headless CMS with a REST API, a TypeScript SDK, a CLI and a hosted MCP server. Agents read and write objects, media and object types, generate media, and can create a project by agent signup.", "url": "https://www.anchorterminal.com/tools/cosmic", "markdownUrl": "https://www.anchorterminal.com/tools/cosmic.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cosmic.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cosmic.json", "dns": "cosmic.grade.anchorterminal.com", "repo": "https://github.com/cosmicjs/mcp", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "packages": [ { "registry": "npm", "name": "@cosmicjs/mcp" }, { "registry": "npm", "name": "@cosmicjs/sdk" }, { "registry": "npm", "name": "@cosmicjs/cli" } ], "auth": "api-key", "authNotes": "Each bucket has a read key and a write key, rotatable independently. The hosted MCP server takes `Authorization: Bearer READ_KEY` for read-only tools or `READ_KEY:WRITE_KEY` for full access; the write key can also go in `X-Cosmic-Write-Key`. The REST API takes the read key as `read_key` in the query or as a Bearer token on GET. POST /v3/agents/sign-up on dapi.cosmicjs.com needs no authentication and returns bucket keys for a new unclaimed project tied to a human's email.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 1 bucket, 10,000 objects and 250,000 non-cached API requests a month, no card. Builder $99 a month, Team $299, Business $499, Small Workspace $999 and Large Workspace $2,999, with 10 per cent off yearly; Enterprise by quote. Webhooks, localisation and revision history are paid add-ons. Workspace plans have a 30-day trial.", "priceSummary": "$99 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the OpenAPI spec, the MCP docs or pricing.md (checked 2026-11-06). An unclaimed or over-limit bucket returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 24, "popularity": { "githubStars": null, "npmWeekly": 295, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.cosmicjs.com/docs", "llmsTxt": "https://www.cosmicjs.com/llms.txt", "openapi": "https://www.cosmicjs.com/openapi.json", "registryName": "com.cosmicjs/mcp", "capabilities": [ "cms.content", "cms.assets", "cms.schema", "cms.publish", "cms.localisation" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "mcp-registry", "openapi", "llms-txt", "free-tier", "no-card", "status-page", "webhooks", "typescript", "cli", "closed-source" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 72.5, "grade": "BB", "agentReady": true, "rank": 123, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "bestFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "strengths": [ "Agent signup API provisions a project and bucket with keys, idempotent per email and agent", "24 MCP tools with readOnlyHint and destructiveHint, and descriptions that say when to use each", "Leaving out the write key gives read-only MCP access", "OpenAPI spec, llms.txt and Markdown docs with an error model and per-code retry guidance", "Free plan with no card and published prices and quotas for every paid plan" ], "weaknesses": [ "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement", "The REST API accepts the read key as a URL query parameter", "Revision history, webhooks and localisation are paid add-ons", "The OpenAPI spec covers 21 operations, fewer than the documented API", "Data is kept indefinitely unless deletion is requested" ], "agentNotes": [ "Send only the read key in the Bearer token unless the task needs writes", "Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days", "Fix and don't retry on 400; wait and retry on 429", "Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit", "Confirm with the user before cosmic_objects_delete, which deletes permanently" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.5 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 53 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @cosmicjs/mcp", "http": "curl -X POST https://dapi.cosmicjs.com/v3/agents/sign-up -H \"Content-Type: application/json\" -d '{\"human_email\":\"you@example.com\",\"project_name\":\"Recipe Blog\",\"agent_id\":\"my-agent\"}'", "config": { "mcpServers": { "cosmic": { "headers": { "Authorization": "Bearer your-read-key:your-write-key" }, "url": "https://mcp.cosmicjs.com/v1/buckets/your-bucket-slug" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/cosmic" }, "area": "business", "unitPrices": [ { "item": "Builder plan", "unit": "month", "usd": 99, "note": "3 buckets, 50,000 objects, 1 million non-cached requests; $89 a month yearly" }, { "item": "Team plan", "unit": "month", "usd": 299, "note": "5 buckets, 100,000 objects, 2 million non-cached requests" }, { "item": "Business plan", "unit": "month", "usd": 499, "note": "10 buckets, 250,000 objects, 5 million non-cached requests" } ], "provenance": { "legalEntity": "Cosmic Inc.", "domain": "cosmicjs.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.cosmicjs.com/terms-of-service", "privacy": "https://www.cosmicjs.com/privacy-policy", "statusPage": "https://cosmicstatus.com", "changelog": "https://www.cosmicjs.com/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy were last updated on 13 January 2025 and name Cosmic JS at 3208 Bonniebrook Dr, Plano, Texas. The MCP server's licence names Cosmic Inc.", "The terms forbid using a robot or spider to copy or scrape the website without written permission; recorded as a fact. www.cosmicjs.com/robots.txt allows all crawlers, including ClaudeBot, except /api/, /search, /community/members/ and /v3/.", "www.cosmicjs.com/.well-known/security.txt returned 404. The security page asks for vulnerability reports at support@cosmicjs.com.", "cosmicstatus.com redirects to a Statuspage at cosmicjs.statuspage.io with API and Web Dashboard components." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cosmic.json", "live": { "slug": "cosmic", "probe": { "target": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "method": "get", "lastAt": "2026-11-07T18:20:18.962856282Z", "lastOk": true, "lastStatus": 401, "lastMs": 494, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 452, "p95ms24h": 538, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://cosmicstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:35.290408052Z" }, "versions": [ { "registry": "github", "name": "cosmicjs/mcp", "version": "v1.7.1", "released": "2026-11-02", "seenAt": "2026-11-06T23:17:54.958583794Z" }, { "registry": "mcp-registry", "name": "com.cosmicjs/mcp", "version": "1.6.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@cosmicjs/cli", "version": "1.12.0", "seenAt": "2026-11-06T23:17:52.953736128Z" }, { "registry": "npm", "name": "@cosmicjs/mcp", "version": "1.7.1", "seenAt": "2026-11-06T23:17:50.755872442Z" }, { "registry": "npm", "name": "@cosmicjs/sdk", "version": "2.4.0", "seenAt": "2026-11-06T23:17:51.562341268Z" } ], "githubStars": 1, "npmWeekly": 295, "securityTxt": { "url": "https://cosmicjs.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:42.91283778Z" }, "llmsTxt": { "url": "https://www.cosmicjs.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:12.321724133Z" }, "pages": [ { "url": "https://www.cosmicjs.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:27:27.310794511Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3e45613abe99" }, { "url": "https://www.cosmicjs.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:27:31.923491628Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d4aa3db9a89b" }, { "url": "https://www.cosmicjs.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:27:35.902981274Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3c4a26f1901" } ], "updatedAt": "2026-11-07T18:20:18.962856282Z" } }, "answer": "Cosmic scores 72.5 (BB) on agent readiness against Strapi's 67.7 (B), and leads in 3 of 7 scored categories. Strapi leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "strapi", "name": "Strapi", "vendor": "Strapi, Inc.", "vendorUrl": "https://strapi.io", "kind": "http-api", "category": "cms", "summary": "Strapi is an open-source headless CMS for Node.js that its owner hosts, with a paid cloud. Agents create, localise and publish entries through generated REST and GraphQL APIs or a built-in MCP server.", "url": "https://www.anchorterminal.com/tools/strapi", "markdownUrl": "https://www.anchorterminal.com/tools/strapi.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/strapi.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/strapi.json", "dns": "strapi.grade.anchorterminal.com", "repo": "https://github.com/strapi/strapi", "license": "MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "@strapi/strapi" }, { "registry": "npm", "name": "@strapi/client" } ], "auth": "api-key", "authNotes": "Self-serve tokens created in the admin panel of your own instance, with no app review or partner approval. API tokens authenticate the Content API under /api and are read-only, full access or custom per content type and action. Admin tokens authenticate admin routes and the MCP server at /mcp and hold a chosen subset of their owner's permissions, down to field and locale. Each kind is rejected on the other's routes. Both expire after 7, 30 or 90 days or never, can be regenerated, and travel as `Authorization: Bearer`. An Admin token is shown once.", "pricing": "freemium", "pricingNotes": "The Community Edition is free to self-host with unlimited seats, so an agent can start without a contract or a card. Growth is $45 a month for 3 seats ($15 per extra seat) with a 30-day trial and no card, and Enterprise is priced by sales. Strapi Cloud is $35, $90 or $450 a project a month, needs a card at project creation, and charges $1.50 per 25,000 API requests over the plan (checked 2026-10-07).", "priceSummary": "$45 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation index, the pricing pages or the repository's MCP code (checked 2026-10-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 73289, "npmWeekly": 258813, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://docs.strapi.io", "llmsTxt": "https://docs.strapi.io/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.localisation", "cms.assets", "cms.schema" ], "tags": [ "open-source", "self-hosted", "hosted", "mcp", "llms-txt", "webhooks", "graphql", "typescript", "status-page", "soc2" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 67.7, "grade": "B", "agentReady": false, "rank": 308, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 87, "payments": 50, "reliability": 82, "schema": 80, "security": 66, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -4, "negativeNotes": [ "Strapi publishes its own advisories on GitHub, and this run counts them one by one. OSV lists five for Strapi's packages published in the last 12 months, all fixed in released versions and more than two months old. Two are critical, GHSA-3xcq-8mjw-h6mx (CVE-2026-22599, 13 May 2026, SQL injection in the Content-Type Builder, fixed in 5.33.2 and 4.26.1) and GHSA-rjg2-95x7-8qmx (CVE-2026-27886, 14 May 2026, sensitive data leaked through relation filters, fixed in 5.37.0), 1 each, the value this run gives a fixed critical or High more than two months old. Two are Moderate, GHSA-7mqx-wwh4-f9fw (CVE-2025-64526, 13 May, a rate-limit bypass in Users \u0026 Permissions, fixed in 5.45.0) and GHSA-pcw7-5633-82vv (CVE-2026-22707, 14 May, an upload MIME check bypass, fixed in 5.33.3), 1 each. GHSA-hvp3-26wx-g2w4 (Low, password reset kept refresh sessions) costs nothing. 1 + 1 + 1 + 1 = 4. https://api.osv.dev/v1/query ; https://github.com/strapi/strapi/security/advisories" ], "verdict": "The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is paid-only and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.", "bestFor": "Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.", "strengths": [ "Admin tokens carry a chosen subset of the owner's permissions, down to content type, action, field and locale, with 7, 30 or 90 day expiry", "The MCP server lists only the tools a token may use and narrows each input and output schema to permitted fields", "Media delete tools preview by default through `dryRun` and name what would be removed before anything is deleted", "Weekly releases, 14 tagged versions between 5 August and 28 October 2026, with release notes per version", "MIT Community Edition, free to self-host with unlimited seats, plus llms.txt, llms-full.txt and Markdown copies of every docs page" ], "weaknesses": [ "Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans", "Audit Logs and Review Workflows are Enterprise only, so the free edition has no record of what an agent changed", "A REST POST or PUT publishes immediately unless the request passes `status=draft`", "The MCP server can't upload files, describes dynamic zones as untyped arrays and sets no read-only or destructive annotations", "Five advisories were published in May 2026, two critical (SQL injection in the Content-Type Builder, a data leak through relation filters), all fixed in earlier releases" ], "agentNotes": [ "Pass `status=draft` on every REST POST and PUT. Without it the Content API publishes the entry at once", "Use an Admin token for `/mcp` and admin routes and an API token for `/api`. Each kind is rejected on the other's routes", "Upload files with multipart POST to `/api/upload` first, then reference the returned file id in the entry. MCP tools can't upload", "Call `media_delete_assets` and `media_delete_folder` without `dryRun` first to preview, and take asset ids only from `media_list_assets`", "Keep your own copy of an entry before updating it. API and MCP writes create no Content History version" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.7 } ], "editorialScores": { "ergonomics": 65, "maintenance": 87, "payments": 50, "reliability": 82, "schema": 80, "security": 66, "transparency": 75 }, "provenanceScore": 69, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx create-strapi@latest", "http": "curl 'http://localhost:1337/api/restaurants?status=draft' \\\n -H \"Authorization: Bearer $STRAPI_API_TOKEN\"", "claudeCode": "claude mcp add strapi-mcp --transport http http://localhost:1337/mcp -H \"Authorization: Bearer YOUR_ADMIN_TOKEN\"", "config": { "mcpServers": { "strapi-mcp": { "headers": { "Authorization": "Bearer YOUR_ADMIN_TOKEN" }, "type": "streamable-http", "url": "http://localhost:1337/mcp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/strapi" }, "area": "business", "unitPrices": [ { "item": "Community Edition, self-hosted", "unit": "month", "usd": 0, "note": "MIT, unlimited seats, you pay for your own hosting" }, { "item": "Growth, self-hosted", "unit": "month", "usd": 45, "note": "3 seats included, $15 per extra seat" }, { "item": "Strapi Cloud Starter", "unit": "month", "usd": 35, "note": "per project, 100,000 API requests" }, { "item": "Strapi Cloud Pro", "unit": "month", "usd": 90, "note": "per project, 1 million API requests" }, { "item": "Strapi Cloud Business", "unit": "month", "usd": 450, "note": "per project, 10 million API requests" }, { "item": "Strapi Cloud API requests over the plan", "unit": "1k-requests", "usd": 0.06, "note": "$1.50 per 25,000" } ], "provenance": { "legalEntity": "Strapi, Inc.", "domain": "strapi.io", "domainRegistered": "2015-09-21", "endpointOnVendorDomain": false, "terms": "https://strapi.io/cloud-legal", "privacy": "https://strapi.io/privacy", "statusPage": "https://status.strapi.io", "changelog": "https://github.com/strapi/strapi/releases", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The Strapi Cloud terms (effective 7 October 2026) name Strapi, Inc., 548 Market St, PMB 60577, San Francisco, California 94104. The repository's copyright line names Strapi Solutions SAS, and the privacy policy gives Strapi Solutions, 128 rue de la Boétie, 75008 Paris.", "A self-hosted install answers on its owner's domain. Strapi Cloud projects answer at https://\u003cproject\u003e.strapiapp.com.", "https://strapi.io/.well-known/security.txt returned 404 on 1 November 2026, as on 7 October. The repository holds a .well-known/security.txt with an Expires of 20 May 2027 and a Canonical line pointing at that URL.", "RDAP for strapi.io gives a registration date of 2015-09-21.", "The status page runs on Better Stack and covers Strapi Cloud, the website and the docs, not self-hosted installs." ], "score": 69 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/strapi.json", "live": { "slug": "strapi", "vendorStatus": { "page": "https://status.strapi.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:49.371257801Z" }, "versions": [ { "registry": "github", "name": "strapi/strapi", "version": "v5.61.0", "released": "2026-11-04", "seenAt": "2026-11-07T00:08:50.606092668Z" }, { "registry": "npm", "name": "@strapi/client", "version": "1.6.2", "seenAt": "2026-11-07T00:08:48.630156095Z" }, { "registry": "npm", "name": "@strapi/strapi", "version": "5.61.0", "seenAt": "2026-11-07T00:08:48.416025704Z" } ], "githubStars": 73439, "npmWeekly": 272760, "securityTxt": { "url": "https://strapi.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:29.878163067Z" }, "llmsTxt": { "url": "https://docs.strapi.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:03.195364993Z" }, "domain": { "domain": "strapi.io", "checkedAt": "2026-11-01T14:14:17.339178201Z" }, "pages": [ { "url": "https://strapi.io/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:21:04.710154099Z", "changedAt": "2026-10-21T00:35:29.759997175Z", "fingerprint": "ebba9951194b" }, { "url": "https://strapi.io/cloud-legal", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:21:02.008660727Z", "changedAt": "2026-10-21T00:35:27.142871952Z", "fingerprint": "79685bdc4a33" } ], "github": { "repo": "strapi/strapi", "checkedAt": "2026-11-02T09:28:28.153243123Z", "stars": 73423, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:28:09Z", "openIssues": 228, "openPRs": 437, "issuesOpened90d": 201, "issuesClosed90d": 231, "prsMerged90d": 456, "ci": { "branch": "develop", "runs": 50, "success": 30, "failure": 2, "other": 18, "latest": "success", "latestAt": "2026-11-02T09:27:48Z" }, "advisories": [ { "ghsa": "GHSA-rjg2-95x7-8qmx", "cve": "CVE-2026-27886", "severity": "critical", "published": "2026-05-13T13:39:31Z" }, { "ghsa": "GHSA-pcw7-5633-82vv", "cve": "CVE-2026-22707", "severity": "medium", "published": "2026-05-13T13:39:19Z" }, { "ghsa": "GHSA-7mqx-wwh4-f9fw", "cve": "CVE-2025-64526", "severity": "medium", "published": "2026-05-13T13:38:04Z" }, { "ghsa": "GHSA-hvp3-26wx-g2w4", "cve": "CVE-2026-22706", "severity": "low", "published": "2026-05-13T13:37:55Z" }, { "ghsa": "GHSA-3xcq-8mjw-h6mx", "cve": "CVE-2026-22599", "severity": "critical", "published": "2026-05-13T13:37:42Z" }, { "ghsa": "GHSA-495j-h493-42q2", "cve": "CVE-2024-56143", "severity": "high", "published": "2025-10-16T15:07:22Z" }, { "ghsa": "GHSA-2cjv-6wg9-f4f3", "cve": "CVE-2025-25298", "severity": "low", "published": "2025-10-16T15:07:06Z" }, { "ghsa": "GHSA-9329-mxxw-qwf8", "cve": "CVE-2025-53092", "severity": "high", "published": "2025-10-16T15:06:12Z" }, { "ghsa": "GHSA-v8wj-f5c7-pvxf", "cve": "CVE-2024-52588", "severity": "medium", "published": "2025-05-27T14:27:33Z" }, { "ghsa": "GHSA-wrvh-rcmr-9qfc", "cve": "CVE-2024-34065", "severity": "high", "published": "2024-06-12T13:03:16Z" }, { "ghsa": "GHSA-pm9q-xj9p-96pm", "cve": "CVE-2024-31217", "severity": "medium", "published": "2024-06-12T13:02:22Z" }, { "ghsa": "GHSA-6j89-frxc-q26m", "cve": "CVE-2024-29181", "severity": "low", "published": "2024-06-12T13:01:39Z" }, { "ghsa": "GHSA-gc7p-j5xm-xxh2", "cve": "CVE-2023-39345", "severity": "high", "published": "2023-11-03T07:43:47Z" }, { "ghsa": "GHSA-m284-85mf-cgrc", "cve": "CVE-2023-37263", "severity": "low", "published": "2023-09-13T15:15:38Z" }, { "ghsa": "GHSA-v8gg-4mq2-88q4", "cve": "CVE-2023-36472", "severity": "medium", "published": "2023-09-13T15:15:10Z" }, { "ghsa": "GHSA-24q2-59hm-rh9r", "cve": "CVE-2023-38507", "severity": "high", "published": "2023-09-13T15:15:03Z" }, { "ghsa": "GHSA-9xg4-3qfm-9w8f", "cve": "CVE-2023-34235", "severity": "high", "published": "2023-07-25T13:10:12Z" }, { "ghsa": "GHSA-chmr-rg2f-9jmf", "cve": "CVE-2023-34093", "severity": "medium", "published": "2023-07-25T13:10:08Z" }, { "ghsa": "GHSA-2h87-4q2w-v4hf", "cve": "CVE-2023-22621", "severity": "critical", "published": "2023-04-18T16:47:52Z" }, { "ghsa": "GHSA-jjqf-j4w7-92w8", "cve": "CVE-2023-22894", "severity": "critical", "published": "2023-04-18T16:47:44Z" }, { "ghsa": "GHSA-xv3q-jrmm-4fxv", "cve": "CVE-2023-22893", "severity": "high", "published": "2023-04-18T16:47:06Z" } ], "replies": { "sampled": 25, "unanswered": 18, "medianDays": 1.7 } }, "updatedAt": "2026-11-07T16:01:29.878163067Z" } }, "edges": [ { "by": 19, "category": "security", "leads": "strapi", "name": "Security \u0026 auth", "reasons": { "a": "Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.", "b": "API tokens are read-only, full access or custom per content type and action. Admin tokens hold a chosen subset of the owner's permissions down to field and locale. Both expire after 7, 30 or 90 days or never, can be regenerated, and travel only in the Authorization header. No OAuth (28 of 30). Read-only tokens hide every write tool, permissions are checked again at run time, MCP create writes a draft and media deletes preview first. Nothing asks a person to approve a publish or a delete, and Review Workflows are Enterprise only (15 of 20). Entries hold text written by other people, and we found no prompt-injection guidance in the MCP docs. Media responses are cut to an allowlist of fields (3 of 15). Audit Logs mark MCP actions with `origin: mcp` but need the Enterprise plan and skip reads (7 of 15). SECURITY.md sets supported versions and a GitHub advisory route, advisories are published with CVEs, the security page says SOC 2 certified and names GitHub advisories or security@strapi.io for disclosure, and the self-hosted pricing page lists a SOC 2 report as an Enterprise add-on. No bug bounty by stated policy, and strapi.io/.well-known/security.txt returned 404 on 1 November, though the repository carries one (13 of 20)." }, "scores": { "a": 47, "b": 66 } }, { "by": 17, "category": "ergonomics", "leads": "cosmic", "name": "Agent ergonomics", "reasons": { "a": "24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.", "b": "A project with five collection types and Draft \u0026 Publish exposes about 50 MCP tools, 40 generated plus 10 for media, which is the more-than-30 band (5). We added 8 because a token only sees the tools its permissions allow, so a narrow token cuts the list, and 2 for REST `fields` selection (15 of 25). Page and offset pagination with a default of 25, filters with more than 20 operators, sort and field selection (20). One error shape with status, name, message and details, and partial-failure reports on bulk media tools (16 of 20). No idempotency keys, and we found no `readOnlyHint` or `destructiveHint` in the MCP source. PUT by `documentId` is repeatable and media deletes have `dryRun` (6 of 20). Few required parameters and sensible defaults, with one official client library, @strapi/client for JavaScript (8 of 15)." }, "scores": { "a": 82, "b": 65 } }, { "by": 9, "category": "transparency", "leads": "strapi", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.", "b": "MIT for the Community Edition, with ee/ directories under a separate Enterprise Edition licence that the LICENSE file explains (26 of 30). A self-hosted install keeps content on its owner's servers. For Strapi Cloud the terms delete customer content at termination but keep backups for unstated \"standard periods\", a DPA dated 21 November 2024 is part of the cloud terms, and the privacy policy is dated 1 March 2023. The Cloud Policies still describe a Free plan that the pricing page and docs no longer list (20 of 30). SECURITY.md dates each major's support, with v4 ended in October 2025 and security fixes until April 2026, and v5 breaking changes are documented one by one. No stated notice period for API changes (14 of 20). Telemetry is on by default and documented with an opt-out command and flag. The MCP usage events added in May 2026 aren't named on that page (15 of 20)." }, "scores": { "a": 63, "b": 72 } }, { "by": 8, "category": "reliability", "leads": "cosmic", "name": "Reliability", "reasons": { "a": "Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.", "b": "Read with the local-software lines, since the graded surface is the Community Edition its owner hosts. Strapi Cloud's status page isn't scored here. Official npm packages, with Node.js 20 to 26 stated in `engines` at v5.60.0 (20). A Tests workflow runs unit, API, CLI and end-to-end suites. Per the 7 October check, not re-read on 1 November (GitHub's pages refuse our reader), the latest push run on develop passed on 7 October 2026, and on main the 30 September run passed and the 7 October run failed (20 of 25). Per the same check, 217 open issues, 45 labelled severity high and one critical, with 283 closed against 208 opened since 9 July (15 of 25). Semver releases with notes per version and each v5 breaking change documented on its own page, but OpenAPI generation is declared outside semver. No commit from 5.51.2 to 5.60.0 is marked breaking (12 of 15). 5.x is the stable line and SECURITY.md marks it LTS (15)." }, "scores": { "a": 90, "b": 82 } }, { "by": 8, "category": "schema", "leads": "cosmic", "name": "Schema \u0026 documentation", "reasons": { "a": "openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.", "b": "No published OpenAPI file, because endpoints depend on each project's content types. `strapi openapi generate` writes an OpenAPI 3.1.0 file for a project and is marked experimental, and every MCP tool carries JSON Schema 2020-12 input and output schemas built from the content model (20 of 25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). The 10 media tools say when to use each one and when not to, while generated content tools get a single line such as `Content-manager list for api::article.article` (14 of 20). Schemas are narrowed per field, action and locale and sort values are enums, but dynamic zones are untyped arrays and circular components fall back to an open record (12 of 15). REST pages pair curl examples with responses, and the error format and error classes are documented, without a list of status codes per endpoint (12 of 15). Semver with release notes on GitHub. The REST paths carry no API version (12 of 15)." }, "scores": { "a": 88, "b": 80 } }, { "by": 5, "category": "payments", "leads": "strapi", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.", "b": "Scored with the self-hosted rule, taking prices from the paid options beside the free edition. No x402, MPP or L402 (0). The Community Edition is free, Growth is $45 a month, and Strapi Cloud lists $35, $90 and $450 a project a month with $1.50 per further 25,000 API requests, all public (20). The Community Edition needs no card and Growth has a 30-day trial without one. Strapi Cloud asks for a card at project creation (20). Install and the first administrator can be scripted (`create-strapi`, `strapi admin:create-user`) with no account at Strapi, but the docs create API and Admin tokens only in the admin panel, so half (10)." }, "scores": { "a": 45, "b": 50 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Cosmic Inc.", "b": "Strapi, Inc.", "name": "Vendor" }, { "a": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms", "name": "Licence" }, { "a": "24", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.cosmicjs/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-11-02", "b": "2026-10-28", "name": "Last release" }, { "a": "no date given", "b": "2026-10-07", "name": "Terms last updated" }, { "a": "no date given", "b": "2023-03-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "295 npm/wk", "b": "73k stars, 259k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cosmic scores 72.5 (BB) on agent readiness against Strapi's 67.7 (B), and leads in 3 of 7 scored categories. Strapi leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, Cosmic or Strapi?" }, { "answer": "Both need an API key.", "question": "Do Cosmic and Strapi need an API key?" }, { "answer": "Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. No hosted endpoint is listed for Strapi.", "question": "Can an agent call Cosmic and Strapi without installing anything?" }, { "answer": "No open-source release is listed for Cosmic. Strapi is open source (MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms).", "question": "Are Cosmic and Strapi open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 90 against 82", "Schema \u0026 documentation, 88 against 80", "Agent ergonomics, 82 against 65" ], "also": [ "Agent-ready, a grade of BB or better", "A hosted endpoint, with nothing to install", "Runs on your own machine", "Free to start without a card", "No incidents deducted, where Strapi loses 4 points for them" ], "goodFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "slug": "cosmic", "watchFor": "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement" }, { "aheadOn": [ "Security \u0026 auth, 66 against 47", "Payments \u0026 pricing, 50 against 45", "Transparency \u0026 trust, 72 against 63" ], "also": [ "Open source" ], "goodFor": "Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.", "slug": "strapi", "watchFor": "Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans" } ], "history": { "cosmic": null, "strapi": [ { "causes": [ "correction" ], "date": "2026-11-01", "delta": 2, "from": 65.7, "fromGrade": "B", "to": 67.7, "toGrade": "B" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": -0.2, "from": 65.9, "fromGrade": "B", "to": 65.7, "toGrade": "B" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.2, "from": 65.7, "fromGrade": "B", "to": 65.9, "toGrade": "B" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-strapi.json", "title": "BCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/bcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic.json", "title": "ButterCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-strapi.json", "title": "ButterCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/buttercms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic.json", "title": "Contentstack vs Cosmic", "url": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-strapi.json", "title": "Contentstack vs Strapi", "url": "https://www.anchorterminal.com/compare/contentstack-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-datocms.json", "title": "Cosmic vs DatoCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-directus.json", "title": "Cosmic vs Directus", "url": "https://www.anchorterminal.com/compare/cosmic-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.json", "title": "Cosmic vs Ghost", "url": "https://www.anchorterminal.com/compare/cosmic-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph.json", "title": "Cosmic vs Hygraph", "url": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.json", "title": "Cosmic vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-payload.json", "title": "Cosmic vs Payload", "url": "https://www.anchorterminal.com/compare/cosmic-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-prismic.json", "title": "Cosmic vs Prismic", "url": "https://www.anchorterminal.com/compare/cosmic-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-sanity.json", "title": "Cosmic vs Sanity", "url": "https://www.anchorterminal.com/compare/cosmic-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok.json", "title": "Cosmic vs Storyblok", "url": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.json", "title": "Cosmic vs Webflow", "url": "https://www.anchorterminal.com/compare/cosmic-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json", "title": "Cosmic vs WordPress", "url": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-strapi.json", "title": "DatoCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/datocms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-strapi.json", "title": "Directus vs Strapi", "url": "https://www.anchorterminal.com/compare/directus-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-strapi.json", "title": "dotCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/dotcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-strapi.json", "title": "Ghost vs Strapi", "url": "https://www.anchorterminal.com/compare/ghost-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-strapi.json", "title": "Hygraph vs Strapi", "url": "https://www.anchorterminal.com/compare/hygraph-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-strapi.json", "title": "Kontent.ai vs Strapi", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-strapi.json", "title": "Payload vs Strapi", "url": "https://www.anchorterminal.com/compare/payload-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/prismic-vs-strapi.json", "title": "Prismic vs Strapi", "url": "https://www.anchorterminal.com/compare/prismic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-strapi.json", "title": "Sanity vs Strapi", "url": "https://www.anchorterminal.com/compare/sanity-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-strapi.json", "title": "Storyblok vs Strapi", "url": "https://www.anchorterminal.com/compare/storyblok-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-webflow.json", "title": "Strapi vs Webflow", "url": "https://www.anchorterminal.com/compare/strapi-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-wordpress.json", "title": "Strapi vs WordPress", "url": "https://www.anchorterminal.com/compare/strapi-vs-wordpress" } ], "panel": null, "scores": [ { "by": 8, "cosmic": 90, "edge": "cosmic", "key": "reliability", "name": "Reliability", "strapi": 82, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 8, "cosmic": 88, "edge": "cosmic", "key": "schema", "name": "Schema \u0026 documentation", "strapi": 80, "weight": 13 }, { "by": 17, "cosmic": 82, "edge": "cosmic", "key": "ergonomics", "name": "Agent ergonomics", "strapi": 65, "weight": 13 }, { "by": 19, "cosmic": 47, "edge": "strapi", "key": "security", "name": "Security \u0026 auth", "strapi": 66, "weight": 14 }, { "by": 5, "cosmic": 45, "edge": "strapi", "key": "payments", "name": "Payments \u0026 pricing", "strapi": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 1, "cosmic": 86, "edge": "strapi", "key": "maintenance", "name": "Maintenance \u0026 community", "strapi": 87, "weight": 7 }, { "by": 9, "cosmic": 63, "edge": "strapi", "key": "transparency", "name": "Transparency \u0026 trust", "strapi": 72, "weight": 7 } ], "summary": "Cosmic scores 72.5 (BB) on agent readiness against Strapi's 67.7 (B), and leads in 3 of 7 scored categories. Strapi leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "cosmic": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "strapi": "The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is paid-only and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cosmic-vs-strapi", "json": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.min.md" }, "markdown": "Cosmic scores 72.5 (BB) on agent readiness against Strapi's 67.7 (B), and leads in 3 of 7 scored categories. Strapi leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust. Both do content management.\n\n- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json\n- Strapi: grade B, 67.7/100, rank #308 of 1486. Markdown https://www.anchorterminal.com/tools/strapi.md · JSON https://www.anchorterminal.com/api/v1/tools/strapi.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### Cosmic (BB)\n\nGood for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.\n\nAhead on:\n- Reliability, 90 against 82\n- Schema \u0026 documentation, 88 against 80\n- Agent ergonomics, 82 against 65\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- Free to start without a card\n- No incidents deducted, where Strapi loses 4 points for them\n\nWatch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement\n\n### Strapi (B)\n\nGood for: Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.\n\nAhead on:\n- Security \u0026 auth, 66 against 47\n- Payments \u0026 pricing, 50 against 45\n- Transparency \u0026 trust, 72 against 63\n\nAlso in its favour:\n- Open source\n\nWatch for: Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans\n\n\n## Why the edge\n\n### Security \u0026 auth: Strapi +19\n\n- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.\n- Strapi (66): API tokens are read-only, full access or custom per content type and action. Admin tokens hold a chosen subset of the owner's permissions down to field and locale. Both expire after 7, 30 or 90 days or never, can be regenerated, and travel only in the Authorization header. No OAuth (28 of 30). Read-only tokens hide every write tool, permissions are checked again at run time, MCP create writes a draft and media deletes preview first. Nothing asks a person to approve a publish or a delete, and Review Workflows are Enterprise only (15 of 20). Entries hold text written by other people, and we found no prompt-injection guidance in the MCP docs. Media responses are cut to an allowlist of fields (3 of 15). Audit Logs mark MCP actions with `origin: mcp` but need the Enterprise plan and skip reads (7 of 15). SECURITY.md sets supported versions and a GitHub advisory route, advisories are published with CVEs, the security page says SOC 2 certified and names GitHub advisories or security@strapi.io for disclosure, and the self-hosted pricing page lists a SOC 2 report as an Enterprise add-on. No bug bounty by stated policy, and strapi.io/.well-known/security.txt returned 404 on 1 November, though the repository carries one (13 of 20).\n\n### Agent ergonomics: Cosmic +17\n\n- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.\n- Strapi (65): A project with five collection types and Draft \u0026 Publish exposes about 50 MCP tools, 40 generated plus 10 for media, which is the more-than-30 band (5). We added 8 because a token only sees the tools its permissions allow, so a narrow token cuts the list, and 2 for REST `fields` selection (15 of 25). Page and offset pagination with a default of 25, filters with more than 20 operators, sort and field selection (20). One error shape with status, name, message and details, and partial-failure reports on bulk media tools (16 of 20). No idempotency keys, and we found no `readOnlyHint` or `destructiveHint` in the MCP source. PUT by `documentId` is repeatable and media deletes have `dryRun` (6 of 20). Few required parameters and sensible defaults, with one official client library, @strapi/client for JavaScript (8 of 15).\n\n### Transparency \u0026 trust: Strapi +9\n\n- Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.\n- Strapi (72): MIT for the Community Edition, with ee/ directories under a separate Enterprise Edition licence that the LICENSE file explains (26 of 30). A self-hosted install keeps content on its owner's servers. For Strapi Cloud the terms delete customer content at termination but keep backups for unstated \"standard periods\", a DPA dated 21 November 2024 is part of the cloud terms, and the privacy policy is dated 1 March 2023. The Cloud Policies still describe a Free plan that the pricing page and docs no longer list (20 of 30). SECURITY.md dates each major's support, with v4 ended in October 2025 and security fixes until April 2026, and v5 breaking changes are documented one by one. No stated notice period for API changes (14 of 20). Telemetry is on by default and documented with an opt-out command and flag. The MCP usage events added in May 2026 aren't named on that page (15 of 20).\n\n### Reliability: Cosmic +8\n\n- Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.\n- Strapi (82): Read with the local-software lines, since the graded surface is the Community Edition its owner hosts. Strapi Cloud's status page isn't scored here. Official npm packages, with Node.js 20 to 26 stated in `engines` at v5.60.0 (20). A Tests workflow runs unit, API, CLI and end-to-end suites. Per the 7 October check, not re-read on 1 November (GitHub's pages refuse our reader), the latest push run on develop passed on 7 October 2026, and on main the 30 September run passed and the 7 October run failed (20 of 25). Per the same check, 217 open issues, 45 labelled severity high and one critical, with 283 closed against 208 opened since 9 July (15 of 25). Semver releases with notes per version and each v5 breaking change documented on its own page, but OpenAPI generation is declared outside semver. No commit from 5.51.2 to 5.60.0 is marked breaking (12 of 15). 5.x is the stable line and SECURITY.md marks it LTS (15).\n\n### Schema \u0026 documentation: Cosmic +8\n\n- Cosmic (88): openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.\n- Strapi (80): No published OpenAPI file, because endpoints depend on each project's content types. `strapi openapi generate` writes an OpenAPI 3.1.0 file for a project and is marked experimental, and every MCP tool carries JSON Schema 2020-12 input and output schemas built from the content model (20 of 25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). The 10 media tools say when to use each one and when not to, while generated content tools get a single line such as `Content-manager list for api::article.article` (14 of 20). Schemas are narrowed per field, action and locale and sort values are enums, but dynamic zones are untyped arrays and circular components fall back to an open record (12 of 15). REST pages pair curl examples with responses, and the error format and error classes are documented, without a list of status codes per endpoint (12 of 15). Semver with release notes on GitHub. The REST paths carry no API version (12 of 15).\n\n### Payments \u0026 pricing: Strapi +5\n\n- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.\n- Strapi (50): Scored with the self-hosted rule, taking prices from the paid options beside the free edition. No x402, MPP or L402 (0). The Community Edition is free, Growth is $45 a month, and Strapi Cloud lists $35, $90 and $450 a project a month with $1.50 per further 25,000 API requests, all public (20). The Community Edition needs no card and Growth has a 30-day trial without one. Strapi Cloud asks for a card at project creation (20). Install and the first administrator can be scripted (`create-strapi`, `strapi admin:create-user`) with no account at Strapi, but the docs create API and Admin tokens only in the admin panel, so half (10).\n\n## Score by category\n\n| Category | Weight | Cosmic | Strapi | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 90 | 82 | Cosmic +8 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 88 | 80 | Cosmic +8 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 65 | Cosmic +17 |\n| Security \u0026 auth | 14% (17.5 this run) | 47 | 66 | Strapi +19 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 50 | Strapi +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 86 | 87 | Strapi +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 72 | Strapi +9 |\n| Negative events | ≤15 | 0 | -4 | |\n| **Total** | | **72.5 · BB** | **67.7 · B** | |\n\n## Facts side by side\n\n| Fact | Cosmic | Strapi |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Cosmic Inc. | Strapi, Inc. |\n| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | no (local only) |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |\n| Auth | API key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | none | MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms |\n| Tools exposed | 24 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.cosmicjs/mcp` | not listed |\n| Last release | 2026-11-02 | 2026-10-28 |\n| Terms last updated | no date given | 2026-10-07 |\n| Privacy policy last updated | no date given | 2023-03-01 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 295 npm/wk | 73k stars, 259k npm/wk |\n| Agent reviews | none | 3.5/5 (4) |\n\n## How the scores have moved\n\n### Cosmic\n\nNo score change since it was listed.\n\n### Strapi\n\n- +2.0 on 1 November 2026: correction\n- -0.2 on 28 October 2026: correction\n- +0.2 on 28 October 2026: new evidence\n\n## Verdicts\n\n**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.\n\n**Strapi.** The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is paid-only and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.\n\n## Before you call either\n\n### Cosmic\n\n1. Send only the read key in the Bearer token unless the task needs writes\n2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days\n3. Fix and don't retry on 400; wait and retry on 429\n4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit\n5. Confirm with the user before cosmic_objects_delete, which deletes permanently\n\n### Strapi\n\n1. Pass `status=draft` on every REST POST and PUT. Without it the Content API publishes the entry at once\n2. Use an Admin token for `/mcp` and admin routes and an API token for `/api`. Each kind is rejected on the other's routes\n3. Upload files with multipart POST to `/api/upload` first, then reference the returned file id in the entry. MCP tools can't upload\n4. Call `media_delete_assets` and `media_delete_folder` without `dryRun` first to preview, and take asset ids only from `media_list_assets`\n5. Keep your own copy of an entry before updating it. API and MCP writes create no Content History version\n\n## Questions\n\n### Which is better for AI agents, Cosmic or Strapi?\n\nCosmic scores 72.5 (BB) on agent readiness against Strapi's 67.7 (B), and leads in 3 of 7 scored categories. Strapi leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.\n\n### Do Cosmic and Strapi need an API key?\n\nBoth need an API key.\n\n### Can an agent call Cosmic and Strapi without installing anything?\n\nCosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. No hosted endpoint is listed for Strapi.\n\n### Are Cosmic and Strapi open source?\n\nNo open-source release is listed for Cosmic. Strapi is open source (MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-strapi.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-strapi.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cosmic\", \"b\": \"strapi\"}`. From a terminal: `anchor compare cosmic strapi`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/strapi.json\n\n## Other comparisons with Cosmic or Strapi\n\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)\n- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)\n- [ButterCMS vs Strapi](https://www.anchorterminal.com/compare/buttercms-vs-strapi.md)\n- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)\n- [Contentstack vs Strapi](https://www.anchorterminal.com/compare/contentstack-vs-strapi.md)\n- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)\n- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)\n- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)\n- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)\n- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)\n- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)\n- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)\n- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)\n- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)\n- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)\n- [DatoCMS vs Strapi](https://www.anchorterminal.com/compare/datocms-vs-strapi.md)\n- [Directus vs Strapi](https://www.anchorterminal.com/compare/directus-vs-strapi.md)\n- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)\n- [Ghost vs Strapi](https://www.anchorterminal.com/compare/ghost-vs-strapi.md)\n- [Hygraph vs Strapi](https://www.anchorterminal.com/compare/hygraph-vs-strapi.md)\n- [Kontent.ai vs Strapi](https://www.anchorterminal.com/compare/kontent-ai-vs-strapi.md)\n- [Payload vs Strapi](https://www.anchorterminal.com/compare/payload-vs-strapi.md)\n- [Prismic vs Strapi](https://www.anchorterminal.com/compare/prismic-vs-strapi.md)\n- [Sanity vs Strapi](https://www.anchorterminal.com/compare/sanity-vs-strapi.md)\n- [Storyblok vs Strapi](https://www.anchorterminal.com/compare/storyblok-vs-strapi.md)\n- [Strapi vs Webflow](https://www.anchorterminal.com/compare/strapi-vs-webflow.md)\n- [Strapi vs WordPress](https://www.anchorterminal.com/compare/strapi-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cosmic vs Strapi", "url": "" } ], "description": "Cosmic scores 72.5 (BB) to Strapi's 67.7 (B) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cosmic BB 72.5", "Strapi B 67.7", "scores" ], "h1": "Cosmic vs Strapi", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cosmic-vs-strapi", "published": "2026-10-01", "section": "tools", "title": "Cosmic vs Strapi for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cosmic-vs-strapi" }, "tokens": { "markdown": 4900, "slim": 3030 }, "version": 1 }