# Cosmic vs Strapi (slim)

> Cosmic scores 72.5 (BB) to Strapi's 67.7 (B) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cosmic-vs-strapi.md (~4,900 tokens) · this version ~3,030 tokens · JSON https://www.anchorterminal.com/compare/cosmic-vs-strapi.json · canonical https://www.anchorterminal.com/compare/cosmic-vs-strapi
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Cosmic scores 72.5 (BB) on agent readiness against Strapi's 67.7 (B), and leads in 3 of 7 scored categories. Strapi leads on security & auth, payments & pricing and transparency & trust. Both do content management.

- Cosmic: BB 72.5, rank #123 of 1486 · https://www.anchorterminal.com/tools/cosmic.min.md
- Strapi: B 67.7, rank #308 of 1486 · https://www.anchorterminal.com/tools/strapi.min.md
- Cosmic, good for Teams that want an agent to set up and fill a hosted CMS end to end, including signup. Ahead on Reliability, 90 against 82; Schema & documentation, 88 against 80; Agent ergonomics, 82 against 65. Also Agent-ready, a grade of BB or better; A hosted endpoint, with nothing to install; Runs on your own machine; Free to start without a card; No incidents deducted, where Strapi loses 4 points for them.
- Strapi, good for Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token. Ahead on Security & auth, 66 against 47; Payments & pricing, 50 against 45; Transparency & trust, 72 against 63. Also Open source.

| Category | Cosmic | Strapi |
| --- | --- | --- |
| Reliability (16%) | 90 | 82 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 88 | 80 |
| Agent ergonomics (13%) | 82 | 65 |
| Security & auth (14%) | 47 | 66 |
| Payments & pricing (10%) | 45 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 86 | 87 |
| Transparency & trust (7%) | 63 | 72 |

| Fact (where they differ) | Cosmic | Strapi |
| --- | --- | --- |
| Vendor | Cosmic Inc. | Strapi, Inc. |
| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | no (local only) |
| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |
| Licence | none | MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms |
| Tools exposed | 24 | none |
| Read-only variant documented | yes | no |
| MCP registry | `com.cosmicjs/mcp` | not listed |
| Last release | 2026-11-02 | 2026-10-28 |
| Terms last updated | no date given | 2026-10-07 |
| Privacy policy last updated | no date given | 2023-03-01 |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | not found in the text | yes |
| Popularity | 295 npm/wk | 73k stars, 259k npm/wk |
| Agent reviews | none | 3.5/5 (4) |

Why the edge:
- Security & auth, Strapi +19: Cosmic 47 (Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.); Strapi 66 (API tokens are read-only, full access or custom per content type and action. Admin tokens hold a chosen subset of the owner's permissions down to field and locale. Both expire after 7, 30 or 90 days or never, can be regenerated, and travel only in the Authorization header. No OAuth (28 of 30). Read-only tokens hide every write tool, permissions are checked again at run time, MCP create writes a draft and media deletes preview first. Nothing asks a person to approve a publish or a delete, and Review Workflows are Enterprise only (15 of 20). Entries hold text written by other people, and we found no prompt-injection guidance in the MCP docs. Media responses are cut to an allowlist of fields (3 of 15). Audit Logs mark MCP actions with `origin: mcp` but need the Enterprise plan and skip reads (7 of 15). SECURITY.md sets supported versions and a GitHub advisory route, advisories are published with CVEs, the security page says SOC 2 certified and names GitHub advisories or security@strapi.io for disclosure, and the self-hosted pricing page lists a SOC 2 report as an Enterprise add-on. No bug bounty by stated policy, and strapi.io/.well-known/security.txt returned 404 on 1 November, though the repository carries one (13 of 20).)
- Agent ergonomics, Cosmic +17: Cosmic 82 (24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.); Strapi 65 (A project with five collection types and Draft & Publish exposes about 50 MCP tools, 40 generated plus 10 for media, which is the more-than-30 band (5). We added 8 because a token only sees the tools its permissions allow, so a narrow token cuts the list, and 2 for REST `fields` selection (15 of 25). Page and offset pagination with a default of 25, filters with more than 20 operators, sort and field selection (20). One error shape with status, name, message and details, and partial-failure reports on bulk media tools (16 of 20). No idempotency keys, and we found no `readOnlyHint` or `destructiveHint` in the MCP source. PUT by `documentId` is repeatable and media deletes have `dryRun` (6 of 20). Few required parameters and sensible defaults, with one official client library, @strapi/client for JavaScript (8 of 15).)
- Transparency & trust, Strapi +9: Cosmic 63 (A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.); Strapi 72 (MIT for the Community Edition, with ee/ directories under a separate Enterprise Edition licence that the LICENSE file explains (26 of 30). A self-hosted install keeps content on its owner's servers. For Strapi Cloud the terms delete customer content at termination but keep backups for unstated "standard periods", a DPA dated 21 November 2024 is part of the cloud terms, and the privacy policy is dated 1 March 2023. The Cloud Policies still describe a Free plan that the pricing page and docs no longer list (20 of 30). SECURITY.md dates each major's support, with v4 ended in October 2025 and security fixes until April 2026, and v5 breaking changes are documented one by one. No stated notice period for API changes (14 of 20). Telemetry is on by default and documented with an opt-out command and flag. The MCP usage events added in May 2026 aren't named on that page (15 of 20).)
- Reliability, Cosmic +8: Cosmic 90 (Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.); Strapi 82 (Read with the local-software lines, since the graded surface is the Community Edition its owner hosts. Strapi Cloud's status page isn't scored here. Official npm packages, with Node.js 20 to 26 stated in `engines` at v5.60.0 (20). A Tests workflow runs unit, API, CLI and end-to-end suites. Per the 7 October check, not re-read on 1 November (GitHub's pages refuse our reader), the latest push run on develop passed on 7 October 2026, and on main the 30 September run passed and the 7 October run failed (20 of 25). Per the same check, 217 open issues, 45 labelled severity high and one critical, with 283 closed against 208 opened since 9 July (15 of 25). Semver releases with notes per version and each v5 breaking change documented on its own page, but OpenAPI generation is declared outside semver. No commit from 5.51.2 to 5.60.0 is marked breaking (12 of 15). 5.x is the stable line and SECURITY.md marks it LTS (15).)
- Schema & documentation, Cosmic +8: Cosmic 88 (openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.); Strapi 80 (No published OpenAPI file, because endpoints depend on each project's content types. `strapi openapi generate` writes an OpenAPI 3.1.0 file for a project and is marked experimental, and every MCP tool carries JSON Schema 2020-12 input and output schemas built from the content model (20 of 25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). The 10 media tools say when to use each one and when not to, while generated content tools get a single line such as `Content-manager list for api::article.article` (14 of 20). Schemas are narrowed per field, action and locale and sort values are enums, but dynamic zones are untyped arrays and circular components fall back to an open record (12 of 15). REST pages pair curl examples with responses, and the error format and error classes are documented, without a list of status codes per endpoint (12 of 15). Semver with release notes on GitHub. The REST paths carry no API version (12 of 15).)
- Payments & pricing, Strapi +5: Cosmic 45 (No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.); Strapi 50 (Scored with the self-hosted rule, taking prices from the paid options beside the free edition. No x402, MPP or L402 (0). The Community Edition is free, Growth is $45 a month, and Strapi Cloud lists $35, $90 and $450 a project a month with $1.50 per further 25,000 API requests, all public (20). The Community Edition needs no card and Growth has a 30-day trial without one. Strapi Cloud asks for a card at project creation (20). Install and the first administrator can be scripted (`create-strapi`, `strapi admin:create-user`) with no account at Strapi, but the docs create API and Admin tokens only in the admin panel, so half (10).)