{ "data": { "a": { "slug": "cosmic", "name": "Cosmic", "vendor": "Cosmic Inc.", "vendorUrl": "https://www.cosmicjs.com", "kind": "http-api", "category": "cms", "summary": "Cosmic is a hosted headless CMS with a REST API, a TypeScript SDK, a CLI and a hosted MCP server. Agents read and write objects, media and object types, generate media, and can create a project by agent signup.", "url": "https://www.anchorterminal.com/tools/cosmic", "markdownUrl": "https://www.anchorterminal.com/tools/cosmic.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cosmic.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cosmic.json", "dns": "cosmic.grade.anchorterminal.com", "repo": "https://github.com/cosmicjs/mcp", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "packages": [ { "registry": "npm", "name": "@cosmicjs/mcp" }, { "registry": "npm", "name": "@cosmicjs/sdk" }, { "registry": "npm", "name": "@cosmicjs/cli" } ], "auth": "api-key", "authNotes": "Each bucket has a read key and a write key, rotatable independently. The hosted MCP server takes `Authorization: Bearer READ_KEY` for read-only tools or `READ_KEY:WRITE_KEY` for full access; the write key can also go in `X-Cosmic-Write-Key`. The REST API takes the read key as `read_key` in the query or as a Bearer token on GET. POST /v3/agents/sign-up on dapi.cosmicjs.com needs no authentication and returns bucket keys for a new unclaimed project tied to a human's email.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 1 bucket, 10,000 objects and 250,000 non-cached API requests a month, no card. Builder $99 a month, Team $299, Business $499, Small Workspace $999 and Large Workspace $2,999, with 10 per cent off yearly; Enterprise by quote. Webhooks, localisation and revision history are paid add-ons. Workspace plans have a 30-day trial.", "priceSummary": "$99 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the OpenAPI spec, the MCP docs or pricing.md (checked 2026-11-06). An unclaimed or over-limit bucket returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 24, "popularity": { "githubStars": null, "npmWeekly": 295, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.cosmicjs.com/docs", "llmsTxt": "https://www.cosmicjs.com/llms.txt", "openapi": "https://www.cosmicjs.com/openapi.json", "registryName": "com.cosmicjs/mcp", "capabilities": [ "cms.content", "cms.assets", "cms.schema", "cms.publish", "cms.localisation" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "mcp-registry", "openapi", "llms-txt", "free-tier", "no-card", "status-page", "webhooks", "typescript", "cli", "closed-source" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 72.5, "grade": "BB", "agentReady": true, "rank": 123, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "bestFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "strengths": [ "Agent signup API provisions a project and bucket with keys, idempotent per email and agent", "24 MCP tools with readOnlyHint and destructiveHint, and descriptions that say when to use each", "Leaving out the write key gives read-only MCP access", "OpenAPI spec, llms.txt and Markdown docs with an error model and per-code retry guidance", "Free plan with no card and published prices and quotas for every paid plan" ], "weaknesses": [ "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement", "The REST API accepts the read key as a URL query parameter", "Revision history, webhooks and localisation are paid add-ons", "The OpenAPI spec covers 21 operations, fewer than the documented API", "Data is kept indefinitely unless deletion is requested" ], "agentNotes": [ "Send only the read key in the Bearer token unless the task needs writes", "Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days", "Fix and don't retry on 400; wait and retry on 429", "Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit", "Confirm with the user before cosmic_objects_delete, which deletes permanently" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.5 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 53 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @cosmicjs/mcp", "http": "curl -X POST https://dapi.cosmicjs.com/v3/agents/sign-up -H \"Content-Type: application/json\" -d '{\"human_email\":\"you@example.com\",\"project_name\":\"Recipe Blog\",\"agent_id\":\"my-agent\"}'", "config": { "mcpServers": { "cosmic": { "headers": { "Authorization": "Bearer your-read-key:your-write-key" }, "url": "https://mcp.cosmicjs.com/v1/buckets/your-bucket-slug" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/cosmic" }, "area": "business", "unitPrices": [ { "item": "Builder plan", "unit": "month", "usd": 99, "note": "3 buckets, 50,000 objects, 1 million non-cached requests; $89 a month yearly" }, { "item": "Team plan", "unit": "month", "usd": 299, "note": "5 buckets, 100,000 objects, 2 million non-cached requests" }, { "item": "Business plan", "unit": "month", "usd": 499, "note": "10 buckets, 250,000 objects, 5 million non-cached requests" } ], "provenance": { "legalEntity": "Cosmic Inc.", "domain": "cosmicjs.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.cosmicjs.com/terms-of-service", "privacy": "https://www.cosmicjs.com/privacy-policy", "statusPage": "https://cosmicstatus.com", "changelog": "https://www.cosmicjs.com/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy were last updated on 13 January 2025 and name Cosmic JS at 3208 Bonniebrook Dr, Plano, Texas. The MCP server's licence names Cosmic Inc.", "The terms forbid using a robot or spider to copy or scrape the website without written permission; recorded as a fact. www.cosmicjs.com/robots.txt allows all crawlers, including ClaudeBot, except /api/, /search, /community/members/ and /v3/.", "www.cosmicjs.com/.well-known/security.txt returned 404. The security page asks for vulnerability reports at support@cosmicjs.com.", "cosmicstatus.com redirects to a Statuspage at cosmicjs.statuspage.io with API and Web Dashboard components." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cosmic.json", "live": { "slug": "cosmic", "probe": { "target": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "method": "get", "lastAt": "2026-11-07T18:20:18.962856282Z", "lastOk": true, "lastStatus": 401, "lastMs": 494, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 452, "p95ms24h": 538, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://cosmicstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:35.290408052Z" }, "versions": [ { "registry": "github", "name": "cosmicjs/mcp", "version": "v1.7.1", "released": "2026-11-02", "seenAt": "2026-11-06T23:17:54.958583794Z" }, { "registry": "mcp-registry", "name": "com.cosmicjs/mcp", "version": "1.6.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@cosmicjs/cli", "version": "1.12.0", "seenAt": "2026-11-06T23:17:52.953736128Z" }, { "registry": "npm", "name": "@cosmicjs/mcp", "version": "1.7.1", "seenAt": "2026-11-06T23:17:50.755872442Z" }, { "registry": "npm", "name": "@cosmicjs/sdk", "version": "2.4.0", "seenAt": "2026-11-06T23:17:51.562341268Z" } ], "githubStars": 1, "npmWeekly": 295, "securityTxt": { "url": "https://cosmicjs.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:42.91283778Z" }, "llmsTxt": { "url": "https://www.cosmicjs.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:12.321724133Z" }, "pages": [ { "url": "https://www.cosmicjs.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:27:27.310794511Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3e45613abe99" }, { "url": "https://www.cosmicjs.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:27:31.923491628Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d4aa3db9a89b" }, { "url": "https://www.cosmicjs.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:27:35.902981274Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3c4a26f1901" } ], "updatedAt": "2026-11-07T18:20:18.962856282Z" } }, "answer": "Cosmic scores 72.5 (BB) on agent readiness against Webflow's 70.4 (BB), and leads in 5 of 7 scored categories. Webflow leads on security \u0026 auth and transparency \u0026 trust.", "b": { "slug": "webflow", "name": "Webflow", "vendor": "Webflow, Inc.", "vendorUrl": "https://webflow.com", "kind": "http-api", "category": "cms", "summary": "Webflow is a hosted website builder with a built-in CMS. Agents reach it through the Data API v2 (collections, items, assets, pages, locales, publishing) or the official hosted MCP server, which wraps that API in 34 tools.", "url": "https://www.anchorterminal.com/tools/webflow", "markdownUrl": "https://www.anchorterminal.com/tools/webflow.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/webflow.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/webflow.json", "dns": "webflow.grade.anchorterminal.com", "repo": "https://github.com/webflow/openapi-spec", "license": "Proprietary service under Webflow's Terms of Service. The OpenAPI spec, the JavaScript and Python SDKs and the open-source MCP server on GitHub are MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.webflow.com/v2", "packages": [ { "registry": "npm", "name": "webflow-api" }, { "registry": "pypi", "name": "webflow" }, { "registry": "npm", "name": "webflow-mcp-server" } ], "auth": "mixed", "authNotes": "Self-serve. The Data API takes a Bearer token, either a site token or an OAuth access token. A site administrator creates a site token under Apps \u0026 integrations and picks read and write scopes. Each site allows 5 tokens and a token expires after 365 days without use. An OAuth app is registered in a workspace with its scopes, and only apps listed on the Marketplace go through review. The MCP server uses browser OAuth with PKCE and dynamic client registration, where a site owner or admin picks the sites or the workspace. Custom code endpoints and workspace activity logs aren't open to site tokens.", "pricing": "freemium", "pricingNotes": "The Starter site plan is free and includes the CMS APIs at 60 requests a minute, 50 CMS items and the MCP server, so an agent can start without a contract. Basic is $15 a month billed yearly and has no CMS. Premium is $25 a month billed yearly with 20,000 CMS items and 120 requests a minute. Team is $2,500 a month on an annual contract and Enterprise is sold through sales. Prices are per site (https://webflow.com/pricing, checked 2026-10-08).", "priceSummary": "$15 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Data API docs, the MCP server docs or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 34, "popularity": { "githubStars": null, "npmWeekly": 85160, "pypiWeekly": 121246, "asOf": "2026-10-08" }, "docsUrl": "https://developers.webflow.com/data/docs", "llmsTxt": "https://developers.webflow.com/llms.txt", "openapi": "https://raw.githubusercontent.com/webflow/openapi-spec/main/openapi/v2.yml", "registryName": "com.webflow/mcp", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.schema", "cms.localisation" ], "tags": [ "official", "hosted", "mcp", "oauth", "openapi", "llms-txt", "closed-source", "free-tier", "webhooks", "typescript", "python", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 70.4, "grade": "BB", "agentReady": true, "rank": 199, "ranked": true, "rankOf": 1486, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 80, "payments": 30, "reliability": 84, "schema": 87, "security": 74, "transparency": 81 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "7 October 2026. The Get Site Plan endpoint changed the `id` and `displayName` it returns for Starter sites and renamed some plans, in place. The changelog entry of the same date calls it a breaking change and no earlier notice was found. It is documented, so the deduction is small (https://developers.webflow.com/home/changelog/2026/10/7)." ], "verdict": "The Data API has a public OpenAPI 3.1 spec with 140 operations, scoped OAuth and site tokens, and CMS items that stay drafts until a separate publish call. The MCP server loads 34 multi-action tools and can't create new localised CMS items. The free plan holds 50 CMS items, and the activity log needs the $2,500 Team plan.", "bestFor": "Teams whose website already runs on Webflow and who want an agent to draft, update and publish CMS items, fix metadata or manage assets.", "strengths": [ "Public OpenAPI 3.1 spec for Data API v2 with 140 operations, MIT, last synced on 2 September 2026, plus llms.txt and a Markdown copy of every docs page", "OAuth and site tokens take read and write scope pairs per resource (cms, assets, pages, sites and others), and each site allows at most 5 tokens", "CMS items are created and updated as drafts. Publishing an item or the whole site is a separate call", "429 responses carry Retry-After, every response carries X-RateLimit-Remaining, and the JavaScript and Python SDKs back off automatically", "Hosted MCP server at mcp.webflow.com/mcp is listed in the official MCP registry as com.webflow/mcp and has its own component on the status page" ], "weaknesses": [ "The MCP server documents 34 tools (27 data, 3 Designer session, 4 utility), each with several actions, and a granted tool grants all its actions", "No idempotency keys on Data API writes in the reviewed documentation. Site publish is limited to one successful call a minute", "The MCP server can't create new localised CMS items. It reads and updates existing items in secondary locales", "The Starter plan allows 50 CMS items and 60 requests a minute. The site activity log that records agent changes is listed on Team ($2,500 a month) and Enterprise", "On 7 October 2026 Get Site Plan changed its `id` and `displayName` values in place, marked as breaking in the changelog entry of the same day" ], "agentNotes": [ "Send the token as `Authorization: Bearer` to https://api.webflow.com/v2. Ask for `cms:read` and `cms:write` only, plus `sites:write` if the task publishes", "Create or update items first, then call Publish Items or Publish Site. An item with `isDraft` true and a `lastPublished` date is live with unpublished changes", "Stay under 60 requests a minute on Starter and Basic and 120 on Premium, read X-RateLimit-Remaining, and wait for Retry-After on 429", "Page item lists with `limit` (maximum 100) and `offset`, and filter with `filter[\u003cfieldSlug\u003e][\u003coperator\u003e]`, up to 10 terms", "Upload an asset in two steps (create the asset with a file hash, then POST the bytes to the presigned URL). Write localised content with the item's `cmsLocaleId`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.4 } ], "editorialScores": { "ergonomics": 72, "maintenance": 80, "payments": 30, "reliability": 84, "schema": 87, "security": 74, "transparency": 65 }, "provenanceScore": 97, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install webflow-api", "http": "curl --request GET \\\n --url https://api.webflow.com/v2/sites \\\n --header 'accept: application/json' \\\n --header 'authorization: Bearer YOUR_API_TOKEN'", "claudeCode": "claude mcp add --transport http webflow https://mcp.webflow.com/mcp" }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/webflow" }, "area": "business", "unitPrices": [ { "item": "Basic site plan", "unit": "month", "usd": 15, "note": "billed yearly, per site, no CMS" }, { "item": "Premium site plan", "unit": "month", "usd": 25, "note": "billed yearly, per site, 20,000 CMS items and 120 requests a minute" }, { "item": "Team platform plan", "unit": "month", "usd": 2500, "note": "annual contract, 5 full and 5 limited seats included" } ], "provenance": { "legalEntity": "Webflow, Inc.", "domain": "webflow.com", "domainRegistered": "2003-03-31", "endpointOnVendorDomain": true, "terms": "https://webflow.com/legal/terms", "privacy": "https://webflow.com/legal/privacy", "statusPage": "https://status.webflow.com", "changelog": "https://developers.webflow.com/home/changelog", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Terms of Service name Webflow, Inc., a Delaware corporation at 398 11th Street, Floor 2, San Francisco, CA 94103, and are governed by California law.", "The Terms of Service (effective 15 November 2023) govern the platform and incorporate the Developer Terms of Service at https://webflow.com/legal/developer-terms-of-service, which cover API use and rate limits.", "The privacy policy is effective 17 March 2025. The DPA is effective 15 November 2023 and the sub-processor list was updated on 9 July 2026.", "The Data API answers at api.webflow.com and the MCP server at mcp.webflow.com.", "webflow.com/.well-known/security.txt points to a Bugcrowd disclosure programme and expires on 31 December 2026.", "RDAP for webflow.com gives a registration date of 2003-03-31.", "status.webflow.com runs on Statuspage with components for the Data API and the MCP server." ], "score": 97 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/webflow.json", "live": { "slug": "webflow", "probe": { "target": "https://api.webflow.com/v2", "method": "get", "lastAt": "2026-11-07T18:21:05.18640595Z", "lastOk": true, "lastStatus": 404, "lastMs": 270, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 287, "p95ms24h": 397, "samples24h": 239, "samples30d": 7440, "days": [ { "date": "2026-10-08", "probes": 70, "ok": 70 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.webflow.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:22:11.183509603Z" }, "versions": [ { "registry": "mcp-registry", "name": "com.webflow/mcp", "version": "2.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "webflow-api", "version": "3.3.4", "seenAt": "2026-11-07T00:16:57.354522678Z" }, { "registry": "npm", "name": "webflow-mcp-server", "version": "1.0.0", "seenAt": "2026-11-07T00:17:00.104827849Z" }, { "registry": "pypi", "name": "webflow", "version": "2.0.0", "released": "2026-03-12", "seenAt": "2026-11-07T00:16:57.805129165Z" } ], "githubStars": 14, "npmWeekly": 82354, "pypiWeekly": 186963, "securityTxt": { "url": "https://webflow.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:15.527868378Z" }, "llmsTxt": { "url": "https://developers.webflow.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:21.8813987Z" }, "domain": { "domain": "webflow.com", "registered": "2003-03-31", "source": "https://rdap.verisign.com/com/v1/domain/webflow.com", "checkedAt": "2026-11-01T14:27:26.928129519Z" }, "pages": [ { "url": "https://developers.webflow.com/home/changelog", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:04:42.015675459Z", "changedAt": "2026-10-31T06:08:42.770759668Z", "fingerprint": "3987ccb7f811" }, { "url": "https://developers.webflow.com/home/changelog/2026/10/9", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:04:44.700652093Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "7e67cf4ed8ff" }, { "url": "https://webflow.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:23:49.01246629Z", "changedAt": "2026-10-31T06:23:49.011572947Z", "fingerprint": "b615de0b6bb9" }, { "url": "https://webflow.com/legal/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:23:44.827786609Z", "changedAt": "2026-10-31T06:23:44.639467742Z", "fingerprint": "3152a1cd712c" }, { "url": "https://webflow.com/legal/terms", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:23:46.950481319Z", "changedAt": "2026-10-31T06:23:46.941328164Z", "fingerprint": "0108e43611ca" } ], "mcpTools": { "url": "https://mcp.webflow.com/mcp", "checkedAt": "2026-11-07T01:49:13.117649065Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:49:13.117649065Z" }, "github": { "repo": "webflow/openapi-spec", "checkedAt": "2026-11-02T09:38:09.499391382Z", "stars": 14, "archived": false, "issuesEnabled": true, "pushedAt": "2026-09-02T20:19:20Z", "openIssues": 10, "openPRs": 0, "issuesOpened90d": 4, "issuesClosed90d": 0, "prsMerged90d": 0, "replies": { "sampled": 9, "unanswered": 6, "medianDays": 13.2 } }, "updatedAt": "2026-11-07T18:22:11.183509603Z" } }, "edges": [ { "by": 27, "category": "security", "leads": "webflow", "name": "Security \u0026 auth", "reasons": { "a": "Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.", "b": "OAuth with read and write scope pairs per resource, or site tokens with the same scopes, at most 5 per site, which expire after 365 days without use. The MCP server uses OAuth with PKCE, dynamic client registration, refresh tokens and a revocation endpoint. Tokens travel in the Authorization header. We took 2 off because the MCP metadata also accepts the `plain` challenge method and site-token rotation isn't described (28). Scopes split read from write, the person picks sites or a workspace at authorisation, and the MCP server follows the user's role. A granted tool grants all its actions and no confirmation step for deletes was found (14). Agent Instructions stored on a site are given to every connected agent automatically, and the docs give no guidance on treating site content as untrusted beyond limiting authorised sites and reviewing generated drafts (5). Agent changes are recorded in the site activity log, which the pricing page lists on Team and Enterprise, with an Audit Logs API on Enterprise (9). A valid security.txt pointing to a Bugcrowd disclosure programme, SOC 2 Type II, ISO 27001, 27017, 27018 and 42001, and an annual penetration test report in the trust centre (18)." }, "scores": { "a": 47, "b": 74 } }, { "by": 18, "category": "transparency", "leads": "webflow", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.", "b": "Closed service with published Terms of Service and Developer Terms. The OpenAPI spec, both SDKs and the older open-source MCP server are MIT (17). Privacy policy effective 17 March 2025 and a DPA effective 15 November 2023 with deletion or return of personal data at termination. Retention is stated as for as long as necessary, with no periods (20). A dated v1 deprecation notice (31 March 2025) and a removal notice for the User Accounts APIs, but no written deprecation policy, and two breaking changes in the last 90 days landed on the day of their changelog entry (11). Sub-processor list updated 9 July 2026 with each company's country, nearly all in the USA. No choice of data region was found (17)." }, "scores": { "a": 63, "b": 81 } }, { "by": 15, "category": "payments", "leads": "cosmic", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.", "b": "No x402, MPP or L402 (0). Plan prices are public (Basic $15 and Premium $25 a month billed yearly, Team $2,500 a month on an annual contract), with Enterprise through sales and no per-call price (10). The Starter site plan is free and includes the CMS APIs at 60 requests a minute and the MCP server. The pricing page doesn't say whether signup needs a card (20, with that caveat). A person signs up in a browser and creates the token or approves the OAuth screen (0)." }, "scores": { "a": 45, "b": 30 } }, { "by": 10, "category": "ergonomics", "leads": "cosmic", "name": "Agent ergonomics", "reasons": { "a": "24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.", "b": "The MCP server documents 34 tools, each bundling several actions, which is the checklist's 5. We added 6 for `get_more_tools`, which loads specialised tools on request, and for tools labelled read or write (11 of 25). `limit` up to 100 and `offset` on lists, and custom-field filters and sorts on collection items with up to 10 filter terms (20). Errors carry a machine-readable code from a published list, and the MCP server returns `ModeForbidden` when a tool can't run in the current Designer mode (16). No idempotency keys on Data API writes. The open-source server sets `readOnlyHint` on its tools, and the hosted server has a dry run and an idempotency key for Webflow Cloud deploys only (10 of 20). Few required parameters, and official SDKs for JavaScript and Python (15)." }, "scores": { "a": 82, "b": 72 } }, { "by": 6, "category": "reliability", "leads": "cosmic", "name": "Reliability", "reasons": { "a": "Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.", "b": "Graded on the Data API v2 and the hosted MCP server. Public status page at status.webflow.com with components for the Data API and the MCP server and a full incident history (20). In the 90 days to 1 November 2026, read from the status history feed (the /api/ path is disallowed by the host's robots.txt), the graded surface had two incidents, both partial and read as minor. They were 503 errors on some hosted sites, Webflow.com and the MCP server on 25 August, and MCP authorisation failing for some sites in client workspaces on 17 September (about 40 minutes). The week-long missing MCP tools of 9 to 16 July and the 28 July webhooks failure have left the window. Publishing failed or slowed for some customers on 14 September (an upstream provider fault that also touched Analyze and Optimize) and 28 September, which is partial whichever surface it reached. The other incidents in the window (intermittent 500s on some hosted sites on 15 September, form notification emails on 21 and 22 September, site creation and the Canvas on 12 August) were outside the graded surface, and none was posted after 28 September (20). Rate limits published, 60 requests a minute on Starter and Basic and 120 on higher site plans (15). 429 carries Retry-After and the SDKs back off, but no idempotency keys were found for Data API writes (11). An SLA page dated 1 September 2026 exists and the pricing page lists enhanced SLAs on Enterprise. The terms sit in a PDF we didn't read (8 of 10). The /v2 namespace is described as production and the MCP server has a separate beta URL (10)." }, "scores": { "a": 90, "b": 84 } }, { "by": 6, "category": "maintenance", "leads": "cosmic", "name": "Maintenance \u0026 community", "reasons": { "a": "MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.", "b": "The newest developer changelog entry is dated 28 October 2026 (a robots.txt Content API in beta) (30). Twenty-two dated entries between 10 August and 28 October 2026, among them the AEO Analytics and Optimize APIs out of beta on 13 and 15 October (20). Public changelog, a support site and a community forum. We couldn't read the GitHub issue trackers, and the open-source MCP repository has had only a CI change (26 October) since 10 April 2026 while the hosted server moved to v2.1 (8 of 15). The server is in the official MCP registry as com.webflow/mcp, and the JavaScript SDK (tag v3.3.4, 16 March 2026; main's package.json reads 3.3.5) and Python SDK (2.0.0, 12 March 2026) are the current official SDKs (15). The JavaScript SDK repository has CI, a dependency patch merged on 6 October and a CI pin on 26 October 2026. The MCP repository pins webflow-api 3.2.1 (7)." }, "scores": { "a": 86, "b": 80 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Cosmic Inc.", "b": "Webflow, Inc.", "name": "Vendor" }, { "a": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "b": "https://api.webflow.com/v2", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary service under Webflow's Terms of Service. The OpenAPI spec, the JavaScript and Python SDKs and the open-source MCP server on GitHub are MIT", "name": "Licence" }, { "a": "24", "b": "34", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.cosmicjs/mcp", "b": "com.webflow/mcp", "name": "MCP registry" }, { "a": "2026-11-02", "b": "2026-10-28", "name": "Last release" }, { "a": "no date given", "b": "2023-11-15", "name": "Terms last updated" }, { "a": "no date given", "b": "2025-03-17", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "295 npm/wk", "b": "85k npm/wk, 121k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cosmic scores 72.5 (BB) on agent readiness against Webflow's 70.4 (BB), and leads in 5 of 7 scored categories. Webflow leads on security \u0026 auth and transparency \u0026 trust.", "question": "Which is better for AI agents, Cosmic or Webflow?" }, { "answer": "Cosmic needs an API key. Webflow takes an API key or an OAuth sign-in.", "question": "Do Cosmic and Webflow need an API key?" }, { "answer": "Yes. Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug} and Webflow at https://api.webflow.com/v2.", "question": "Can an agent call Cosmic and Webflow without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 90 against 84", "Agent ergonomics, 82 against 72", "Payments \u0026 pricing, 45 against 30", "Maintenance \u0026 community, 86 against 80" ], "also": [ "Runs on your own machine", "Free to start without a card", "No incidents deducted, where Webflow loses 3 points for them" ], "goodFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "slug": "cosmic", "watchFor": "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement" }, { "aheadOn": [ "Security \u0026 auth, 74 against 47", "Transparency \u0026 trust, 81 against 63" ], "also": null, "goodFor": "Teams whose website already runs on Webflow and who want an agent to draft, update and publish CMS items, fix metadata or manage assets.", "slug": "webflow", "watchFor": "The MCP server documents 34 tools (27 data, 3 Designer session, 4 utility), each with several actions, and a granted tool grants all its actions" } ], "history": { "cosmic": null, "webflow": [ { "causes": [ "time" ], "date": "2026-11-01", "delta": 1, "from": 69.4, "fromGrade": "B", "to": 70.4, "toGrade": "BB" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-webflow.json", "title": "BCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/bcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic.json", "title": "ButterCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-webflow.json", "title": "ButterCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/buttercms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic.json", "title": "Contentstack vs Cosmic", "url": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-webflow.json", "title": "Contentstack vs Webflow", "url": "https://www.anchorterminal.com/compare/contentstack-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-datocms.json", "title": "Cosmic vs DatoCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-directus.json", "title": "Cosmic vs Directus", "url": "https://www.anchorterminal.com/compare/cosmic-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.json", "title": "Cosmic vs Ghost", "url": "https://www.anchorterminal.com/compare/cosmic-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph.json", "title": "Cosmic vs Hygraph", "url": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.json", "title": "Cosmic vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-payload.json", "title": "Cosmic vs Payload", "url": "https://www.anchorterminal.com/compare/cosmic-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-prismic.json", "title": "Cosmic vs Prismic", "url": "https://www.anchorterminal.com/compare/cosmic-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-sanity.json", "title": "Cosmic vs Sanity", "url": "https://www.anchorterminal.com/compare/cosmic-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok.json", "title": "Cosmic vs Storyblok", "url": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.json", "title": "Cosmic vs Strapi", "url": "https://www.anchorterminal.com/compare/cosmic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json", "title": "Cosmic vs WordPress", "url": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-webflow.json", "title": "DatoCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/datocms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-webflow.json", "title": "Directus vs Webflow", "url": "https://www.anchorterminal.com/compare/directus-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-webflow.json", "title": "dotCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/dotcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-webflow.json", "title": "Ghost vs Webflow", "url": "https://www.anchorterminal.com/compare/ghost-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-webflow.json", "title": "Hygraph vs Webflow", "url": "https://www.anchorterminal.com/compare/hygraph-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-webflow.json", "title": "Kontent.ai vs Webflow", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-webflow.json", "title": "Payload vs Webflow", "url": "https://www.anchorterminal.com/compare/payload-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/prismic-vs-webflow.json", "title": "Prismic vs Webflow", "url": "https://www.anchorterminal.com/compare/prismic-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-webflow.json", "title": "Sanity vs Webflow", "url": "https://www.anchorterminal.com/compare/sanity-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-webflow.json", "title": "Storyblok vs Webflow", "url": "https://www.anchorterminal.com/compare/storyblok-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-webflow.json", "title": "Strapi vs Webflow", "url": "https://www.anchorterminal.com/compare/strapi-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/webflow-vs-wordpress.json", "title": "Webflow vs WordPress", "url": "https://www.anchorterminal.com/compare/webflow-vs-wordpress" } ], "panel": null, "scores": [ { "by": 6, "cosmic": 90, "edge": "cosmic", "key": "reliability", "name": "Reliability", "webflow": 84, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 1, "cosmic": 88, "edge": "cosmic", "key": "schema", "name": "Schema \u0026 documentation", "webflow": 87, "weight": 13 }, { "by": 10, "cosmic": 82, "edge": "cosmic", "key": "ergonomics", "name": "Agent ergonomics", "webflow": 72, "weight": 13 }, { "by": 27, "cosmic": 47, "edge": "webflow", "key": "security", "name": "Security \u0026 auth", "webflow": 74, "weight": 14 }, { "by": 15, "cosmic": 45, "edge": "cosmic", "key": "payments", "name": "Payments \u0026 pricing", "webflow": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 6, "cosmic": 86, "edge": "cosmic", "key": "maintenance", "name": "Maintenance \u0026 community", "webflow": 80, "weight": 7 }, { "by": 18, "cosmic": 63, "edge": "webflow", "key": "transparency", "name": "Transparency \u0026 trust", "webflow": 81, "weight": 7 } ], "summary": "Cosmic scores 72.5 (BB) on agent readiness against Webflow's 70.4 (BB), and leads in 5 of 7 scored categories. Webflow leads on security \u0026 auth and transparency \u0026 trust. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "cosmic": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "webflow": "The Data API has a public OpenAPI 3.1 spec with 140 operations, scoped OAuth and site tokens, and CMS items that stay drafts until a separate publish call. The MCP server loads 34 multi-action tools and can't create new localised CMS items. The free plan holds 50 CMS items, and the activity log needs the $2,500 Team plan." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cosmic-vs-webflow", "json": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.min.md" }, "markdown": "Cosmic scores 72.5 (BB) on agent readiness against Webflow's 70.4 (BB), and leads in 5 of 7 scored categories. Webflow leads on security \u0026 auth and transparency \u0026 trust. Both do content management.\n\n- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json\n- Webflow: grade BB, 70.4/100, rank #199 of 1486. Markdown https://www.anchorterminal.com/tools/webflow.md · JSON https://www.anchorterminal.com/api/v1/tools/webflow.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### Cosmic (BB)\n\nGood for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.\n\nAhead on:\n- Reliability, 90 against 84\n- Agent ergonomics, 82 against 72\n- Payments \u0026 pricing, 45 against 30\n- Maintenance \u0026 community, 86 against 80\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n- No incidents deducted, where Webflow loses 3 points for them\n\nWatch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement\n\n### Webflow (BB)\n\nGood for: Teams whose website already runs on Webflow and who want an agent to draft, update and publish CMS items, fix metadata or manage assets.\n\nAhead on:\n- Security \u0026 auth, 74 against 47\n- Transparency \u0026 trust, 81 against 63\n\nWatch for: The MCP server documents 34 tools (27 data, 3 Designer session, 4 utility), each with several actions, and a granted tool grants all its actions\n\n\n## Why the edge\n\n### Security \u0026 auth: Webflow +27\n\n- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.\n- Webflow (74): OAuth with read and write scope pairs per resource, or site tokens with the same scopes, at most 5 per site, which expire after 365 days without use. The MCP server uses OAuth with PKCE, dynamic client registration, refresh tokens and a revocation endpoint. Tokens travel in the Authorization header. We took 2 off because the MCP metadata also accepts the `plain` challenge method and site-token rotation isn't described (28). Scopes split read from write, the person picks sites or a workspace at authorisation, and the MCP server follows the user's role. A granted tool grants all its actions and no confirmation step for deletes was found (14). Agent Instructions stored on a site are given to every connected agent automatically, and the docs give no guidance on treating site content as untrusted beyond limiting authorised sites and reviewing generated drafts (5). Agent changes are recorded in the site activity log, which the pricing page lists on Team and Enterprise, with an Audit Logs API on Enterprise (9). A valid security.txt pointing to a Bugcrowd disclosure programme, SOC 2 Type II, ISO 27001, 27017, 27018 and 42001, and an annual penetration test report in the trust centre (18).\n\n### Transparency \u0026 trust: Webflow +18\n\n- Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.\n- Webflow (81): Closed service with published Terms of Service and Developer Terms. The OpenAPI spec, both SDKs and the older open-source MCP server are MIT (17). Privacy policy effective 17 March 2025 and a DPA effective 15 November 2023 with deletion or return of personal data at termination. Retention is stated as for as long as necessary, with no periods (20). A dated v1 deprecation notice (31 March 2025) and a removal notice for the User Accounts APIs, but no written deprecation policy, and two breaking changes in the last 90 days landed on the day of their changelog entry (11). Sub-processor list updated 9 July 2026 with each company's country, nearly all in the USA. No choice of data region was found (17).\n\n### Payments \u0026 pricing: Cosmic +15\n\n- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.\n- Webflow (30): No x402, MPP or L402 (0). Plan prices are public (Basic $15 and Premium $25 a month billed yearly, Team $2,500 a month on an annual contract), with Enterprise through sales and no per-call price (10). The Starter site plan is free and includes the CMS APIs at 60 requests a minute and the MCP server. The pricing page doesn't say whether signup needs a card (20, with that caveat). A person signs up in a browser and creates the token or approves the OAuth screen (0).\n\n### Agent ergonomics: Cosmic +10\n\n- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.\n- Webflow (72): The MCP server documents 34 tools, each bundling several actions, which is the checklist's 5. We added 6 for `get_more_tools`, which loads specialised tools on request, and for tools labelled read or write (11 of 25). `limit` up to 100 and `offset` on lists, and custom-field filters and sorts on collection items with up to 10 filter terms (20). Errors carry a machine-readable code from a published list, and the MCP server returns `ModeForbidden` when a tool can't run in the current Designer mode (16). No idempotency keys on Data API writes. The open-source server sets `readOnlyHint` on its tools, and the hosted server has a dry run and an idempotency key for Webflow Cloud deploys only (10 of 20). Few required parameters, and official SDKs for JavaScript and Python (15).\n\n### Reliability: Cosmic +6\n\n- Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.\n- Webflow (84): Graded on the Data API v2 and the hosted MCP server. Public status page at status.webflow.com with components for the Data API and the MCP server and a full incident history (20). In the 90 days to 1 November 2026, read from the status history feed (the /api/ path is disallowed by the host's robots.txt), the graded surface had two incidents, both partial and read as minor. They were 503 errors on some hosted sites, Webflow.com and the MCP server on 25 August, and MCP authorisation failing for some sites in client workspaces on 17 September (about 40 minutes). The week-long missing MCP tools of 9 to 16 July and the 28 July webhooks failure have left the window. Publishing failed or slowed for some customers on 14 September (an upstream provider fault that also touched Analyze and Optimize) and 28 September, which is partial whichever surface it reached. The other incidents in the window (intermittent 500s on some hosted sites on 15 September, form notification emails on 21 and 22 September, site creation and the Canvas on 12 August) were outside the graded surface, and none was posted after 28 September (20). Rate limits published, 60 requests a minute on Starter and Basic and 120 on higher site plans (15). 429 carries Retry-After and the SDKs back off, but no idempotency keys were found for Data API writes (11). An SLA page dated 1 September 2026 exists and the pricing page lists enhanced SLAs on Enterprise. The terms sit in a PDF we didn't read (8 of 10). The /v2 namespace is described as production and the MCP server has a separate beta URL (10).\n\n### Maintenance \u0026 community: Cosmic +6\n\n- Cosmic (86): MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.\n- Webflow (80): The newest developer changelog entry is dated 28 October 2026 (a robots.txt Content API in beta) (30). Twenty-two dated entries between 10 August and 28 October 2026, among them the AEO Analytics and Optimize APIs out of beta on 13 and 15 October (20). Public changelog, a support site and a community forum. We couldn't read the GitHub issue trackers, and the open-source MCP repository has had only a CI change (26 October) since 10 April 2026 while the hosted server moved to v2.1 (8 of 15). The server is in the official MCP registry as com.webflow/mcp, and the JavaScript SDK (tag v3.3.4, 16 March 2026; main's package.json reads 3.3.5) and Python SDK (2.0.0, 12 March 2026) are the current official SDKs (15). The JavaScript SDK repository has CI, a dependency patch merged on 6 October and a CI pin on 26 October 2026. The MCP repository pins webflow-api 3.2.1 (7).\n\n## Score by category\n\n| Category | Weight | Cosmic | Webflow | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 90 | 84 | Cosmic +6 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 88 | 87 | Cosmic +1 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 72 | Cosmic +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 47 | 74 | Webflow +27 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 30 | Cosmic +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 86 | 80 | Cosmic +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 81 | Webflow +18 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **72.5 · BB** | **70.4 · BB** | |\n\n## Facts side by side\n\n| Fact | Cosmic | Webflow |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Cosmic Inc. | Webflow, Inc. |\n| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | `https://api.webflow.com/v2` |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | none | Proprietary service under Webflow's Terms of Service. The OpenAPI spec, the JavaScript and Python SDKs and the open-source MCP server on GitHub are MIT |\n| Tools exposed | 24 | 34 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.cosmicjs/mcp` | `com.webflow/mcp` |\n| Last release | 2026-11-02 | 2026-10-28 |\n| Terms last updated | no date given | 2023-11-15 |\n| Privacy policy last updated | no date given | 2025-03-17 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 295 npm/wk | 85k npm/wk, 121k PyPI/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### Cosmic\n\nNo score change since it was listed.\n\n### Webflow\n\n- +1.0 on 1 November 2026 (B to BB): time\n\n## Verdicts\n\n**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.\n\n**Webflow.** The Data API has a public OpenAPI 3.1 spec with 140 operations, scoped OAuth and site tokens, and CMS items that stay drafts until a separate publish call. The MCP server loads 34 multi-action tools and can't create new localised CMS items. The free plan holds 50 CMS items, and the activity log needs the $2,500 Team plan.\n\n## Before you call either\n\n### Cosmic\n\n1. Send only the read key in the Bearer token unless the task needs writes\n2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days\n3. Fix and don't retry on 400; wait and retry on 429\n4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit\n5. Confirm with the user before cosmic_objects_delete, which deletes permanently\n\n### Webflow\n\n1. Send the token as `Authorization: Bearer` to https://api.webflow.com/v2. Ask for `cms:read` and `cms:write` only, plus `sites:write` if the task publishes\n2. Create or update items first, then call Publish Items or Publish Site. An item with `isDraft` true and a `lastPublished` date is live with unpublished changes\n3. Stay under 60 requests a minute on Starter and Basic and 120 on Premium, read X-RateLimit-Remaining, and wait for Retry-After on 429\n4. Page item lists with `limit` (maximum 100) and `offset`, and filter with `filter[\u003cfieldSlug\u003e][\u003coperator\u003e]`, up to 10 terms\n5. Upload an asset in two steps (create the asset with a file hash, then POST the bytes to the presigned URL). Write localised content with the item's `cmsLocaleId`\n\n## Questions\n\n### Which is better for AI agents, Cosmic or Webflow?\n\nCosmic scores 72.5 (BB) on agent readiness against Webflow's 70.4 (BB), and leads in 5 of 7 scored categories. Webflow leads on security \u0026 auth and transparency \u0026 trust.\n\n### Do Cosmic and Webflow need an API key?\n\nCosmic needs an API key. Webflow takes an API key or an OAuth sign-in.\n\n### Can an agent call Cosmic and Webflow without installing anything?\n\nYes. Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug} and Webflow at https://api.webflow.com/v2.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-webflow.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-webflow.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cosmic\", \"b\": \"webflow\"}`. From a terminal: `anchor compare cosmic webflow`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/webflow.json\n\n## Other comparisons with Cosmic or Webflow\n\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)\n- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)\n- [ButterCMS vs Webflow](https://www.anchorterminal.com/compare/buttercms-vs-webflow.md)\n- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)\n- [Contentstack vs Webflow](https://www.anchorterminal.com/compare/contentstack-vs-webflow.md)\n- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)\n- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)\n- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)\n- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)\n- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)\n- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)\n- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)\n- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)\n- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)\n- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)\n- [DatoCMS vs Webflow](https://www.anchorterminal.com/compare/datocms-vs-webflow.md)\n- [Directus vs Webflow](https://www.anchorterminal.com/compare/directus-vs-webflow.md)\n- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)\n- [Ghost vs Webflow](https://www.anchorterminal.com/compare/ghost-vs-webflow.md)\n- [Hygraph vs Webflow](https://www.anchorterminal.com/compare/hygraph-vs-webflow.md)\n- [Kontent.ai vs Webflow](https://www.anchorterminal.com/compare/kontent-ai-vs-webflow.md)\n- [Payload vs Webflow](https://www.anchorterminal.com/compare/payload-vs-webflow.md)\n- [Prismic vs Webflow](https://www.anchorterminal.com/compare/prismic-vs-webflow.md)\n- [Sanity vs Webflow](https://www.anchorterminal.com/compare/sanity-vs-webflow.md)\n- [Storyblok vs Webflow](https://www.anchorterminal.com/compare/storyblok-vs-webflow.md)\n- [Strapi vs Webflow](https://www.anchorterminal.com/compare/strapi-vs-webflow.md)\n- [Webflow vs WordPress](https://www.anchorterminal.com/compare/webflow-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cosmic vs Webflow", "url": "" } ], "description": "Cosmic scores 72.5 (BB) to Webflow's 70.4 (BB) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cosmic BB 72.5", "Webflow BB 70.4", "scores" ], "h1": "Cosmic vs Webflow", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cosmic-vs-webflow", "published": "2026-10-01", "section": "tools", "title": "Cosmic vs Webflow for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cosmic-vs-webflow" }, "tokens": { "markdown": 4900, "slim": 3030 }, "version": 1 }