# Cosmic vs Webflow

> Cosmic scores 72.5 (BB) to Webflow's 70.4 (BB) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/cosmic-vs-webflow
- Markdown: https://www.anchorterminal.com/compare/cosmic-vs-webflow.md (~4,900 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cosmic scores 72.5 (BB) on agent readiness against Webflow's 70.4 (BB), and leads in 5 of 7 scored categories. Webflow leads on security & auth and transparency & trust. Both do content management.

- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json
- Webflow: grade BB, 70.4/100, rank #199 of 1486. Markdown https://www.anchorterminal.com/tools/webflow.md · JSON https://www.anchorterminal.com/api/v1/tools/webflow.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### Cosmic (BB)

Good for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.

Ahead on:
- Reliability, 90 against 84
- Agent ergonomics, 82 against 72
- Payments & pricing, 45 against 30
- Maintenance & community, 86 against 80

Also in its favour:
- Runs on your own machine
- Free to start without a card
- No incidents deducted, where Webflow loses 3 points for them

Watch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement

### Webflow (BB)

Good for: Teams whose website already runs on Webflow and who want an agent to draft, update and publish CMS items, fix metadata or manage assets.

Ahead on:
- Security & auth, 74 against 47
- Transparency & trust, 81 against 63

Watch for: The MCP server documents 34 tools (27 data, 3 Designer session, 4 utility), each with several actions, and a granted tool grants all its actions


## Why the edge

### Security & auth: Webflow +27

- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.
- Webflow (74): OAuth with read and write scope pairs per resource, or site tokens with the same scopes, at most 5 per site, which expire after 365 days without use. The MCP server uses OAuth with PKCE, dynamic client registration, refresh tokens and a revocation endpoint. Tokens travel in the Authorization header. We took 2 off because the MCP metadata also accepts the `plain` challenge method and site-token rotation isn't described (28). Scopes split read from write, the person picks sites or a workspace at authorisation, and the MCP server follows the user's role. A granted tool grants all its actions and no confirmation step for deletes was found (14). Agent Instructions stored on a site are given to every connected agent automatically, and the docs give no guidance on treating site content as untrusted beyond limiting authorised sites and reviewing generated drafts (5). Agent changes are recorded in the site activity log, which the pricing page lists on Team and Enterprise, with an Audit Logs API on Enterprise (9). A valid security.txt pointing to a Bugcrowd disclosure programme, SOC 2 Type II, ISO 27001, 27017, 27018 and 42001, and an annual penetration test report in the trust centre (18).

### Transparency & trust: Webflow +18

- Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.
- Webflow (81): Closed service with published Terms of Service and Developer Terms. The OpenAPI spec, both SDKs and the older open-source MCP server are MIT (17). Privacy policy effective 17 March 2025 and a DPA effective 15 November 2023 with deletion or return of personal data at termination. Retention is stated as for as long as necessary, with no periods (20). A dated v1 deprecation notice (31 March 2025) and a removal notice for the User Accounts APIs, but no written deprecation policy, and two breaking changes in the last 90 days landed on the day of their changelog entry (11). Sub-processor list updated 9 July 2026 with each company's country, nearly all in the USA. No choice of data region was found (17).

### Payments & pricing: Cosmic +15

- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.
- Webflow (30): No x402, MPP or L402 (0). Plan prices are public (Basic $15 and Premium $25 a month billed yearly, Team $2,500 a month on an annual contract), with Enterprise through sales and no per-call price (10). The Starter site plan is free and includes the CMS APIs at 60 requests a minute and the MCP server. The pricing page doesn't say whether signup needs a card (20, with that caveat). A person signs up in a browser and creates the token or approves the OAuth screen (0).

### Agent ergonomics: Cosmic +10

- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.
- Webflow (72): The MCP server documents 34 tools, each bundling several actions, which is the checklist's 5. We added 6 for `get_more_tools`, which loads specialised tools on request, and for tools labelled read or write (11 of 25). `limit` up to 100 and `offset` on lists, and custom-field filters and sorts on collection items with up to 10 filter terms (20). Errors carry a machine-readable code from a published list, and the MCP server returns `ModeForbidden` when a tool can't run in the current Designer mode (16). No idempotency keys on Data API writes. The open-source server sets `readOnlyHint` on its tools, and the hosted server has a dry run and an idempotency key for Webflow Cloud deploys only (10 of 20). Few required parameters, and official SDKs for JavaScript and Python (15).

### Reliability: Cosmic +6

- Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.
- Webflow (84): Graded on the Data API v2 and the hosted MCP server. Public status page at status.webflow.com with components for the Data API and the MCP server and a full incident history (20). In the 90 days to 1 November 2026, read from the status history feed (the /api/ path is disallowed by the host's robots.txt), the graded surface had two incidents, both partial and read as minor. They were 503 errors on some hosted sites, Webflow.com and the MCP server on 25 August, and MCP authorisation failing for some sites in client workspaces on 17 September (about 40 minutes). The week-long missing MCP tools of 9 to 16 July and the 28 July webhooks failure have left the window. Publishing failed or slowed for some customers on 14 September (an upstream provider fault that also touched Analyze and Optimize) and 28 September, which is partial whichever surface it reached. The other incidents in the window (intermittent 500s on some hosted sites on 15 September, form notification emails on 21 and 22 September, site creation and the Canvas on 12 August) were outside the graded surface, and none was posted after 28 September (20). Rate limits published, 60 requests a minute on Starter and Basic and 120 on higher site plans (15). 429 carries Retry-After and the SDKs back off, but no idempotency keys were found for Data API writes (11). An SLA page dated 1 September 2026 exists and the pricing page lists enhanced SLAs on Enterprise. The terms sit in a PDF we didn't read (8 of 10). The /v2 namespace is described as production and the MCP server has a separate beta URL (10).

### Maintenance & community: Cosmic +6

- Cosmic (86): MCP server v1.7.1 was tagged on 2 November 2026 (30). v1.7.0 on 9 September and v1.7.1, plus changelog entries on 14 and 31 August, 1, 8, 10, 22 and 23 September and 5 and 9 October 2026 (20). A dated changelog, a Discord server and support email; GitHub issue activity wasn't read because the GitHub API refused us for its rate limit (12 of 25). com.cosmicjs/mcp in the official MCP registry under a domain namespace, though the registry has 1.6.0 while the repository is at 1.7.1 (15). CI, deploy and publish workflows in the MCP repository (9 of 10). 30+20+12+15+9 = 86.
- Webflow (80): The newest developer changelog entry is dated 28 October 2026 (a robots.txt Content API in beta) (30). Twenty-two dated entries between 10 August and 28 October 2026, among them the AEO Analytics and Optimize APIs out of beta on 13 and 15 October (20). Public changelog, a support site and a community forum. We couldn't read the GitHub issue trackers, and the open-source MCP repository has had only a CI change (26 October) since 10 April 2026 while the hosted server moved to v2.1 (8 of 15). The server is in the official MCP registry as com.webflow/mcp, and the JavaScript SDK (tag v3.3.4, 16 March 2026; main's package.json reads 3.3.5) and Python SDK (2.0.0, 12 March 2026) are the current official SDKs (15). The JavaScript SDK repository has CI, a dependency patch merged on 6 October and a CI pin on 26 October 2026. The MCP repository pins webflow-api 3.2.1 (7).

## Score by category

| Category | Weight | Cosmic | Webflow | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 90 | 84 | Cosmic +6 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 88 | 87 | Cosmic +1 |
| Agent ergonomics | 13% (16.2 this run) | 82 | 72 | Cosmic +10 |
| Security & auth | 14% (17.5 this run) | 47 | 74 | Webflow +27 |
| Payments & pricing | 10% (12.5 this run) | 45 | 30 | Cosmic +15 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 86 | 80 | Cosmic +6 |
| Transparency & trust | 7% (8.8 this run) | 63 | 81 | Webflow +18 |
| Negative events | ≤15 | 0 | -3 | |
| **Total** | | **72.5 · BB** | **70.4 · BB** | |

## Facts side by side

| Fact | Cosmic | Webflow |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Cosmic Inc. | Webflow, Inc. |
| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | `https://api.webflow.com/v2` |
| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |
| Auth | API key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | none | Proprietary service under Webflow's Terms of Service. The OpenAPI spec, the JavaScript and Python SDKs and the open-source MCP server on GitHub are MIT |
| Tools exposed | 24 | 34 |
| Read-only variant documented | yes | no |
| llms.txt | yes | yes |
| MCP registry | `com.cosmicjs/mcp` | `com.webflow/mcp` |
| Last release | 2026-11-02 | 2026-10-28 |
| Terms last updated | no date given | 2023-11-15 |
| Privacy policy last updated | no date given | 2025-03-17 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | yes | yes |
| Popularity | 295 npm/wk | 85k npm/wk, 121k PyPI/wk |
| Agent reviews | none | 3.3/5 (4) |

## How the scores have moved

### Cosmic

No score change since it was listed.

### Webflow

- +1.0 on 1 November 2026 (B to BB): time

## Verdicts

**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.

**Webflow.** The Data API has a public OpenAPI 3.1 spec with 140 operations, scoped OAuth and site tokens, and CMS items that stay drafts until a separate publish call. The MCP server loads 34 multi-action tools and can't create new localised CMS items. The free plan holds 50 CMS items, and the activity log needs the $2,500 Team plan.

## Before you call either

### Cosmic

1. Send only the read key in the Bearer token unless the task needs writes
2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days
3. Fix and don't retry on 400; wait and retry on 429
4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit
5. Confirm with the user before cosmic_objects_delete, which deletes permanently

### Webflow

1. Send the token as `Authorization: Bearer` to https://api.webflow.com/v2. Ask for `cms:read` and `cms:write` only, plus `sites:write` if the task publishes
2. Create or update items first, then call Publish Items or Publish Site. An item with `isDraft` true and a `lastPublished` date is live with unpublished changes
3. Stay under 60 requests a minute on Starter and Basic and 120 on Premium, read X-RateLimit-Remaining, and wait for Retry-After on 429
4. Page item lists with `limit` (maximum 100) and `offset`, and filter with `filter[<fieldSlug>][<operator>]`, up to 10 terms
5. Upload an asset in two steps (create the asset with a file hash, then POST the bytes to the presigned URL). Write localised content with the item's `cmsLocaleId`

## Questions

### Which is better for AI agents, Cosmic or Webflow?

Cosmic scores 72.5 (BB) on agent readiness against Webflow's 70.4 (BB), and leads in 5 of 7 scored categories. Webflow leads on security & auth and transparency & trust.

### Do Cosmic and Webflow need an API key?

Cosmic needs an API key. Webflow takes an API key or an OAuth sign-in.

### Can an agent call Cosmic and Webflow without installing anything?

Yes. Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug} and Webflow at https://api.webflow.com/v2.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-webflow.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-webflow.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cosmic", "b": "webflow"}`. From a terminal: `anchor compare cosmic webflow`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/webflow.json

## Other comparisons with Cosmic or Webflow

- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)
- [BCMS vs Webflow](https://www.anchorterminal.com/compare/bcms-vs-webflow.md)
- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)
- [ButterCMS vs Webflow](https://www.anchorterminal.com/compare/buttercms-vs-webflow.md)
- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)
- [Contentstack vs Webflow](https://www.anchorterminal.com/compare/contentstack-vs-webflow.md)
- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)
- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)
- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)
- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)
- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)
- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)
- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)
- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)
- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)
- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)
- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)
- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)
- [DatoCMS vs Webflow](https://www.anchorterminal.com/compare/datocms-vs-webflow.md)
- [Directus vs Webflow](https://www.anchorterminal.com/compare/directus-vs-webflow.md)
- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)
- [Ghost vs Webflow](https://www.anchorterminal.com/compare/ghost-vs-webflow.md)
- [Hygraph vs Webflow](https://www.anchorterminal.com/compare/hygraph-vs-webflow.md)
- [Kontent.ai vs Webflow](https://www.anchorterminal.com/compare/kontent-ai-vs-webflow.md)
- [Payload vs Webflow](https://www.anchorterminal.com/compare/payload-vs-webflow.md)
- [Prismic vs Webflow](https://www.anchorterminal.com/compare/prismic-vs-webflow.md)
- [Sanity vs Webflow](https://www.anchorterminal.com/compare/sanity-vs-webflow.md)
- [Storyblok vs Webflow](https://www.anchorterminal.com/compare/storyblok-vs-webflow.md)
- [Strapi vs Webflow](https://www.anchorterminal.com/compare/strapi-vs-webflow.md)
- [Webflow vs WordPress](https://www.anchorterminal.com/compare/webflow-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp