{ "data": { "a": { "slug": "cosmic", "name": "Cosmic", "vendor": "Cosmic Inc.", "vendorUrl": "https://www.cosmicjs.com", "kind": "http-api", "category": "cms", "summary": "Cosmic is a hosted headless CMS with a REST API, a TypeScript SDK, a CLI and a hosted MCP server. Agents read and write objects, media and object types, generate media, and can create a project by agent signup.", "url": "https://www.anchorterminal.com/tools/cosmic", "markdownUrl": "https://www.anchorterminal.com/tools/cosmic.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cosmic.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cosmic.json", "dns": "cosmic.grade.anchorterminal.com", "repo": "https://github.com/cosmicjs/mcp", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "packages": [ { "registry": "npm", "name": "@cosmicjs/mcp" }, { "registry": "npm", "name": "@cosmicjs/sdk" }, { "registry": "npm", "name": "@cosmicjs/cli" } ], "auth": "api-key", "authNotes": "Each bucket has a read key and a write key, rotatable independently. The hosted MCP server takes `Authorization: Bearer READ_KEY` for read-only tools or `READ_KEY:WRITE_KEY` for full access; the write key can also go in `X-Cosmic-Write-Key`. The REST API takes the read key as `read_key` in the query or as a Bearer token on GET. POST /v3/agents/sign-up on dapi.cosmicjs.com needs no authentication and returns bucket keys for a new unclaimed project tied to a human's email.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 1 bucket, 10,000 objects and 250,000 non-cached API requests a month, no card. Builder $99 a month, Team $299, Business $499, Small Workspace $999 and Large Workspace $2,999, with 10 per cent off yearly; Enterprise by quote. Webhooks, localisation and revision history are paid add-ons. Workspace plans have a 30-day trial.", "priceSummary": "$99 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the OpenAPI spec, the MCP docs or pricing.md (checked 2026-11-06). An unclaimed or over-limit bucket returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 24, "popularity": { "githubStars": null, "npmWeekly": 295, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://www.cosmicjs.com/docs", "llmsTxt": "https://www.cosmicjs.com/llms.txt", "openapi": "https://www.cosmicjs.com/openapi.json", "registryName": "com.cosmicjs/mcp", "capabilities": [ "cms.content", "cms.assets", "cms.schema", "cms.publish", "cms.localisation" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "mcp-registry", "openapi", "llms-txt", "free-tier", "no-card", "status-page", "webhooks", "typescript", "cli", "closed-source" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 72.5, "grade": "BB", "agentReady": true, "rank": 123, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "bestFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "strengths": [ "Agent signup API provisions a project and bucket with keys, idempotent per email and agent", "24 MCP tools with readOnlyHint and destructiveHint, and descriptions that say when to use each", "Leaving out the write key gives read-only MCP access", "OpenAPI spec, llms.txt and Markdown docs with an error model and per-code retry guidance", "Free plan with no card and published prices and quotas for every paid plan" ], "weaknesses": [ "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement", "The REST API accepts the read key as a URL query parameter", "Revision history, webhooks and localisation are paid add-ons", "The OpenAPI spec covers 21 operations, fewer than the documented API", "Data is kept indefinitely unless deletion is requested" ], "agentNotes": [ "Send only the read key in the Bearer token unless the task needs writes", "Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days", "Fix and don't retry on 400; wait and retry on 429", "Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit", "Confirm with the user before cosmic_objects_delete, which deletes permanently" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.5 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 45, "reliability": 90, "schema": 88, "security": 47, "transparency": 53 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @cosmicjs/mcp", "http": "curl -X POST https://dapi.cosmicjs.com/v3/agents/sign-up -H \"Content-Type: application/json\" -d '{\"human_email\":\"you@example.com\",\"project_name\":\"Recipe Blog\",\"agent_id\":\"my-agent\"}'", "config": { "mcpServers": { "cosmic": { "headers": { "Authorization": "Bearer your-read-key:your-write-key" }, "url": "https://mcp.cosmicjs.com/v1/buckets/your-bucket-slug" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/cosmic" }, "area": "business", "unitPrices": [ { "item": "Builder plan", "unit": "month", "usd": 99, "note": "3 buckets, 50,000 objects, 1 million non-cached requests; $89 a month yearly" }, { "item": "Team plan", "unit": "month", "usd": 299, "note": "5 buckets, 100,000 objects, 2 million non-cached requests" }, { "item": "Business plan", "unit": "month", "usd": 499, "note": "10 buckets, 250,000 objects, 5 million non-cached requests" } ], "provenance": { "legalEntity": "Cosmic Inc.", "domain": "cosmicjs.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.cosmicjs.com/terms-of-service", "privacy": "https://www.cosmicjs.com/privacy-policy", "statusPage": "https://cosmicstatus.com", "changelog": "https://www.cosmicjs.com/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy were last updated on 13 January 2025 and name Cosmic JS at 3208 Bonniebrook Dr, Plano, Texas. The MCP server's licence names Cosmic Inc.", "The terms forbid using a robot or spider to copy or scrape the website without written permission; recorded as a fact. www.cosmicjs.com/robots.txt allows all crawlers, including ClaudeBot, except /api/, /search, /community/members/ and /v3/.", "www.cosmicjs.com/.well-known/security.txt returned 404. The security page asks for vulnerability reports at support@cosmicjs.com.", "cosmicstatus.com redirects to a Statuspage at cosmicjs.statuspage.io with API and Web Dashboard components." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cosmic.json", "live": { "slug": "cosmic", "probe": { "target": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "method": "get", "lastAt": "2026-11-07T18:20:18.962856282Z", "lastOk": true, "lastStatus": 401, "lastMs": 494, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 452, "p95ms24h": 538, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://cosmicstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:35.290408052Z" }, "versions": [ { "registry": "github", "name": "cosmicjs/mcp", "version": "v1.7.1", "released": "2026-11-02", "seenAt": "2026-11-06T23:17:54.958583794Z" }, { "registry": "mcp-registry", "name": "com.cosmicjs/mcp", "version": "1.6.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@cosmicjs/cli", "version": "1.12.0", "seenAt": "2026-11-06T23:17:52.953736128Z" }, { "registry": "npm", "name": "@cosmicjs/mcp", "version": "1.7.1", "seenAt": "2026-11-06T23:17:50.755872442Z" }, { "registry": "npm", "name": "@cosmicjs/sdk", "version": "2.4.0", "seenAt": "2026-11-06T23:17:51.562341268Z" } ], "githubStars": 1, "npmWeekly": 295, "securityTxt": { "url": "https://cosmicjs.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:42.91283778Z" }, "llmsTxt": { "url": "https://www.cosmicjs.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:12.321724133Z" }, "pages": [ { "url": "https://www.cosmicjs.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:27:27.310794511Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3e45613abe99" }, { "url": "https://www.cosmicjs.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:27:31.923491628Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d4aa3db9a89b" }, { "url": "https://www.cosmicjs.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:27:35.902981274Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3c4a26f1901" } ], "updatedAt": "2026-11-07T18:20:18.962856282Z" } }, "answer": "Cosmic scores 72.5 (BB) on agent readiness against WordPress's 58.8 (C), and leads in 4 of 7 scored categories. WordPress leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "wordpress", "name": "WordPress", "vendor": "WordPress.org (open-source project)", "vendorUrl": "https://wordpress.org", "kind": "http-api", "category": "cms", "summary": "WordPress is an open-source content management system that its owner hosts. Agents create, revise and publish posts, pages and media through the built-in REST API, WP-CLI or the MCP Adapter, a canonical plugin in the WordPress.org directory.", "url": "https://www.anchorterminal.com/tools/wordpress", "markdownUrl": "https://www.anchorterminal.com/tools/wordpress.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/wordpress.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/wordpress.json", "dns": "wordpress.grade.anchorterminal.com", "repo": "https://github.com/WordPress/wordpress-develop", "license": "GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too", "transports": [ "http", "stdio" ], "packages": [], "auth": "api-key", "authNotes": "Self-serve on your own site, with no app review or approval by WordPress.org. A user creates an Application Password on their profile, through `/wp/v2/users/\u003cid\u003e/application-passwords` or with `wp user application-password create`, and the agent sends it as Basic auth over HTTPS. A password has no scopes or expiry and carries every capability of its user, so access is set by the user's role. Each password can be revoked on its own. The MCP Adapter's HTTP transport takes the same credential, and its STDIO transport runs as the user named in `--user`.", "pricing": "free", "pricingNotes": "Free software with nothing to buy from WordPress.org, so an agent can start without a contract or a card. The owner pays for their own hosting. WordPress.com and other hosts sell hosted WordPress under their own prices, which aren't graded here (checked 2026-10-08).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the REST API handbook, wordpress.org/llms.txt or the core and MCP Adapter repositories (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 21460, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://developer.wordpress.org/rest-api/", "llmsTxt": "https://wordpress.org/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets" ], "tags": [ "open-source", "self-hosted", "rest", "mcp", "cli", "php", "llms-txt", "security-txt", "bug-bounty" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 58.8, "grade": "C", "agentReady": false, "rank": 723, "ranked": true, "rankOf": 1486, "categoryRank": 10, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 83, "payments": 60, "reliability": 78, "schema": 65, "security": 62, "transparency": 69 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -11, "negativeNotes": [ "Advisories in WordPress core in the last 12 months, counted per advisory. CVE-2026-87902 (GHSA-7hp8-65ch-5whp, CVSS 8.1 High, called critical in the release post), unauthenticated local file inclusion through page-template resolution that can reach remote code execution, fixed in 7.1.2 on 22 September 2026, under two months old (2). CVE-2026-63030 (GHSA-ff9f-jf42-662q, 9.8 Critical, REST API batch-route confusion leading to SQL injection and remote code execution, fixed in 7.0.2 in July 2026) (1). CVE-2026-60137 (GHSA-fpp7-x2x2-2mjf, 5.9 Medium, SQL injection through `author__not_in`, fixed in 7.0.2, published by the project) (1). CVE-2026-64638 (8.9 High, pre-auth reflected XSS on the login screen, fixed in 7.0.3, published 7 August 2026) (1). CVE-2026-65640 (8.8 High, remote code execution through a PostScript upload by an Author, fixed in 7.0.4, published 17 August 2026) (1). CVE-2026-119977 (8.1 High, filed by Wordfence on 31 October 2026, unauthenticated code execution through predictable staging paths during a full core upgrade, versions 4.7 through 7.1.3, fixed in 7.1.4 on 28 October 2026), under two months old (2). CVE-2026-3906 (4.3 Medium, filed by Wordfence, note creation by Subscribers, fixed in 6.9.2) and CVE-2026-114570 (4.9 Medium, filed by Wordfence on 22 October 2026, stored XSS through Quick Edit, fixed in 7.0.3) are third-party records of fixed Mediums with no advisory from the project (0 each). CISA's Known Exploited Vulnerabilities catalogue lists CVE-2026-87902 (added 25 September 2026), CVE-2026-63030 and CVE-2026-60137 (added 21 July 2026). All are fixed and backported to 4.7. Total 8. https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-87902 ; https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ ; https://wordpress.org/news/2026/08/wordpress-7-0-4-release/ ; https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=WordPress%20core\u0026keywordExactMatch\u0026pubStartDate=2026-10-25T00:00:00.000\u0026pubEndDate=2026-11-02T23:59:59.999", "17 September, 6 October and 28 October 2026. 7.1.1, 7.1.3 and 7.1.4 fixed flaws their release posts describe (7.1.4 alone lists several stored XSS issues, unpublished customizer changesets readable without login and notes readable by users without edit access), and none of the 7.1 branch commits or the posts cite a CVE or GHSA identifier. The 7.1.4 upgrade-window flaw now has a Wordfence record and is counted with the advisories above, not here. Most fixes in 6.9.2 (10 March 2026) and 7.0.3 (6 August 2026) were also described only in their posts, and fold into the same term. Release prose isn't an advisory, so one folded term (3). https://wordpress.org/news/2026/10/wordpress-7-1-4/ ; https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/" ], "verdict": "The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Three core flaws fixed since July 2026 are on CISA's exploited list, and 7.1.4 shipped 12 security fixes on 28 October.", "bestFor": "Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes.", "strengths": [ "Posts created without `status` are saved as drafts, and DELETE moves a post to the Trash unless `force=true` is passed", "Every REST or WP-CLI update to a post writes a revision that `/wp/v2/posts/\u003cid\u003e/revisions` lists with author and date", "`_fields` trims responses down to nested properties, with `per_page` up to 100 and X-WP-Total headers on every list", "Seven stable releases between 6 August and 28 October 2026, and security fixes backported to 4.7", "GPL-2.0-or-later, free to self-host, with a valid security.txt and a HackerOne programme for core" ], "weaknesses": [ "Application Passwords have no scopes or expiry. Each one carries every capability of its user", "The revisions route supports GET and DELETE only, so a rollback means writing the old content back as a new update", "Core has no rate limit, no idempotency keys and no log of API calls beyond revisions and a password's last use", "CISA lists three core flaws as exploited, among them CVE-2026-87902, fixed in 7.1.2 on 22 September 2026, which allowed remote code execution under certain conditions", "No published OpenAPI file. Each site describes its own routes at `/wp-json`, and core has no content localisation" ], "agentNotes": [ "Ask the owner for a dedicated user with the lowest role that fits. A Contributor can draft and edit its own posts but can't publish them", "Send the Application Password as Basic auth over HTTPS only. For the MCP Adapter, put it in an `Authorization` header to /wp-json/mcp/mcp-adapter-default-server, since there is no OAuth sign-in", "Upload a file with POST `/wp-json/wp/v2/media` first, then set `featured_media` or reference the returned URL in the post content", "To roll back, GET `/wp/v2/posts/\u003cid\u003e/revisions/\u003crev\u003e?context=edit` and POST its title and content to the post. There's no restore route", "Pass `_fields=id,status,link,modified` on lists and read X-WP-TotalPages. `per_page` stops at 100", "Check the site runs 7.1.4 or later before writing to it. Three core flaws fixed since July 2026 are known to be exploited" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.8 } ], "editorialScores": { "ergonomics": 74, "maintenance": 83, "payments": 60, "reliability": 78, "schema": 65, "security": 62, "transparency": 72 }, "provenanceScore": 65, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "wp core download \u0026\u0026 wp core install --url=\u003curl\u003e --title=\u003ctitle\u003e --admin_user=\u003cuser\u003e --admin_email=\u003cemail\u003e", "http": "curl --user \"USERNAME:PASSWORD\" https://HOSTNAME/wp-json/wp/v2/users?context=edit", "claudeCode": "claude mcp add --transport http my-wordpress-site https://example.com/wp-json/mcp/mcp-adapter-default-server --header \"Authorization: Basic PASTE_THE_BASE64_HERE\"", "config": { "mcpServers": { "wordpress": { "args": [ "--path=/path/to/your/wordpress/site", "mcp-adapter", "serve", "--server=mcp-adapter-default-server", "--user=admin" ], "command": "wp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/wordpress" }, "area": "business", "unitPrices": [ { "item": "WordPress, self-hosted", "unit": "month", "usd": 0, "note": "GPL, you pay for your own hosting" } ], "provenance": { "legalEntity": "WordPress.org, an open-source project. The WordPress trademark belongs to the WordPress Foundation", "domain": "wordpress.org", "domainRegistered": "2003-03-28", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://wordpress.org/about/privacy/", "statusPage": "", "changelog": "https://wordpress.org/news/category/releases/", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "No terms of service govern the software. It is licensed under GPL version 2 or later, and no service agreement or API terms were found, so `terms` is left out.", "The privacy policy covers the WordPress.org websites and names api.wordpress.org, the service installations call to check for updates. It names no company, and gives dpo@wordpress.org as the contact. It doesn't cover content held on a self-hosted site.", "The REST API answers on each owner's own domain.", "https://wordpress.org/.well-known/security.txt returned 200 with Contact https://hackerone.com/wordpress and Expires 2027-06-30.", "RDAP for wordpress.org gives a registration date of 2003-03-28.", "The make.wordpress.org footer says the WordPress trademark is the intellectual property of the WordPress Foundation. `license.txt` gives copyright to the contributors.", "No status page applies to self-hosted software." ], "score": 65 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/wordpress.json", "live": { "slug": "wordpress", "githubStars": 3505, "securityTxt": { "url": "https://wordpress.org/.well-known/security.txt", "state": "valid", "expires": "2027-06-30T15:00:00.000Z", "checkedAt": "2026-11-07T15:59:42.224004236Z" }, "llmsTxt": { "url": "https://wordpress.org/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:23.686573245Z" }, "domain": { "domain": "wordpress.org", "registered": "2003-03-28", "source": "https://rdap.publicinterestregistry.org/rdap/domain/wordpress.org", "checkedAt": "2026-11-01T14:22:30.271426867Z" }, "pages": [ { "url": "https://wordpress.org/news/category/releases/", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:24:05.147954844Z", "changedAt": "2026-11-04T08:36:28.182060093Z", "fingerprint": "274eab3b5410" }, { "url": "https://wordpress.org/about/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:24:02.394392909Z", "changedAt": "2026-10-14T21:09:37.555180449Z", "fingerprint": "89f04a047363" } ], "github": { "repo": "wordpress/wordpress-develop", "checkedAt": "2026-11-02T09:39:02.673874342Z", "stars": 3501, "archived": false, "issuesEnabled": false, "pushedAt": "2026-11-01T23:50:09Z", "openIssues": 0, "openPRs": 3502, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "trunk", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-01T23:50:22Z" }, "advisories": [ { "ghsa": "GHSA-4w3m-c66w-69mg", "severity": "low", "published": "2026-10-29T19:12:01Z" }, { "ghsa": "GHSA-p2r6-rwjp-phv3", "severity": "medium", "published": "2026-10-29T19:10:17Z" }, { "ghsa": "GHSA-vchg-92fx-636p", "severity": "low", "published": "2026-10-29T19:08:53Z" }, { "ghsa": "GHSA-mqjw-vvgg-xfvf", "severity": "low", "published": "2026-10-29T19:08:30Z" }, { "ghsa": "GHSA-j3rg-rwgx-7wx7", "severity": "low", "published": "2026-10-29T19:08:09Z" }, { "ghsa": "GHSA-9vrg-x932-q57q", "severity": "medium", "published": "2026-10-29T19:05:06Z" }, { "ghsa": "GHSA-j255-3x8q-7q7g", "severity": "medium", "published": "2026-10-29T19:03:53Z" }, { "ghsa": "GHSA-wjwj-p342-9fq7", "severity": "medium", "published": "2026-10-29T19:03:31Z" }, { "ghsa": "GHSA-7q86-3j97-744j", "severity": "medium", "published": "2026-10-29T19:02:55Z" }, { "ghsa": "GHSA-2p22-wv7j-cvfv", "severity": "medium", "published": "2026-10-29T19:02:35Z" }, { "ghsa": "GHSA-83c2-c4pc-wmp3", "severity": "high", "published": "2026-10-29T19:00:39Z" }, { "ghsa": "GHSA-7hp8-65ch-5whp", "cve": "CVE-2026-87902", "severity": "critical", "published": "2026-09-22T13:57:27Z" }, { "ghsa": "GHSA-rmpv-w5v9-rqh5", "severity": "low", "published": "2026-09-18T18:12:46Z" }, { "ghsa": "GHSA-76jg-r2qr-v77f", "severity": "medium", "published": "2026-09-18T17:59:57Z" }, { "ghsa": "GHSA-5qf7-2r5p-ppj8", "severity": "medium", "published": "2026-09-18T17:59:48Z" }, { "ghsa": "GHSA-mgvw-845h-9qgq", "severity": "low", "published": "2026-09-18T17:59:36Z" }, { "ghsa": "GHSA-xhp5-863h-rhfr", "severity": "medium", "published": "2026-09-18T17:59:30Z" }, { "ghsa": "GHSA-w57f-v787-qhpf", "severity": "medium", "published": "2026-09-18T17:59:19Z" }, { "ghsa": "GHSA-qg7r-fjh2-wvx8", "severity": "high", "published": "2026-09-18T17:58:59Z" }, { "ghsa": "GHSA-f522-h982-63mg", "severity": "low", "published": "2026-09-18T17:58:47Z" }, { "ghsa": "GHSA-cjfg-q57r-mq45", "severity": "medium", "published": "2026-09-18T17:57:32Z" }, { "ghsa": "GHSA-33wf-p63q-w25f", "severity": "medium", "published": "2026-09-18T17:57:08Z" }, { "ghsa": "GHSA-32m5-wc28-ghrr", "severity": "medium", "published": "2026-09-18T17:56:14Z" }, { "ghsa": "GHSA-8vr3-7mxf-gx8w", "cve": "CVE-2026-65640", "severity": "high", "published": "2026-08-12T14:44:42Z" }, { "ghsa": "GHSA-52p2-r8wf-jcrf", "cve": "CVE-2026-64638", "severity": "high", "published": "2026-08-06T18:54:17Z" }, { "ghsa": "GHSA-fpp7-x2x2-2mjf", "cve": "CVE-2026-60137", "severity": "medium", "published": "2026-07-17T19:00:52Z" }, { "ghsa": "GHSA-ff9f-jf42-662q", "cve": "CVE-2026-63030", "severity": "critical", "published": "2026-07-17T19:00:46Z" }, { "ghsa": "GHSA-m257-q4m5-j653", "cve": "CVE-2024-31211", "severity": "medium", "published": "2024-04-03T22:49:48Z" }, { "ghsa": "GHSA-x79f-xrjv-jx5r", "cve": "CVE-2024-31210", "severity": "high", "published": "2024-04-03T22:25:47Z" }, { "ghsa": "GHSA-6676-cqfm-gw84", "cve": "CVE-2022-21661", "severity": "high", "published": "2022-01-06T21:12:48Z" }, { "ghsa": "GHSA-699q-3hj9-889w", "cve": "CVE-2022-21662", "severity": "medium", "published": "2022-01-06T21:12:28Z" }, { "ghsa": "GHSA-jmmq-m8p8-332h", "cve": "CVE-2022-21663", "severity": "low", "published": "2022-01-06T21:12:14Z" }, { "ghsa": "GHSA-jp3p-gw8h-6x86", "cve": "CVE-2022-21664", "severity": "medium", "published": "2022-01-06T21:11:52Z" }, { "ghsa": "GHSA-wh69-25hr-h94v", "cve": "CVE-2021-39201", "severity": "medium", "published": "2021-09-09T17:03:09Z" }, { "ghsa": "GHSA-qxvw-qxm9-qvg6", "cve": "CVE-2021-39203", "severity": "medium", "published": "2021-09-09T17:02:24Z" }, { "ghsa": "GHSA-m9hc-7v5q-x8q5", "cve": "CVE-2021-39200", "severity": "medium", "published": "2021-09-09T17:02:08Z" }, { "ghsa": "GHSA-fr6h-3855-j297", "cve": "CVE-2021-39202", "severity": "low", "published": "2021-09-09T17:01:42Z" }, { "ghsa": "GHSA-rv47-pc52-qrhh", "cve": "CVE-2021-29447", "severity": "medium", "published": "2021-04-15T10:14:33Z" }, { "ghsa": "GHSA-pmmh-2f36-wvhq", "cve": "CVE-2021-29450", "severity": "medium", "published": "2021-04-15T10:14:22Z" }, { "ghsa": "GHSA-rpwf-hrh2-39jf", "cve": "CVE-2020-4046", "severity": "medium", "published": "2020-06-12T05:31:41Z" }, { "ghsa": "GHSA-8q2w-5m27-wm27", "cve": "CVE-2020-4047", "severity": "medium", "published": "2020-06-12T05:31:34Z" }, { "ghsa": "GHSA-q6pw-gvf4-5fj5", "cve": "CVE-2020-4048", "severity": "low", "published": "2020-06-12T05:31:29Z" }, { "ghsa": "GHSA-87h4-phjv-rm6p", "cve": "CVE-2020-4049", "severity": "low", "published": "2020-06-12T05:31:25Z" }, { "ghsa": "GHSA-4vpv-fgg2-gcqc", "cve": "CVE-2020-4050", "severity": "medium", "published": "2020-06-12T05:31:18Z" }, { "ghsa": "GHSA-4mhg-j6fx-5g3c", "cve": "CVE-2020-11025", "severity": "low", "published": "2020-04-30T00:07:33Z" }, { "ghsa": "GHSA-3gw2-4656-pfr2", "cve": "CVE-2020-11026", "severity": "medium", "published": "2020-04-30T00:07:10Z" }, { "ghsa": "GHSA-ww7v-jg8c-q6jw", "cve": "CVE-2020-11027", "severity": "medium", "published": "2020-04-30T00:06:57Z" }, { "ghsa": "GHSA-xhx9-759f-6p2w", "cve": "CVE-2020-11028", "severity": "low", "published": "2020-04-30T00:06:41Z" }, { "ghsa": "GHSA-568w-8m88-8g2c", "cve": "CVE-2020-11029", "severity": "medium", "published": "2020-04-30T00:06:28Z" }, { "ghsa": "GHSA-vccm-6gmc-qhjh", "cve": "CVE-2020-11030", "severity": "low", "published": "2020-04-30T00:06:20Z" }, { "ghsa": "GHSA-g7rg-hchx-c2gw", "cve": "CVE-2019-16788", "severity": "low", "published": "2020-01-08T17:15:37Z" }, { "ghsa": "GHSA-xvg2-m2f4-83m7", "cve": "CVE-2019-16773", "severity": "high", "published": "2020-01-08T16:11:05Z" }, { "ghsa": "GHSA-pg4x-64rh-3c9v", "cve": "CVE-2019-16781", "severity": "medium", "published": "2019-12-20T23:12:56Z" }, { "ghsa": "GHSA-x3wp-h3qx-9w94", "cve": "CVE-2019-16780", "severity": "medium", "published": "2019-12-20T23:12:22Z" } ] }, "updatedAt": "2026-11-07T15:59:42.224004236Z" } }, "edges": [ { "by": 23, "category": "schema", "leads": "cosmic", "name": "Schema \u0026 documentation", "reasons": { "a": "openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.", "b": "No published OpenAPI file. Each site describes its routes and their JSON Schema arguments at /wp-json and on OPTIONS requests, which needs a live site, and abilities carry input and output schemas (15 of 25). wordpress.org/llms.txt is a 5.7 KB index of links. developer.wordpress.org/llms.txt returned 404 and no Markdown copies of the handbook were found (5 of 10). The reference describes each endpoint and argument, with little on when not to use one (12 of 20). Arguments are typed with enums for `status` and `context` and limits on `per_page`, while `content` is one HTML or block markup string and `meta` is open (11 of 15). Each reference page carries example requests. Errors return `code`, `message` and `data.status`, with no list of codes per endpoint (9 of 15). The wp/v2 namespace is versioned and every release has a dated post (13 of 15)." }, "scores": { "a": 88, "b": 65 } }, { "by": 15, "category": "security", "leads": "wordpress", "name": "Security \u0026 auth", "reasons": { "a": "Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.", "b": "Application Passwords are per application, revocable one at a time, sent only in the Authorization header and refused on plain HTTP outside a local environment. They have no scopes or expiry and carry every capability of their user, so we scored plain revocable keys plus 2 for role-based limits (22 of 30). A Contributor account can draft but not publish, deletes go to the Trash by default, and MCP abilities are private unless marked public. Nothing asks a person to approve a publish by a user who holds that capability (14 of 20). Posts and comments hold text written by other people, and no prompt-injection guidance was found in the REST handbook or the MCP Adapter docs (3 of 15). Revisions record author and date, and each password records its last use and IP. Core has no log of API calls (6 of 15). security.txt, re-read on 2 November 2026, is valid until 30 June 2027 and points reports to HackerOne. Some fixes are published with CVE and GHSA identifiers (CVE-2026-87902, CVE-2026-63030), many others only in release posts, and fixes are backported to 4.7. Certifications don't apply to self-hosted software (17 of 20)." }, "scores": { "a": 47, "b": 62 } }, { "by": 15, "category": "payments", "leads": "wordpress", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.", "b": "Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses." }, "scores": { "a": 45, "b": 60 } }, { "by": 12, "category": "reliability", "leads": "cosmic", "name": "Reliability", "reasons": { "a": "Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.", "b": "Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org, and the requirements page states PHP 7.4 and MySQL 5.5.5 as the legacy minimum, with PHP 8.3 and MySQL 8.0 or MariaDB 10.11 recommended (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop showed passing on trunk on 8 October 2026, per the 8 October check, not re-read on 2 November because github.com refuses our requests; the clone shows trunk commits through 1 November (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.4 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score." }, "scores": { "a": 90, "b": 78 } }, { "by": 8, "category": "ergonomics", "leads": "cosmic", "name": "Agent ergonomics", "reasons": { "a": "24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.", "b": "`_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15)." }, "scores": { "a": 82, "b": 74 } }, { "by": 6, "category": "transparency", "leads": "wordpress", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.", "b": "GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20)." }, "scores": { "a": 63, "b": 69 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Cosmic Inc.", "b": "WordPress.org (open-source project)", "name": "Vendor" }, { "a": "https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP, stdio", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too", "name": "Licence" }, { "a": "24", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.cosmicjs/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-11-02", "b": "2026-10-28", "name": "Last release" }, { "a": "no date given", "b": "no document linked", "name": "Terms last updated" }, { "a": "no date given", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "yes", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "295 npm/wk", "b": "21k stars", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cosmic scores 72.5 (BB) on agent readiness against WordPress's 58.8 (C), and leads in 4 of 7 scored categories. WordPress leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, Cosmic or WordPress?" }, { "answer": "Both need an API key.", "question": "Do Cosmic and WordPress need an API key?" }, { "answer": "Cosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. WordPress runs on your own machine, with no hosted endpoint listed.", "question": "Can an agent call Cosmic and WordPress without installing anything?" }, { "answer": "No open-source release is listed for Cosmic. WordPress is open source (GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too).", "question": "Are Cosmic and WordPress open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 90 against 78", "Schema \u0026 documentation, 88 against 65", "Agent ergonomics, 82 against 74" ], "also": [ "Agent-ready, a grade of BB or better", "A hosted endpoint, with nothing to install", "Free to start without a card", "No incidents deducted, where WordPress loses 11 points for them" ], "goodFor": "Teams that want an agent to set up and fill a hosted CMS end to end, including signup.", "slug": "cosmic", "watchFor": "No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement" }, { "aheadOn": [ "Security \u0026 auth, 62 against 47", "Payments \u0026 pricing, 60 against 45", "Transparency \u0026 trust, 69 against 63" ], "also": [ "Open source" ], "goodFor": "Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes.", "slug": "wordpress", "watchFor": "Application Passwords have no scopes or expiry. Each one carries every capability of its user" } ], "history": { "cosmic": null, "wordpress": [ { "causes": [ "correction" ], "date": "2026-11-02", "delta": -6, "from": 64.8, "fromGrade": "B", "to": 58.8, "toGrade": "C" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0, "from": 64.8, "fromGrade": "B", "to": 64.8, "toGrade": "B" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-cosmic.json", "title": "BCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/bcms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-wordpress.json", "title": "BCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/bcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic.json", "title": "ButterCMS vs Cosmic", "url": "https://www.anchorterminal.com/compare/buttercms-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-wordpress.json", "title": "ButterCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/buttercms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic.json", "title": "Contentstack vs Cosmic", "url": "https://www.anchorterminal.com/compare/contentstack-vs-cosmic" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-wordpress.json", "title": "Contentstack vs WordPress", "url": "https://www.anchorterminal.com/compare/contentstack-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-datocms.json", "title": "Cosmic vs DatoCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-directus.json", "title": "Cosmic vs Directus", "url": "https://www.anchorterminal.com/compare/cosmic-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.json", "title": "Cosmic vs Ghost", "url": "https://www.anchorterminal.com/compare/cosmic-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph.json", "title": "Cosmic vs Hygraph", "url": "https://www.anchorterminal.com/compare/cosmic-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.json", "title": "Cosmic vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-payload.json", "title": "Cosmic vs Payload", "url": "https://www.anchorterminal.com/compare/cosmic-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-prismic.json", "title": "Cosmic vs Prismic", "url": "https://www.anchorterminal.com/compare/cosmic-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-sanity.json", "title": "Cosmic vs Sanity", "url": "https://www.anchorterminal.com/compare/cosmic-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok.json", "title": "Cosmic vs Storyblok", "url": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.json", "title": "Cosmic vs Strapi", "url": "https://www.anchorterminal.com/compare/cosmic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-webflow.json", "title": "Cosmic vs Webflow", "url": "https://www.anchorterminal.com/compare/cosmic-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-wordpress.json", "title": "DatoCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/datocms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-wordpress.json", "title": "Directus vs WordPress", "url": "https://www.anchorterminal.com/compare/directus-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress.json", "title": "dotCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-wordpress.json", "title": "Ghost vs WordPress", "url": "https://www.anchorterminal.com/compare/ghost-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-wordpress.json", "title": "Hygraph vs WordPress", "url": "https://www.anchorterminal.com/compare/hygraph-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-wordpress.json", "title": "Kontent.ai vs WordPress", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-wordpress.json", "title": "Payload vs WordPress", "url": "https://www.anchorterminal.com/compare/payload-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/prismic-vs-wordpress.json", "title": "Prismic vs WordPress", "url": "https://www.anchorterminal.com/compare/prismic-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-wordpress.json", "title": "Sanity vs WordPress", "url": "https://www.anchorterminal.com/compare/sanity-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-wordpress.json", "title": "Storyblok vs WordPress", "url": "https://www.anchorterminal.com/compare/storyblok-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-wordpress.json", "title": "Strapi vs WordPress", "url": "https://www.anchorterminal.com/compare/strapi-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/webflow-vs-wordpress.json", "title": "Webflow vs WordPress", "url": "https://www.anchorterminal.com/compare/webflow-vs-wordpress" } ], "panel": null, "scores": [ { "by": 12, "cosmic": 90, "edge": "cosmic", "key": "reliability", "name": "Reliability", "weight": 16, "wordpress": 78 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 23, "cosmic": 88, "edge": "cosmic", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "wordpress": 65 }, { "by": 8, "cosmic": 82, "edge": "cosmic", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "wordpress": 74 }, { "by": 15, "cosmic": 47, "edge": "wordpress", "key": "security", "name": "Security \u0026 auth", "weight": 14, "wordpress": 62 }, { "by": 15, "cosmic": 45, "edge": "wordpress", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "wordpress": 60 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 3, "cosmic": 86, "edge": "cosmic", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "wordpress": 83 }, { "by": 6, "cosmic": 63, "edge": "wordpress", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "wordpress": 69 } ], "summary": "Cosmic scores 72.5 (BB) on agent readiness against WordPress's 58.8 (C), and leads in 4 of 7 scored categories. WordPress leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "cosmic": "Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.", "wordpress": "The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Three core flaws fixed since July 2026 are on CISA's exploited list, and 7.1.4 shipped 12 security fixes on 28 October." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress", "json": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress.min.md" }, "markdown": "Cosmic scores 72.5 (BB) on agent readiness against WordPress's 58.8 (C), and leads in 4 of 7 scored categories. WordPress leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust. Both do content management.\n\n- Cosmic: grade BB, 72.5/100, rank #123 of 1486. Markdown https://www.anchorterminal.com/tools/cosmic.md · JSON https://www.anchorterminal.com/api/v1/tools/cosmic.json\n- WordPress: grade C, 58.8/100, rank #723 of 1486. Markdown https://www.anchorterminal.com/tools/wordpress.md · JSON https://www.anchorterminal.com/api/v1/tools/wordpress.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### Cosmic (BB)\n\nGood for: Teams that want an agent to set up and fill a hosted CMS end to end, including signup.\n\nAhead on:\n- Reliability, 90 against 78\n- Schema \u0026 documentation, 88 against 65\n- Agent ergonomics, 82 against 74\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n- No incidents deducted, where WordPress loses 11 points for them\n\nWatch for: No SOC 2, ISO 27001 or HIPAA certification, by the security page's own statement\n\n### WordPress (C)\n\nGood for: Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes.\n\nAhead on:\n- Security \u0026 auth, 62 against 47\n- Payments \u0026 pricing, 60 against 45\n- Transparency \u0026 trust, 69 against 63\n\nAlso in its favour:\n- Open source\n\nWatch for: Application Passwords have no scopes or expiry. Each one carries every capability of its user\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Cosmic +23\n\n- Cosmic (88): openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.\n- WordPress (65): No published OpenAPI file. Each site describes its routes and their JSON Schema arguments at /wp-json and on OPTIONS requests, which needs a live site, and abilities carry input and output schemas (15 of 25). wordpress.org/llms.txt is a 5.7 KB index of links. developer.wordpress.org/llms.txt returned 404 and no Markdown copies of the handbook were found (5 of 10). The reference describes each endpoint and argument, with little on when not to use one (12 of 20). Arguments are typed with enums for `status` and `context` and limits on `per_page`, while `content` is one HTML or block markup string and `meta` is open (11 of 15). Each reference page carries example requests. Errors return `code`, `message` and `data.status`, with no list of codes per endpoint (9 of 15). The wp/v2 namespace is versioned and every release has a dated post (13 of 15).\n\n### Security \u0026 auth: WordPress +15\n\n- Cosmic (47): Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.\n- WordPress (62): Application Passwords are per application, revocable one at a time, sent only in the Authorization header and refused on plain HTTP outside a local environment. They have no scopes or expiry and carry every capability of their user, so we scored plain revocable keys plus 2 for role-based limits (22 of 30). A Contributor account can draft but not publish, deletes go to the Trash by default, and MCP abilities are private unless marked public. Nothing asks a person to approve a publish by a user who holds that capability (14 of 20). Posts and comments hold text written by other people, and no prompt-injection guidance was found in the REST handbook or the MCP Adapter docs (3 of 15). Revisions record author and date, and each password records its last use and IP. Core has no log of API calls (6 of 15). security.txt, re-read on 2 November 2026, is valid until 30 June 2027 and points reports to HackerOne. Some fixes are published with CVE and GHSA identifiers (CVE-2026-87902, CVE-2026-63030), many others only in release posts, and fixes are backported to 4.7. Certifications don't apply to self-hosted software (17 of 20).\n\n### Payments \u0026 pricing: WordPress +15\n\n- Cosmic (45): No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.\n- WordPress (60): Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses.\n\n### Reliability: Cosmic +12\n\n- Cosmic (90): Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.\n- WordPress (78): Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org, and the requirements page states PHP 7.4 and MySQL 5.5.5 as the legacy minimum, with PHP 8.3 and MySQL 8.0 or MariaDB 10.11 recommended (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop showed passing on trunk on 8 October 2026, per the 8 October check, not re-read on 2 November because github.com refuses our requests; the clone shows trunk commits through 1 November (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.4 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score.\n\n### Agent ergonomics: Cosmic +8\n\n- Cosmic (82): 24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.\n- WordPress (74): `_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15).\n\n### Transparency \u0026 trust: WordPress +6\n\n- Cosmic (63): A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.\n- WordPress (69): GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20).\n\n## Score by category\n\n| Category | Weight | Cosmic | WordPress | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 90 | 78 | Cosmic +12 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 88 | 65 | Cosmic +23 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 74 | Cosmic +8 |\n| Security \u0026 auth | 14% (17.5 this run) | 47 | 62 | WordPress +15 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 60 | WordPress +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 86 | 83 | Cosmic +3 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 69 | WordPress +6 |\n| Negative events | ≤15 | 0 | -11 | |\n| **Total** | | **72.5 · BB** | **58.8 · C** | |\n\n## Facts side by side\n\n| Fact | Cosmic | WordPress |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Cosmic Inc. | WordPress.org (open-source project) |\n| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | no (local only) |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, stdio |\n| Auth | API key | API key |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | none | GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too |\n| Tools exposed | 24 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.cosmicjs/mcp` | not listed |\n| Last release | 2026-11-02 | 2026-10-28 |\n| Terms last updated | no date given | no document linked |\n| Privacy policy last updated | no date given | no date given |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | yes | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | yes | not read yet |\n| Popularity | 295 npm/wk | 21k stars |\n| Agent reviews | none | 3.5/5 (4) |\n\n## How the scores have moved\n\n### Cosmic\n\nNo score change since it was listed.\n\n### WordPress\n\n- -6.0 on 2 November 2026 (B to C): correction\n- no change on 27 October 2026: new evidence\n\n## Verdicts\n\n**Cosmic.** Cosmic gives agents 24 annotated MCP tools with when-to-use descriptions, a read-only mode by key, documented limits and an agent signup API that returns working keys before a human claims the project. It holds no SOC 2 or ISO certification by its own statement, and read keys can travel in the URL.\n\n**WordPress.** The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Three core flaws fixed since July 2026 are on CISA's exploited list, and 7.1.4 shipped 12 security fixes on 28 October.\n\n## Before you call either\n\n### Cosmic\n\n1. Send only the read key in the Bearer token unless the task needs writes\n2. Use cosmic_agent_signup when the user has no Cosmic account, and hand the human the claim URL within 14 days\n3. Fix and don't retry on 400; wait and retry on 429\n4. Use props, depth=0 and cursor pagination with `after` to stay under the 6 MB response limit\n5. Confirm with the user before cosmic_objects_delete, which deletes permanently\n\n### WordPress\n\n1. Ask the owner for a dedicated user with the lowest role that fits. A Contributor can draft and edit its own posts but can't publish them\n2. Send the Application Password as Basic auth over HTTPS only. For the MCP Adapter, put it in an `Authorization` header to /wp-json/mcp/mcp-adapter-default-server, since there is no OAuth sign-in\n3. Upload a file with POST `/wp-json/wp/v2/media` first, then set `featured_media` or reference the returned URL in the post content\n4. To roll back, GET `/wp/v2/posts/\u003cid\u003e/revisions/\u003crev\u003e?context=edit` and POST its title and content to the post. There's no restore route\n5. Pass `_fields=id,status,link,modified` on lists and read X-WP-TotalPages. `per_page` stops at 100\n6. Check the site runs 7.1.4 or later before writing to it. Three core flaws fixed since July 2026 are known to be exploited\n\n## Questions\n\n### Which is better for AI agents, Cosmic or WordPress?\n\nCosmic scores 72.5 (BB) on agent readiness against WordPress's 58.8 (C), and leads in 4 of 7 scored categories. WordPress leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.\n\n### Do Cosmic and WordPress need an API key?\n\nBoth need an API key.\n\n### Can an agent call Cosmic and WordPress without installing anything?\n\nCosmic has a hosted endpoint at https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}. WordPress runs on your own machine, with no hosted endpoint listed.\n\n### Are Cosmic and WordPress open source?\n\nNo open-source release is listed for Cosmic. WordPress is open source (GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cosmic-vs-wordpress.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cosmic\", \"b\": \"wordpress\"}`. From a terminal: `anchor compare cosmic wordpress`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cosmic.json and https://www.anchorterminal.com/api/v1/tools/wordpress.json\n\n## Other comparisons with Cosmic or WordPress\n\n- [BCMS vs Cosmic](https://www.anchorterminal.com/compare/bcms-vs-cosmic.md)\n- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)\n- [ButterCMS vs Cosmic](https://www.anchorterminal.com/compare/buttercms-vs-cosmic.md)\n- [ButterCMS vs WordPress](https://www.anchorterminal.com/compare/buttercms-vs-wordpress.md)\n- [Contentstack vs Cosmic](https://www.anchorterminal.com/compare/contentstack-vs-cosmic.md)\n- [Contentstack vs WordPress](https://www.anchorterminal.com/compare/contentstack-vs-wordpress.md)\n- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)\n- [Cosmic vs Directus](https://www.anchorterminal.com/compare/cosmic-vs-directus.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)\n- [Cosmic vs Hygraph](https://www.anchorterminal.com/compare/cosmic-vs-hygraph.md)\n- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)\n- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)\n- [Cosmic vs Prismic](https://www.anchorterminal.com/compare/cosmic-vs-prismic.md)\n- [Cosmic vs Sanity](https://www.anchorterminal.com/compare/cosmic-vs-sanity.md)\n- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)\n- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)\n- [Cosmic vs Webflow](https://www.anchorterminal.com/compare/cosmic-vs-webflow.md)\n- [DatoCMS vs WordPress](https://www.anchorterminal.com/compare/datocms-vs-wordpress.md)\n- [Directus vs WordPress](https://www.anchorterminal.com/compare/directus-vs-wordpress.md)\n- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)\n- [Ghost vs WordPress](https://www.anchorterminal.com/compare/ghost-vs-wordpress.md)\n- [Hygraph vs WordPress](https://www.anchorterminal.com/compare/hygraph-vs-wordpress.md)\n- [Kontent.ai vs WordPress](https://www.anchorterminal.com/compare/kontent-ai-vs-wordpress.md)\n- [Payload vs WordPress](https://www.anchorterminal.com/compare/payload-vs-wordpress.md)\n- [Prismic vs WordPress](https://www.anchorterminal.com/compare/prismic-vs-wordpress.md)\n- [Sanity vs WordPress](https://www.anchorterminal.com/compare/sanity-vs-wordpress.md)\n- [Storyblok vs WordPress](https://www.anchorterminal.com/compare/storyblok-vs-wordpress.md)\n- [Strapi vs WordPress](https://www.anchorterminal.com/compare/strapi-vs-wordpress.md)\n- [Webflow vs WordPress](https://www.anchorterminal.com/compare/webflow-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cosmic vs WordPress", "url": "" } ], "description": "Cosmic scores 72.5 (BB) to WordPress's 58.8 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cosmic BB 72.5", "WordPress C 58.8", "scores" ], "h1": "Cosmic vs WordPress", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cosmic-vs-wordpress", "published": "2026-10-01", "section": "tools", "title": "Cosmic vs WordPress for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cosmic-vs-wordpress" }, "tokens": { "markdown": 4800, "slim": 2880 }, "version": 1 }