# Cosmic vs WordPress (slim)

> Cosmic scores 72.5 (BB) to WordPress's 58.8 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md (~4,800 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/cosmic-vs-wordpress.json · canonical https://www.anchorterminal.com/compare/cosmic-vs-wordpress
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Cosmic scores 72.5 (BB) on agent readiness against WordPress's 58.8 (C), and leads in 4 of 7 scored categories. WordPress leads on security & auth, payments & pricing and transparency & trust. Both do content management.

- Cosmic: BB 72.5, rank #124 of 1510 · https://www.anchorterminal.com/tools/cosmic.min.md
- WordPress: C 58.8, rank #727 of 1510 · https://www.anchorterminal.com/tools/wordpress.min.md
- Cosmic, good for Teams that want an agent to set up and fill a hosted CMS end to end, including signup. Ahead on Reliability, 90 against 78; Schema & documentation, 88 against 65; Agent ergonomics, 82 against 74. Also Agent-ready, a grade of BB or better; A hosted endpoint, with nothing to install; Free to start without a card; No incidents deducted, where WordPress loses 11 points for them.
- WordPress, good for Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes. Ahead on Security & auth, 62 against 47; Payments & pricing, 60 against 45; Transparency & trust, 69 against 63. Also Open source.

| Category | Cosmic | WordPress |
| --- | --- | --- |
| Reliability (16%) | 90 | 78 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 88 | 65 |
| Agent ergonomics (13%) | 82 | 74 |
| Security & auth (14%) | 47 | 62 |
| Payments & pricing (10%) | 45 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 86 | 83 |
| Transparency & trust (7%) | 63 | 69 |

| Fact (where they differ) | Cosmic | WordPress |
| --- | --- | --- |
| Vendor | Cosmic Inc. | WordPress.org (open-source project) |
| Hosted endpoint | `https://mcp.cosmicjs.com/v1/buckets/{bucket_slug}` | no (local only) |
| Transports | HTTP, Streamable HTTP, stdio | HTTP, stdio |
| Pricing | Freemium | Free |
| Licence | none | GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too |
| Tools exposed | 24 | none |
| Read-only variant documented | yes | no |
| MCP registry | `com.cosmicjs/mcp` | not listed |
| Last release | 2026-11-02 | 2026-10-28 |
| Terms last updated | no date given | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | 295 npm/wk | 21k stars |
| Agent reviews | none | 3.5/5 (4) |

Why the edge:
- Schema & documentation, Cosmic +23: Cosmic 88 (openapi.json at www.cosmicjs.com covers 21 operations on 12 paths, each with a summary, a description and documented 401, 402, 404, 429 and 500 responses, though the docs describe more endpoints than it covers (revisions, AI, search); MCP tools have typed inputs (20 of 25). llms.txt and every docs page as Markdown (10). Tool descriptions say when to use each tool and when not to, such as never calling delete speculatively (18 of 20). 11 enums in the spec, typed metafields and validation messages (11 of 15). Examples on every API page and an error model with a sample (14 of 15). API v3 paths and a dated changelog (15). 20+10+18+11+14+15 = 88.); WordPress 65 (No published OpenAPI file. Each site describes its routes and their JSON Schema arguments at /wp-json and on OPTIONS requests, which needs a live site, and abilities carry input and output schemas (15 of 25). wordpress.org/llms.txt is a 5.7 KB index of links. developer.wordpress.org/llms.txt returned 404 and no Markdown copies of the handbook were found (5 of 10). The reference describes each endpoint and argument, with little on when not to use one (12 of 20). Arguments are typed with enums for `status` and `context` and limits on `per_page`, while `content` is one HTML or block markup string and `meta` is open (11 of 15). Each reference page carries example requests. Errors return `code`, `message` and `data.status`, with no list of codes per endpoint (9 of 15). The wp/v2 namespace is versioned and every release has a dated post (13 of 15).)
- Security & auth, WordPress +15: Cosmic 47 (Separate read and write keys per bucket, rotatable independently (25), less 10 because the docs give `read_key` as a query parameter on GET (15 of 30). Read-only MCP access by leaving out the write key, four user roles on every plan, and a delete tool told not to run speculatively; no approval step (14 of 20). Objects hold text written by people and AI generation writes into the bucket; no prompt-injection guidance was found (3 of 15). An append-only audit log of security-relevant actions on Workspace or Pro plans (10 of 15). No SOC 2, ISO 27001 or HIPAA by the security page's own statement, no security.txt, reports to support email (5 of 20). 15+14+3+10+5 = 47.); WordPress 62 (Application Passwords are per application, revocable one at a time, sent only in the Authorization header and refused on plain HTTP outside a local environment. They have no scopes or expiry and carry every capability of their user, so we scored plain revocable keys plus 2 for role-based limits (22 of 30). A Contributor account can draft but not publish, deletes go to the Trash by default, and MCP abilities are private unless marked public. Nothing asks a person to approve a publish by a user who holds that capability (14 of 20). Posts and comments hold text written by other people, and no prompt-injection guidance was found in the REST handbook or the MCP Adapter docs (3 of 15). Revisions record author and date, and each password records its last use and IP. Core has no log of API calls (6 of 15). security.txt, re-read on 2 November 2026, is valid until 30 June 2027 and points reports to HackerOne. Some fixes are published with CVE and GHSA identifiers (CVE-2026-87902, CVE-2026-63030), many others only in release posts, and fixes are backported to 4.7. Certifications don't apply to self-hosted software (17 of 20).)
- Payments & pricing, WordPress +15: Cosmic 45 (No x402, MPP or L402 (0). Plan prices and quotas are public, with add-ons; no per-call price (10). Free plan with no card (20). Agent signup returns working bucket keys with no human signup; the human claims the project by emailed code within 14 days, so partial (15 of 20). 0+10+20+15 = 45.); WordPress 60 (Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses.)
- Reliability, Cosmic +12: Cosmic 90 (Graded on the hosted service with the hosted lines. Statuspage at cosmicstatus.com with API and Web Dashboard components (20). The history page shows no incidents in September, October or November 2026, and the newest incident in the feed is from 26 May 2025. The MCP server isn't a component, so 25 of 30. 100 requests a second with a burst of 200, timeouts and size limits are documented (15). 429 is documented and the error page says which codes to fix and not retry; no Retry-After guidance was found. Agent signup is idempotent (12 of 15). The security page says Enterprise has an SLA from 99.95 per cent uptime; the SLA page itself wasn't read (8 of 10). Hosted MCP is announced as available now, with no beta label (10). 20+25+15+12+8+10 = 90.); WordPress 78 (Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org, and the requirements page states PHP 7.4 and MySQL 5.5.5 as the legacy minimum, with PHP 8.3 and MySQL 8.0 or MariaDB 10.11 recommended (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop showed passing on trunk on 8 October 2026, per the 8 October check, not re-read on 2 November because github.com refuses our requests; the clone shows trunk commits through 1 November (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.4 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score.)
- Agent ergonomics, Cosmic +8: Cosmic 82 (24 tools, in the 11 to 30 band (15), plus 5 because omitting the write key gives a read-only subset (20 of 25). limit, props, depth, cursor pagination with `after`, status and locale filters (20). Status codes with specific messages and fix-or-retry guidance per code (17 of 20). readOnlyHint and destructiveHint on the MCP tools; no idempotency keys for writes, though agent signup is idempotent (14 of 20). Few required parameters, a TypeScript SDK and a CLI, no SDK in a second language found (11 of 15). 20+20+17+14+11 = 82.); WordPress 74 (`_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15).)
- Transparency & trust, WordPress +6: Cosmic 63 (A closed service; the MCP server is MIT (18 of 30). Terms and privacy policy of 13 January 2025 give general retention, and the security FAQ says data is kept indefinitely unless deletion is requested; storage in MongoDB Atlas is disclosed (15 of 30). Some fields are marked deprecated in v3 and the changelog is dated; no deprecation policy (8 of 20). The security page answers who the sub-processors are, but that answer wasn't readable in the page source (12 of 20). 18+15+8+12 = 53.); WordPress 69 (GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20).)