{ "data": { "a": { "slug": "datocms", "name": "DatoCMS", "vendor": "Dato Srl", "vendorUrl": "https://www.datocms.com", "kind": "http-api", "category": "cms", "summary": "DatoCMS is a hosted headless CMS from Dato Srl in Milan. Agents write records, assets, locales and schema through the REST Content Management API, the `datocms` CLI or a hosted MCP server, and read through a GraphQL Content Delivery API.", "url": "https://www.anchorterminal.com/tools/datocms", "markdownUrl": "https://www.anchorterminal.com/tools/datocms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/datocms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/datocms.json", "dns": "datocms.grade.anchorterminal.com", "repo": "https://github.com/datocms/js-rest-api-clients", "license": "Proprietary service under Dato Srl's terms of service. The API clients in datocms/js-rest-api-clients and the CLI in datocms/cli are MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://site-api.datocms.com", "packages": [ { "registry": "npm", "name": "@datocms/cma-client-node" }, { "registry": "npm", "name": "@datocms/cma-client" }, { "registry": "npm", "name": "datocms" } ], "auth": "mixed", "authNotes": "Self-serve. The Content Management API takes an API token as a Bearer header. A person creates the token in the project's settings and binds it to a role, which limits it by model, action and environment. Every project starts with a read-only token, and tokens can be rotated by API. The hosted MCP server uses browser OAuth through oauth.datocms.com with PKCE and dynamic client registration, where the person picks projects and one of three access levels. Accounts on single sign-on can't use the MCP server. No app review or sales approval is needed.", "pricing": "freemium", "pricingNotes": "The Free plan needs no card and includes 25,000 Content Management API calls a month, 300 records and three sandbox environments, with no overage. Professional is €199 a month, or €149 a month billed yearly, with 100,000 management API calls and €9 per extra 100,000. Enterprise is sold through sales. Prices are in euros only (https://www.datocms.com/pricing, checked 2026-10-08).", "priceSummary": "Freemium", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Content Management API docs, the MCP server docs or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 9, "popularity": { "githubStars": null, "npmWeekly": 140150, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://www.datocms.com/docs/content-management-api", "llmsTxt": "https://www.datocms.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.localisation", "cms.schema" ], "tags": [ "official", "hosted", "mcp", "oauth", "closed-source", "no-card", "free-tier", "llms-txt", "webhooks", "typescript", "cli", "graphql", "status-page", "iso27001" ], "lastRelease": "2026-10-01", "graded": true, "anchor": { "graded": true, "score": 74.4, "grade": "BB", "agentReady": true, "rank": 85, "ranked": true, "rankOf": 1486, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 78, "maintenance": 81, "payments": 35, "reliability": 80, "schema": 85, "security": 77, "transparency": 80 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "The Content Management API publishes a JSON Hyper-Schema for 202 operations, 100 documented error codes and rate-limit headers, and the hosted MCP server adds OAuth with three access levels. There are no idempotency keys, the only official client library is JavaScript, audit logs are Enterprise only, and prices are in euros with no machine payment route.", "bestFor": "Teams on DatoCMS who want an agent to create, translate and publish records, upload assets or change models, testing first in a sandbox environment.", "strengths": [ "Machine-readable JSON Hyper-Schema at `https://site-api.datocms.com/docs/site-api-hyperschema.json` covering 53 resources and 202 operations, with 656 examples", "Error bodies carry one of 100 documented codes, a `doc_url` and a `transient` flag, and 429 responses carry `x-ratelimit-reset`", "API tokens bind to custom roles by model, action and environment, and every project starts with a read-only token", "Hosted MCP server with OAuth (PKCE, dynamic client registration, revocation), per-project selection and a read-only level enforced at the network layer", "Free plan with no card, 25,000 Content Management API calls a month and three sandbox environments for testing changes away from the primary" ], "weaknesses": [ "No idempotency keys in the reviewed documentation. Safe retries rest on optimistic locking and the JavaScript client's automatic retry", "The only official client library is JavaScript and TypeScript. No Python, Go, PHP or Ruby client appears in the documentation index", "Audit logs are an Enterprise feature with a default retention of two months", "A database upgrade on 19 September 2026 put every project in read-only mode for about four hours, over an hour past its announced window", "The terms let Dato Srl modify or discontinue API access with or without notice, and free projects are suspended for the rest of the month at a quota limit" ], "agentNotes": [ "Send `X-Api-Version: 3` and `Accept: application/json` on every request, with `Content-Type: application/vnd.api+json` on writes", "Records are `items`, models are `item_types` and assets are `uploads` in every path and payload", "Save a record, then call the publish endpoint as a separate PUT. Send `meta.current_version` on updates and re-fetch on `STALE_ITEM_VERSION`", "Stay under 60 requests every 3 seconds. On 429 wait the seconds in `x-ratelimit-reset`, and retry any error whose body has `transient` set to true", "Fork a sandbox environment for schema changes and promote it when checked. Use `POST /items/validate` to test a payload without saving it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.4 } ], "editorialScores": { "ergonomics": 78, "maintenance": 81, "payments": 35, "reliability": 80, "schema": 85, "security": 77, "transparency": 65 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @datocms/cma-client-node", "http": "curl \\\n -H 'Authorization: Bearer \u003cYOUR-API-TOKEN\u003e' \\\n -H 'Accept: application/json' \\\n -H 'X-Api-Version: 3' \\\n https://site-api.datocms.com/site", "claudeCode": "claude mcp add --transport http DatoCMS https://mcp.datocms.com", "config": { "mcpServers": { "DatoCMS": { "type": "http", "url": "https://mcp.datocms.com" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/datocms" }, "area": "business", "provenance": { "legalEntity": "Dato Srl", "domain": "datocms.com", "domainRegistered": "2016-03-18", "endpointOnVendorDomain": true, "terms": "https://www.datocms.com/legal/terms", "privacy": "https://www.datocms.com/legal/privacy-policy", "statusPage": "https://status.datocms.com", "changelog": "https://www.datocms.com/product-updates", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The terms of service and the privacy policy name DATO SRL, Via U. Visconti di Modrone 2, 20122 Milano, Italy. The terms cover every plan except Enterprise, which has a separate agreement we did not find published.", "The Content Management API answers at site-api.datocms.com, the MCP server at mcp.datocms.com and the OAuth server at oauth.datocms.com.", "www.datocms.com/.well-known/security.txt gives security@datocms.com, a PGP key and the security policy page, and has no Expires field.", "The privacy policy carries no revision date in the Markdown copy we read. The GDPR page was last updated on 3 June 2026 and the security page on 2 September 2025.", "RDAP for datocms.com gives a registration date of 2016-03-18.", "The status page is the vendor's own, with a static mirror at status2.datocms.com and RSS, Atom and JSON history feeds. No data processing agreement was found on the legal pages." ], "score": 95 }, "requirements": { "setupChecked": true, "complianceChecked": true, "card": "no", "freeTier": true, "minutes": 5, "credential": "api-key", "hosting": [ "EU" ], "euResidency": "yes", "trainsOnData": "unknown", "zeroRetention": "no", "certifications": [ "ISO 27001", "GDPR" ], "selfHost": "no" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/datocms.json", "live": { "slug": "datocms", "probe": { "target": "https://site-api.datocms.com", "method": "get", "lastAt": "2026-11-07T18:20:20.159649825Z", "lastOk": true, "lastStatus": 404, "lastMs": 62, "authRequired": false, "uptime24h": 100, "uptime30d": 99.99, "p50ms24h": 62, "p95ms24h": 143, "samples24h": 239, "samples30d": 7420, "days": [ { "date": "2026-10-08", "probes": 50, "ok": 50 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 250 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.datocms.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:36.297876197Z" }, "versions": [ { "registry": "github", "name": "datocms/js-rest-api-clients", "version": "@datocms/rest-client-utils@6.10.1", "released": "2026-10-23", "seenAt": "2026-11-06T23:19:40.178439133Z" }, { "registry": "npm", "name": "@datocms/cma-client", "version": "6.8.0", "seenAt": "2026-11-06T23:19:36.194788127Z" }, { "registry": "npm", "name": "@datocms/cma-client-node", "version": "6.1.3", "seenAt": "2026-11-06T23:19:35.987800577Z" }, { "registry": "npm", "name": "datocms", "version": "4.2.0", "seenAt": "2026-11-06T23:19:38.437435285Z" } ], "githubStars": 12, "npmWeekly": 157292, "securityTxt": { "url": "https://datocms.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:40.163821122Z" }, "llmsTxt": { "url": "https://www.datocms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:14.474958296Z" }, "domain": { "domain": "datocms.com", "registered": "2016-03-18", "source": "https://rdap.verisign.com/com/v1/domain/datocms.com", "checkedAt": "2026-11-01T14:12:01.427477482Z" }, "pages": [ { "url": "https://www.datocms.com/product-updates", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:27:47.041321592Z", "changedAt": "2026-10-31T06:26:38.552266422Z", "fingerprint": "1d870ee03384" }, { "url": "https://www.datocms.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:27:43.511094098Z", "changedAt": "2026-11-05T13:11:31.026914526Z", "fingerprint": "18868554ac0b" }, { "url": "https://www.datocms.com/legal/privacy-policy", "kind": "privacy", "status": 0, "checkedAt": "2026-11-07T14:27:43.372241402Z", "changedAt": "0001-01-01T00:00:00Z", "blockedByRobots": true }, { "url": "https://www.datocms.com/legal/terms", "kind": "terms", "status": 0, "checkedAt": "2026-11-07T14:27:43.511075488Z", "changedAt": "0001-01-01T00:00:00Z", "blockedByRobots": true } ], "mcpTools": { "url": "https://mcp.datocms.com", "checkedAt": "2026-11-07T01:43:42.095325206Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:43:42.095325206Z" }, "github": { "repo": "datocms/js-rest-api-clients", "checkedAt": "2026-11-02T08:43:10.517173543Z", "stars": 12, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-26T10:34:10Z", "openIssues": 3, "openPRs": 4, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 11, "ci": { "branch": "main", "runs": 50, "success": 46, "failure": 4, "other": 0, "latest": "success", "latestAt": "2026-10-26T10:36:18Z" }, "replies": { "sampled": 14, "unanswered": 1, "medianDays": 0.4 } }, "updatedAt": "2026-11-07T18:20:20.159649825Z" } }, "answer": "DatoCMS scores 74.4 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.", "b": { "slug": "dotcms", "name": "dotCMS", "vendor": "dotCMS LLC", "vendorUrl": "https://www.dotcms.com", "kind": "mcp", "category": "cms", "summary": "dotCMS is an enterprise CMS with headless REST APIs, workflows and push publishing, run as dotCMS Cloud or self-hosted. Agents use the @dotcms/mcp-server package, which searches the instance's OpenAPI spec and runs API calls in a sandbox.", "url": "https://www.anchorterminal.com/tools/dotcms", "markdownUrl": "https://www.anchorterminal.com/tools/dotcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/dotcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/dotcms.json", "dns": "dotcms.grade.anchorterminal.com", "repo": "https://github.com/dotCMS/core", "license": "BUSL-1.1", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@dotcms/mcp-server" } ], "auth": "api-key", "authNotes": "The MCP server reads DOTCMS_URL and AUTH_TOKEN. API tokens are JWTs issued for a dotCMS user, carry that user's role permissions, take an expiry in days, and are created by administrators in the user manager or through /api/v1/authentication/api-token. The docs recommend a separate user and role per application; the MCP server needs write permission for content types, content and workflows. Tokens are injected outside the sandbox, so sandboxed code never sees them.", "pricing": "freemium", "pricingNotes": "dotCMS is free with every capability for companies under $5 million in revenue under its BSL licence, self-hosted. Cloud plans (Starter, Professional, Business, Enterprise) are priced on request, with monthly request and bandwidth allowances and SLAs of 99.5 to 99.9 per cent.", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP README, the dev docs or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 7, "popularity": { "githubStars": null, "npmWeekly": 43, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://dev.dotcms.com/docs/build/integrations/dotai/mcp-server", "llmsTxt": "https://dev.dotcms.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.schema", "cms.localisation" ], "tags": [ "official", "mcp", "stdio", "self-hosted", "hosted", "source-available", "llms-txt", "sales-led", "sla", "typescript" ], "lastRelease": "2026-09-02", "graded": true, "anchor": { "graded": true, "score": 57.7, "grade": "C", "agentReady": false, "rank": 780, "ranked": true, "rankOf": 1486, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.", "bestFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "strengths": [ "Seven tools in code mode, with the instance's OpenAPI spec searchable from the sandbox", "The API token stays outside the sandbox, which only receives results", "JWT tokens per user with role permissions and an expiry", "security.txt with PGP, a bounty-backed disclosure policy and LTS security backports", "Free with every capability for organisations under $5 million in revenue" ], "weaknesses": [ "Pre-1.0 package, with the dev docs still pointing at the beta tag", "The server needs a token with write permission for content types, content and workflows", "execute can call any endpoint, and no read-only mode or annotations were found", "Cloud prices are on request only", "Source-available under the BSL, not an OSI licence" ], "agentNotes": [ "Search the spec with `search` before writing an `execute` call, and return only the fields you need", "Use a token for a dedicated user and role, not an administrator's", "Confirm with the user before execute calls that publish, archive or delete content", "Keep results small with pick and first, since output is capped at about 25,000 characters", "Use download_assets for theme folders so files land on disk instead of in context" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.7 } ], "editorialScores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 51 }, "provenanceScore": 57, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @dotcms/mcp-server", "config": { "mcpServers": { "dotcms": { "args": [ "-y", "@dotcms/mcp-server" ], "command": "npx", "env": { "AUTH_TOKEN": "your-api-token", "DOTCMS_URL": "https://your-dotcms-instance.com" } } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/dotcms" }, "area": "business", "provenance": { "legalEntity": "dotCMS LLC", "domain": "dotcms.com", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://github.com/dotCMS/core/blob/main/LICENSE", "privacy": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "statusPage": "", "changelog": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "The MCP server runs locally and calls the customer's own dotCMS instance, so the endpoint isn't on a dotCMS domain.", "The privacy policy, last updated 8 September 2026, covers dotCMS's websites only and names dotCMS Holdings, LLC, dotCMS Services LLC and dotCMS LLC.", "www.dotcms.com/robots.txt disallows /docs/ and /utils/; dev.dotcms.com allows all with Content-Signal ai-train=yes, search=yes, ai-input=yes.", "www.dotcms.com/terms-of-service and /privacy-policy returned 404; no cloud terms of service were found, so the licence stands in for terms.", "No status page answered (status.dotcms.com refused the connection)." ], "score": 57 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/dotcms.json", "live": { "slug": "dotcms", "versions": [ { "registry": "github", "name": "dotCMS/core", "version": "dotcms-cli-26.11.06-03", "released": "2026-11-06", "seenAt": "2026-11-06T23:22:22.409374032Z" }, { "registry": "npm", "name": "@dotcms/mcp-server", "version": "0.1.1", "seenAt": "2026-11-06T23:22:21.577680774Z" } ], "githubStars": 971, "npmWeekly": 43, "securityTxt": { "url": "https://dotcms.com/.well-known/security.txt", "state": "valid", "expires": "2027-06-09T23:59:59.000Z", "checkedAt": "2026-11-07T16:00:46.289271049Z" }, "llmsTxt": { "url": "https://dev.dotcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:19.058875451Z" }, "pages": [ { "url": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:02:43.439634709Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "14706a7e3d20" }, { "url": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:02:39.904485204Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b8fe703d4258" }, { "url": "https://raw.githubusercontent.com/dotCMS/core/main/LICENSE", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:20:41.976083247Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dd3baa6b46f" } ], "updatedAt": "2026-11-07T16:00:46.289271049Z" } }, "edges": [ { "by": 33, "category": "reliability", "leads": "datocms", "name": "Reliability", "reasons": { "a": "Graded on the Content Management API, with the hosted MCP server noted. Public status page at status.datocms.com with the Content Management API as a named component and incident history back to 2023 (20). In the 90 days to 1 November 2026 the JSON history feed, re-read on 1 November, lists two email delivery faults (9 to 10 August, 27 to 28 September), a partial outage of the upstream image provider on 1 September, and a scheduled database upgrade on 19 September that kept every project read-only from 05:30 to about 09:43 UTC against a three-hour window, with writes returning 503. No unplanned API outage in the period and still no entry after 27 September, so 18 of 30. An API outage on 2 December 2025 falls outside the 90 days. Rate limit published as 60 requests every 3 seconds, re-read on 1 November (15). 429 responses carry `x-ratelimit-reset`, errors carry a `transient` flag and the official client retries both. No idempotency keys, though updates take optimistic locking (12). The pricing page lists guaranteed uptime SLAs on Enterprise with no figure (5). API version 3 is generally available. The MCP docs describe their limits as those of an initial beta phase (10).", "b": "Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47." }, "scores": { "a": 80, "b": 47 } }, { "by": 26, "category": "transparency", "leads": "datocms", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service with published terms for the Free and Professional plans, per the 8 October check, not re-read on 17 October or 1 November because www.datocms.com's robots.txt disallows /legal/ for every agent, and MIT clients and CLI. The Enterprise agreement isn't published (15). Per the same check, the privacy policy, a GDPR page updated on 3 June 2026 and the security page state EU hosting, 14 days of database backups and deletion of content within 4 days of termination. No data processing agreement was found on the legal pages (20). A written rule that breaking changes come only with a new API version, and one dated notice (30 days for legacy upload endpoints in 2025). The terms also reserve the right to modify or discontinue API access with or without notice (12). The GDPR page, per the 8 October check, lists 22 third-party services with the data each receives, and names AWS in Ireland, backups in France and Cloudflare R2 in the EU (18).", "b": "dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51." }, "scores": { "a": 80, "b": 54 } }, { "by": 20, "category": "schema", "leads": "datocms", "name": "Schema \u0026 documentation", "reasons": { "a": "A public JSON Hyper-Schema describes 53 resources and 202 operations. It is not OpenAPI, and the `.well-known/api-catalog` file links it (22 of 25). A root llms.txt, llms-full.txt and a Markdown copy of every docs page at the same URL plus .md (10). Every operation has a title, 43 of 202 have a description in the schema, and the docs say when to use the management API, the delivery API, the CLI skills or the MCP server (14). Inputs are typed with required fields and 72 enums. Record field values depend on each project's own models, checked by the validate endpoints (11). 656 examples in the schema and 100 error codes on one page, each with a recovery hint (15). `X-Api-Version` with a written rule that breaking changes come only with a new version, and a dated product changelog. The management API has no changelog of its own (13).", "b": "The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65." }, "scores": { "a": 85, "b": 65 } }, { "by": 14, "category": "security", "leads": "datocms", "name": "Security \u0026 auth", "reasons": { "a": "API tokens bound to custom roles, revocable and rotatable by API, sent only as a Bearer header. The MCP server uses OAuth with PKCE S256, dynamic client registration and revocation, with projects and one of three access levels chosen on the consent screen. The OAuth metadata lists three coarse scopes, per the 8 October check, not re-read since because oauth.datocms.com's robots.txt disallows every path (28). Every project starts with a read-only token, roles limit by model, action and environment, and the MCP read-only level is enforced by the runner and by the API through `X-Abort-If-Destructive-Request`. Read-write scripts ask the user to confirm (18). The MCP docs treat model-written code as untrusted, with restricted network egress, credential brokering and static checks. No guidance on treating stored content as untrusted input was found (11). Audit logs are Enterprise only with two months of retention by default. Record versions name the editor on every plan (8). ISO 27001, a security.txt with a PGP key and a disclosure address, re-read on 1 November and still without an Expires field. No bug bounty or SOC 2 report of its own found (12).", "b": "JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63." }, "scores": { "a": 77, "b": 63 } }, { "by": 10, "category": "ergonomics", "leads": "datocms", "name": "Agent ergonomics", "reasons": { "a": "List responses are sized with `page[limit]` and a `nested` switch for block content. No field selection was found on the management API. The MCP server names nine tools, and the vendor says its documentation tools are token intensive. The CLI's `schema:inspect` has an output format written for models (18 of 25). Offset pagination with `meta.total_count` and filters by ids, model, text and field values (20). Error bodies carry a stable code, a `doc_url` and a `transient` flag (20). No idempotency keys. Updates take optimistic locking through `meta.current_version`, `POST /items/validate` tests a payload without saving, and the MCP server splits read-only and read-write execution. We couldn't read the tool annotations (12). Every request needs the `X-Api-Version` header, and the only official client library is JavaScript and TypeScript (8).", "b": "7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68." }, "scores": { "a": 78, "b": 68 } }, { "by": 6, "category": "maintenance", "leads": "datocms", "name": "Maintenance \u0026 community", "reasons": { "a": "@datocms/cma-client 6.8.0 of 1 October 2026 is still the latest client tag on 1 November, and the product changelog's newest entry is dated the same day. The same repository tagged @datocms/dashboard-client 6.10.0 on 14 October and @datocms/rest-client-utils 6.10.1, the HTTP layer under the clients, on 23 October (30). Ten changelog entries from 24 August to 1 October and 37 client tags in the 90 days from 3 August, nine of them cma-client releases (20). Public changelog, a community forum, a Slack community and support by email. Per the 8 October check, not re-read since, the client repository had 14 issues in all, three open, the oldest from 2023 (11 of 15). Current official client and CLI. The official MCP registry still returned no DatoCMS entry on 1 November (13). The client and CLI repositories have CI and release workflows, and both had commits on 26 October. The CLI's last tags are from 31 August. We couldn't check that CI passes (7).", "b": "dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75." }, "scores": { "a": 81, "b": 75 } } ], "facts": [ { "a": "HTTP API", "b": "MCP server", "name": "Kind" }, { "a": "Dato Srl", "b": "dotCMS LLC", "name": "Vendor" }, { "a": "https://site-api.datocms.com", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "stdio", "name": "Transports" }, { "a": "OAuth or key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under Dato Srl's terms of service. The API clients in datocms/js-rest-api-clients and the CLI in datocms/cli are MIT", "b": "BUSL-1.1", "name": "Licence" }, { "a": "9", "b": "7", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-01", "b": "2026-09-02", "name": "Last release" }, { "a": "couldn't be read", "b": "no date given", "name": "Terms last updated" }, { "a": "couldn't be read", "b": "2026-09-08", "name": "Privacy policy last updated" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "140k npm/wk", "b": "43 npm/wk", "name": "Popularity" }, { "a": "3.5/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "DatoCMS scores 74.4 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, DatoCMS or dotCMS?" }, { "answer": "DatoCMS takes an API key or an OAuth sign-in. dotCMS needs an API key.", "question": "Do DatoCMS and dotCMS need an API key?" }, { "answer": "DatoCMS has a hosted endpoint at https://site-api.datocms.com. dotCMS runs on your own machine, with no hosted endpoint listed.", "question": "Can an agent call DatoCMS and dotCMS without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 80 against 47", "Schema \u0026 documentation, 85 against 65", "Agent ergonomics, 78 against 68", "Security \u0026 auth, 77 against 63", "Maintenance \u0026 community, 81 against 75", "Transparency \u0026 trust, 80 against 54" ], "also": [ "Agent-ready, a grade of BB or better", "A hosted endpoint, with nothing to install", "Free to start without a card" ], "goodFor": "Teams on DatoCMS who want an agent to create, translate and publish records, upload assets or change models, testing first in a sandbox environment.", "slug": "datocms", "watchFor": "No idempotency keys in the reviewed documentation. Safe retries rest on optimistic locking and the JavaScript client's automatic retry" }, { "aheadOn": null, "also": [ "Runs on your own machine" ], "goodFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "slug": "dotcms", "watchFor": "Pre-1.0 package, with the dev docs still pointing at the beta tag" } ], "history": null, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-datocms.json", "title": "BCMS vs DatoCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-datocms.json", "title": "ButterCMS vs DatoCMS", "url": "https://www.anchorterminal.com/compare/buttercms-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms.json", "title": "ButterCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-datocms.json", "title": "Contentstack vs DatoCMS", "url": "https://www.anchorterminal.com/compare/contentstack-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms.json", "title": "Contentstack vs dotCMS", "url": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-datocms.json", "title": "Cosmic vs DatoCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-datocms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-directus.json", "title": "DatoCMS vs Directus", "url": "https://www.anchorterminal.com/compare/datocms-vs-directus" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-ghost.json", "title": "DatoCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/datocms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-hygraph.json", "title": "DatoCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/datocms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-kontent-ai.json", "title": "DatoCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/datocms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-payload.json", "title": "DatoCMS vs Payload", "url": "https://www.anchorterminal.com/compare/datocms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-prismic.json", "title": "DatoCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/datocms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-sanity.json", "title": "DatoCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/datocms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-storyblok.json", "title": "DatoCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/datocms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-strapi.json", "title": "DatoCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/datocms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-webflow.json", "title": "DatoCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/datocms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-wordpress.json", "title": "DatoCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/datocms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-dotcms.json", "title": "Directus vs dotCMS", "url": "https://www.anchorterminal.com/compare/directus-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-ghost.json", "title": "dotCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/dotcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph.json", "title": "dotCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.json", "title": "dotCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-payload.json", "title": "dotCMS vs Payload", "url": "https://www.anchorterminal.com/compare/dotcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-prismic.json", "title": "dotCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/dotcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-sanity.json", "title": "dotCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/dotcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok.json", "title": "dotCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-strapi.json", "title": "dotCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/dotcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-webflow.json", "title": "dotCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/dotcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress.json", "title": "dotCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress" } ], "panel": null, "scores": [ { "by": 33, "datocms": 80, "dotcms": 47, "edge": "datocms", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 20, "datocms": 85, "dotcms": 65, "edge": "datocms", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 10, "datocms": 78, "dotcms": 68, "edge": "datocms", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 14, "datocms": 77, "dotcms": 63, "edge": "datocms", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 0, "datocms": 35, "dotcms": 35, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 6, "datocms": 81, "dotcms": 75, "edge": "datocms", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 26, "datocms": 80, "dotcms": 54, "edge": "datocms", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "DatoCMS scores 74.4 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "datocms": "The Content Management API publishes a JSON Hyper-Schema for 202 operations, 100 documented error codes and rate-limit headers, and the hosted MCP server adds OAuth with three access levels. There are no idempotency keys, the only official client library is JavaScript, audit logs are Enterprise only, and prices are in euros with no machine payment route.", "dotcms": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/datocms-vs-dotcms", "json": "https://www.anchorterminal.com/compare/datocms-vs-dotcms.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/datocms-vs-dotcms.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/datocms-vs-dotcms.min.md" }, "markdown": "DatoCMS scores 74.4 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. Both do content management.\n\n- DatoCMS: grade BB, 74.4/100, rank #85 of 1486. Markdown https://www.anchorterminal.com/tools/datocms.md · JSON https://www.anchorterminal.com/api/v1/tools/datocms.json\n- dotCMS: grade C, 57.7/100, rank #780 of 1486. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### DatoCMS (BB)\n\nGood for: Teams on DatoCMS who want an agent to create, translate and publish records, upload assets or change models, testing first in a sandbox environment.\n\nAhead on:\n- Reliability, 80 against 47\n- Schema \u0026 documentation, 85 against 65\n- Agent ergonomics, 78 against 68\n- Security \u0026 auth, 77 against 63\n- Maintenance \u0026 community, 81 against 75\n- Transparency \u0026 trust, 80 against 54\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n\nWatch for: No idempotency keys in the reviewed documentation. Safe retries rest on optimistic locking and the JavaScript client's automatic retry\n\n### dotCMS (C)\n\nGood for: Enterprises already on dotCMS who want an agent to manage content and pages.\n\nAlso in its favour:\n- Runs on your own machine\n\nWatch for: Pre-1.0 package, with the dev docs still pointing at the beta tag\n\n\n## Why the edge\n\n### Reliability: DatoCMS +33\n\n- DatoCMS (80): Graded on the Content Management API, with the hosted MCP server noted. Public status page at status.datocms.com with the Content Management API as a named component and incident history back to 2023 (20). In the 90 days to 1 November 2026 the JSON history feed, re-read on 1 November, lists two email delivery faults (9 to 10 August, 27 to 28 September), a partial outage of the upstream image provider on 1 September, and a scheduled database upgrade on 19 September that kept every project read-only from 05:30 to about 09:43 UTC against a three-hour window, with writes returning 503. No unplanned API outage in the period and still no entry after 27 September, so 18 of 30. An API outage on 2 December 2025 falls outside the 90 days. Rate limit published as 60 requests every 3 seconds, re-read on 1 November (15). 429 responses carry `x-ratelimit-reset`, errors carry a `transient` flag and the official client retries both. No idempotency keys, though updates take optimistic locking (12). The pricing page lists guaranteed uptime SLAs on Enterprise with no figure (5). API version 3 is generally available. The MCP docs describe their limits as those of an initial beta phase (10).\n- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.\n\n### Transparency \u0026 trust: DatoCMS +26\n\n- DatoCMS (80): Closed service with published terms for the Free and Professional plans, per the 8 October check, not re-read on 17 October or 1 November because www.datocms.com's robots.txt disallows /legal/ for every agent, and MIT clients and CLI. The Enterprise agreement isn't published (15). Per the same check, the privacy policy, a GDPR page updated on 3 June 2026 and the security page state EU hosting, 14 days of database backups and deletion of content within 4 days of termination. No data processing agreement was found on the legal pages (20). A written rule that breaking changes come only with a new API version, and one dated notice (30 days for legacy upload endpoints in 2025). The terms also reserve the right to modify or discontinue API access with or without notice (12). The GDPR page, per the 8 October check, lists 22 third-party services with the data each receives, and names AWS in Ireland, backups in France and Cloudflare R2 in the EU (18).\n- dotCMS (54): dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.\n\n### Schema \u0026 documentation: DatoCMS +20\n\n- DatoCMS (85): A public JSON Hyper-Schema describes 53 resources and 202 operations. It is not OpenAPI, and the `.well-known/api-catalog` file links it (22 of 25). A root llms.txt, llms-full.txt and a Markdown copy of every docs page at the same URL plus .md (10). Every operation has a title, 43 of 202 have a description in the schema, and the docs say when to use the management API, the delivery API, the CLI skills or the MCP server (14). Inputs are typed with required fields and 72 enums. Record field values depend on each project's own models, checked by the validate endpoints (11). 656 examples in the schema and 100 error codes on one page, each with a recovery hint (15). `X-Api-Version` with a written rule that breaking changes come only with a new version, and a dated product changelog. The management API has no changelog of its own (13).\n- dotCMS (65): The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.\n\n### Security \u0026 auth: DatoCMS +14\n\n- DatoCMS (77): API tokens bound to custom roles, revocable and rotatable by API, sent only as a Bearer header. The MCP server uses OAuth with PKCE S256, dynamic client registration and revocation, with projects and one of three access levels chosen on the consent screen. The OAuth metadata lists three coarse scopes, per the 8 October check, not re-read since because oauth.datocms.com's robots.txt disallows every path (28). Every project starts with a read-only token, roles limit by model, action and environment, and the MCP read-only level is enforced by the runner and by the API through `X-Abort-If-Destructive-Request`. Read-write scripts ask the user to confirm (18). The MCP docs treat model-written code as untrusted, with restricted network egress, credential brokering and static checks. No guidance on treating stored content as untrusted input was found (11). Audit logs are Enterprise only with two months of retention by default. Record versions name the editor on every plan (8). ISO 27001, a security.txt with a PGP key and a disclosure address, re-read on 1 November and still without an Expires field. No bug bounty or SOC 2 report of its own found (12).\n- dotCMS (63): JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.\n\n### Agent ergonomics: DatoCMS +10\n\n- DatoCMS (78): List responses are sized with `page[limit]` and a `nested` switch for block content. No field selection was found on the management API. The MCP server names nine tools, and the vendor says its documentation tools are token intensive. The CLI's `schema:inspect` has an output format written for models (18 of 25). Offset pagination with `meta.total_count` and filters by ids, model, text and field values (20). Error bodies carry a stable code, a `doc_url` and a `transient` flag (20). No idempotency keys. Updates take optimistic locking through `meta.current_version`, `POST /items/validate` tests a payload without saving, and the MCP server splits read-only and read-write execution. We couldn't read the tool annotations (12). Every request needs the `X-Api-Version` header, and the only official client library is JavaScript and TypeScript (8).\n- dotCMS (68): 7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.\n\n### Maintenance \u0026 community: DatoCMS +6\n\n- DatoCMS (81): @datocms/cma-client 6.8.0 of 1 October 2026 is still the latest client tag on 1 November, and the product changelog's newest entry is dated the same day. The same repository tagged @datocms/dashboard-client 6.10.0 on 14 October and @datocms/rest-client-utils 6.10.1, the HTTP layer under the clients, on 23 October (30). Ten changelog entries from 24 August to 1 October and 37 client tags in the 90 days from 3 August, nine of them cma-client releases (20). Public changelog, a community forum, a Slack community and support by email. Per the 8 October check, not re-read since, the client repository had 14 issues in all, three open, the oldest from 2023 (11 of 15). Current official client and CLI. The official MCP registry still returned no DatoCMS entry on 1 November (13). The client and CLI repositories have CI and release workflows, and both had commits on 26 October. The CLI's last tags are from 31 August. We couldn't check that CI passes (7).\n- dotCMS (75): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.\n\n## Score by category\n\n| Category | Weight | DatoCMS | dotCMS | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 80 | 47 | DatoCMS +33 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 65 | DatoCMS +20 |\n| Agent ergonomics | 13% (16.2 this run) | 78 | 68 | DatoCMS +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 77 | 63 | DatoCMS +14 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 35 | 35 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 81 | 75 | DatoCMS +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 80 | 54 | DatoCMS +26 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **74.4 · BB** | **57.7 · C** | |\n\n## Facts side by side\n\n| Fact | DatoCMS | dotCMS |\n| --- | --- | --- |\n| Kind | HTTP API | MCP server |\n| Vendor | Dato Srl | dotCMS LLC |\n| Hosted endpoint | `https://site-api.datocms.com` | no (local only) |\n| Transports | HTTP, Streamable HTTP | stdio |\n| Auth | OAuth or key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service under Dato Srl's terms of service. The API clients in datocms/js-rest-api-clients and the CLI in datocms/cli are MIT | BUSL-1.1 |\n| Tools exposed | 9 | 7 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-01 | 2026-09-02 |\n| Terms last updated | couldn't be read | no date given |\n| Privacy policy last updated | couldn't be read | 2026-09-08 |\n| Customer content may train models | couldn't be read | not found in the text |\n| Terms restrict automated access | couldn't be read | not found in the text |\n| Terms restrict benchmarking | couldn't be read | not found in the text |\n| Terms or service can change without notice | couldn't be read | not found in the text |\n| Arbitration or class-action waiver | couldn't be read | not found in the text |\n| Popularity | 140k npm/wk | 43 npm/wk |\n| Agent reviews | 3.5/5 (4) | none |\n\n## Verdicts\n\n**DatoCMS.** The Content Management API publishes a JSON Hyper-Schema for 202 operations, 100 documented error codes and rate-limit headers, and the hosted MCP server adds OAuth with three access levels. There are no idempotency keys, the only official client library is JavaScript, audit logs are Enterprise only, and prices are in euros with no machine payment route.\n\n**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.\n\n## Before you call either\n\n### DatoCMS\n\n1. Send `X-Api-Version: 3` and `Accept: application/json` on every request, with `Content-Type: application/vnd.api+json` on writes\n2. Records are `items`, models are `item_types` and assets are `uploads` in every path and payload\n3. Save a record, then call the publish endpoint as a separate PUT. Send `meta.current_version` on updates and re-fetch on `STALE_ITEM_VERSION`\n4. Stay under 60 requests every 3 seconds. On 429 wait the seconds in `x-ratelimit-reset`, and retry any error whose body has `transient` set to true\n5. Fork a sandbox environment for schema changes and promote it when checked. Use `POST /items/validate` to test a payload without saving it\n\n### dotCMS\n\n1. Search the spec with `search` before writing an `execute` call, and return only the fields you need\n2. Use a token for a dedicated user and role, not an administrator's\n3. Confirm with the user before execute calls that publish, archive or delete content\n4. Keep results small with pick and first, since output is capped at about 25,000 characters\n5. Use download_assets for theme folders so files land on disk instead of in context\n\n## Questions\n\n### Which is better for AI agents, DatoCMS or dotCMS?\n\nDatoCMS scores 74.4 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.\n\n### Do DatoCMS and dotCMS need an API key?\n\nDatoCMS takes an API key or an OAuth sign-in. dotCMS needs an API key.\n\n### Can an agent call DatoCMS and dotCMS without installing anything?\n\nDatoCMS has a hosted endpoint at https://site-api.datocms.com. dotCMS runs on your own machine, with no hosted endpoint listed.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/datocms-vs-dotcms.json, and with the fewest tokens: https://www.anchorterminal.com/compare/datocms-vs-dotcms.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"datocms\", \"b\": \"dotcms\"}`. From a terminal: `anchor compare datocms dotcms`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/datocms.json and https://www.anchorterminal.com/api/v1/tools/dotcms.json\n\n## Other comparisons with DatoCMS or dotCMS\n\n- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [ButterCMS vs DatoCMS](https://www.anchorterminal.com/compare/buttercms-vs-datocms.md)\n- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)\n- [Contentstack vs DatoCMS](https://www.anchorterminal.com/compare/contentstack-vs-datocms.md)\n- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)\n- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [DatoCMS vs Directus](https://www.anchorterminal.com/compare/datocms-vs-directus.md)\n- [DatoCMS vs Ghost](https://www.anchorterminal.com/compare/datocms-vs-ghost.md)\n- [DatoCMS vs Hygraph](https://www.anchorterminal.com/compare/datocms-vs-hygraph.md)\n- [DatoCMS vs Kontent.ai](https://www.anchorterminal.com/compare/datocms-vs-kontent-ai.md)\n- [DatoCMS vs Payload](https://www.anchorterminal.com/compare/datocms-vs-payload.md)\n- [DatoCMS vs Prismic](https://www.anchorterminal.com/compare/datocms-vs-prismic.md)\n- [DatoCMS vs Sanity](https://www.anchorterminal.com/compare/datocms-vs-sanity.md)\n- [DatoCMS vs Storyblok](https://www.anchorterminal.com/compare/datocms-vs-storyblok.md)\n- [DatoCMS vs Strapi](https://www.anchorterminal.com/compare/datocms-vs-strapi.md)\n- [DatoCMS vs Webflow](https://www.anchorterminal.com/compare/datocms-vs-webflow.md)\n- [DatoCMS vs WordPress](https://www.anchorterminal.com/compare/datocms-vs-wordpress.md)\n- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)\n- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)\n- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)\n- [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md)\n- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)\n- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)\n- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)\n- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)\n- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)\n- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)\n- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "DatoCMS vs dotCMS", "url": "" } ], "description": "DatoCMS scores 74.4 (BB) to dotCMS's 57.7 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "DatoCMS BB 74.4", "dotCMS C 57.7", "scores" ], "h1": "DatoCMS vs dotCMS", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/datocms-vs-dotcms", "published": "2026-10-01", "section": "tools", "title": "DatoCMS vs dotCMS for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/datocms-vs-dotcms" }, "tokens": { "markdown": 4850, "slim": 3130 }, "version": 1 }