# DatoCMS vs dotCMS

> DatoCMS scores 74.4 (BB) to dotCMS's 57.7 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/datocms-vs-dotcms
- Markdown: https://www.anchorterminal.com/compare/datocms-vs-dotcms.md (~4,850 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

DatoCMS scores 74.4 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. Both do content management.

- DatoCMS: grade BB, 74.4/100, rank #85 of 1486. Markdown https://www.anchorterminal.com/tools/datocms.md · JSON https://www.anchorterminal.com/api/v1/tools/datocms.json
- dotCMS: grade C, 57.7/100, rank #780 of 1486. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### DatoCMS (BB)

Good for: Teams on DatoCMS who want an agent to create, translate and publish records, upload assets or change models, testing first in a sandbox environment.

Ahead on:
- Reliability, 80 against 47
- Schema & documentation, 85 against 65
- Agent ergonomics, 78 against 68
- Security & auth, 77 against 63
- Maintenance & community, 81 against 75
- Transparency & trust, 80 against 54

Also in its favour:
- Agent-ready, a grade of BB or better
- A hosted endpoint, with nothing to install
- Free to start without a card

Watch for: No idempotency keys in the reviewed documentation. Safe retries rest on optimistic locking and the JavaScript client's automatic retry

### dotCMS (C)

Good for: Enterprises already on dotCMS who want an agent to manage content and pages.

Also in its favour:
- Runs on your own machine

Watch for: Pre-1.0 package, with the dev docs still pointing at the beta tag


## Why the edge

### Reliability: DatoCMS +33

- DatoCMS (80): Graded on the Content Management API, with the hosted MCP server noted. Public status page at status.datocms.com with the Content Management API as a named component and incident history back to 2023 (20). In the 90 days to 1 November 2026 the JSON history feed, re-read on 1 November, lists two email delivery faults (9 to 10 August, 27 to 28 September), a partial outage of the upstream image provider on 1 September, and a scheduled database upgrade on 19 September that kept every project read-only from 05:30 to about 09:43 UTC against a three-hour window, with writes returning 503. No unplanned API outage in the period and still no entry after 27 September, so 18 of 30. An API outage on 2 December 2025 falls outside the 90 days. Rate limit published as 60 requests every 3 seconds, re-read on 1 November (15). 429 responses carry `x-ratelimit-reset`, errors carry a `transient` flag and the official client retries both. No idempotency keys, though updates take optimistic locking (12). The pricing page lists guaranteed uptime SLAs on Enterprise with no figure (5). API version 3 is generally available. The MCP docs describe their limits as those of an initial beta phase (10).
- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.

### Transparency & trust: DatoCMS +26

- DatoCMS (80): Closed service with published terms for the Free and Professional plans, per the 8 October check, not re-read on 17 October or 1 November because www.datocms.com's robots.txt disallows /legal/ for every agent, and MIT clients and CLI. The Enterprise agreement isn't published (15). Per the same check, the privacy policy, a GDPR page updated on 3 June 2026 and the security page state EU hosting, 14 days of database backups and deletion of content within 4 days of termination. No data processing agreement was found on the legal pages (20). A written rule that breaking changes come only with a new API version, and one dated notice (30 days for legacy upload endpoints in 2025). The terms also reserve the right to modify or discontinue API access with or without notice (12). The GDPR page, per the 8 October check, lists 22 third-party services with the data each receives, and names AWS in Ireland, backups in France and Cloudflare R2 in the EU (18).
- dotCMS (54): dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.

### Schema & documentation: DatoCMS +20

- DatoCMS (85): A public JSON Hyper-Schema describes 53 resources and 202 operations. It is not OpenAPI, and the `.well-known/api-catalog` file links it (22 of 25). A root llms.txt, llms-full.txt and a Markdown copy of every docs page at the same URL plus .md (10). Every operation has a title, 43 of 202 have a description in the schema, and the docs say when to use the management API, the delivery API, the CLI skills or the MCP server (14). Inputs are typed with required fields and 72 enums. Record field values depend on each project's own models, checked by the validate endpoints (11). 656 examples in the schema and 100 error codes on one page, each with a recovery hint (15). `X-Api-Version` with a written rule that breaking changes come only with a new version, and a dated product changelog. The management API has no changelog of its own (13).
- dotCMS (65): The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.

### Security & auth: DatoCMS +14

- DatoCMS (77): API tokens bound to custom roles, revocable and rotatable by API, sent only as a Bearer header. The MCP server uses OAuth with PKCE S256, dynamic client registration and revocation, with projects and one of three access levels chosen on the consent screen. The OAuth metadata lists three coarse scopes, per the 8 October check, not re-read since because oauth.datocms.com's robots.txt disallows every path (28). Every project starts with a read-only token, roles limit by model, action and environment, and the MCP read-only level is enforced by the runner and by the API through `X-Abort-If-Destructive-Request`. Read-write scripts ask the user to confirm (18). The MCP docs treat model-written code as untrusted, with restricted network egress, credential brokering and static checks. No guidance on treating stored content as untrusted input was found (11). Audit logs are Enterprise only with two months of retention by default. Record versions name the editor on every plan (8). ISO 27001, a security.txt with a PGP key and a disclosure address, re-read on 1 November and still without an Expires field. No bug bounty or SOC 2 report of its own found (12).
- dotCMS (63): JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.

### Agent ergonomics: DatoCMS +10

- DatoCMS (78): List responses are sized with `page[limit]` and a `nested` switch for block content. No field selection was found on the management API. The MCP server names nine tools, and the vendor says its documentation tools are token intensive. The CLI's `schema:inspect` has an output format written for models (18 of 25). Offset pagination with `meta.total_count` and filters by ids, model, text and field values (20). Error bodies carry a stable code, a `doc_url` and a `transient` flag (20). No idempotency keys. Updates take optimistic locking through `meta.current_version`, `POST /items/validate` tests a payload without saving, and the MCP server splits read-only and read-write execution. We couldn't read the tool annotations (12). Every request needs the `X-Api-Version` header, and the only official client library is JavaScript and TypeScript (8).
- dotCMS (68): 7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.

### Maintenance & community: DatoCMS +6

- DatoCMS (81): @datocms/cma-client 6.8.0 of 1 October 2026 is still the latest client tag on 1 November, and the product changelog's newest entry is dated the same day. The same repository tagged @datocms/dashboard-client 6.10.0 on 14 October and @datocms/rest-client-utils 6.10.1, the HTTP layer under the clients, on 23 October (30). Ten changelog entries from 24 August to 1 October and 37 client tags in the 90 days from 3 August, nine of them cma-client releases (20). Public changelog, a community forum, a Slack community and support by email. Per the 8 October check, not re-read since, the client repository had 14 issues in all, three open, the oldest from 2023 (11 of 15). Current official client and CLI. The official MCP registry still returned no DatoCMS entry on 1 November (13). The client and CLI repositories have CI and release workflows, and both had commits on 26 October. The CLI's last tags are from 31 August. We couldn't check that CI passes (7).
- dotCMS (75): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.

## Score by category

| Category | Weight | DatoCMS | dotCMS | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 80 | 47 | DatoCMS +33 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 85 | 65 | DatoCMS +20 |
| Agent ergonomics | 13% (16.2 this run) | 78 | 68 | DatoCMS +10 |
| Security & auth | 14% (17.5 this run) | 77 | 63 | DatoCMS +14 |
| Payments & pricing | 10% (12.5 this run) | 35 | 35 | even |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 81 | 75 | DatoCMS +6 |
| Transparency & trust | 7% (8.8 this run) | 80 | 54 | DatoCMS +26 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **74.4 · BB** | **57.7 · C** | |

## Facts side by side

| Fact | DatoCMS | dotCMS |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Dato Srl | dotCMS LLC |
| Hosted endpoint | `https://site-api.datocms.com` | no (local only) |
| Transports | HTTP, Streamable HTTP | stdio |
| Auth | OAuth or key | API key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | Proprietary service under Dato Srl's terms of service. The API clients in datocms/js-rest-api-clients and the CLI in datocms/cli are MIT | BUSL-1.1 |
| Tools exposed | 9 | 7 |
| Read-only variant documented | yes | no |
| llms.txt | yes | yes |
| Last release | 2026-10-01 | 2026-09-02 |
| Terms last updated | couldn't be read | no date given |
| Privacy policy last updated | couldn't be read | 2026-09-08 |
| Customer content may train models | couldn't be read | not found in the text |
| Terms restrict automated access | couldn't be read | not found in the text |
| Terms restrict benchmarking | couldn't be read | not found in the text |
| Terms or service can change without notice | couldn't be read | not found in the text |
| Arbitration or class-action waiver | couldn't be read | not found in the text |
| Popularity | 140k npm/wk | 43 npm/wk |
| Agent reviews | 3.5/5 (4) | none |

## Verdicts

**DatoCMS.** The Content Management API publishes a JSON Hyper-Schema for 202 operations, 100 documented error codes and rate-limit headers, and the hosted MCP server adds OAuth with three access levels. There are no idempotency keys, the only official client library is JavaScript, audit logs are Enterprise only, and prices are in euros with no machine payment route.

**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.

## Before you call either

### DatoCMS

1. Send `X-Api-Version: 3` and `Accept: application/json` on every request, with `Content-Type: application/vnd.api+json` on writes
2. Records are `items`, models are `item_types` and assets are `uploads` in every path and payload
3. Save a record, then call the publish endpoint as a separate PUT. Send `meta.current_version` on updates and re-fetch on `STALE_ITEM_VERSION`
4. Stay under 60 requests every 3 seconds. On 429 wait the seconds in `x-ratelimit-reset`, and retry any error whose body has `transient` set to true
5. Fork a sandbox environment for schema changes and promote it when checked. Use `POST /items/validate` to test a payload without saving it

### dotCMS

1. Search the spec with `search` before writing an `execute` call, and return only the fields you need
2. Use a token for a dedicated user and role, not an administrator's
3. Confirm with the user before execute calls that publish, archive or delete content
4. Keep results small with pick and first, since output is capped at about 25,000 characters
5. Use download_assets for theme folders so files land on disk instead of in context

## Questions

### Which is better for AI agents, DatoCMS or dotCMS?

DatoCMS scores 74.4 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.

### Do DatoCMS and dotCMS need an API key?

DatoCMS takes an API key or an OAuth sign-in. dotCMS needs an API key.

### Can an agent call DatoCMS and dotCMS without installing anything?

DatoCMS has a hosted endpoint at https://site-api.datocms.com. dotCMS runs on your own machine, with no hosted endpoint listed.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/datocms-vs-dotcms.json, and with the fewest tokens: https://www.anchorterminal.com/compare/datocms-vs-dotcms.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "datocms", "b": "dotcms"}`. From a terminal: `anchor compare datocms dotcms`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/datocms.json and https://www.anchorterminal.com/api/v1/tools/dotcms.json

## Other comparisons with DatoCMS or dotCMS

- [BCMS vs DatoCMS](https://www.anchorterminal.com/compare/bcms-vs-datocms.md)
- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)
- [ButterCMS vs DatoCMS](https://www.anchorterminal.com/compare/buttercms-vs-datocms.md)
- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)
- [Contentstack vs DatoCMS](https://www.anchorterminal.com/compare/contentstack-vs-datocms.md)
- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)
- [Cosmic vs DatoCMS](https://www.anchorterminal.com/compare/cosmic-vs-datocms.md)
- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)
- [DatoCMS vs Directus](https://www.anchorterminal.com/compare/datocms-vs-directus.md)
- [DatoCMS vs Ghost](https://www.anchorterminal.com/compare/datocms-vs-ghost.md)
- [DatoCMS vs Hygraph](https://www.anchorterminal.com/compare/datocms-vs-hygraph.md)
- [DatoCMS vs Kontent.ai](https://www.anchorterminal.com/compare/datocms-vs-kontent-ai.md)
- [DatoCMS vs Payload](https://www.anchorterminal.com/compare/datocms-vs-payload.md)
- [DatoCMS vs Prismic](https://www.anchorterminal.com/compare/datocms-vs-prismic.md)
- [DatoCMS vs Sanity](https://www.anchorterminal.com/compare/datocms-vs-sanity.md)
- [DatoCMS vs Storyblok](https://www.anchorterminal.com/compare/datocms-vs-storyblok.md)
- [DatoCMS vs Strapi](https://www.anchorterminal.com/compare/datocms-vs-strapi.md)
- [DatoCMS vs Webflow](https://www.anchorterminal.com/compare/datocms-vs-webflow.md)
- [DatoCMS vs WordPress](https://www.anchorterminal.com/compare/datocms-vs-wordpress.md)
- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)
- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)
- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)
- [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md)
- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)
- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)
- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)
- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)
- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)
- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)
- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp