Get an audit

Head to head · Cms content · October 2026 research run

Directus vs Payload

Directus scores 67.1 (B) on agent readiness against Payload's 55.2 (C), and leads in 6 of 7 scored categories. Both do cms content.

DirectusMonospace Inc. (Directus) · HTTP API B67.1/100#217 of 722 PayloadPayload CMS, Inc. (Figma) · HTTP API C55.2/100#516 of 722

Which one, for what

Directus B

Good for Teams that already keep content in an SQL database and want an agent to edit items, files and the data model under a named user's permissions.

Ahead on

  • Schema & documentation, 81 against 70
  • Agent ergonomics, 73 against 64
  • Security & auth, 68 against 57
  • Payments & pricing, 55 against 45
  • Maintenance & community, 86 against 78

Watch for

Version 12 (10 June 2026) added licence enforcement. The free Core tier allows 3 Studio seats, 25 collections and 5 flows, and an instance over its limits is locked after a grace period

Payload C

Good for Teams that build on Next.js and want the content model in TypeScript, with drafts, versions and localisation in the free core.

Also in its favour

  • Open source

Watch for

49 security advisories in the 12 months to 8 October 2026, 8 critical, 38 of them published since 18 September 2026

Score by category

CategoryWeight this runDirectusPayloadEdge
Reliability16%208278Directus +4
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.28170Directus +11
Agent ergonomics13%16.27364Directus +9
Security & auth14%17.56857Directus +11
Payments & pricing10%12.55545Directus +10
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.88678Directus +8
Transparency & trust7%8.86162Payload +1
Negative events≤15-6-10
Total67.1 · B55.2 · C

Facts side by side

FactDirectusPayload
KindHTTP APIHTTP API
VendorMonospace Inc. (Directus)Payload CMS, Inc. (Figma)
Hosted endpointno (local only)no (local only)
TransportsHTTP, Streamable HTTPHTTP, Streamable HTTP
AuthOAuth or keyAPI key
PricingFreemiumFree
x402nono
LicenceMSCL-1.0-GPL (Monospace Sustainable Core Licence 1.0), source-available with a licence key for paid tiers, each version converting to GPL-3.0 after four years. @directus/sdk is MITMIT for the core and the official packages. Enterprise add-ons are sold separately through sales
Tools exposed12none
Read-only variant documentednono
llms.txtyesyes
Last release2026-10-072026-09-23
Terms last updatedno date givenno document linked
Privacy policy last updated2026-06-092024-03-28
Customer content may train modelsnot found in the text
Terms restrict automated accessnot found in the text
Terms restrict benchmarkingyes
Terms or service can change without noticenot found in the text
Arbitration or class-action waivernot found in the text
Popularity38k stars, 23k npm/wk45k stars, 1.1M npm/wk

Verdicts

Directus

The built-in MCP server works under the connecting user's permissions, supports OAuth limited to the MCP endpoint and blocks deletes unless an administrator allows them. Since version 12 a licence check caps the free Core tier at 3 Studio seats, 25 collections and 5 flows, and the default tool list carries about 79 KB of instructions.

Payload

Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. The vendor published 49 advisories in 12 months, 8 of them critical, so an install older than 3.90.0 is exposed. No OpenAPI file is published.

Before you call either

Directus

  1. Connect with OAuth or an Authorization: Bearer header. Don't put the token in the URL as ?access_token=, where it can be logged
  2. Use /mcp?tool_mode=registry when the client loads every tool definition. Default mode sends each tool's full instructions, about 79 KB in total
  3. Read the schema tool before writing. Item payloads are untyped objects, so field names and types come only from the data model
  4. Publish a version with POST /versions/{id}/promote over REST. The MCP items tool refuses system collections such as directus_versions
  5. Count translation and junction tables against the 25-collection Core limit before creating collections

Payload

  1. Check the installed version first. Anything below 3.90.0 carries published critical advisories, so ask the owner to upgrade before writing
  2. Send REST keys as Authorization: {collection-slug} API-Key {key} and MCP keys as Authorization: Bearer {key}. The two key kinds are separate
  3. To publish, set _status: 'published' in the data. The draft parameter only relaxes validation and chooses where an update is written
  4. Upload files with multipart POST to the upload collection, with other fields as JSON in _payload. No MCP upload tool is documented
  5. Roll back with POST /api/{collection-slug}/versions/:id after listing versions. Versions exist only where the collection config enables them

Questions

Which is better for AI agents, Directus or Payload?

Directus scores 67.1 (B) on agent readiness against Payload's 55.2 (C), and leads in 6 of 7 scored categories.

Do Directus and Payload need an API key?

Directus takes an API key or an OAuth sign-in. Payload needs an API key.

Can an agent call Directus and Payload without installing anything?

No hosted endpoint is listed for Directus. No hosted endpoint is listed for Payload.

Are Directus and Payload open source?

No open-source release is listed for Directus. Payload is open source (MIT for the core and the official packages. Enterprise add-ons are sold separately through sales).

Other comparisons with Directus or Payload

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report