dotCMS vs Ghost

dotCMS 47

Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.

Ghost 83

Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official ghost package on npm, with Node.js ^22.23.1 or ^24.20.0 in engines in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of limit=all documented there (13 of 15). 6.x is the current stable line (15).

dotCMS 54

dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.

Ghost 75

MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and useTinfoil for all. The default configuration also points updateCheck at updates.ghost.org, which that section doesn't list; the 4 November source sends only ghost_version in that request (13 of 20).

dotCMS 35

Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.

Ghost 50

Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10).

dotCMS 65

The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.

Ghost 51

Per the 8 October check, not re-read on 4 November (docs host paused under the terms). No OpenAPI or similar file was found in the docs index or the repository (0 of 25). llms.txt with 177 links, llms-full.txt and a Markdown copy of every page (10). The reference states what each endpoint does and which fields are required, with little on when not to use one (10 of 20). No published schemas. Required fields are named (title on create, updated_at on edit), and post content is one Lexical JSON string (6 of 15). Request and response examples on each page and token generation in Bash, JavaScript, Ruby and Python. The errors page lists five status codes and the errorType and message fields, without a list per endpoint (10 of 15). Accept-Version header, a stability index per endpoint, a breaking changes page and release notes (15).

dotCMS 75

dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.

Ghost 85

v6.74.0 was tagged on 3 November 2026, the day before this check, after v6.70.0 (13 October), v6.71.0 (15 October), v6.72.0 (20 October) and v6.73.0 (27 October) (30). Five tags since 13 October alone, and 19 npm versions between 10 July and 8 October per the earlier check (20). 33 open issues on 8 October and advisories fixed and published with reporter credits; reply times on individual issues not read (18 of 25). @tryghost/admin-api 1.14.13 was published on 21 September 2026 per the 8 October check; npm couldn't be read on 4 November. The official MCP registry listed third-party Ghost servers only (10 of 15). A Renovate workflow keeps dependencies current. The CI badge on main read failing on 8 October; today's result is unread (7 of 10).

dotCMS 63

JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.

Ghost 56

An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at GET /actions. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20).