{ "data": { "a": { "slug": "dotcms", "name": "dotCMS", "vendor": "dotCMS LLC", "vendorUrl": "https://www.dotcms.com", "kind": "mcp", "category": "cms", "summary": "dotCMS is an enterprise CMS with headless REST APIs, workflows and push publishing, run as dotCMS Cloud or self-hosted. Agents use the @dotcms/mcp-server package, which searches the instance's OpenAPI spec and runs API calls in a sandbox.", "url": "https://www.anchorterminal.com/tools/dotcms", "markdownUrl": "https://www.anchorterminal.com/tools/dotcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/dotcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/dotcms.json", "dns": "dotcms.grade.anchorterminal.com", "repo": "https://github.com/dotCMS/core", "license": "BUSL-1.1", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@dotcms/mcp-server" } ], "auth": "api-key", "authNotes": "The MCP server reads DOTCMS_URL and AUTH_TOKEN. API tokens are JWTs issued for a dotCMS user, carry that user's role permissions, take an expiry in days, and are created by administrators in the user manager or through /api/v1/authentication/api-token. The docs recommend a separate user and role per application; the MCP server needs write permission for content types, content and workflows. Tokens are injected outside the sandbox, so sandboxed code never sees them.", "pricing": "freemium", "pricingNotes": "dotCMS is free with every capability for companies under $5 million in revenue under its BSL licence, self-hosted. Cloud plans (Starter, Professional, Business, Enterprise) are priced on request, with monthly request and bandwidth allowances and SLAs of 99.5 to 99.9 per cent.", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP README, the dev docs or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 7, "popularity": { "githubStars": null, "npmWeekly": 43, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://dev.dotcms.com/docs/build/integrations/dotai/mcp-server", "llmsTxt": "https://dev.dotcms.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.schema", "cms.localisation" ], "tags": [ "official", "mcp", "stdio", "self-hosted", "hosted", "source-available", "llms-txt", "sales-led", "sla", "typescript" ], "lastRelease": "2026-09-02", "graded": true, "anchor": { "graded": true, "score": 57.7, "grade": "C", "agentReady": false, "rank": 780, "ranked": true, "rankOf": 1486, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.", "bestFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "strengths": [ "Seven tools in code mode, with the instance's OpenAPI spec searchable from the sandbox", "The API token stays outside the sandbox, which only receives results", "JWT tokens per user with role permissions and an expiry", "security.txt with PGP, a bounty-backed disclosure policy and LTS security backports", "Free with every capability for organisations under $5 million in revenue" ], "weaknesses": [ "Pre-1.0 package, with the dev docs still pointing at the beta tag", "The server needs a token with write permission for content types, content and workflows", "execute can call any endpoint, and no read-only mode or annotations were found", "Cloud prices are on request only", "Source-available under the BSL, not an OSI licence" ], "agentNotes": [ "Search the spec with `search` before writing an `execute` call, and return only the fields you need", "Use a token for a dedicated user and role, not an administrator's", "Confirm with the user before execute calls that publish, archive or delete content", "Keep results small with pick and first, since output is capped at about 25,000 characters", "Use download_assets for theme folders so files land on disk instead of in context" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.7 } ], "editorialScores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 51 }, "provenanceScore": 57, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @dotcms/mcp-server", "config": { "mcpServers": { "dotcms": { "args": [ "-y", "@dotcms/mcp-server" ], "command": "npx", "env": { "AUTH_TOKEN": "your-api-token", "DOTCMS_URL": "https://your-dotcms-instance.com" } } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/dotcms" }, "area": "business", "provenance": { "legalEntity": "dotCMS LLC", "domain": "dotcms.com", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://github.com/dotCMS/core/blob/main/LICENSE", "privacy": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "statusPage": "", "changelog": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "The MCP server runs locally and calls the customer's own dotCMS instance, so the endpoint isn't on a dotCMS domain.", "The privacy policy, last updated 8 September 2026, covers dotCMS's websites only and names dotCMS Holdings, LLC, dotCMS Services LLC and dotCMS LLC.", "www.dotcms.com/robots.txt disallows /docs/ and /utils/; dev.dotcms.com allows all with Content-Signal ai-train=yes, search=yes, ai-input=yes.", "www.dotcms.com/terms-of-service and /privacy-policy returned 404; no cloud terms of service were found, so the licence stands in for terms.", "No status page answered (status.dotcms.com refused the connection)." ], "score": 57 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/dotcms.json", "live": { "slug": "dotcms", "versions": [ { "registry": "github", "name": "dotCMS/core", "version": "dotcms-cli-26.11.06-03", "released": "2026-11-06", "seenAt": "2026-11-06T23:22:22.409374032Z" }, { "registry": "npm", "name": "@dotcms/mcp-server", "version": "0.1.1", "seenAt": "2026-11-06T23:22:21.577680774Z" } ], "githubStars": 971, "npmWeekly": 43, "securityTxt": { "url": "https://dotcms.com/.well-known/security.txt", "state": "valid", "expires": "2027-06-09T23:59:59.000Z", "checkedAt": "2026-11-07T16:00:46.289271049Z" }, "llmsTxt": { "url": "https://dev.dotcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:19.058875451Z" }, "pages": [ { "url": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:02:43.439634709Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "14706a7e3d20" }, { "url": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:02:39.904485204Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b8fe703d4258" }, { "url": "https://raw.githubusercontent.com/dotCMS/core/main/LICENSE", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:20:41.976083247Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dd3baa6b46f" } ], "updatedAt": "2026-11-07T16:00:46.289271049Z" } }, "answer": "dotCMS scores 57.7 (C) on agent readiness against Ghost's 51.2 (D), and leads in 2 of 7 scored categories. Ghost leads on reliability, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "ghost", "name": "Ghost", "vendor": "Ghost Foundation", "vendorUrl": "https://ghost.org", "kind": "http-api", "category": "cms", "summary": "Ghost is an open-source publishing platform for websites, newsletters and paid memberships, self-hosted or run by the Ghost Foundation as Ghost(Pro). Agents create, edit and publish posts and pages and upload images through its Admin API.", "url": "https://www.anchorterminal.com/tools/ghost", "markdownUrl": "https://www.anchorterminal.com/tools/ghost.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ghost.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ghost.json", "dns": "ghost.grade.anchorterminal.com", "repo": "https://github.com/TryGhost/Ghost", "license": "MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "ghost" }, { "registry": "npm", "name": "@tryghost/admin-api" }, { "registry": "npm", "name": "ghost-cli" } ], "auth": "api-key", "authNotes": "Self-serve, with no app review or partner approval. An owner or administrator creates a custom integration in Ghost Admin and copies its Admin API key, an id and a hex secret joined by a colon. The client signs an HS256 JSON Web Token with the secret (`kid` the id, `aud` `/admin/`, expiry at most 5 minutes) and sends it as `Authorization: Ghost \u003ctoken\u003e`. Integrations hold one fixed permission set with no scopes. A staff access token from a user's profile works the same way and carries that user's role. Session login with email and password is meant for clients where the user is present. On Ghost(Pro) the Admin API and custom integrations need the Publisher plan or above.", "pricing": "freemium", "pricingNotes": "The software is free under MIT to self-host, so an agent's owner can start without a contract or a card. Ghost(Pro) lists Starter at $18, Publisher at $29 and Business at $199 a month billed yearly for up to 1,000 members, rising with audience size, and Custom through sales. The Admin API isn't included in Starter. Plans show a free trial, and we couldn't read whether it needs a card (checked 2026-10-08).", "priceSummary": "$18 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation index, the pricing page or the repository's file list (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 55500, "npmWeekly": 23628, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.ghost.org/admin-api", "llmsTxt": "https://docs.ghost.org/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets" ], "tags": [ "open-source", "self-hosted", "hosted", "rest", "llms-txt", "webhooks", "newsletter", "memberships", "nodejs", "status-page" ], "lastRelease": "2026-11-03", "graded": true, "anchor": { "graded": true, "score": 51.2, "grade": "D", "agentReady": false, "rank": 1027, "ranked": true, "rankOf": 1486, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 85, "payments": 50, "reliability": 83, "schema": 51, "security": 56, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -15, "negativeNotes": [ "4 November 2025 to 27 October 2026: OSV holds 46 advisories for the `ghost` package published in the 12 months, 2 critical, 13 high, 28 moderate and 3 low, all with fixed versions and published by Ghost on GitHub. Counted one by one by this run's values (a fixed High under two months 2, older Criticals and Highs 1, vendor-published fixed Moderates 1, fixed Lows 0), they pass the floor on the 8 Highs published on 7 October 2026 alone, among them GHSA-788w-68h3-cvxp and GHSA-jj74-hc2q-xrvm (remote code execution through bookmark card images and theme translation files), GHSA-v6q3-xqxm-6f5v (invite token disclosure) and five stored-XSS advisories. Self-hosted-only advisories count, since the listing covers the software and Ghost(Pro). The newest, GHSA-qrh6-cwg3-343x (moderate, comment like authorisation bypass, fixed in 6.44.1), was published on 27 October 2026. -15, the floor (https://api.osv.dev/v1/query, https://github.com/TryGhost/Ghost/security/advisories)" ], "verdict": "A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical.", "bestFor": "A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.", "strengths": [ "Admin API keys sign JSON Web Tokens that last at most 5 minutes and travel in the Authorization header, so the key itself is never sent", "A staff access token carries its user's role, and a Contributor can add and edit drafts but can't change a post's status", "Every PUT must send the post's current `updated_at`, which Ghost uses for collision detection", "Weekly releases, with v6.70.0 to v6.74.0 tagged between 13 October and 3 November 2026", "MIT licence, with llms.txt, llms-full.txt and a Markdown copy of every docs page" ], "weaknesses": [ "No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository", "A custom integration has one fixed permission set covering posts, members, settings, themes and users, with no scopes and no read-only Admin key", "46 advisories published in 12 months to 27 October 2026, 15 high or critical, including remote code execution through bookmark card images", "No content locales or custom content types, and the Admin API has no documented route for restoring a post revision", "On Ghost(Pro) the Admin API and custom integrations start at the Publisher plan, not Starter" ], "agentNotes": [ "Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set `kid` to the key id, `aud` to `/admin/` and `exp` at most 5 minutes ahead", "Set `status` to `draft` on every create unless told to publish, and publish later with a PUT that sets `status` to `published`", "GET the post before each PUT and send its `updated_at` back. Tags and authors in a PUT replace the existing lists", "Send content as a Lexical JSON string, or add `?source=html` and send `html`. The HTML conversion is lossy unless wrapped in an HTML card", "Page through lists with `limit` up to 100 and `page`. Since Ghost 6.0 `limit=all` returns 100 items without an error" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 51.2 } ], "editorialScores": { "ergonomics": 69, "maintenance": 85, "payments": 50, "reliability": 83, "schema": 51, "security": 56, "transparency": 76 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @tryghost/admin-api", "http": "curl -H \"Authorization: Ghost $token\" -H \"Accept-Version: $version\" https://{admin_domain}/ghost/api/admin/{resource}/" }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/ghost" }, "area": "business", "unitPrices": [ { "item": "Self-hosted Ghost", "unit": "month", "usd": 0, "note": "MIT, you pay for your own hosting and email delivery" }, { "item": "Ghost(Pro) Starter", "unit": "month", "usd": 18, "note": "billed yearly, up to 1,000 members, no Admin API" }, { "item": "Ghost(Pro) Publisher", "unit": "month", "usd": 29, "note": "billed yearly, up to 1,000 members, 3 staff users, Admin API included" }, { "item": "Ghost(Pro) Business", "unit": "month", "usd": 199, "note": "billed yearly, up to 1,000 members, 15 staff users" } ], "provenance": { "legalEntity": "Ghost Foundation Ltd", "domain": "ghost.org", "domainRegistered": "2005-06-25", "endpointOnVendorDomain": false, "terms": "https://ghost.org/terms/", "privacy": "https://ghost.org/privacy/", "statusPage": "https://ghoststatus.org", "changelog": "https://github.com/TryGhost/Ghost/releases", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms govern the Ghost.org website, the Ghost software and the hosted service, and name the Ghost Foundation as owner and operator under the law of England and Wales. The privacy policy names Ghost Foundation Ltd. Neither page showed a dated revision that we could read.", "The privacy policy covers Ghost Foundation's own website and services. Content on a self-hosted site stays on its owner's server and isn't covered by it.", "A self-hosted install answers on its owner's domain. Ghost(Pro) sites use a `*.ghost.io` admin domain.", "https://ghost.org/.well-known/security.txt returned 404 on 8 October 2026. SECURITY.md in the repository and https://docs.ghost.org/security give security@ghost.org and a disclosure policy.", "RDAP for ghost.org gives a registration date of 2005-06-25 and a transfer on 2013-09-12.", "status.ghost.org redirects to ghoststatus.org, an incident.io page for Ghost(Pro), not for self-hosted installs. It listed three minor incidents between 10 July and 8 October 2026." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ghost.json", "live": { "slug": "ghost", "vendorStatus": { "page": "https://ghoststatus.org", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:12.785760962Z" }, "versions": [ { "registry": "github", "name": "TryGhost/Ghost", "version": "v6.75.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:28:07.551181612Z" }, { "registry": "npm", "name": "@tryghost/admin-api", "version": "1.14.14", "seenAt": "2026-11-06T23:28:03.481723829Z" }, { "registry": "npm", "name": "ghost", "version": "6.75.0", "seenAt": "2026-11-06T23:28:03.271076255Z" }, { "registry": "npm", "name": "ghost-cli", "version": "1.34.1", "seenAt": "2026-11-06T23:28:05.5408522Z" } ], "githubStars": 55700, "npmWeekly": 27684, "securityTxt": { "url": "https://ghost.org/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:51.111296428Z" }, "llmsTxt": { "url": "https://docs.ghost.org/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:35.412849236Z" }, "domain": { "domain": "ghost.org", "registered": "2005-06-25", "source": "https://rdap.publicinterestregistry.org/rdap/domain/ghost.org", "checkedAt": "2026-11-01T14:09:34.995895353Z" }, "pages": [ { "url": "https://ghost.org/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:10:26.706948154Z", "changedAt": "2026-11-05T12:33:58.2502144Z", "fingerprint": "d7b08147c021" }, { "url": "https://ghost.org/terms/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:10:29.038519001Z", "changedAt": "2026-11-05T12:34:00.703860998Z", "fingerprint": "65e4a1f15699" } ], "github": { "repo": "tryghost/ghost", "checkedAt": "2026-11-02T09:33:05.874117023Z", "stars": 55656, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:28:37Z", "openIssues": 31, "openPRs": 165, "issuesOpened90d": 68, "issuesClosed90d": 67, "prsMerged90d": 2135, "ci": { "branch": "main", "runs": 50, "success": 44, "failure": 1, "other": 5, "latest": "success", "latestAt": "2026-11-02T06:16:34Z" }, "advisories": [ { "ghsa": "GHSA-cr6m-qrr6-q3j8", "cve": "CVE-2026-84383", "severity": "high", "published": "2026-10-01T15:22:42Z" }, { "ghsa": "GHSA-788w-68h3-cvxp", "cve": "CVE-2026-105642", "severity": "high", "published": "2026-10-01T15:22:29Z" }, { "ghsa": "GHSA-69qc-f5m6-889c", "cve": "CVE-2026-105643", "severity": "high", "published": "2026-10-01T15:20:36Z" }, { "ghsa": "GHSA-hqq2-xqr2-fmx2", "cve": "CVE-2026-105644", "severity": "medium", "published": "2026-10-01T15:20:13Z" }, { "ghsa": "GHSA-9m4w-fmjw-fvjq", "cve": "CVE-2026-105645", "severity": "medium", "published": "2026-10-01T15:19:23Z" }, { "ghsa": "GHSA-fwh9-qg68-vxp4", "cve": "CVE-2026-105646", "severity": "medium", "published": "2026-10-01T15:17:44Z" }, { "ghsa": "GHSA-322m-ff4g-9vx9", "cve": "CVE-2026-105647", "severity": "medium", "published": "2026-09-24T14:25:11Z" }, { "ghsa": "GHSA-r7f2-6fj8-6fg2", "cve": "CVE-2026-105648", "severity": "medium", "published": "2026-09-24T14:24:59Z" }, { "ghsa": "GHSA-8575-cr6v-7jh4", "cve": "CVE-2026-105649", "severity": "high", "published": "2026-09-24T14:24:46Z" }, { "ghsa": "GHSA-v3xr-g6p2-fvgv", "cve": "CVE-2026-105650", "severity": "high", "published": "2026-09-17T18:24:59Z" }, { "ghsa": "GHSA-347q-26qq-h2p6", "cve": "CVE-2026-105651", "severity": "high", "published": "2026-09-17T18:23:00Z" }, { "ghsa": "GHSA-53vv-xm9f-mm82", "cve": "CVE-2026-105652", "severity": "low", "published": "2026-09-17T18:21:33Z" }, { "ghsa": "GHSA-v6q3-xqxm-6f5v", "cve": "CVE-2026-105675", "severity": "high", "published": "2026-09-17T18:19:01Z" }, { "ghsa": "GHSA-m382-6jw4-fmp6", "cve": "CVE-2026-105676", "severity": "medium", "published": "2026-09-17T18:17:57Z" }, { "ghsa": "GHSA-jj74-hc2q-xrvm", "cve": "CVE-2026-105677", "severity": "high", "published": "2026-09-17T18:15:14Z" }, { "ghsa": "GHSA-4pvx-fwjj-8gpc", "cve": "CVE-2026-105678", "severity": "medium", "published": "2026-09-17T18:12:05Z" }, { "ghsa": "GHSA-gfjp-2p8f-94qv", "cve": "CVE-2026-105679", "severity": "high", "published": "2026-09-17T18:02:48Z" }, { "ghsa": "GHSA-rcx7-6m7p-xw5c", "severity": "high", "published": "2026-09-11T15:47:08Z" }, { "ghsa": "GHSA-ffmj-3ppp-cj4r", "severity": "high", "published": "2026-09-11T15:46:48Z" }, { "ghsa": "GHSA-rrq6-9r3c-7w26", "severity": "medium", "published": "2026-09-09T00:22:45Z" }, { "ghsa": "GHSA-mp9q-4q6m-44f5", "cve": "CVE-2026-103292", "severity": "high", "published": "2026-09-08T22:49:46Z" }, { "ghsa": "GHSA-q734-xjgc-vpj9", "severity": "critical", "published": "2026-09-03T20:44:38Z" }, { "ghsa": "GHSA-rv92-9vfp-2826", "severity": "medium", "published": "2026-09-03T20:40:32Z" }, { "ghsa": "GHSA-x3mg-q38v-m562", "cve": "CVE-2026-105680", "severity": "medium", "published": "2026-09-03T20:39:42Z" }, { "ghsa": "GHSA-xcgh-2828-cvmx", "severity": "medium", "published": "2026-09-03T20:39:22Z" }, { "ghsa": "GHSA-qppx-rw6v-xjqf", "severity": "high", "published": "2026-09-03T20:36:45Z" }, { "ghsa": "GHSA-ghq6-q78f-2cpg", "severity": "medium", "published": "2026-08-20T16:58:52Z" }, { "ghsa": "GHSA-5ppm-p957-x46r", "severity": "medium", "published": "2026-08-20T16:57:44Z" }, { "ghsa": "GHSA-jj85-wvj2-r86m", "severity": "medium", "published": "2026-08-20T16:57:23Z" }, { "ghsa": "GHSA-6v8p-3jx9-8chr", "severity": "medium", "published": "2026-08-13T15:00:36Z" }, { "ghsa": "GHSA-5pxf-whwv-g54g", "severity": "high", "published": "2026-08-13T15:00:22Z" }, { "ghsa": "GHSA-v9vj-6fq5-99xj", "severity": "medium", "published": "2026-08-13T15:00:10Z" }, { "ghsa": "GHSA-8vhf-xxpj-4qrg", "severity": "high", "published": "2026-08-13T14:59:47Z" }, { "ghsa": "GHSA-5685-hwm9-62cg", "severity": "medium", "published": "2026-08-13T14:59:34Z" }, { "ghsa": "GHSA-vm82-r49m-224q", "severity": "medium", "published": "2026-08-13T14:55:42Z" }, { "ghsa": "GHSA-q55r-w7fh-rmh6", "severity": "high", "published": "2026-08-13T14:55:25Z" }, { "ghsa": "GHSA-mf3j-vxq2-vmc4", "severity": "medium", "published": "2026-08-13T14:55:04Z" }, { "ghsa": "GHSA-q98w-jm4q-wch7", "severity": "medium", "published": "2026-08-12T15:27:09Z" }, { "ghsa": "GHSA-vf9h-87xm-g767", "severity": "medium", "published": "2026-08-12T15:26:22Z" }, { "ghsa": "GHSA-pv24-pfvg-vr83", "severity": "high", "published": "2026-08-11T16:03:10Z" }, { "ghsa": "GHSA-qrh6-cwg3-343x", "severity": "medium", "published": "2026-08-11T16:02:11Z" }, { "ghsa": "GHSA-6q6j-f24j-p477", "cve": "CVE-2026-105681", "severity": "medium", "published": "2026-08-11T16:01:40Z" }, { "ghsa": "GHSA-354h-gmhv-mr9c", "cve": "CVE-2026-105682", "severity": "low", "published": "2026-08-11T16:01:02Z" }, { "ghsa": "GHSA-83rp-q473-j88c", "cve": "CVE-2026-105683", "severity": "low", "published": "2026-08-11T16:00:28Z" }, { "ghsa": "GHSA-4wx2-7gvj-qfq3", "cve": "CVE-2026-70589", "severity": "medium", "published": "2026-07-30T17:38:18Z" }, { "ghsa": "GHSA-7mpp-r37j-x5wh", "cve": "CVE-2026-70594", "severity": "medium", "published": "2026-07-30T17:38:09Z" }, { "ghsa": "GHSA-2gx6-7gx2-wwcf", "cve": "CVE-2026-70588", "severity": "medium", "published": "2026-07-30T17:37:55Z" }, { "ghsa": "GHSA-cjc9-q5gf-327p", "cve": "CVE-2026-70593", "severity": "medium", "published": "2026-07-30T17:37:42Z" }, { "ghsa": "GHSA-x5mm-wm4g-j5xv", "cve": "CVE-2026-70595", "severity": "medium", "published": "2026-07-30T17:37:32Z" }, { "ghsa": "GHSA-pr22-p9rp-2cqv", "cve": "CVE-2026-70596", "severity": "medium", "published": "2026-07-30T17:37:22Z" }, { "ghsa": "GHSA-cj62-hvv2-2q5h", "cve": "CVE-2026-70592", "severity": "medium", "published": "2026-07-30T17:37:04Z" }, { "ghsa": "GHSA-gcvv-72q8-9v76", "cve": "CVE-2026-70591", "severity": "medium", "published": "2026-07-30T17:36:37Z" }, { "ghsa": "GHSA-jm22-3w23-5q7w", "cve": "CVE-2026-70590", "severity": "medium", "published": "2026-07-30T17:36:22Z" }, { "ghsa": "GHSA-xm43-3m56-w3wf", "cve": "CVE-2026-59817", "severity": "medium", "published": "2026-06-23T19:47:17Z" }, { "ghsa": "GHSA-xpp7-93x6-v29m", "cve": "CVE-2026-53950", "severity": "high", "published": "2026-06-10T08:25:13Z" }, { "ghsa": "GHSA-jx35-x7fj-vgpr", "cve": "CVE-2026-53949", "severity": "medium", "published": "2026-06-10T08:24:57Z" }, { "ghsa": "GHSA-944x-pm95-3jpr", "cve": "CVE-2026-53948", "severity": "medium", "published": "2026-06-10T08:24:43Z" }, { "ghsa": "GHSA-chgm-3698-jm42", "cve": "CVE-2026-53947", "severity": "medium", "published": "2026-06-10T08:24:25Z" }, { "ghsa": "GHSA-g366-23fw-ggp6", "cve": "CVE-2026-53946", "severity": "medium", "published": "2026-06-10T08:24:06Z" }, { "ghsa": "GHSA-ch52-px8q-f22j", "cve": "CVE-2026-53945", "severity": "medium", "published": "2026-06-10T08:23:44Z" }, { "ghsa": "GHSA-wvp2-4qqp-4h3r", "cve": "CVE-2026-53944", "severity": "medium", "published": "2026-06-10T08:23:16Z" }, { "ghsa": "GHSA-62q6-4hv4-vjrw", "cve": "CVE-2026-53943", "severity": "critical", "published": "2026-05-28T07:03:25Z" }, { "ghsa": "GHSA-9m84-wc28-w895", "cve": "CVE-2026-29784", "severity": "high", "published": "2026-03-04T17:51:38Z" }, { "ghsa": "GHSA-cgc2-rcrh-qr5x", "cve": "CVE-2026-29053", "severity": "high", "published": "2026-03-02T15:45:46Z" }, { "ghsa": "GHSA-w52v-v783-gw97", "cve": "CVE-2026-26980", "severity": "critical", "published": "2026-02-16T18:04:35Z" }, { "ghsa": "GHSA-gv6q-2m97-882h", "cve": "CVE-2026-24778", "severity": "high", "published": "2026-01-27T12:28:29Z" }, { "ghsa": "GHSA-gjrp-xgmh-x9qq", "cve": "CVE-2026-22596", "severity": "medium", "published": "2026-01-08T14:38:23Z" }, { "ghsa": "GHSA-vmc4-9828-r48r", "cve": "CVE-2026-22597", "severity": "medium", "published": "2026-01-08T14:38:01Z" }, { "ghsa": "GHSA-9xg7-mwmp-xmjx", "cve": "CVE-2026-22595", "severity": "high", "published": "2026-01-08T14:37:41Z" }, { "ghsa": "GHSA-5fp7-g646-ccf4", "cve": "CVE-2026-22594", "severity": "high", "published": "2026-01-08T14:37:08Z" }, { "ghsa": "GHSA-f7qg-xj45-w956", "cve": "CVE-2025-9862", "severity": "medium", "published": "2025-09-14T13:48:18Z" }, { "ghsa": "GHSA-78x2-cwp9-5j42", "cve": "CVE-2024-43409", "severity": "medium", "published": "2024-08-20T14:43:13Z" }, { "ghsa": "GHSA-9c9v-w225-v5rg", "cve": "CVE-2023-40028", "severity": "medium", "published": "2023-08-15T11:36:14Z" }, { "ghsa": "GHSA-r97q-ghch-82j9", "cve": "CVE-2023-31133", "severity": "high", "published": "2023-05-03T12:55:49Z" }, { "ghsa": "GHSA-9gh8-wp53-ccc6", "cve": "CVE-2022-41654", "severity": "high", "published": "2022-11-28T15:06:43Z" }, { "ghsa": "GHSA-7v28-g2pq-ggg8", "cve": "CVE-2022-24785", "severity": "medium", "published": "2022-06-15T03:15:13Z" }, { "ghsa": "GHSA-65p7-pjj8-ggmr", "severity": "medium", "published": "2021-09-23T10:28:44Z" }, { "ghsa": "GHSA-wfrj-qqc2-83cm", "severity": "medium", "published": "2021-09-17T16:10:16Z" }, { "ghsa": "GHSA-j5c2-hm46-wp5c", "cve": "CVE-2021-39192", "severity": "medium", "published": "2021-07-20T15:15:46Z" }, { "ghsa": "GHSA-9fgx-q25h-jxrg", "cve": "CVE-2021-29484", "severity": "high", "published": "2021-04-29T11:19:15Z" } ], "replies": { "sampled": 25, "unanswered": 0, "medianDays": 4.8 } }, "updatedAt": "2026-11-07T18:21:12.785760962Z" } }, "edges": [ { "by": 36, "category": "reliability", "leads": "ghost", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.", "b": "Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official `ghost` package on npm, with Node.js ^22.23.1 or ^24.20.0 in `engines` in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of `limit=all` documented there (13 of 15). 6.x is the current stable line (15)." }, "scores": { "a": 47, "b": 83 } }, { "by": 21, "category": "transparency", "leads": "ghost", "name": "Transparency \u0026 trust", "reasons": { "a": "dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.", "b": "MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and `useTinfoil` for all. The default configuration also points `updateCheck` at updates.ghost.org, which that section doesn't list; the 4 November source sends only `ghost_version` in that request (13 of 20)." }, "scores": { "a": 54, "b": 75 } }, { "by": 15, "category": "payments", "leads": "ghost", "name": "Payments \u0026 pricing", "reasons": { "a": "Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.", "b": "Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10)." }, "scores": { "a": 35, "b": 50 } }, { "by": 14, "category": "schema", "leads": "dotcms", "name": "Schema \u0026 documentation", "reasons": { "a": "The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.", "b": "Per the 8 October check, not re-read on 4 November (docs host paused under the terms). No OpenAPI or similar file was found in the docs index or the repository (0 of 25). llms.txt with 177 links, llms-full.txt and a Markdown copy of every page (10). The reference states what each endpoint does and which fields are required, with little on when not to use one (10 of 20). No published schemas. Required fields are named (`title` on create, `updated_at` on edit), and post content is one Lexical JSON string (6 of 15). Request and response examples on each page and token generation in Bash, JavaScript, Ruby and Python. The errors page lists five status codes and the `errorType` and `message` fields, without a list per endpoint (10 of 15). `Accept-Version` header, a stability index per endpoint, a breaking changes page and release notes (15)." }, "scores": { "a": 65, "b": 51 } }, { "by": 10, "category": "maintenance", "leads": "ghost", "name": "Maintenance \u0026 community", "reasons": { "a": "dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.", "b": "v6.74.0 was tagged on 3 November 2026, the day before this check, after v6.70.0 (13 October), v6.71.0 (15 October), v6.72.0 (20 October) and v6.73.0 (27 October) (30). Five tags since 13 October alone, and 19 npm versions between 10 July and 8 October per the earlier check (20). 33 open issues on 8 October and advisories fixed and published with reporter credits; reply times on individual issues not read (18 of 25). @tryghost/admin-api 1.14.13 was published on 21 September 2026 per the 8 October check; npm couldn't be read on 4 November. The official MCP registry listed third-party Ghost servers only (10 of 15). A Renovate workflow keeps dependencies current. The CI badge on main read failing on 8 October; today's result is unread (7 of 10)." }, "scores": { "a": 75, "b": 85 } }, { "by": 7, "category": "security", "leads": "dotcms", "name": "Security \u0026 auth", "reasons": { "a": "JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.", "b": "An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at `GET /actions`. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20)." }, "scores": { "a": 63, "b": 56 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "dotCMS LLC", "b": "Ghost Foundation", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "stdio", "b": "HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "BUSL-1.1", "b": "MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms", "name": "Licence" }, { "a": "7", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-02", "b": "2026-11-03", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "2026-09-08", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "43 npm/wk", "b": "56k stars, 24k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "dotCMS scores 57.7 (C) on agent readiness against Ghost's 51.2 (D), and leads in 2 of 7 scored categories. Ghost leads on reliability, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, dotCMS or Ghost?" }, { "answer": "Both need an API key.", "question": "Do dotCMS and Ghost need an API key?" }, { "answer": "dotCMS runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Ghost.", "question": "Can an agent call dotCMS and Ghost without installing anything?" }, { "answer": "No open-source release is listed for dotCMS. Ghost is open source (MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms).", "question": "Are dotCMS and Ghost open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 65 against 51", "Security \u0026 auth, 63 against 56" ], "also": [ "Runs on your own machine", "No incidents deducted, where Ghost loses 15 points for them" ], "goodFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "slug": "dotcms", "watchFor": "Pre-1.0 package, with the dev docs still pointing at the beta tag" }, { "aheadOn": [ "Reliability, 83 against 47", "Payments \u0026 pricing, 50 against 35", "Maintenance \u0026 community, 85 against 75", "Transparency \u0026 trust, 75 against 54" ], "also": [ "Open source" ], "goodFor": "A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.", "slug": "ghost", "watchFor": "No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository" } ], "history": { "dotcms": null, "ghost": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-04", "delta": -7.4, "from": 58.6, "fromGrade": "C", "to": 51.2, "toGrade": "D" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.2, "from": 58.4, "fromGrade": "C", "to": 58.6, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 58.3, "fromGrade": "C", "to": 58.4, "toGrade": "C" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-ghost.json", "title": "BCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/bcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms.json", "title": "ButterCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-ghost.json", "title": "ButterCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/buttercms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms.json", "title": "Contentstack vs dotCMS", "url": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-ghost.json", "title": "Contentstack vs Ghost", "url": "https://www.anchorterminal.com/compare/contentstack-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-ghost.json", "title": "Cosmic vs Ghost", "url": "https://www.anchorterminal.com/compare/cosmic-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-dotcms.json", "title": "DatoCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/datocms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-ghost.json", "title": "DatoCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/datocms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-dotcms.json", "title": "Directus vs dotCMS", "url": "https://www.anchorterminal.com/compare/directus-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-ghost.json", "title": "Directus vs Ghost", "url": "https://www.anchorterminal.com/compare/directus-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph.json", "title": "dotCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.json", "title": "dotCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-payload.json", "title": "dotCMS vs Payload", "url": "https://www.anchorterminal.com/compare/dotcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-prismic.json", "title": "dotCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/dotcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-sanity.json", "title": "dotCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/dotcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok.json", "title": "dotCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-strapi.json", "title": "dotCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/dotcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-webflow.json", "title": "dotCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/dotcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress.json", "title": "dotCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-hygraph.json", "title": "Ghost vs Hygraph", "url": "https://www.anchorterminal.com/compare/ghost-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-kontent-ai.json", "title": "Ghost vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/ghost-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-payload.json", "title": "Ghost vs Payload", "url": "https://www.anchorterminal.com/compare/ghost-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-prismic.json", "title": "Ghost vs Prismic", "url": "https://www.anchorterminal.com/compare/ghost-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-sanity.json", "title": "Ghost vs Sanity", "url": "https://www.anchorterminal.com/compare/ghost-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-storyblok.json", "title": "Ghost vs Storyblok", "url": "https://www.anchorterminal.com/compare/ghost-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-strapi.json", "title": "Ghost vs Strapi", "url": "https://www.anchorterminal.com/compare/ghost-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-webflow.json", "title": "Ghost vs Webflow", "url": "https://www.anchorterminal.com/compare/ghost-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-wordpress.json", "title": "Ghost vs WordPress", "url": "https://www.anchorterminal.com/compare/ghost-vs-wordpress" } ], "panel": null, "scores": [ { "by": 36, "dotcms": 47, "edge": "ghost", "ghost": 83, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 14, "dotcms": 65, "edge": "dotcms", "ghost": 51, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 1, "dotcms": 68, "edge": "ghost", "ghost": 69, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 7, "dotcms": 63, "edge": "dotcms", "ghost": 56, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 15, "dotcms": 35, "edge": "ghost", "ghost": 50, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 10, "dotcms": 75, "edge": "ghost", "ghost": 85, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 21, "dotcms": 54, "edge": "ghost", "ghost": 75, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "dotCMS scores 57.7 (C) on agent readiness against Ghost's 51.2 (D), and leads in 2 of 7 scored categories. Ghost leads on reliability, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "dotcms": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.", "ghost": "A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/dotcms-vs-ghost", "json": "https://www.anchorterminal.com/compare/dotcms-vs-ghost.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/dotcms-vs-ghost.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/dotcms-vs-ghost.min.md" }, "markdown": "dotCMS scores 57.7 (C) on agent readiness against Ghost's 51.2 (D), and leads in 2 of 7 scored categories. Ghost leads on reliability, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do content management.\n\n- dotCMS: grade C, 57.7/100, rank #780 of 1486. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json\n- Ghost: grade D, 51.2/100, rank #1027 of 1486. Markdown https://www.anchorterminal.com/tools/ghost.md · JSON https://www.anchorterminal.com/api/v1/tools/ghost.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### dotCMS (C)\n\nGood for: Enterprises already on dotCMS who want an agent to manage content and pages.\n\nAhead on:\n- Schema \u0026 documentation, 65 against 51\n- Security \u0026 auth, 63 against 56\n\nAlso in its favour:\n- Runs on your own machine\n- No incidents deducted, where Ghost loses 15 points for them\n\nWatch for: Pre-1.0 package, with the dev docs still pointing at the beta tag\n\n### Ghost (D)\n\nGood for: A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.\n\nAhead on:\n- Reliability, 83 against 47\n- Payments \u0026 pricing, 50 against 35\n- Maintenance \u0026 community, 85 against 75\n- Transparency \u0026 trust, 75 against 54\n\nAlso in its favour:\n- Open source\n\nWatch for: No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository\n\n\n## Why the edge\n\n### Reliability: Ghost +36\n\n- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.\n- Ghost (83): Read with the local-software lines, since the graded surface is the open-source release its owner hosts. Ghost(Pro)'s status page isn't scored here. Official `ghost` package on npm, with Node.js ^22.23.1 or ^24.20.0 in `engines` in the 4 November source, and a supported stack named in the hosting guide (20). A public CI workflow (ci.yml) runs on pushes to main and runs the unit, type and end-to-end tests; GitHub's pages answer 403 in this session, so today's result is unread (the badge read failing on 8 October) (15 of 25). The repository showed 33 open issues and 140 open pull requests against weekly releases on 8 October; not re-read (20 of 25). Semver version numbers, release notes per version and a breaking changes page per major, with the 6.0 removal of `limit=all` documented there (13 of 15). 6.x is the current stable line (15).\n\n### Transparency \u0026 trust: Ghost +21\n\n- dotCMS (54): dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.\n- Ghost (75): MIT, copyright Ghost Foundation, with the source public (30). Per the 8 October check, not re-read on 4 November (ghost.org and docs.ghost.org paused under the terms): a self-hosted site keeps content on its owner's server. For Ghost(Pro) the privacy policy places servers in Amsterdam and a DPA lists subprocessors in an annex, while retention is stated only as kept where necessary and the terms make the customer responsible for backups (18 of 30). A table dates each major's end of life (5.x in January 2026, 6.x to be confirmed), endpoints carry a stability index and breaking changes are catalogued per major. No notice period in days was found (15 of 20). The configuration page documents Gravatar, structured data and IndexNow calls with a switch for each and `useTinfoil` for all. The default configuration also points `updateCheck` at updates.ghost.org, which that section doesn't list; the 4 November source sends only `ghost_version` in that request (13 of 20).\n\n### Payments \u0026 pricing: Ghost +15\n\n- dotCMS (35): Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.\n- Ghost (50): Per the 8 October check, not re-read on 4 November (ghost.org paused under the terms). Scored with the self-hosted rule, taking prices from Ghost(Pro) beside the free software. No x402, MPP or L402 found (0). The software is free under MIT, and Ghost(Pro) lists $18, $29 and $199 a month billed yearly at up to 1,000 members (20). Self-hosting needs no card or account. Whether the Ghost(Pro) trial asks for a card wasn't readable (20). The docs create Admin API keys in the Ghost Admin screens, so a person sets up the integration. Install is scriptable, so half (10).\n\n### Schema \u0026 documentation: dotCMS +14\n\n- dotCMS (65): The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.\n- Ghost (51): Per the 8 October check, not re-read on 4 November (docs host paused under the terms). No OpenAPI or similar file was found in the docs index or the repository (0 of 25). llms.txt with 177 links, llms-full.txt and a Markdown copy of every page (10). The reference states what each endpoint does and which fields are required, with little on when not to use one (10 of 20). No published schemas. Required fields are named (`title` on create, `updated_at` on edit), and post content is one Lexical JSON string (6 of 15). Request and response examples on each page and token generation in Bash, JavaScript, Ruby and Python. The errors page lists five status codes and the `errorType` and `message` fields, without a list per endpoint (10 of 15). `Accept-Version` header, a stability index per endpoint, a breaking changes page and release notes (15).\n\n### Maintenance \u0026 community: Ghost +10\n\n- dotCMS (75): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.\n- Ghost (85): v6.74.0 was tagged on 3 November 2026, the day before this check, after v6.70.0 (13 October), v6.71.0 (15 October), v6.72.0 (20 October) and v6.73.0 (27 October) (30). Five tags since 13 October alone, and 19 npm versions between 10 July and 8 October per the earlier check (20). 33 open issues on 8 October and advisories fixed and published with reporter credits; reply times on individual issues not read (18 of 25). @tryghost/admin-api 1.14.13 was published on 21 September 2026 per the 8 October check; npm couldn't be read on 4 November. The official MCP registry listed third-party Ghost servers only (10 of 15). A Renovate workflow keeps dependencies current. The CI badge on main read failing on 8 October; today's result is unread (7 of 10).\n\n### Security \u0026 auth: dotCMS +7\n\n- dotCMS (63): JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.\n- Ghost (56): An Admin API key belongs to one custom integration, can be regenerated, and signs tokens that last at most 5 minutes and travel in the Authorization header. Integrations have one fixed permission set and no scopes, so we scored plain revocable keys plus 2 for role-bound staff tokens (22 of 30). The Content API key is sent as a query parameter. It reads published content only and isn't the graded credential, so no deduction. A Contributor's staff token can add and edit drafts but not change status, per the post model. No read-only Admin key and no approval step for a publish or delete (12 of 20). Posts, members and comments hold text written by other people, and no prompt-injection guidance was found (3 of 15). An actions log is readable at `GET /actions`. No per-call log was found (8 of 15). A disclosure policy with response times and security@ghost.org per the 8 October check, and advisories published on GitHub with credits (OSV holds 46 published from 4 November 2025 to 27 October 2026). No bug bounty or certification was found, and ghost.org/.well-known/security.txt returned 404 (11 of 20).\n\n## Score by category\n\n| Category | Weight | dotCMS | Ghost | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 47 | 83 | Ghost +36 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 65 | 51 | dotCMS +14 |\n| Agent ergonomics | 13% (16.2 this run) | 68 | 69 | Ghost +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 56 | dotCMS +7 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 35 | 50 | Ghost +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 75 | 85 | Ghost +10 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 54 | 75 | Ghost +21 |\n| Negative events | ≤15 | 0 | -15 | |\n| **Total** | | **57.7 · C** | **51.2 · D** | |\n\n## Facts side by side\n\n| Fact | dotCMS | Ghost |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | dotCMS LLC | Ghost Foundation |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | stdio | HTTP |\n| Auth | API key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | BUSL-1.1 | MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms |\n| Tools exposed | 7 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-09-02 | 2026-11-03 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | 2026-09-08 | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 43 npm/wk | 56k stars, 24k npm/wk |\n\n## How the scores have moved\n\n### dotCMS\n\nNo score change since it was listed.\n\n### Ghost\n\n- -7.4 on 4 November 2026 (C to D): new evidence, correction\n- +0.2 on 28 October 2026: new evidence\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.\n\n**Ghost.** A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without publishing. The Admin API has no OpenAPI file and one fixed permission set per integration, and OSV lists 46 Ghost advisories in the year to 27 October 2026, 15 high or critical.\n\n## Before you call either\n\n### dotCMS\n\n1. Search the spec with `search` before writing an `execute` call, and return only the fields you need\n2. Use a token for a dedicated user and role, not an administrator's\n3. Confirm with the user before execute calls that publish, archive or delete content\n4. Keep results small with pick and first, since output is capped at about 25,000 characters\n5. Use download_assets for theme folders so files land on disk instead of in context\n\n### Ghost\n\n1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set `kid` to the key id, `aud` to `/admin/` and `exp` at most 5 minutes ahead\n2. Set `status` to `draft` on every create unless told to publish, and publish later with a PUT that sets `status` to `published`\n3. GET the post before each PUT and send its `updated_at` back. Tags and authors in a PUT replace the existing lists\n4. Send content as a Lexical JSON string, or add `?source=html` and send `html`. The HTML conversion is lossy unless wrapped in an HTML card\n5. Page through lists with `limit` up to 100 and `page`. Since Ghost 6.0 `limit=all` returns 100 items without an error\n\n## Questions\n\n### Which is better for AI agents, dotCMS or Ghost?\n\ndotCMS scores 57.7 (C) on agent readiness against Ghost's 51.2 (D), and leads in 2 of 7 scored categories. Ghost leads on reliability, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.\n\n### Do dotCMS and Ghost need an API key?\n\nBoth need an API key.\n\n### Can an agent call dotCMS and Ghost without installing anything?\n\ndotCMS runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Ghost.\n\n### Are dotCMS and Ghost open source?\n\nNo open-source release is listed for dotCMS. Ghost is open source (MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/dotcms-vs-ghost.json, and with the fewest tokens: https://www.anchorterminal.com/compare/dotcms-vs-ghost.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"dotcms\", \"b\": \"ghost\"}`. From a terminal: `anchor compare dotcms ghost`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/dotcms.json and https://www.anchorterminal.com/api/v1/tools/ghost.json\n\n## Other comparisons with dotCMS or Ghost\n\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Ghost](https://www.anchorterminal.com/compare/bcms-vs-ghost.md)\n- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)\n- [ButterCMS vs Ghost](https://www.anchorterminal.com/compare/buttercms-vs-ghost.md)\n- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)\n- [Contentstack vs Ghost](https://www.anchorterminal.com/compare/contentstack-vs-ghost.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Ghost](https://www.anchorterminal.com/compare/cosmic-vs-ghost.md)\n- [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md)\n- [DatoCMS vs Ghost](https://www.anchorterminal.com/compare/datocms-vs-ghost.md)\n- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)\n- [Directus vs Ghost](https://www.anchorterminal.com/compare/directus-vs-ghost.md)\n- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)\n- [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md)\n- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)\n- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)\n- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)\n- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)\n- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)\n- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)\n- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)\n- [Ghost vs Hygraph](https://www.anchorterminal.com/compare/ghost-vs-hygraph.md)\n- [Ghost vs Kontent.ai](https://www.anchorterminal.com/compare/ghost-vs-kontent-ai.md)\n- [Ghost vs Payload](https://www.anchorterminal.com/compare/ghost-vs-payload.md)\n- [Ghost vs Prismic](https://www.anchorterminal.com/compare/ghost-vs-prismic.md)\n- [Ghost vs Sanity](https://www.anchorterminal.com/compare/ghost-vs-sanity.md)\n- [Ghost vs Storyblok](https://www.anchorterminal.com/compare/ghost-vs-storyblok.md)\n- [Ghost vs Strapi](https://www.anchorterminal.com/compare/ghost-vs-strapi.md)\n- [Ghost vs Webflow](https://www.anchorterminal.com/compare/ghost-vs-webflow.md)\n- [Ghost vs WordPress](https://www.anchorterminal.com/compare/ghost-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "dotCMS vs Ghost", "url": "" } ], "description": "dotCMS scores 57.7 (C) to Ghost's 51.2 (D) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "dotCMS C 57.7", "Ghost D 51.2", "scores" ], "h1": "dotCMS vs Ghost", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/dotcms-vs-ghost", "published": "2026-10-01", "section": "tools", "title": "dotCMS vs Ghost for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/dotcms-vs-ghost" }, "tokens": { "markdown": 4650, "slim": 2730 }, "version": 1 }