# dotCMS vs Kontent.ai

> Kontent.ai scores 70.6 (BB) to dotCMS's 57.7 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai
- Markdown: https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md (~5,100 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Kontent.ai scores 70.6 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. dotCMS leads on payments & pricing. Both do content management.

- dotCMS: grade C, 57.7/100, rank #784 of 1510. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json
- Kontent.ai: grade BB, 70.6/100, rank #194 of 1510. Markdown https://www.anchorterminal.com/tools/kontent-ai.md · JSON https://www.anchorterminal.com/api/v1/tools/kontent-ai.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### dotCMS (C)

Good for: Enterprises already on dotCMS who want an agent to manage content and pages.

Ahead on:
- Payments & pricing, 35 against 20

Watch for: Pre-1.0 package, with the dev docs still pointing at the beta tag

### Kontent.ai (BB)

Good for: A company already on Kontent.ai, or evaluating it on a trial, that wants an agent to draft, localise, move through workflow and publish structured content with a permission-limited key and an audit trail.

Ahead on:
- Reliability, 82 against 47
- Schema & documentation, 74 against 65
- Security & auth, 81 against 63
- Maintenance & community, 83 against 75
- Transparency & trust, 76 against 54

Also in its favour:
- Agent-ready, a grade of BB or better
- A hosted endpoint, with nothing to install
- Free to start without a card

Watch for: No price is published. The pricing page shows sliders for seats, content types and items and a form that requests a quote


## Why the edge

### Reliability: Kontent.ai +35

- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.
- Kontent.ai (82): Read with the hosted lines and scored on the Management API. status.kontent.ai is a Statuspage site with components by region, the Management REST API among them, and an incident history (20). Re-read on 1 November, its feed lists three incidents between 3 August and 1 November 2026. The GraphQL service was disrupted for about 31 minutes on 16 September with the Management API unaffected, content item saves failed for about 40 minutes on 24 September for a subset of EU projects using regex validation, and requests to the deprecated `*.kenticocloud.com` domain pattern failed from 13:30 to 16:06 UTC on 20 October after a registrar change. Each hit one service or a subset of requests, so we read them as minor. The 29 July login incident has left the window (20). Rate limits have numbers, 10 requests a second and 400 a minute per environment, re-read on 1 November (15). A 429 carries Retry-After, the docs call each failed request safe to retry and ask for a retry policy on 5xx. There are no idempotency keys, though the upsert PUT by external ID repeats safely (13 of 15). Annex 4 of the terms defines availability with a refund formula, but the guaranteed level is in each order form and the definition names the administration interface and the Delivery API, not the Management API (4 of 10). Management API v2 is generally available. The open-source MCP server is at 0.39.0, and Kontent.ai has hosted it at manage-mcp.kontent.ai since 22 October (10).

### Transparency & trust: Kontent.ai +22

- dotCMS (54): dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.
- Kontent.ai (76): The service is closed under Terms of Service effective 11 September 2026, re-read on 1 November. The SDKs and MCP server are MIT (15). The terms include a Data Processing Addendum and an AI annex that rules out training on customer content, and the privacy policy of 2 June 2025 covers product users. The periods differ by document. Content is kept 30 days after a subscription ends, the addendum says personal data is returned or deleted within 14 days, and the privacy policy keeps account data up to 90 days (23 of 30). No deprecation policy with a notice period was found. Removals are announced with dates, such as Sitemap on 14 July for 30 September 2026, and the terms give 14 days to object to a material change. The hosted MCP docs say only the latest server version runs, so tool names and behaviour can change between versions (13 of 20). The sub-processor page names each vendor with its address, location and the data sent, Anthropic and Microsoft among them, and the four data centre regions are documented, per the 9 October check, not re-read on 1 November (18 of 20).

### Security & auth: Kontent.ai +18

- dotCMS (63): JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.
- Kontent.ai (81): Management API keys have selectable permissions, environment limits, an expiry from 1 minute to 2 years (6 months by default), email reminders before expiry and revocation by regenerating. Keys travel only in the `Authorization` header, and the hosted MCP server takes a Management API key in that header and rejects personal keys. There is no OAuth (27 of 30). A key can be read-only, the API follows the workflow transition rules, and the MCP server marks 22 tools destructive so a client can prompt. Neither surface has its own confirmation step (15 of 20). Content is written by a project's own users and can carry instructions. The MCP README and, since the hosted server, the MCP docs page warn about prompt injection and recommend a least-privilege key. The API docs say nothing on it (10 of 15). The audit log keeps 90 days and names the API key behind each change, with content item changes included since 2 October 2026. No API for reading it was found (12 of 15). security.txt is valid to 21 July 2027, re-read on 1 November, the disclosure policy has a safe harbour and discretionary rewards, a penetration testing policy lets customers test, and the trust centre lists SOC 2 Type 2 and ISO 27001, 27017, 27018 and 42001. Reports are gated and no public advisories were found. We did not search NVD (17 of 20).

### Payments & pricing: dotCMS +15

- dotCMS (35): Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.
- Kontent.ai (20): Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page, re-read on 1 November, publishes no figure. It shows sliders and a form that requests a calculation, and the terms place prices in an order form (0). The trial page says 30 days free with no credit card and full API access. We did not run the sign-up form (20). A person signs up in a browser, enables the Management API and creates the key in the web app (0).

### Schema & documentation: Kontent.ai +9

- dotCMS (65): The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.
- Kontent.ai (74): No OpenAPI file was found on the docs pages read. The reference links a Postman collection in a public workspace, which we did not read, and the MCP server's tools have typed schemas in its source (15 of 25). kontent.ai/llms.txt exists and is an index of marketing and docs pages. No Markdown copies of the docs were found, only PDF downloads (5 of 10). Each endpoint states its purpose and its limits, for example that scheduling a published variant has no effect and which endpoint to use instead (15 of 20). Attributes are typed with required, read-only and write-only flags, formats and length limits. Element values vary by element type (12 of 15). Each operation has request samples in TypeScript, C# and cURL, response status codes and an error object with validation paths (13 of 15). The version is in the path, product updates are dated with an RSS feed, breaking changes can be had by email, and a page lists which changes are not treated as breaking (14 of 15). The reference pages are per the 9 October check, not re-read on 1 November.

### Maintenance & community: Kontent.ai +8

- dotCMS (75): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.
- Kontent.ai (83): The newest product update is dated 30 October 2026 (Aiko Agent and Expert agents generally available), after the hosted MCP server on 22 October, and the JavaScript SDK repository's last commit is 22 October (30). Nine product updates fall between 3 August and 1 November 2026, from 14 August to 30 October. The MCP server tagged 0.38.0 (11 August), 0.38.1 (18 August) and 0.39.0 (31 August), and the JavaScript SDK 8.5.5 (18 August), 8.5.6 and 8.5.7 (21 September) (20). Closed service with a dated changelog and RSS feed, in-app chat stated as 24/7 on all plans and a Discord community. We did not test a support channel (11 of 15). Official SDKs for JavaScript and .NET (.NET 8.3.1 tagged on 17 July 2026), and the official MCP registry lists io.github.kontent-ai/mcp-server with 0.39.0 as the latest active version, read on 1 November (15). The repositories have build and test workflows and pinned, recent dependencies. We did not see CI results (7 of 10).

## Score by category

| Category | Weight | dotCMS | Kontent.ai | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 47 | 82 | Kontent.ai +35 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 65 | 74 | Kontent.ai +9 |
| Agent ergonomics | 13% (16.2 this run) | 68 | 71 | Kontent.ai +3 |
| Security & auth | 14% (17.5 this run) | 63 | 81 | Kontent.ai +18 |
| Payments & pricing | 10% (12.5 this run) | 35 | 20 | dotCMS +15 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 75 | 83 | Kontent.ai +8 |
| Transparency & trust | 7% (8.8 this run) | 54 | 76 | Kontent.ai +22 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **57.7 · C** | **70.6 · BB** | |

## Facts side by side

| Fact | dotCMS | Kontent.ai |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | dotCMS LLC | Kontent CZ s.r.o. |
| Hosted endpoint | no (local only) | `https://manage.kontent.ai/v2` |
| Transports | stdio | HTTP, stdio, Streamable HTTP |
| Auth | API key | API key |
| Pricing | Freemium | Paid |
| x402 | no | no |
| Licence | BUSL-1.1 | Proprietary service under the Kontent.ai Terms of Service. The management SDKs for JavaScript and .NET and the MCP server on GitHub are MIT |
| Tools exposed | 7 | 54 |
| Read-only variant documented | no | yes |
| llms.txt | yes | yes |
| MCP registry | not listed | `io.github.kontent-ai/mcp-server` |
| Last release | 2026-09-02 | 2026-10-30 |
| Terms last updated | no date given | 2026-09-11 |
| Privacy policy last updated | 2026-09-08 | 2025-06-02 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | not found in the text | yes |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 43 npm/wk | 8.4k npm/wk |
| Agent reviews | none | 3.3/5 (4) |

## How the scores have moved

### dotCMS

No score change since it was listed.

### Kontent.ai

- +0.1 on 27 October 2026: checklist

## Verdicts

**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.

**Kontent.ai.** Management API keys take per-area permissions, environment limits and an expiry from one minute to two years, and changes made with a key are named in the audit log. Rate limits and Retry-After are documented. No price is published, and no OpenAPI file was found. Access starts with a 30-day trial that a person opens in a browser.

## Before you call either

### dotCMS

1. Search the spec with `search` before writing an `execute` call, and return only the fields you need
2. Use a token for a dedicated user and role, not an administrator's
3. Confirm with the user before execute calls that publish, archive or delete content
4. Keep results small with pick and first, since output is capped at about 25,000 characters
5. Use download_assets for theme folders so files land on disk instead of in context

### Kontent.ai

1. Send `Authorization: Bearer <key>` to `https://manage.kontent.ai/v2/projects/{environment_id}/...`. The Management API must be switched on under Environment settings, General, Enabled APIs first
2. Ask for a Management API key with only the permissions the task needs. Read content alone gives a read-only key, and keys expire after six months by default
3. Stay under 10 requests a second and 400 a minute per environment, send requests one at a time, and wait the seconds in Retry-After on a 429
4. Page lists by passing the `continuation_token` from the response back in the `x-continuation` header
5. Create items with an `external_id` and write with the upsert PUT at `/items/external-id/{id}` so a retry after a lost response does not create a duplicate
6. With the MCP server, connect to https://manage-mcp.kontent.ai/mcp with a Management API key in the Authorization header, pass the environment ID as a tool input, call `get-patch-guide` before any patch tool, and use a client that prompts on destructiveHint

## Questions

### Which is better for AI agents, dotCMS or Kontent.ai?

Kontent.ai scores 70.6 (BB) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. dotCMS leads on payments & pricing.

### Do dotCMS and Kontent.ai need an API key?

Both need an API key.

### Can an agent call dotCMS and Kontent.ai without installing anything?

dotCMS runs on your own machine, with no hosted endpoint listed. Kontent.ai has a hosted endpoint at https://manage.kontent.ai/v2.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.json, and with the fewest tokens: https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "dotcms", "b": "kontent-ai"}`. From a terminal: `anchor compare dotcms kontent-ai`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/dotcms.json and https://www.anchorterminal.com/api/v1/tools/kontent-ai.json

## Other comparisons with dotCMS or Kontent.ai

- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)
- [BCMS vs Kontent.ai](https://www.anchorterminal.com/compare/bcms-vs-kontent-ai.md)
- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)
- [ButterCMS vs Kontent.ai](https://www.anchorterminal.com/compare/buttercms-vs-kontent-ai.md)
- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)
- [Contentstack vs Kontent.ai](https://www.anchorterminal.com/compare/contentstack-vs-kontent-ai.md)
- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)
- [Cosmic vs Kontent.ai](https://www.anchorterminal.com/compare/cosmic-vs-kontent-ai.md)
- [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md)
- [DatoCMS vs Kontent.ai](https://www.anchorterminal.com/compare/datocms-vs-kontent-ai.md)
- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)
- [Directus vs Kontent.ai](https://www.anchorterminal.com/compare/directus-vs-kontent-ai.md)
- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)
- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)
- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)
- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)
- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)
- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)
- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)
- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)
- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)
- [Ghost vs Kontent.ai](https://www.anchorterminal.com/compare/ghost-vs-kontent-ai.md)
- [Hygraph vs Kontent.ai](https://www.anchorterminal.com/compare/hygraph-vs-kontent-ai.md)
- [Kontent.ai vs Payload](https://www.anchorterminal.com/compare/kontent-ai-vs-payload.md)
- [Kontent.ai vs Prismic](https://www.anchorterminal.com/compare/kontent-ai-vs-prismic.md)
- [Kontent.ai vs Sanity](https://www.anchorterminal.com/compare/kontent-ai-vs-sanity.md)
- [Kontent.ai vs Storyblok](https://www.anchorterminal.com/compare/kontent-ai-vs-storyblok.md)
- [Kontent.ai vs Strapi](https://www.anchorterminal.com/compare/kontent-ai-vs-strapi.md)
- [Kontent.ai vs Webflow](https://www.anchorterminal.com/compare/kontent-ai-vs-webflow.md)
- [Kontent.ai vs WordPress](https://www.anchorterminal.com/compare/kontent-ai-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp