{ "data": { "a": { "slug": "dotcms", "name": "dotCMS", "vendor": "dotCMS LLC", "vendorUrl": "https://www.dotcms.com", "kind": "mcp", "category": "cms", "summary": "dotCMS is an enterprise CMS with headless REST APIs, workflows and push publishing, run as dotCMS Cloud or self-hosted. Agents use the @dotcms/mcp-server package, which searches the instance's OpenAPI spec and runs API calls in a sandbox.", "url": "https://www.anchorterminal.com/tools/dotcms", "markdownUrl": "https://www.anchorterminal.com/tools/dotcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/dotcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/dotcms.json", "dns": "dotcms.grade.anchorterminal.com", "repo": "https://github.com/dotCMS/core", "license": "BUSL-1.1", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@dotcms/mcp-server" } ], "auth": "api-key", "authNotes": "The MCP server reads DOTCMS_URL and AUTH_TOKEN. API tokens are JWTs issued for a dotCMS user, carry that user's role permissions, take an expiry in days, and are created by administrators in the user manager or through /api/v1/authentication/api-token. The docs recommend a separate user and role per application; the MCP server needs write permission for content types, content and workflows. Tokens are injected outside the sandbox, so sandboxed code never sees them.", "pricing": "freemium", "pricingNotes": "dotCMS is free with every capability for companies under $5 million in revenue under its BSL licence, self-hosted. Cloud plans (Starter, Professional, Business, Enterprise) are priced on request, with monthly request and bandwidth allowances and SLAs of 99.5 to 99.9 per cent.", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP README, the dev docs or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 7, "popularity": { "githubStars": null, "npmWeekly": 43, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://dev.dotcms.com/docs/build/integrations/dotai/mcp-server", "llmsTxt": "https://dev.dotcms.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.schema", "cms.localisation" ], "tags": [ "official", "mcp", "stdio", "self-hosted", "hosted", "source-available", "llms-txt", "sales-led", "sla", "typescript" ], "lastRelease": "2026-09-02", "graded": true, "anchor": { "graded": true, "score": 57.7, "grade": "C", "agentReady": false, "rank": 780, "ranked": true, "rankOf": 1486, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.", "bestFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "strengths": [ "Seven tools in code mode, with the instance's OpenAPI spec searchable from the sandbox", "The API token stays outside the sandbox, which only receives results", "JWT tokens per user with role permissions and an expiry", "security.txt with PGP, a bounty-backed disclosure policy and LTS security backports", "Free with every capability for organisations under $5 million in revenue" ], "weaknesses": [ "Pre-1.0 package, with the dev docs still pointing at the beta tag", "The server needs a token with write permission for content types, content and workflows", "execute can call any endpoint, and no read-only mode or annotations were found", "Cloud prices are on request only", "Source-available under the BSL, not an OSI licence" ], "agentNotes": [ "Search the spec with `search` before writing an `execute` call, and return only the fields you need", "Use a token for a dedicated user and role, not an administrator's", "Confirm with the user before execute calls that publish, archive or delete content", "Keep results small with pick and first, since output is capped at about 25,000 characters", "Use download_assets for theme folders so files land on disk instead of in context" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.7 } ], "editorialScores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 51 }, "provenanceScore": 57, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @dotcms/mcp-server", "config": { "mcpServers": { "dotcms": { "args": [ "-y", "@dotcms/mcp-server" ], "command": "npx", "env": { "AUTH_TOKEN": "your-api-token", "DOTCMS_URL": "https://your-dotcms-instance.com" } } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/dotcms" }, "area": "business", "provenance": { "legalEntity": "dotCMS LLC", "domain": "dotcms.com", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://github.com/dotCMS/core/blob/main/LICENSE", "privacy": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "statusPage": "", "changelog": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "The MCP server runs locally and calls the customer's own dotCMS instance, so the endpoint isn't on a dotCMS domain.", "The privacy policy, last updated 8 September 2026, covers dotCMS's websites only and names dotCMS Holdings, LLC, dotCMS Services LLC and dotCMS LLC.", "www.dotcms.com/robots.txt disallows /docs/ and /utils/; dev.dotcms.com allows all with Content-Signal ai-train=yes, search=yes, ai-input=yes.", "www.dotcms.com/terms-of-service and /privacy-policy returned 404; no cloud terms of service were found, so the licence stands in for terms.", "No status page answered (status.dotcms.com refused the connection)." ], "score": 57 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/dotcms.json", "live": { "slug": "dotcms", "versions": [ { "registry": "github", "name": "dotCMS/core", "version": "dotcms-cli-26.11.06-03", "released": "2026-11-06", "seenAt": "2026-11-06T23:22:22.409374032Z" }, { "registry": "npm", "name": "@dotcms/mcp-server", "version": "0.1.1", "seenAt": "2026-11-06T23:22:21.577680774Z" } ], "githubStars": 971, "npmWeekly": 43, "securityTxt": { "url": "https://dotcms.com/.well-known/security.txt", "state": "valid", "expires": "2027-06-09T23:59:59.000Z", "checkedAt": "2026-11-07T16:00:46.289271049Z" }, "llmsTxt": { "url": "https://dev.dotcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:19.058875451Z" }, "pages": [ { "url": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:02:43.439634709Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "14706a7e3d20" }, { "url": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:02:39.904485204Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b8fe703d4258" }, { "url": "https://raw.githubusercontent.com/dotCMS/core/main/LICENSE", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:20:41.976083247Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dd3baa6b46f" } ], "updatedAt": "2026-11-07T16:00:46.289271049Z" } }, "answer": "dotCMS scores 57.7 (C) on agent readiness against Payload's 50.1 (D), and leads in 2 of 7 scored categories. Payload leads on reliability, schema \u0026 documentation, payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "payload", "name": "Payload", "vendor": "Payload CMS, Inc. (Figma)", "vendorUrl": "https://payloadcms.com", "kind": "http-api", "category": "cms", "summary": "Payload is an open-source, code-first headless CMS and application framework for Node.js and Next.js, now part of Figma. Agents manage content, drafts, versions and locales through generated REST and GraphQL APIs or an official MCP plugin.", "url": "https://www.anchorterminal.com/tools/payload", "markdownUrl": "https://www.anchorterminal.com/tools/payload.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/payload.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/payload.json", "dns": "payload.grade.anchorterminal.com", "repo": "https://github.com/payloadcms/payload", "license": "MIT for the core and the official packages. Enterprise add-ons are sold separately through sales", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "payload" }, { "registry": "npm", "name": "@payloadcms/plugin-mcp" }, { "registry": "npm", "name": "@payloadcms/sdk" } ], "auth": "api-key", "authNotes": "Self-serve keys on your own instance, with no app review or partner approval. REST and GraphQL take a per-user API key sent as `Authorization: {collection-slug} API-Key {key}` once `auth.useAPIKey` is set on an auth collection. The key signs requests in as that user under the collection's access control, doesn't expire, is shown once, and can be regenerated or revoked by an admin. The MCP plugin has its own keys, created in the admin panel under MCP API Keys with find, create, update and delete switches per collection, sent as `Authorization: Bearer {key}`. Changing `PAYLOAD_SECRET` invalidates every key.", "pricing": "free", "pricingNotes": "Free to self-host under the MIT licence, with no account at Payload and no card, so an agent can start without a contract. Enterprise (SSO, publishing workflows, visual editor, dedicated support) is sold through sales with no public price. Payload Cloud has paused deployment of new projects since Payload joined Figma (checked 2026-10-08).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the 3.x documentation, the get-started page or the MCP plugin source (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 45151, "npmWeekly": 1108564, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://payloadcms.com/docs", "llmsTxt": "https://payloadcms.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.localisation", "cms.assets", "cms.schema" ], "tags": [ "open-source", "self-hosted", "mcp", "llms-txt", "graphql", "rest", "typescript", "nextjs" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 50.1, "grade": "D", "agentReady": false, "rank": 1068, "ranked": true, "rankOf": 1486, "categoryRank": 16, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 78, "payments": 45, "reliability": 76, "schema": 70, "security": 57, "transparency": 65 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -15, "negativeNotes": [ "5 February to 7 October 2026, counted per advisory on 4 November. OSV lists 38 Payload advisories published in the 12 months to 4 November 2026 (7 critical, 19 high, 12 moderate), 28 of them on 6 and 7 October, and GitHub listed 49 on 8 October. They include remote code execution through the first-register operation (GHSA-97rh-rhh2-7vjv), SQL injection on Postgres and SQLite (GHSA-v49j-62m6-pgrr) and unauthorised document updates (GHSA-f7hx-52q9-hcrf). All but one are fixed and vendor-published. GHSA-jg8r-5jh2-v2xj (Moderate, from a third-party CVE record) gives only a last affected version, 3.88.0, and costs 0. The ten fixed Highs in the payload core package on 6 and 7 October alone come to 20 at 2 each, so with the two -3 terms below the deduction is held at the floor of -15. https://osv.dev/list?q=payload\u0026ecosystem=npm", "2026-10-15. 3.91.0, a minor release, changed the MCP find, create and update tools' `select` input and the auth tool's `headers` from a JSON string to an object. The commit says clients that send them as strings now get an input validation error, The commit carries no breaking marker, and no earlier notice was found in the 3.x docs or tags (-3). https://github.com/payloadcms/payload/commit/0f6c5b015079c69e8a5469c411f06bbe8cf89907", "2026-10-15 and 2026-10-27. Released fixes of described flaws in the payload core package with no advisory. 3.91.0 makes `findByID` apply read access to the latest draft, which could return a base row when that draft should be denied, and 3.92.1 runs the password field's validation on reset, which before the fix let a user reset a password to `abc` despite a configured minimum length (-3, one term). https://github.com/payloadcms/payload/commit/779f06ff826cc693919df122349720dc7ab971c5" ], "verdict": "Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. 38 advisories were published in the 12 months to November 2026, most on 6 and 7 October, so an install older than 3.90.0 is exposed. No OpenAPI file is published.", "bestFor": "Teams that build on Next.js and want the content model in TypeScript, with drafts, versions and localisation in the free core.", "strengths": [ "MIT core with drafts, version history and restore through `POST /api/{collection-slug}/versions/:id`, none of it behind a paid plan", "MCP API keys carry find, create, update and delete switches per collection, and the key's user still passes through the collection's access control", "New documents default to `_status: 'draft'`, so nothing is published unless the request sets `_status: 'published'`", "MCP find tools default to 10 documents and depth 0, cap at 100, and take `select` to return named fields only", "llms.txt per major version, llms-full.txt and a Markdown copy of every docs page" ], "weaknesses": [ "38 security advisories on OSV in the 12 months to 4 November 2026, 7 critical, 28 published on 6 and 7 October", "No OpenAPI file is published or generated by the core packages, and REST error responses have no reference page", "REST and MCP API keys don't expire, and rate limiting is left to the owner's own hooks or proxy", "No idempotency keys, and the MCP tools set no `readOnlyHint` or `destructiveHint` annotations in 3.92.1", "Payload Cloud is closed to new projects, Enterprise is priced by sales, and no status page or security.txt was found" ], "agentNotes": [ "Check the installed version first. Anything below 3.90.0 carries published critical advisories, and 3.92.0 and later need Node.js 22.23.4 or 24.22.1, so ask the owner to upgrade before writing", "Send REST keys as `Authorization: {collection-slug} API-Key {key}` and MCP keys as `Authorization: Bearer {key}`. The two key kinds are separate", "To publish, set `_status: 'published'` in the data. The `draft` parameter only relaxes validation and chooses where an update is written", "Upload files with multipart POST to the upload collection, with other fields as JSON in `_payload`. No MCP upload tool is documented", "Roll back with `POST /api/{collection-slug}/versions/:id` after listing versions. Versions exist only where the collection config enables them" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 50.1 } ], "editorialScores": { "ergonomics": 64, "maintenance": 78, "payments": 45, "reliability": 76, "schema": 70, "security": 57, "transparency": 74 }, "provenanceScore": 56, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx create-payload-app", "http": "curl 'http://localhost:3000/api/pages' \\\n -H \"Authorization: users API-Key $PAYLOAD_API_KEY\"", "claudeCode": "claude mcp add --transport http Payload http://127.0.0.1:3000/api/mcp \\\n --header \"Authorization: Bearer MCP-USER-API-KEY\"", "config": { "mcpServers": { "Payload": { "headers": { "Authorization": "Bearer MCP-USER-API-KEY" }, "type": "http", "url": "http://localhost:3000/api/mcp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/payload" }, "area": "business", "unitPrices": [ { "item": "Self-hosted Payload", "unit": "month", "usd": 0, "note": "MIT, you pay for your own hosting and database" } ], "provenance": { "legalEntity": "Payload CMS, Inc.", "domain": "payloadcms.com", "domainRegistered": "2018-04-02", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://payloadcms.com/privacy", "statusPage": "", "changelog": "https://github.com/payloadcms/payload/releases", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "No `terms` is recorded. The only terms on payloadcms.com are the Payload Cloud terms at https://payloadcms.com/cloud-terms, which govern a hosted service closed to new projects. The software an agent uses is under the MIT licence in LICENSE.md.", "The privacy policy (effective 28 March 2024) names Payload CMS, Inc. as controller. The Cloud terms call it a Delaware corporation with an address at 624 Stocking Ave. NW, Grand Rapids, Michigan 49504. LICENSE.md names Payload CMS, LLC.", "The site says Payload has joined Figma. The privacy policy and the Cloud terms don't mention Figma.", "A self-hosted install answers on its owner's domain.", "https://payloadcms.com/.well-known/security.txt and https://payloadcms.com/security.txt returned 404 on 8 October 2026. SECURITY.md gives security@payloadcms.com.", "No status page is linked from the site footer, the security page or the get-started page, and status.payloadcms.com didn't resolve.", "RDAP for payloadcms.com gives a registration date of 2018-04-02." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/payload.json", "live": { "slug": "payload", "versions": [ { "registry": "github", "name": "payloadcms/payload", "version": "v3.93.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:54:45.541345599Z" }, { "registry": "npm", "name": "@payloadcms/plugin-mcp", "version": "3.93.0", "seenAt": "2026-11-06T23:54:42.211942183Z" }, { "registry": "npm", "name": "@payloadcms/sdk", "version": "3.93.0", "seenAt": "2026-11-06T23:54:43.736498363Z" }, { "registry": "npm", "name": "payload", "version": "3.93.0", "seenAt": "2026-11-06T23:54:40.407274595Z" } ], "githubStars": 45704, "npmWeekly": 1559191, "securityTxt": { "url": "https://payloadcms.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:26.701040057Z" }, "llmsTxt": { "url": "https://payloadcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:36.323644893Z" }, "domain": { "domain": "payloadcms.com", "registered": "2018-04-02", "source": "https://rdap.verisign.com/com/v1/domain/payloadcms.com", "checkedAt": "2026-11-01T14:25:48.820751509Z" }, "pages": [ { "url": "https://payloadcms.com/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:16:07.777499825Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f0ac80167ab5" } ], "github": { "repo": "payloadcms/payload", "checkedAt": "2026-11-02T09:15:04.874079949Z", "stars": 45615, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T04:10:19Z", "openIssues": 563, "openPRs": 908, "issuesOpened90d": 282, "issuesClosed90d": 105, "prsMerged90d": 589, "ci": { "branch": "main", "runs": 50, "success": 44, "failure": 6, "other": 0, "latest": "success", "latestAt": "2026-10-30T21:03:13Z" }, "advisories": [ { "ghsa": "GHSA-mg7r-jhr9-m745", "severity": "medium", "published": "2026-10-08T13:43:37Z" }, { "ghsa": "GHSA-wvw7-x9pg-w4cc", "severity": "medium", "published": "2026-10-08T13:41:15Z" }, { "ghsa": "GHSA-g6p9-6gm4-cj6m", "severity": "medium", "published": "2026-10-08T13:40:11Z" }, { "ghsa": "GHSA-m35c-r5p5-c3w8", "severity": "medium", "published": "2026-10-08T13:34:55Z" }, { "ghsa": "GHSA-97w9-jq7h-73pq", "severity": "medium", "published": "2026-10-08T13:33:28Z" }, { "ghsa": "GHSA-8j2x-hjh9-3ff8", "severity": "medium", "published": "2026-10-08T13:30:36Z" }, { "ghsa": "GHSA-cqr4-hjg9-833p", "severity": "high", "published": "2026-10-08T13:29:15Z" }, { "ghsa": "GHSA-h5rh-4jwf-738p", "severity": "high", "published": "2026-10-06T13:51:06Z" }, { "ghsa": "GHSA-jjm7-864w-gg8q", "severity": "high", "published": "2026-10-06T13:48:22Z" }, { "ghsa": "GHSA-2qw6-cm49-277x", "severity": "high", "published": "2026-10-06T13:46:58Z" }, { "ghsa": "GHSA-q6mq-ch85-c8mm", "cve": "CVE-2026-105804", "severity": "medium", "published": "2026-09-29T19:03:57Z" }, { "ghsa": "GHSA-mc8m-rr6c-r5qr", "cve": "CVE-2026-93363", "severity": "medium", "published": "2026-09-25T13:57:20Z" }, { "ghsa": "GHSA-9g87-32v6-3c2r", "cve": "CVE-2026-105805", "severity": "medium", "published": "2026-09-22T21:17:14Z" }, { "ghsa": "GHSA-2q76-m6w6-qgc6", "cve": "CVE-2026-105806", "severity": "high", "published": "2026-09-22T21:16:13Z" }, { "ghsa": "GHSA-qf28-8hc6-vwrp", "cve": "CVE-2026-105844", "severity": "critical", "published": "2026-09-22T21:15:53Z" }, { "ghsa": "GHSA-v49j-62m6-pgrr", "cve": "CVE-2026-105845", "severity": "critical", "published": "2026-09-22T21:15:22Z" }, { "ghsa": "GHSA-w84c-53h3-mc2g", "cve": "CVE-2026-105846", "severity": "medium", "published": "2026-09-22T21:14:59Z" }, { "ghsa": "GHSA-fpww-c55p-cjv6", "cve": "CVE-2026-105847", "severity": "high", "published": "2026-09-18T16:56:00Z" }, { "ghsa": "GHSA-r9v2-gg2j-22q5", "cve": "CVE-2026-105848", "severity": "medium", "published": "2026-09-18T16:55:34Z" }, { "ghsa": "GHSA-238x-w2j9-gwwr", "cve": "CVE-2026-105849", "severity": "high", "published": "2026-09-18T16:52:57Z" }, { "ghsa": "GHSA-8r29-2mp2-pmrw", "cve": "CVE-2026-105850", "severity": "high", "published": "2026-09-18T16:52:10Z" }, { "ghsa": "GHSA-7c34-32v3-j575", "cve": "CVE-2026-105852", "severity": "medium", "published": "2026-09-18T16:51:57Z" }, { "ghsa": "GHSA-xgv3-crq2-6f69", "cve": "CVE-2026-105853", "severity": "high", "published": "2026-09-18T16:51:35Z" }, { "ghsa": "GHSA-2g7p-5934-q4w7", "cve": "CVE-2026-105854", "severity": "high", "published": "2026-09-18T16:51:17Z" }, { "ghsa": "GHSA-fx49-4h83-wjv9", "cve": "CVE-2026-105855", "severity": "high", "published": "2026-09-18T16:50:47Z" }, { "ghsa": "GHSA-pj7x-6wpf-pgvp", "cve": "CVE-2026-105856", "severity": "high", "published": "2026-09-18T16:49:45Z" }, { "ghsa": "GHSA-97rh-rhh2-7vjv", "cve": "CVE-2026-105858", "severity": "high", "published": "2026-09-18T16:49:05Z" }, { "ghsa": "GHSA-p96c-xwx8-3cqj", "cve": "CVE-2026-105860", "severity": "high", "published": "2026-09-18T16:48:16Z" }, { "ghsa": "GHSA-pj5h-5q6c-3pfx", "cve": "CVE-2026-105861", "severity": "high", "published": "2026-09-18T16:47:28Z" }, { "ghsa": "GHSA-2pwp-2369-8fg3", "cve": "CVE-2026-105862", "severity": "high", "published": "2026-09-18T16:40:31Z" }, { "ghsa": "GHSA-xhm9-gwgw-3q2q", "cve": "CVE-2026-105864", "severity": "medium", "published": "2026-09-18T16:40:05Z" }, { "ghsa": "GHSA-p223-2wr2-j562", "cve": "CVE-2026-105865", "severity": "high", "published": "2026-09-18T16:39:47Z" }, { "ghsa": "GHSA-v5gf-vpjc-pc7w", "cve": "CVE-2026-105866", "severity": "medium", "published": "2026-09-18T16:39:23Z" }, { "ghsa": "GHSA-7vg8-29qx-jgj8", "cve": "CVE-2026-105867", "severity": "high", "published": "2026-09-18T16:38:59Z" }, { "ghsa": "GHSA-9qpg-3cf8-w33x", "cve": "CVE-2026-105868", "severity": "high", "published": "2026-09-18T16:38:12Z" }, { "ghsa": "GHSA-vc4h-q48j-5hcx", "cve": "CVE-2026-105851", "severity": "critical", "published": "2026-09-18T14:40:21Z" }, { "ghsa": "GHSA-r488-j9vj-wx3q", "cve": "CVE-2026-105857", "severity": "critical", "published": "2026-09-18T14:37:58Z" }, { "ghsa": "GHSA-f7hx-52q9-hcrf", "cve": "CVE-2026-105859", "severity": "critical", "published": "2026-09-18T14:37:41Z" }, { "ghsa": "GHSA-66wr-7vmr-p5jq", "cve": "CVE-2026-105863", "severity": "critical", "published": "2026-09-18T14:37:16Z" }, { "ghsa": "GHSA-4ww4-68q3-h7g5", "cve": "CVE-2026-106100", "severity": "high", "published": "2026-08-27T20:54:58Z" }, { "ghsa": "GHSA-hp5w-3hxx-vmwf", "cve": "CVE-2026-34751", "severity": "critical", "published": "2026-03-30T16:35:21Z" }, { "ghsa": "GHSA-frq9-7j6g-v74x", "cve": "CVE-2026-34750", "severity": "medium", "published": "2026-03-30T16:35:10Z" }, { "ghsa": "GHSA-p6mr-xf3r-ghq4", "cve": "CVE-2026-34749", "severity": "medium", "published": "2026-03-30T16:32:12Z" }, { "ghsa": "GHSA-6r7f-q7f5-wpx8", "cve": "CVE-2026-34746", "severity": "high", "published": "2026-03-30T16:32:08Z" }, { "ghsa": "GHSA-mmxc-95ch-2j7c", "cve": "CVE-2026-34748", "severity": "high", "published": "2026-03-30T16:32:04Z" }, { "ghsa": "GHSA-7xxh-373w-35vg", "cve": "CVE-2026-34747", "severity": "high", "published": "2026-03-30T16:21:20Z" }, { "ghsa": "GHSA-hhfx-5x8j-f5f6", "cve": "CVE-2026-27567", "severity": "medium", "published": "2026-02-23T14:20:17Z" }, { "ghsa": "GHSA-xx6w-jxg9-2wh8", "cve": "CVE-2026-25544", "severity": "critical", "published": "2026-02-05T18:05:22Z" }, { "ghsa": "GHSA-jq29-r496-r955", "cve": "CVE-2026-25574", "severity": "medium", "published": "2026-02-05T18:05:12Z" }, { "ghsa": "GHSA-35jj-vqcf-f2jf", "cve": "CVE-2023-30843", "severity": "high", "published": "2023-04-26T14:03:53Z" } ], "replies": { "sampled": 25, "unanswered": 23, "medianDays": 0.4 } }, "updatedAt": "2026-11-07T16:00:26.701040057Z" } }, "edges": [ { "by": 29, "category": "reliability", "leads": "payload", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.", "b": "Read with the local-software lines, since the graded surface is software its owner hosts. Official npm packages, with Node.js `^22.23.4 || \u003e=24.22.1` in `engines` and in the installation docs since 3.92.0 (20). A public `ci` workflow runs unit, type, integration and end-to-end tests on every push to 3.x. GitHub's pages and API couldn't be read on 4 November, so the result is unread (15 of 25). 499 issues were open on 8 October, 140 of them awaiting triage, with 225 opened and 116 closed since 10 July 2026, not re-read (12 of 25). A written semver policy marks breaking commits with `!` and lists them in release notes, but lets security fixes and experimental APIs change in minor releases (14 of 15). 3.x is the stable line, with 4.0 in beta (15)." }, "scores": { "a": 47, "b": 76 } }, { "by": 11, "category": "transparency", "leads": "payload", "name": "Transparency \u0026 trust", "reasons": { "a": "dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.", "b": "MIT for the core and official packages, with LICENSE.md in the repository (30). A self-hosted install keeps content on its owner's servers. The privacy policy dates from 28 March 2024, states no retention periods that we could find and doesn't mention Figma. The only published terms cover Payload Cloud, which is closed to new projects (15 of 30). A written versioning policy defines breaking changes and how they're announced, with a migration guide per major. No end-of-support date for 3.x was found (13 of 20). Telemetry is on by default, documented as completely anonymous and turned off with `telemetry: false`. The docs don't list the fields sent. The 3.92.1 source sends versions, adapters, plugins, locales, a random install ID and project, domain and user IDs hashed with the install's own secret (16 of 20)." }, "scores": { "a": 54, "b": 65 } }, { "by": 10, "category": "payments", "leads": "payload", "name": "Payments \u0026 pricing", "reasons": { "a": "Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.", "b": "Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under MIT, which the get-started page states. The only paid option, Enterprise, is priced by sales, and Payload Cloud is closed to new projects, so 15 of 20. No card and no account at Payload are needed (20). `npx create-payload-app` installs it, but the docs create REST and MCP API keys in the admin panel, so half (10)." }, "scores": { "a": 35, "b": 45 } }, { "by": 6, "category": "security", "leads": "dotcms", "name": "Security \u0026 auth", "reasons": { "a": "JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.", "b": "REST keys are per user, revocable and regenerable, shown once, and limited by that user's access control down to field level. MCP keys carry per-collection, per-operation switches. Both travel only in the Authorization header. Neither expires, and there is no OAuth (24 of 30). A find-only MCP key is a config switch away and the collection's access control still runs under it. Nothing asks a person to approve a delete or a publish in the free edition (14 of 20). Documents hold text written by other people, and no prompt-injection guidance was found. `overrideResponse` can strip fields before they reach a model (3 of 15). Versions record each change, and `onEvent` and `verboseLogs` expose MCP calls to the owner's own logging. No built-in audit log (7 of 15). SECURITY.md gives a reporting address and, since 16 October 2026, says Payload pays no monetary rewards and runs no bug bounty. Advisories are published on GitHub with affected versions, patches and workarounds. No security.txt or SOC 2 statement was found (9 of 20)." }, "scores": { "a": 63, "b": 57 } }, { "by": 5, "category": "schema", "leads": "payload", "name": "Schema \u0026 documentation", "reasons": { "a": "The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.", "b": "No OpenAPI file is published or generated by the core packages, because endpoints depend on each project's config. Every MCP tool carries a typed input schema built from the collection's fields, and the GraphQL schema is generated from the same config (20 of 25). llms.txt per major version, llms-full.txt and a Markdown copy of every docs page (10). Default MCP tool descriptions are one line, such as `Create a document in a collection.`, unless the owner writes one in the plugin config. The docs tell owners to do so (10 of 20). Field inputs are typed with bounds on `limit` and `depth`, but `where` is JSON passed as a string. `select` became an object in the MCP find tools in 3.91.0 (10 of 15). REST operations show a request and a response each. No reference page for error responses or status codes was found (8 of 15). Semver, release notes on GitHub and separate docs per major version. REST paths carry no version (12 of 15)." }, "scores": { "a": 65, "b": 70 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "dotCMS LLC", "b": "Payload CMS, Inc. (Figma)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "BUSL-1.1", "b": "MIT for the core and the official packages. Enterprise add-ons are sold separately through sales", "name": "Licence" }, { "a": "7", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-02", "b": "2026-10-27", "name": "Last release" }, { "a": "no date given", "b": "no document linked", "name": "Terms last updated" }, { "a": "2026-09-08", "b": "2024-03-28", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "43 npm/wk", "b": "45k stars, 1.1M npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "dotCMS scores 57.7 (C) on agent readiness against Payload's 50.1 (D), and leads in 2 of 7 scored categories. Payload leads on reliability, schema \u0026 documentation, payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, dotCMS or Payload?" }, { "answer": "Both need an API key.", "question": "Do dotCMS and Payload need an API key?" }, { "answer": "dotCMS runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Payload.", "question": "Can an agent call dotCMS and Payload without installing anything?" }, { "answer": "No open-source release is listed for dotCMS. Payload is open source (MIT for the core and the official packages. Enterprise add-ons are sold separately through sales).", "question": "Are dotCMS and Payload open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 63 against 57" ], "also": [ "Runs on your own machine", "No incidents deducted, where Payload loses 15 points for them" ], "goodFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "slug": "dotcms", "watchFor": "Pre-1.0 package, with the dev docs still pointing at the beta tag" }, { "aheadOn": [ "Reliability, 76 against 47", "Schema \u0026 documentation, 70 against 65", "Payments \u0026 pricing, 45 against 35", "Transparency \u0026 trust, 65 against 54" ], "also": [ "Open source" ], "goodFor": "Teams that build on Next.js and want the content model in TypeScript, with drafts, versions and localisation in the free core.", "slug": "payload", "watchFor": "38 security advisories on OSV in the 12 months to 4 November 2026, 7 critical, 28 published on 6 and 7 October" } ], "history": { "dotcms": null, "payload": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-04", "delta": -5.4, "from": 55.5, "fromGrade": "C", "to": 50.1, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.3, "from": 55.2, "fromGrade": "C", "to": 55.5, "toGrade": "C" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-payload.json", "title": "BCMS vs Payload", "url": "https://www.anchorterminal.com/compare/bcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms.json", "title": "ButterCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-payload.json", "title": "ButterCMS vs Payload", "url": "https://www.anchorterminal.com/compare/buttercms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms.json", "title": "Contentstack vs dotCMS", "url": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-payload.json", "title": "Contentstack vs Payload", "url": "https://www.anchorterminal.com/compare/contentstack-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-payload.json", "title": "Cosmic vs Payload", "url": "https://www.anchorterminal.com/compare/cosmic-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-dotcms.json", "title": "DatoCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/datocms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-payload.json", "title": "DatoCMS vs Payload", "url": "https://www.anchorterminal.com/compare/datocms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-dotcms.json", "title": "Directus vs dotCMS", "url": "https://www.anchorterminal.com/compare/directus-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-payload.json", "title": "Directus vs Payload", "url": "https://www.anchorterminal.com/compare/directus-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-ghost.json", "title": "dotCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/dotcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph.json", "title": "dotCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.json", "title": "dotCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-prismic.json", "title": "dotCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/dotcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-sanity.json", "title": "dotCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/dotcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok.json", "title": "dotCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-strapi.json", "title": "dotCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/dotcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-webflow.json", "title": "dotCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/dotcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress.json", "title": "dotCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-payload.json", "title": "Ghost vs Payload", "url": "https://www.anchorterminal.com/compare/ghost-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-payload.json", "title": "Hygraph vs Payload", "url": "https://www.anchorterminal.com/compare/hygraph-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-payload.json", "title": "Kontent.ai vs Payload", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-prismic.json", "title": "Payload vs Prismic", "url": "https://www.anchorterminal.com/compare/payload-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-sanity.json", "title": "Payload vs Sanity", "url": "https://www.anchorterminal.com/compare/payload-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-storyblok.json", "title": "Payload vs Storyblok", "url": "https://www.anchorterminal.com/compare/payload-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-strapi.json", "title": "Payload vs Strapi", "url": "https://www.anchorterminal.com/compare/payload-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-webflow.json", "title": "Payload vs Webflow", "url": "https://www.anchorterminal.com/compare/payload-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-wordpress.json", "title": "Payload vs WordPress", "url": "https://www.anchorterminal.com/compare/payload-vs-wordpress" } ], "panel": null, "scores": [ { "by": 29, "dotcms": 47, "edge": "payload", "key": "reliability", "name": "Reliability", "payload": 76, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 5, "dotcms": 65, "edge": "payload", "key": "schema", "name": "Schema \u0026 documentation", "payload": 70, "weight": 13 }, { "by": 4, "dotcms": 68, "edge": "dotcms", "key": "ergonomics", "name": "Agent ergonomics", "payload": 64, "weight": 13 }, { "by": 6, "dotcms": 63, "edge": "dotcms", "key": "security", "name": "Security \u0026 auth", "payload": 57, "weight": 14 }, { "by": 10, "dotcms": 35, "edge": "payload", "key": "payments", "name": "Payments \u0026 pricing", "payload": 45, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 3, "dotcms": 75, "edge": "payload", "key": "maintenance", "name": "Maintenance \u0026 community", "payload": 78, "weight": 7 }, { "by": 11, "dotcms": 54, "edge": "payload", "key": "transparency", "name": "Transparency \u0026 trust", "payload": 65, "weight": 7 } ], "summary": "dotCMS scores 57.7 (C) on agent readiness against Payload's 50.1 (D), and leads in 2 of 7 scored categories. Payload leads on reliability, schema \u0026 documentation, payments \u0026 pricing and transparency \u0026 trust. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "dotcms": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.", "payload": "Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. 38 advisories were published in the 12 months to November 2026, most on 6 and 7 October, so an install older than 3.90.0 is exposed. No OpenAPI file is published." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/dotcms-vs-payload", "json": "https://www.anchorterminal.com/compare/dotcms-vs-payload.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/dotcms-vs-payload.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/dotcms-vs-payload.min.md" }, "markdown": "dotCMS scores 57.7 (C) on agent readiness against Payload's 50.1 (D), and leads in 2 of 7 scored categories. Payload leads on reliability, schema \u0026 documentation, payments \u0026 pricing and transparency \u0026 trust. Both do content management.\n\n- dotCMS: grade C, 57.7/100, rank #780 of 1486. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json\n- Payload: grade D, 50.1/100, rank #1068 of 1486. Markdown https://www.anchorterminal.com/tools/payload.md · JSON https://www.anchorterminal.com/api/v1/tools/payload.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### dotCMS (C)\n\nGood for: Enterprises already on dotCMS who want an agent to manage content and pages.\n\nAhead on:\n- Security \u0026 auth, 63 against 57\n\nAlso in its favour:\n- Runs on your own machine\n- No incidents deducted, where Payload loses 15 points for them\n\nWatch for: Pre-1.0 package, with the dev docs still pointing at the beta tag\n\n### Payload (D)\n\nGood for: Teams that build on Next.js and want the content model in TypeScript, with drafts, versions and localisation in the free core.\n\nAhead on:\n- Reliability, 76 against 47\n- Schema \u0026 documentation, 70 against 65\n- Payments \u0026 pricing, 45 against 35\n- Transparency \u0026 trust, 65 against 54\n\nAlso in its favour:\n- Open source\n\nWatch for: 38 security advisories on OSV in the 12 months to 4 November 2026, 7 critical, 28 published on 6 and 7 October\n\n\n## Why the edge\n\n### Reliability: Payload +29\n\n- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.\n- Payload (76): Read with the local-software lines, since the graded surface is software its owner hosts. Official npm packages, with Node.js `^22.23.4 || \u003e=24.22.1` in `engines` and in the installation docs since 3.92.0 (20). A public `ci` workflow runs unit, type, integration and end-to-end tests on every push to 3.x. GitHub's pages and API couldn't be read on 4 November, so the result is unread (15 of 25). 499 issues were open on 8 October, 140 of them awaiting triage, with 225 opened and 116 closed since 10 July 2026, not re-read (12 of 25). A written semver policy marks breaking commits with `!` and lists them in release notes, but lets security fixes and experimental APIs change in minor releases (14 of 15). 3.x is the stable line, with 4.0 in beta (15).\n\n### Transparency \u0026 trust: Payload +11\n\n- dotCMS (54): dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.\n- Payload (65): MIT for the core and official packages, with LICENSE.md in the repository (30). A self-hosted install keeps content on its owner's servers. The privacy policy dates from 28 March 2024, states no retention periods that we could find and doesn't mention Figma. The only published terms cover Payload Cloud, which is closed to new projects (15 of 30). A written versioning policy defines breaking changes and how they're announced, with a migration guide per major. No end-of-support date for 3.x was found (13 of 20). Telemetry is on by default, documented as completely anonymous and turned off with `telemetry: false`. The docs don't list the fields sent. The 3.92.1 source sends versions, adapters, plugins, locales, a random install ID and project, domain and user IDs hashed with the install's own secret (16 of 20).\n\n### Payments \u0026 pricing: Payload +10\n\n- dotCMS (35): Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.\n- Payload (45): Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under MIT, which the get-started page states. The only paid option, Enterprise, is priced by sales, and Payload Cloud is closed to new projects, so 15 of 20. No card and no account at Payload are needed (20). `npx create-payload-app` installs it, but the docs create REST and MCP API keys in the admin panel, so half (10).\n\n### Security \u0026 auth: dotCMS +6\n\n- dotCMS (63): JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.\n- Payload (57): REST keys are per user, revocable and regenerable, shown once, and limited by that user's access control down to field level. MCP keys carry per-collection, per-operation switches. Both travel only in the Authorization header. Neither expires, and there is no OAuth (24 of 30). A find-only MCP key is a config switch away and the collection's access control still runs under it. Nothing asks a person to approve a delete or a publish in the free edition (14 of 20). Documents hold text written by other people, and no prompt-injection guidance was found. `overrideResponse` can strip fields before they reach a model (3 of 15). Versions record each change, and `onEvent` and `verboseLogs` expose MCP calls to the owner's own logging. No built-in audit log (7 of 15). SECURITY.md gives a reporting address and, since 16 October 2026, says Payload pays no monetary rewards and runs no bug bounty. Advisories are published on GitHub with affected versions, patches and workarounds. No security.txt or SOC 2 statement was found (9 of 20).\n\n### Schema \u0026 documentation: Payload +5\n\n- dotCMS (65): The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.\n- Payload (70): No OpenAPI file is published or generated by the core packages, because endpoints depend on each project's config. Every MCP tool carries a typed input schema built from the collection's fields, and the GraphQL schema is generated from the same config (20 of 25). llms.txt per major version, llms-full.txt and a Markdown copy of every docs page (10). Default MCP tool descriptions are one line, such as `Create a document in a collection.`, unless the owner writes one in the plugin config. The docs tell owners to do so (10 of 20). Field inputs are typed with bounds on `limit` and `depth`, but `where` is JSON passed as a string. `select` became an object in the MCP find tools in 3.91.0 (10 of 15). REST operations show a request and a response each. No reference page for error responses or status codes was found (8 of 15). Semver, release notes on GitHub and separate docs per major version. REST paths carry no version (12 of 15).\n\n## Score by category\n\n| Category | Weight | dotCMS | Payload | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 47 | 76 | Payload +29 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 65 | 70 | Payload +5 |\n| Agent ergonomics | 13% (16.2 this run) | 68 | 64 | dotCMS +4 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 57 | dotCMS +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 35 | 45 | Payload +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 75 | 78 | Payload +3 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 54 | 65 | Payload +11 |\n| Negative events | ≤15 | 0 | -15 | |\n| **Total** | | **57.7 · C** | **50.1 · D** | |\n\n## Facts side by side\n\n| Fact | dotCMS | Payload |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | dotCMS LLC | Payload CMS, Inc. (Figma) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | stdio | HTTP, Streamable HTTP |\n| Auth | API key | API key |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | BUSL-1.1 | MIT for the core and the official packages. Enterprise add-ons are sold separately through sales |\n| Tools exposed | 7 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-09-02 | 2026-10-27 |\n| Terms last updated | no date given | no document linked |\n| Privacy policy last updated | 2026-09-08 | 2024-03-28 |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | not found in the text | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n| Popularity | 43 npm/wk | 45k stars, 1.1M npm/wk |\n\n## How the scores have moved\n\n### dotCMS\n\nNo score change since it was listed.\n\n### Payload\n\n- -5.4 on 4 November 2026 (C to D): new evidence, correction\n- +0.3 on 27 October 2026: checklist\n\n## Verdicts\n\n**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.\n\n**Payload.** Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. 38 advisories were published in the 12 months to November 2026, most on 6 and 7 October, so an install older than 3.90.0 is exposed. No OpenAPI file is published.\n\n## Before you call either\n\n### dotCMS\n\n1. Search the spec with `search` before writing an `execute` call, and return only the fields you need\n2. Use a token for a dedicated user and role, not an administrator's\n3. Confirm with the user before execute calls that publish, archive or delete content\n4. Keep results small with pick and first, since output is capped at about 25,000 characters\n5. Use download_assets for theme folders so files land on disk instead of in context\n\n### Payload\n\n1. Check the installed version first. Anything below 3.90.0 carries published critical advisories, and 3.92.0 and later need Node.js 22.23.4 or 24.22.1, so ask the owner to upgrade before writing\n2. Send REST keys as `Authorization: {collection-slug} API-Key {key}` and MCP keys as `Authorization: Bearer {key}`. The two key kinds are separate\n3. To publish, set `_status: 'published'` in the data. The `draft` parameter only relaxes validation and chooses where an update is written\n4. Upload files with multipart POST to the upload collection, with other fields as JSON in `_payload`. No MCP upload tool is documented\n5. Roll back with `POST /api/{collection-slug}/versions/:id` after listing versions. Versions exist only where the collection config enables them\n\n## Questions\n\n### Which is better for AI agents, dotCMS or Payload?\n\ndotCMS scores 57.7 (C) on agent readiness against Payload's 50.1 (D), and leads in 2 of 7 scored categories. Payload leads on reliability, schema \u0026 documentation, payments \u0026 pricing and transparency \u0026 trust.\n\n### Do dotCMS and Payload need an API key?\n\nBoth need an API key.\n\n### Can an agent call dotCMS and Payload without installing anything?\n\ndotCMS runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Payload.\n\n### Are dotCMS and Payload open source?\n\nNo open-source release is listed for dotCMS. Payload is open source (MIT for the core and the official packages. Enterprise add-ons are sold separately through sales).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/dotcms-vs-payload.json, and with the fewest tokens: https://www.anchorterminal.com/compare/dotcms-vs-payload.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"dotcms\", \"b\": \"payload\"}`. From a terminal: `anchor compare dotcms payload`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/dotcms.json and https://www.anchorterminal.com/api/v1/tools/payload.json\n\n## Other comparisons with dotCMS or Payload\n\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Payload](https://www.anchorterminal.com/compare/bcms-vs-payload.md)\n- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)\n- [ButterCMS vs Payload](https://www.anchorterminal.com/compare/buttercms-vs-payload.md)\n- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)\n- [Contentstack vs Payload](https://www.anchorterminal.com/compare/contentstack-vs-payload.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Payload](https://www.anchorterminal.com/compare/cosmic-vs-payload.md)\n- [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md)\n- [DatoCMS vs Payload](https://www.anchorterminal.com/compare/datocms-vs-payload.md)\n- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)\n- [Directus vs Payload](https://www.anchorterminal.com/compare/directus-vs-payload.md)\n- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)\n- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)\n- [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md)\n- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)\n- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)\n- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)\n- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)\n- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)\n- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)\n- [Ghost vs Payload](https://www.anchorterminal.com/compare/ghost-vs-payload.md)\n- [Hygraph vs Payload](https://www.anchorterminal.com/compare/hygraph-vs-payload.md)\n- [Kontent.ai vs Payload](https://www.anchorterminal.com/compare/kontent-ai-vs-payload.md)\n- [Payload vs Prismic](https://www.anchorterminal.com/compare/payload-vs-prismic.md)\n- [Payload vs Sanity](https://www.anchorterminal.com/compare/payload-vs-sanity.md)\n- [Payload vs Storyblok](https://www.anchorterminal.com/compare/payload-vs-storyblok.md)\n- [Payload vs Strapi](https://www.anchorterminal.com/compare/payload-vs-strapi.md)\n- [Payload vs Webflow](https://www.anchorterminal.com/compare/payload-vs-webflow.md)\n- [Payload vs WordPress](https://www.anchorterminal.com/compare/payload-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "dotCMS vs Payload", "url": "" } ], "description": "dotCMS scores 57.7 (C) to Payload's 50.1 (D) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "dotCMS C 57.7", "Payload D 50.1", "scores" ], "h1": "dotCMS vs Payload", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/dotcms-vs-payload", "published": "2026-10-01", "section": "tools", "title": "dotCMS vs Payload for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/dotcms-vs-payload" }, "tokens": { "markdown": 4250, "slim": 2430 }, "version": 1 }