# dotCMS vs Payload (slim)

> dotCMS scores 57.7 (C) to Payload's 50.1 (D) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/dotcms-vs-payload.md (~4,250 tokens) · this version ~2,430 tokens · JSON https://www.anchorterminal.com/compare/dotcms-vs-payload.json · canonical https://www.anchorterminal.com/compare/dotcms-vs-payload
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

dotCMS scores 57.7 (C) on agent readiness against Payload's 50.1 (D), and leads in 2 of 7 scored categories. Payload leads on reliability, schema & documentation, payments & pricing and transparency & trust. Both do content management.

- dotCMS: C 57.7, rank #780 of 1486 · https://www.anchorterminal.com/tools/dotcms.min.md
- Payload: D 50.1, rank #1068 of 1486 · https://www.anchorterminal.com/tools/payload.min.md
- dotCMS, good for Enterprises already on dotCMS who want an agent to manage content and pages. Ahead on Security & auth, 63 against 57. Also Runs on your own machine; No incidents deducted, where Payload loses 15 points for them.
- Payload, good for Teams that build on Next.js and want the content model in TypeScript, with drafts, versions and localisation in the free core. Ahead on Reliability, 76 against 47; Schema & documentation, 70 against 65; Payments & pricing, 45 against 35; Transparency & trust, 65 against 54. Also Open source.

| Category | dotCMS | Payload |
| --- | --- | --- |
| Reliability (16%) | 47 | 76 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 65 | 70 |
| Agent ergonomics (13%) | 68 | 64 |
| Security & auth (14%) | 63 | 57 |
| Payments & pricing (10%) | 35 | 45 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 75 | 78 |
| Transparency & trust (7%) | 54 | 65 |

| Fact (where they differ) | dotCMS | Payload |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | dotCMS LLC | Payload CMS, Inc. (Figma) |
| Transports | stdio | HTTP, Streamable HTTP |
| Pricing | Freemium | Free |
| Licence | BUSL-1.1 | MIT for the core and the official packages. Enterprise add-ons are sold separately through sales |
| Tools exposed | 7 | none |
| Last release | 2026-09-02 | 2026-10-27 |
| Terms last updated | no date given | no document linked |
| Privacy policy last updated | 2026-09-08 | 2024-03-28 |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 43 npm/wk | 45k stars, 1.1M npm/wk |

Why the edge:
- Reliability, Payload +29: dotCMS 47 (Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.); Payload 76 (Read with the local-software lines, since the graded surface is software its owner hosts. Official npm packages, with Node.js `^22.23.4 || >=24.22.1` in `engines` and in the installation docs since 3.92.0 (20). A public `ci` workflow runs unit, type, integration and end-to-end tests on every push to 3.x. GitHub's pages and API couldn't be read on 4 November, so the result is unread (15 of 25). 499 issues were open on 8 October, 140 of them awaiting triage, with 225 opened and 116 closed since 10 July 2026, not re-read (12 of 25). A written semver policy marks breaking commits with `!` and lists them in release notes, but lets security fixes and experimental APIs change in minor releases (14 of 15). 3.x is the stable line, with 4.0 in beta (15).)
- Transparency & trust, Payload +11: dotCMS 54 (dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.); Payload 65 (MIT for the core and official packages, with LICENSE.md in the repository (30). A self-hosted install keeps content on its owner's servers. The privacy policy dates from 28 March 2024, states no retention periods that we could find and doesn't mention Figma. The only published terms cover Payload Cloud, which is closed to new projects (15 of 30). A written versioning policy defines breaking changes and how they're announced, with a migration guide per major. No end-of-support date for 3.x was found (13 of 20). Telemetry is on by default, documented as completely anonymous and turned off with `telemetry: false`. The docs don't list the fields sent. The 3.92.1 source sends versions, adapters, plugins, locales, a random install ID and project, domain and user IDs hashed with the install's own secret (16 of 20).)
- Payments & pricing, Payload +10: dotCMS 35 (Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.); Payload 45 (Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under MIT, which the get-started page states. The only paid option, Enterprise, is priced by sales, and Payload Cloud is closed to new projects, so 15 of 20. No card and no account at Payload are needed (20). `npx create-payload-app` installs it, but the docs create REST and MCP API keys in the admin panel, so half (10).)
- Security & auth, dotCMS +6: dotCMS 63 (JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.); Payload 57 (REST keys are per user, revocable and regenerable, shown once, and limited by that user's access control down to field level. MCP keys carry per-collection, per-operation switches. Both travel only in the Authorization header. Neither expires, and there is no OAuth (24 of 30). A find-only MCP key is a config switch away and the collection's access control still runs under it. Nothing asks a person to approve a delete or a publish in the free edition (14 of 20). Documents hold text written by other people, and no prompt-injection guidance was found. `overrideResponse` can strip fields before they reach a model (3 of 15). Versions record each change, and `onEvent` and `verboseLogs` expose MCP calls to the owner's own logging. No built-in audit log (7 of 15). SECURITY.md gives a reporting address and, since 16 October 2026, says Payload pays no monetary rewards and runs no bug bounty. Advisories are published on GitHub with affected versions, patches and workarounds. No security.txt or SOC 2 statement was found (9 of 20).)
- Schema & documentation, Payload +5: dotCMS 65 (The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.); Payload 70 (No OpenAPI file is published or generated by the core packages, because endpoints depend on each project's config. Every MCP tool carries a typed input schema built from the collection's fields, and the GraphQL schema is generated from the same config (20 of 25). llms.txt per major version, llms-full.txt and a Markdown copy of every docs page (10). Default MCP tool descriptions are one line, such as `Create a document in a collection.`, unless the owner writes one in the plugin config. The docs tell owners to do so (10 of 20). Field inputs are typed with bounds on `limit` and `depth`, but `where` is JSON passed as a string. `select` became an object in the MCP find tools in 3.91.0 (10 of 15). REST operations show a request and a response each. No reference page for error responses or status codes was found (8 of 15). Semver, release notes on GitHub and separate docs per major version. REST paths carry no version (12 of 15).)