dotCMS vs Prismic

dotCMS 47

Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.

Prismic 73

Graded on the hosted MCP server and the Migration, Asset and Types APIs. Public status page at status.prismic.io with nine components, the Migration API among them and no MCP component (18 of 20). The feed lists one incident in the 90 days from 4 August, on 14 September 2026, labelled a full outage of the Content API and Editor. Its write-up gives 18 minutes (09:02 to 09:20 UTC) in which a majority of requests to the Content Delivery API's document search and GraphQL endpoints returned server errors. One product and a share of its requests, with the Migration API untouched, so it reads as partial and minor (20 of 30). Limits published for the Migration API and Asset API (one request a second) and the Content API (200 a second uncached). No MCP limit found (13). The docs say @prismicio/client retries rate-limited queries, and its source reads retry-after on 429. The write API references give no 429 guidance and no idempotency keys (7). The pricing page lists support and uptime SLAs on Enterprise with no figures (5). The Migration API went generally available on 4 August 2025 and the MCP docs carry no beta label (10).

dotCMS 54

dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.

Prismic 73

Closed service with a published Master Services Agreement, and Apache-2.0 clients (17). Privacy policy of 8 April 2026 with an MCP section, a self-service DPA and deletion of customer data 60 days after termination. The security page of 11 June 2026 still says a DPA is not yet online, the privacy policy still cites Privacy Shield, and the AI terms allow use of AI feature data for training (18 of 30). No written deprecation policy. Notices are dated but brief, such as the old MCP server and Slice Machine, and the terms promise an effort at 7 days' notice of updates (8). A sub-processor list published as a PDF and hosting stated as AWS us-east-1 (16).

dotCMS 63

JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.

Prismic 50

The MCP server uses OAuth with PKCE S256, dynamic client registration, refresh tokens and revocation, with no scopes, and works with the signed-in person's role. Write tokens are revocable, repository-wide and unscoped (20 of 30). MCP has no delete tool, stages writes as drafts and publishes only for a Publisher on request, and an Administrator can switch it off per repository. Writer and Publisher roles need the Medium plan, and write tokens have no read-only form (13). The docs recommend human review before publishing. No guidance on treating stored content as untrusted was found, and upload_asset fetches a URL the agent supplies (5). Revision history on every plan and a version list in MCP. No audit log for API or MCP calls found (6). A security page with yearly penetration tests, external audits and a contact address. No security.txt, bug bounty, SOC 2 or ISO 27001 report for Prismic found (6).

dotCMS 65

The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.

Prismic 60

No OpenAPI file was found for the Migration, Asset or Types APIs. The Types API links a Postman collection, the client ships TypeScript types, and the MCP tool schemas need a signed-in session we did not have (10 of 25). A root llms.txt, a docs llms.txt and a Markdown copy of every docs page at the same URL plus .md (10). The MCP page gives each tool's purpose and says which to call first, and the docs say when to prefer the packages or an agent over raw HTTP (14). The Migration API reference types every field with formats and allowed values, while data follows the repository's own types and Types API models are free-form JSON (9). One full request body, two error examples and Types API status codes. The Asset API page promises error handling and documents none (9). No version in the write API paths. A dated updates page, the latest post 15 October 2026, plus changelogs for the client and CLI (8).

dotCMS 68

7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, npx dotcms agent setup, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.

Prismic 63

16 MCP tools (15), plus 4 because search_documents returns metadata only and get_custom_type returns an empty template to fill in (19 of 25). limit, cursor and keyword on the Asset API, and type, locale, status and tag filters on search_documents (16). Migration API errors return a list naming the property, the value and the fault. Status codes are not listed (12). No idempotency keys. Updates are PUT by id, MCP writes stay as drafts in a release, and we could not read the tool annotations (8). create_document fills missing fields with model defaults. The official SDK is JavaScript only (8).