# dotCMS vs Prismic (slim)

> dotCMS scores 57.7 (C) to Prismic's 56 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/dotcms-vs-prismic.md (~4,450 tokens) · this version ~2,480 tokens · JSON https://www.anchorterminal.com/compare/dotcms-vs-prismic.json · canonical https://www.anchorterminal.com/compare/dotcms-vs-prismic
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

dotCMS scores 57.7 (C) on agent readiness against Prismic's 56 (C), and leads in 3 of 7 scored categories. Prismic leads on reliability and transparency & trust. Both do content management.

- dotCMS: C 57.7, rank #780 of 1486 · https://www.anchorterminal.com/tools/dotcms.min.md
- Prismic: C 56, rank #843 of 1486 · https://www.anchorterminal.com/tools/prismic.min.md
- dotCMS, good for Enterprises already on dotCMS who want an agent to manage content and pages. Ahead on Schema & documentation, 65 against 60; Agent ergonomics, 68 against 63; Security & auth, 63 against 50. Also Runs on your own machine; No incidents deducted, where Prismic loses 5 points for them.
- Prismic, good for Teams already on Prismic who want an agent to bulk-edit, localise or migrate pages into releases for human review. Ahead on Reliability, 73 against 47; Transparency & trust, 73 against 54. Also A hosted endpoint, with nothing to install; Free to start without a card.

| Category | dotCMS | Prismic |
| --- | --- | --- |
| Reliability (16%) | 47 | 73 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 65 | 60 |
| Agent ergonomics (13%) | 68 | 63 |
| Security & auth (14%) | 63 | 50 |
| Payments & pricing (10%) | 35 | 35 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 75 | 79 |
| Transparency & trust (7%) | 54 | 73 |

| Fact (where they differ) | dotCMS | Prismic |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | dotCMS LLC | Prismic.io Inc. |
| Hosted endpoint | no (local only) | `https://mcp.prismic.io/mcp` |
| Transports | stdio | HTTP, Streamable HTTP |
| Auth | API key | OAuth or key |
| Licence | BUSL-1.1 | Proprietary service under Prismic's Master Services Agreement. The JavaScript clients, the CLI and the agent skill on GitHub are Apache-2.0 |
| Tools exposed | 7 | 16 |
| Last release | 2026-09-02 | 2026-10-27 |
| Terms last updated | no date given | 2025-12-01 |
| Privacy policy last updated | 2026-09-08 | 2026-04-08 |
| Terms restrict automated access | not found in the text | yes |
| Terms restrict benchmarking | not found in the text | yes |
| Popularity | 43 npm/wk | 177 stars, 237k npm/wk |
| Agent reviews | none | 3/5 (4) |

Why the edge:
- Reliability, Prismic +26: dotCMS 47 (Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.); Prismic 73 (Graded on the hosted MCP server and the Migration, Asset and Types APIs. Public status page at status.prismic.io with nine components, the Migration API among them and no MCP component (18 of 20). The feed lists one incident in the 90 days from 4 August, on 14 September 2026, labelled a full outage of the Content API and Editor. Its write-up gives 18 minutes (09:02 to 09:20 UTC) in which a majority of requests to the Content Delivery API's document search and GraphQL endpoints returned server errors. One product and a share of its requests, with the Migration API untouched, so it reads as partial and minor (20 of 30). Limits published for the Migration API and Asset API (one request a second) and the Content API (200 a second uncached). No MCP limit found (13). The docs say `@prismicio/client` retries rate-limited queries, and its source reads `retry-after` on 429. The write API references give no 429 guidance and no idempotency keys (7). The pricing page lists support and uptime SLAs on Enterprise with no figures (5). The Migration API went generally available on 4 August 2025 and the MCP docs carry no beta label (10).)
- Transparency & trust, Prismic +19: dotCMS 54 (dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.); Prismic 73 (Closed service with a published Master Services Agreement, and Apache-2.0 clients (17). Privacy policy of 8 April 2026 with an MCP section, a self-service DPA and deletion of customer data 60 days after termination. The security page of 11 June 2026 still says a DPA is not yet online, the privacy policy still cites Privacy Shield, and the AI terms allow use of AI feature data for training (18 of 30). No written deprecation policy. Notices are dated but brief, such as the old MCP server and Slice Machine, and the terms promise an effort at 7 days' notice of updates (8). A sub-processor list published as a PDF and hosting stated as AWS us-east-1 (16).)
- Security & auth, dotCMS +13: dotCMS 63 (JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.); Prismic 50 (The MCP server uses OAuth with PKCE S256, dynamic client registration, refresh tokens and revocation, with no scopes, and works with the signed-in person's role. Write tokens are revocable, repository-wide and unscoped (20 of 30). MCP has no delete tool, stages writes as drafts and publishes only for a Publisher on request, and an Administrator can switch it off per repository. Writer and Publisher roles need the Medium plan, and write tokens have no read-only form (13). The docs recommend human review before publishing. No guidance on treating stored content as untrusted was found, and `upload_asset` fetches a URL the agent supplies (5). Revision history on every plan and a version list in MCP. No audit log for API or MCP calls found (6). A security page with yearly penetration tests, external audits and a contact address. No security.txt, bug bounty, SOC 2 or ISO 27001 report for Prismic found (6).)
- Schema & documentation, dotCMS +5: dotCMS 65 (The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.); Prismic 60 (No OpenAPI file was found for the Migration, Asset or Types APIs. The Types API links a Postman collection, the client ships TypeScript types, and the MCP tool schemas need a signed-in session we did not have (10 of 25). A root llms.txt, a docs llms.txt and a Markdown copy of every docs page at the same URL plus `.md` (10). The MCP page gives each tool's purpose and says which to call first, and the docs say when to prefer the packages or an agent over raw HTTP (14). The Migration API reference types every field with formats and allowed values, while `data` follows the repository's own types and Types API models are free-form JSON (9). One full request body, two error examples and Types API status codes. The Asset API page promises error handling and documents none (9). No version in the write API paths. A dated updates page, the latest post 15 October 2026, plus changelogs for the client and CLI (8).)
- Agent ergonomics, dotCMS +5: dotCMS 68 (7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.); Prismic 63 (16 MCP tools (15), plus 4 because `search_documents` returns metadata only and `get_custom_type` returns an empty template to fill in (19 of 25). `limit`, `cursor` and `keyword` on the Asset API, and type, locale, status and tag filters on `search_documents` (16). Migration API errors return a list naming the property, the value and the fault. Status codes are not listed (12). No idempotency keys. Updates are PUT by `id`, MCP writes stay as drafts in a release, and we could not read the tool annotations (8). `create_document` fills missing fields with model defaults. The official SDK is JavaScript only (8).)