dotCMS vs Storyblok

dotCMS 54

dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.

Storyblok 81

Closed service with published self-service and enterprise terms, and MIT client libraries (17). DPA effective 22 April 2026, privacy policy effective 6 October 2025, customer content kept up to 90 days after termination, log files 30 days, and AI terms saying input isn't used for training. We found no contradiction between them (25). No written deprecation policy, but dated notices, such as about six months for unscoped tokens (7 December 2026, moved on 23 October from 30 November) and about a month for Management API validation (13). Sub-processors with locations in DPA Annex 3 and data residency in the EU, US, Canada and Australia (18).

dotCMS 47

Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.

Storyblok 64

Graded on the Management API and the hosted MCP server. Public UptimeRobot status page at uptime.storyblok.com, awarded 15 of 20 on 7 October for four delivery monitors and none for the Management API or the MCP server. Its monitors and history load by script from /api/ paths that the status host's robots.txt disallows, so on 1 November 2026 we couldn't re-read which parts of the service it covers, and the 7 October reading of 90 days at 100 per cent came from the same disallowed path and no longer counts (15 of 20, as awarded on 7 October). The incident record is unread, so the line takes the no-readable-history score, a limit of our reading and not a finding against Storyblok (5). Rate limits published, 3 requests a second on Starter and 6 on paid plans (15). The docs advise slowing down on 429 and retrying with exponential backoff, and the official client retries on 429. No Retry-After header in the API docs and no idempotency keys found (9). SLA of 97 per cent on Growth and Growth Plus, 99.9 on Premium and 99.99 on Elite, stated for the Content Delivery API (10). Management API v1 is generally available and the MCP docs carry no beta label (10). 15 + 5 + 15 + 9 + 10 + 10 = 64.

dotCMS 68

7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, npx dotcms agent setup, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.

Storyblok 78

Seven MCP tools cover the whole Management API through search, describe and execute, and a fields filter trims responses before they return (25). page and per_page up to 1,000 with a total header, and about 30 filters on the story list (20). Error bodies aren't documented beyond HTTP status codes. Validation failures return 422 with the limit and the current value (8). No idempotency keys. Publish, unpublish and restore are GET requests that change state. MCP splits calls into read-only, mutating and destructive tools, and we couldn't read the tool annotations (10). Few required parameters, and official Management API clients for JavaScript and PHP plus universal clients for Swift and Kotlin (15).

dotCMS 63

JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.

Storyblok 73

OAuth with PKCE S256, dynamic client registration, refresh tokens, revocation and 29 scopes on a read, write and publish hierarchy, or personal access tokens with scopes, a space list and an expiry date (30). Less 5 because Content Delivery API tokens travel in the token query parameter. That is a judgement call. Those tokens are read-only and not the graded surface, so we took half the checklist's 10. Scopes separate read, write and publish per space, and execute_destructive needs explicit user confirmation. Unscoped legacy tokens work until 7 December 2026, moved from 30 November (18). The changelog names prompt-injected tokens as a risk that scoping limits, and the MCP page asks users to read plans back before writes. No guidance on treating stored content as untrusted (8). Activity log on every plan with an Activities endpoint, kept 1 day on Starter and 30 days on Growth (11). ISO 27001, TISAX, third-party penetration tests and a security contact address. No security.txt, bug bounty or SOC 2 report found (11).

dotCMS 75

dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.

Storyblok 80

The changelog has an entry on 26 October 2026 and the Management API client 0.11.0 and CLI 4.26.0 were tagged on 30 October 2026 (30). 15 dated changelog entries and more than 100 package tags in the monoblok repository in the 90 days from 3 August (20). Public changelog with RSS, a help centre and a Discord community. Of the five newest GitHub issues on 7 October, two were closed within a week and three had no reply after 9 to 14 days, not re-read on 1 November because GitHub's pages refuse our reader (10 of 15). Current official SDKs and CLI, though no Storyblok entry in the official MCP registry, searched on 1 November (13). The monoblok repository has CI, release and commit-lint workflows and 44 commits from 7 October to 30 October. We didn't check that CI passes (7).