{ "data": { "a": { "slug": "dotcms", "name": "dotCMS", "vendor": "dotCMS LLC", "vendorUrl": "https://www.dotcms.com", "kind": "mcp", "category": "cms", "summary": "dotCMS is an enterprise CMS with headless REST APIs, workflows and push publishing, run as dotCMS Cloud or self-hosted. Agents use the @dotcms/mcp-server package, which searches the instance's OpenAPI spec and runs API calls in a sandbox.", "url": "https://www.anchorterminal.com/tools/dotcms", "markdownUrl": "https://www.anchorterminal.com/tools/dotcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/dotcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/dotcms.json", "dns": "dotcms.grade.anchorterminal.com", "repo": "https://github.com/dotCMS/core", "license": "BUSL-1.1", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@dotcms/mcp-server" } ], "auth": "api-key", "authNotes": "The MCP server reads DOTCMS_URL and AUTH_TOKEN. API tokens are JWTs issued for a dotCMS user, carry that user's role permissions, take an expiry in days, and are created by administrators in the user manager or through /api/v1/authentication/api-token. The docs recommend a separate user and role per application; the MCP server needs write permission for content types, content and workflows. Tokens are injected outside the sandbox, so sandboxed code never sees them.", "pricing": "freemium", "pricingNotes": "dotCMS is free with every capability for companies under $5 million in revenue under its BSL licence, self-hosted. Cloud plans (Starter, Professional, Business, Enterprise) are priced on request, with monthly request and bandwidth allowances and SLAs of 99.5 to 99.9 per cent.", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP README, the dev docs or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 7, "popularity": { "githubStars": null, "npmWeekly": 43, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://dev.dotcms.com/docs/build/integrations/dotai/mcp-server", "llmsTxt": "https://dev.dotcms.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.schema", "cms.localisation" ], "tags": [ "official", "mcp", "stdio", "self-hosted", "hosted", "source-available", "llms-txt", "sales-led", "sla", "typescript" ], "lastRelease": "2026-09-02", "graded": true, "anchor": { "graded": true, "score": 57.7, "grade": "C", "agentReady": false, "rank": 780, "ranked": true, "rankOf": 1486, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.", "bestFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "strengths": [ "Seven tools in code mode, with the instance's OpenAPI spec searchable from the sandbox", "The API token stays outside the sandbox, which only receives results", "JWT tokens per user with role permissions and an expiry", "security.txt with PGP, a bounty-backed disclosure policy and LTS security backports", "Free with every capability for organisations under $5 million in revenue" ], "weaknesses": [ "Pre-1.0 package, with the dev docs still pointing at the beta tag", "The server needs a token with write permission for content types, content and workflows", "execute can call any endpoint, and no read-only mode or annotations were found", "Cloud prices are on request only", "Source-available under the BSL, not an OSI licence" ], "agentNotes": [ "Search the spec with `search` before writing an `execute` call, and return only the fields you need", "Use a token for a dedicated user and role, not an administrator's", "Confirm with the user before execute calls that publish, archive or delete content", "Keep results small with pick and first, since output is capped at about 25,000 characters", "Use download_assets for theme folders so files land on disk instead of in context" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.7 } ], "editorialScores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 51 }, "provenanceScore": 57, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @dotcms/mcp-server", "config": { "mcpServers": { "dotcms": { "args": [ "-y", "@dotcms/mcp-server" ], "command": "npx", "env": { "AUTH_TOKEN": "your-api-token", "DOTCMS_URL": "https://your-dotcms-instance.com" } } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/dotcms" }, "area": "business", "provenance": { "legalEntity": "dotCMS LLC", "domain": "dotcms.com", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://github.com/dotCMS/core/blob/main/LICENSE", "privacy": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "statusPage": "", "changelog": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "The MCP server runs locally and calls the customer's own dotCMS instance, so the endpoint isn't on a dotCMS domain.", "The privacy policy, last updated 8 September 2026, covers dotCMS's websites only and names dotCMS Holdings, LLC, dotCMS Services LLC and dotCMS LLC.", "www.dotcms.com/robots.txt disallows /docs/ and /utils/; dev.dotcms.com allows all with Content-Signal ai-train=yes, search=yes, ai-input=yes.", "www.dotcms.com/terms-of-service and /privacy-policy returned 404; no cloud terms of service were found, so the licence stands in for terms.", "No status page answered (status.dotcms.com refused the connection)." ], "score": 57 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/dotcms.json", "live": { "slug": "dotcms", "versions": [ { "registry": "github", "name": "dotCMS/core", "version": "dotcms-cli-26.11.06-03", "released": "2026-11-06", "seenAt": "2026-11-06T23:22:22.409374032Z" }, { "registry": "npm", "name": "@dotcms/mcp-server", "version": "0.1.1", "seenAt": "2026-11-06T23:22:21.577680774Z" } ], "githubStars": 971, "npmWeekly": 43, "securityTxt": { "url": "https://dotcms.com/.well-known/security.txt", "state": "valid", "expires": "2027-06-09T23:59:59.000Z", "checkedAt": "2026-11-07T16:00:46.289271049Z" }, "llmsTxt": { "url": "https://dev.dotcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:19.058875451Z" }, "pages": [ { "url": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:02:43.439634709Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "14706a7e3d20" }, { "url": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:02:39.904485204Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b8fe703d4258" }, { "url": "https://raw.githubusercontent.com/dotCMS/core/main/LICENSE", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:20:41.976083247Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dd3baa6b46f" } ], "updatedAt": "2026-11-07T16:00:46.289271049Z" } }, "answer": "Storyblok scores 64.8 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.", "b": { "slug": "storyblok", "name": "Storyblok", "vendor": "Storyblok GmbH", "vendorUrl": "https://www.storyblok.com", "kind": "http-api", "category": "cms", "summary": "Storyblok is a hosted headless CMS with a visual editor. Agents write to it through the Management API (stories, components, assets, releases, workflows) or the official hosted MCP server, which wraps that API in seven tools.", "url": "https://www.anchorterminal.com/tools/storyblok", "markdownUrl": "https://www.anchorterminal.com/tools/storyblok.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/storyblok.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/storyblok.json", "dns": "storyblok.grade.anchorterminal.com", "repo": "https://github.com/storyblok/monoblok", "license": "Proprietary service under Storyblok's terms. The SDKs, API clients and CLI in storyblok/monoblok are MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://mapi.storyblok.com/v1", "packages": [ { "registry": "npm", "name": "@storyblok/management-api-client" }, { "registry": "npm", "name": "storyblok-js-client" }, { "registry": "npm", "name": "storyblok" } ], "auth": "mixed", "authNotes": "Self-serve. The Management API takes a personal access token or an OAuth token in the request header. A person creates the token in account settings and picks scopes (16 groups such as stories, assets and components, on a read, write and publish hierarchy), the spaces it covers and an expiry date. The MCP server uses browser OAuth with PKCE and dynamic client registration, where the person picks permissions and spaces on a consent screen, or the same token as a Bearer header. No app review or sales approval is needed. The changelog describes OAuth scoped grants for custom integrations as a Premium and Enterprise feature. Content Delivery API tokens are read-only and travel in the `token` query parameter.", "pricing": "freemium", "pricingNotes": "Starter is free with no card and includes the Management API, 100,000 API requests a month, 1 seat and 2 locales. Growth is $99 a month and Growth Plus $349 a month billed monthly. Premium and Elite are sold through sales. New spaces start with a 45-day Growth Plus trial. On Growth, extra API requests cost $10 per million and extra seats $15 each (https://www.storyblok.com/pricing, checked 2026-10-07).", "priceSummary": "$99 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Management API docs, the MCP server docs or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": 7, "popularity": { "githubStars": 68, "npmWeekly": 432535, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://www.storyblok.com/docs/api/management", "llmsTxt": "https://www.storyblok.com/llms.txt", "openapi": "https://www.storyblok.com/docs/openapi-spec/cdn-v2.openapi.yaml", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.localisation", "cms.schema" ], "tags": [ "official", "hosted", "mcp", "oauth", "closed-source", "no-card", "free-tier", "llms-txt", "webhooks", "typescript", "php", "status-page", "iso27001" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 64.8, "grade": "B", "agentReady": false, "rank": 451, "ranked": true, "rankOf": 1486, "categoryRank": 9, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 78, "maintenance": 80, "payments": 35, "reliability": 64, "schema": 68, "security": 73, "transparency": 81 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "8 April 2026. Storyblok fixed a flaw where the Webhook and Webhook Logs endpoints of the Management API didn't enforce the Admin and Owner restriction the UI applies, so Editor and Restricted roles could manage webhooks by API. It was fixed and disclosed in the changelog, so the deduction is small (https://www.storyblok.com/cl/2026-april-security-fix-webhook-api-now-aligned-with-ui-access-controls)." ], "verdict": "The hosted MCP server covers the whole Management API with seven tools, OAuth scopes split into read, write and publish per space, and a confirmation step on deletes. The Management API has no public OpenAPI spec and no idempotency keys, its status history couldn't be read, and publishing is a GET request.", "bestFor": "Teams already on Storyblok who want an agent to draft, translate and publish stories or change component schemas under scoped, per-space permissions.", "strengths": [ "Official hosted MCP server at mcp.storyblok.com/mcp with seven tools (search, describe, three execute tools, two for asset upload) and a `fields` filter that trims responses", "OAuth with PKCE, dynamic client registration and 29 scopes on a read, write and publish hierarchy, chosen per space on a consent screen", "Personal access tokens take scopes, a space list and an expiry date since 27 May 2026, and unscoped tokens are revoked on 7 December 2026", "Free Starter plan with no card, 100,000 API requests a month and Management API access on every plan", "Every docs page is served as Markdown by adding .md, with request examples in nine languages" ], "weaknesses": [ "The Management API's OpenAPI spec sits in a private repository. Only the Content Delivery API has a public spec (OpenAPI 3.1, 14 operations)", "Management API limit is 3 requests a second on Starter and 6 on paid plans, with no idempotency keys in the reviewed documentation", "The status page's monitors and history load from paths its robots.txt closes to readers like ours, and on 7 October it showed no Management API or MCP monitor", "On 8 April 2026 Storyblok fixed webhook endpoints that had let Editor and Restricted roles manage webhooks through the API", "Version history is kept for 1 day on Starter and 30 days on Growth, so a rollback depends on the plan" ], "agentNotes": [ "Pick the base URL by the space's region (mapi.storyblok.com for the EU, api-us, api-ca or api-ap otherwise). A token sent to the wrong region fails", "Create stories without `publish` to keep them as drafts, then call the publish endpoint. It is a GET, so never prefetch or blindly retry it", "Write translations as `field__i18n__\u003ccode\u003e` keys inside the same content object, and set the component field to translatable first", "Upload an asset in three steps (signed response, POST to S3, finish upload). Through MCP the S3 step needs shell access for curl", "Stay under 3 calls a second on Starter and 6 on paid plans, and back off exponentially on 429. Saves that break a field's max_length return 422", "Replace unscoped personal access tokens with scoped ones before 7 December 2026, when Storyblok revokes them" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.8 } ], "editorialScores": { "ergonomics": 78, "maintenance": 80, "payments": 35, "reliability": 64, "schema": 68, "security": 73, "transparency": 73 }, "provenanceScore": 89, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @storyblok/management-api-client", "http": "curl \"https://mapi.storyblok.com/v1/spaces/$SPACE_ID/stories/\" \\\n -H \"Authorization: $STORYBLOK_PERSONAL_ACCESS_TOKEN\"", "claudeCode": "claude mcp add --transport http Storyblok https://mcp.storyblok.com/mcp", "config": { "mcpServers": { "Storyblok": { "type": "http", "url": "https://mcp.storyblok.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/storyblok" }, "area": "business", "unitPrices": [ { "item": "Growth", "unit": "month", "usd": 99, "note": "billed monthly, $90.75 billed yearly, 5 seats and 1M API requests included" }, { "item": "Growth Plus", "unit": "month", "usd": 349, "note": "billed monthly, $319.91 billed yearly, 15 seats and 4M API requests included" }, { "item": "Additional seat", "unit": "seat-month", "usd": 15, "note": "Starter (up to 2 seats) and Growth (up to 10)" }, { "item": "Additional API requests on Growth", "unit": "1k-requests", "usd": 0.01, "note": "sold as $10 per 1M, up to 5M a month" } ], "provenance": { "legalEntity": "Storyblok GmbH", "domain": "storyblok.com", "domainRegistered": "2015-08-15", "endpointOnVendorDomain": true, "terms": "https://www.storyblok.com/legal/terms", "privacy": "https://www.storyblok.com/legal/privacy-policy", "statusPage": "https://uptime.storyblok.com", "changelog": "https://www.storyblok.com/changelog", "securityTxt": "none", "checked": "2026-10-07", "notes": [ "The legal notice names Storyblok GmbH, Peter-Behrens-Platz 2, 4020 Linz, Austria, company register number FN 479743 f, Regional Court Linz.", "The Management API answers on storyblok.com subdomains and the MCP server at mcp.storyblok.com. Spaces in China use app.storyblokchina.cn.", "security.txt returns 404 on www.storyblok.com, storyblok.com and mapi.storyblok.com. The privacy policy gives security@storyblok.com for security matters.", "The terms page was last updated on 2 October 2026 and links separate self-service and enterprise terms. The self-service terms are governed by Austrian law.", "RDAP for storyblok.com gives a registration date of 2015-08-15.", "The status page runs on UptimeRobot with four monitors (Content Delivery API v1 and v2, GraphQL API, Image Service)." ], "score": 89 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/storyblok.json", "live": { "slug": "storyblok", "probe": { "target": "https://mapi.storyblok.com/v1", "method": "get", "lastAt": "2026-11-07T18:20:57.214480129Z", "lastOk": true, "lastStatus": 404, "lastMs": 116, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 63, "p95ms24h": 152, "samples24h": 239, "samples30d": 7463, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://uptime.storyblok.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:49.270430147Z" }, "versions": [ { "registry": "github", "name": "storyblok/monoblok", "version": "@storyblok/richtext@5.5.1", "released": "2026-11-06", "seenAt": "2026-11-07T00:08:37.693861514Z" }, { "registry": "npm", "name": "@storyblok/management-api-client", "version": "0.12.0", "seenAt": "2026-11-07T00:08:33.503154686Z" }, { "registry": "npm", "name": "storyblok", "version": "4.26.1", "seenAt": "2026-11-07T00:08:35.690390215Z" }, { "registry": "npm", "name": "storyblok-js-client", "version": "7.9.0", "seenAt": "2026-11-07T00:08:34.342464654Z" } ], "githubStars": 69, "npmWeekly": 93933, "securityTxt": { "url": "https://storyblok.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:06.571128432Z" }, "llmsTxt": { "url": "https://www.storyblok.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:03.230141419Z" }, "domain": { "domain": "storyblok.com", "registered": "2015-08-15", "source": "https://rdap.verisign.com/com/v1/domain/storyblok.com", "checkedAt": "2026-11-01T14:10:55.025375688Z" }, "pages": [ { "url": "https://www.storyblok.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:35:07.437531453Z", "changedAt": "2026-11-07T14:35:07.437531453Z", "fingerprint": "1fd2db66b080" }, { "url": "https://www.storyblok.com/cl/unscoped-pat-sunset-moved-to-december-7", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:35:09.715540756Z", "changedAt": "2026-11-07T14:35:09.715540756Z", "fingerprint": "afb883d6444f" }, { "url": "https://www.storyblok.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:35:16.297239101Z", "changedAt": "2026-10-30T06:01:08.396438441Z", "fingerprint": "6e34a25a7226" }, { "url": "https://www.storyblok.com/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:35:11.770605762Z", "changedAt": "2026-10-29T05:28:17.978465711Z", "fingerprint": "97ef6a1f8854" }, { "url": "https://www.storyblok.com/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:35:13.841692406Z", "changedAt": "2026-10-29T05:28:22.626867158Z", "fingerprint": "e5291834da3d" } ], "mcpTools": { "url": "https://mcp.storyblok.com/mcp", "checkedAt": "2026-11-07T01:48:08.962974424Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:48:08.962974424Z" }, "github": { "repo": "storyblok/monoblok", "checkedAt": "2026-11-02T09:28:16.153767092Z", "stars": 69, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T08:53:17Z", "openIssues": 34, "openPRs": 41, "issuesOpened90d": 23, "issuesClosed90d": 32, "prsMerged90d": 111, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-02T08:00:53Z" }, "replies": { "sampled": 25, "unanswered": 9, "medianDays": 6.5 } }, "updatedAt": "2026-11-07T18:20:57.214480129Z" } }, "edges": [ { "by": 27, "category": "transparency", "leads": "storyblok", "name": "Transparency \u0026 trust", "reasons": { "a": "dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.", "b": "Closed service with published self-service and enterprise terms, and MIT client libraries (17). DPA effective 22 April 2026, privacy policy effective 6 October 2025, customer content kept up to 90 days after termination, log files 30 days, and AI terms saying input isn't used for training. We found no contradiction between them (25). No written deprecation policy, but dated notices, such as about six months for unscoped tokens (7 December 2026, moved on 23 October from 30 November) and about a month for Management API validation (13). Sub-processors with locations in DPA Annex 3 and data residency in the EU, US, Canada and Australia (18)." }, "scores": { "a": 54, "b": 81 } }, { "by": 17, "category": "reliability", "leads": "storyblok", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.", "b": "Graded on the Management API and the hosted MCP server. Public UptimeRobot status page at uptime.storyblok.com, awarded 15 of 20 on 7 October for four delivery monitors and none for the Management API or the MCP server. Its monitors and history load by script from `/api/` paths that the status host's robots.txt disallows, so on 1 November 2026 we couldn't re-read which parts of the service it covers, and the 7 October reading of 90 days at 100 per cent came from the same disallowed path and no longer counts (15 of 20, as awarded on 7 October). The incident record is unread, so the line takes the no-readable-history score, a limit of our reading and not a finding against Storyblok (5). Rate limits published, 3 requests a second on Starter and 6 on paid plans (15). The docs advise slowing down on 429 and retrying with exponential backoff, and the official client retries on 429. No Retry-After header in the API docs and no idempotency keys found (9). SLA of 97 per cent on Growth and Growth Plus, 99.9 on Premium and 99.99 on Elite, stated for the Content Delivery API (10). Management API v1 is generally available and the MCP docs carry no beta label (10). 15 + 5 + 15 + 9 + 10 + 10 = 64." }, "scores": { "a": 47, "b": 64 } }, { "by": 10, "category": "ergonomics", "leads": "storyblok", "name": "Agent ergonomics", "reasons": { "a": "7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.", "b": "Seven MCP tools cover the whole Management API through search, describe and execute, and a `fields` filter trims responses before they return (25). `page` and `per_page` up to 1,000 with a `total` header, and about 30 filters on the story list (20). Error bodies aren't documented beyond HTTP status codes. Validation failures return 422 with the limit and the current value (8). No idempotency keys. Publish, unpublish and restore are GET requests that change state. MCP splits calls into read-only, mutating and destructive tools, and we couldn't read the tool annotations (10). Few required parameters, and official Management API clients for JavaScript and PHP plus universal clients for Swift and Kotlin (15)." }, "scores": { "a": 68, "b": 78 } }, { "by": 10, "category": "security", "leads": "storyblok", "name": "Security \u0026 auth", "reasons": { "a": "JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.", "b": "OAuth with PKCE S256, dynamic client registration, refresh tokens, revocation and 29 scopes on a read, write and publish hierarchy, or personal access tokens with scopes, a space list and an expiry date (30). Less 5 because Content Delivery API tokens travel in the `token` query parameter. That is a judgement call. Those tokens are read-only and not the graded surface, so we took half the checklist's 10. Scopes separate read, write and publish per space, and `execute_destructive` needs explicit user confirmation. Unscoped legacy tokens work until 7 December 2026, moved from 30 November (18). The changelog names prompt-injected tokens as a risk that scoping limits, and the MCP page asks users to read plans back before writes. No guidance on treating stored content as untrusted (8). Activity log on every plan with an Activities endpoint, kept 1 day on Starter and 30 days on Growth (11). ISO 27001, TISAX, third-party penetration tests and a security contact address. No security.txt, bug bounty or SOC 2 report found (11)." }, "scores": { "a": 63, "b": 73 } }, { "by": 5, "category": "maintenance", "leads": "storyblok", "name": "Maintenance \u0026 community", "reasons": { "a": "dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.", "b": "The changelog has an entry on 26 October 2026 and the Management API client 0.11.0 and CLI 4.26.0 were tagged on 30 October 2026 (30). 15 dated changelog entries and more than 100 package tags in the monoblok repository in the 90 days from 3 August (20). Public changelog with RSS, a help centre and a Discord community. Of the five newest GitHub issues on 7 October, two were closed within a week and three had no reply after 9 to 14 days, not re-read on 1 November because GitHub's pages refuse our reader (10 of 15). Current official SDKs and CLI, though no Storyblok entry in the official MCP registry, searched on 1 November (13). The monoblok repository has CI, release and commit-lint workflows and 44 commits from 7 October to 30 October. We didn't check that CI passes (7)." }, "scores": { "a": 75, "b": 80 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "dotCMS LLC", "b": "Storyblok GmbH", "name": "Vendor" }, { "a": "no (local only)", "b": "https://mapi.storyblok.com/v1", "name": "Hosted endpoint" }, { "a": "stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "BUSL-1.1", "b": "Proprietary service under Storyblok's terms. The SDKs, API clients and CLI in storyblok/monoblok are MIT", "name": "Licence" }, { "a": "7", "b": "7", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-02", "b": "2026-10-30", "name": "Last release" }, { "a": "no date given", "b": "couldn't be read", "name": "Terms last updated" }, { "a": "2026-09-08", "b": "2025-10-06", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Arbitration or class-action waiver" }, { "a": "43 npm/wk", "b": "68 stars, 433k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Storyblok scores 64.8 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, dotCMS or Storyblok?" }, { "answer": "dotCMS needs an API key. Storyblok takes an API key or an OAuth sign-in.", "question": "Do dotCMS and Storyblok need an API key?" }, { "answer": "dotCMS runs on your own machine, with no hosted endpoint listed. Storyblok has a hosted endpoint at https://mapi.storyblok.com/v1.", "question": "Can an agent call dotCMS and Storyblok without installing anything?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Runs on your own machine", "No incidents deducted, where Storyblok loses 3 points for them" ], "goodFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "slug": "dotcms", "watchFor": "Pre-1.0 package, with the dev docs still pointing at the beta tag" }, { "aheadOn": [ "Reliability, 64 against 47", "Agent ergonomics, 78 against 68", "Security \u0026 auth, 73 against 63", "Maintenance \u0026 community, 80 against 75", "Transparency \u0026 trust, 81 against 54" ], "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card" ], "goodFor": "Teams already on Storyblok who want an agent to draft, translate and publish stories or change component schemas under scoped, per-space permissions.", "slug": "storyblok", "watchFor": "The Management API's OpenAPI spec sits in a private repository. Only the Content Delivery API has a public spec (OpenAPI 3.1, 14 operations)" } ], "history": { "dotcms": null, "storyblok": [ { "causes": [ "correction" ], "date": "2026-11-01", "delta": -3, "from": 67.8, "fromGrade": "B", "to": 64.8, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 67.7, "fromGrade": "B", "to": 67.8, "toGrade": "B" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-storyblok.json", "title": "BCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/bcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms.json", "title": "ButterCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-storyblok.json", "title": "ButterCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/buttercms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms.json", "title": "Contentstack vs dotCMS", "url": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-storyblok.json", "title": "Contentstack vs Storyblok", "url": "https://www.anchorterminal.com/compare/contentstack-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok.json", "title": "Cosmic vs Storyblok", "url": "https://www.anchorterminal.com/compare/cosmic-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-dotcms.json", "title": "DatoCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/datocms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-storyblok.json", "title": "DatoCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/datocms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-dotcms.json", "title": "Directus vs dotCMS", "url": "https://www.anchorterminal.com/compare/directus-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-storyblok.json", "title": "Directus vs Storyblok", "url": "https://www.anchorterminal.com/compare/directus-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-ghost.json", "title": "dotCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/dotcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph.json", "title": "dotCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.json", "title": "dotCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-payload.json", "title": "dotCMS vs Payload", "url": "https://www.anchorterminal.com/compare/dotcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-prismic.json", "title": "dotCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/dotcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-sanity.json", "title": "dotCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/dotcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-strapi.json", "title": "dotCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/dotcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-webflow.json", "title": "dotCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/dotcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress.json", "title": "dotCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-storyblok.json", "title": "Ghost vs Storyblok", "url": "https://www.anchorterminal.com/compare/ghost-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-storyblok.json", "title": "Hygraph vs Storyblok", "url": "https://www.anchorterminal.com/compare/hygraph-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-storyblok.json", "title": "Kontent.ai vs Storyblok", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-storyblok.json", "title": "Payload vs Storyblok", "url": "https://www.anchorterminal.com/compare/payload-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/prismic-vs-storyblok.json", "title": "Prismic vs Storyblok", "url": "https://www.anchorterminal.com/compare/prismic-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-storyblok.json", "title": "Sanity vs Storyblok", "url": "https://www.anchorterminal.com/compare/sanity-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-strapi.json", "title": "Storyblok vs Strapi", "url": "https://www.anchorterminal.com/compare/storyblok-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-webflow.json", "title": "Storyblok vs Webflow", "url": "https://www.anchorterminal.com/compare/storyblok-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-wordpress.json", "title": "Storyblok vs WordPress", "url": "https://www.anchorterminal.com/compare/storyblok-vs-wordpress" } ], "panel": null, "scores": [ { "by": 17, "dotcms": 47, "edge": "storyblok", "key": "reliability", "name": "Reliability", "storyblok": 64, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 3, "dotcms": 65, "edge": "storyblok", "key": "schema", "name": "Schema \u0026 documentation", "storyblok": 68, "weight": 13 }, { "by": 10, "dotcms": 68, "edge": "storyblok", "key": "ergonomics", "name": "Agent ergonomics", "storyblok": 78, "weight": 13 }, { "by": 10, "dotcms": 63, "edge": "storyblok", "key": "security", "name": "Security \u0026 auth", "storyblok": 73, "weight": 14 }, { "by": 0, "dotcms": 35, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "storyblok": 35, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 5, "dotcms": 75, "edge": "storyblok", "key": "maintenance", "name": "Maintenance \u0026 community", "storyblok": 80, "weight": 7 }, { "by": 27, "dotcms": 54, "edge": "storyblok", "key": "transparency", "name": "Transparency \u0026 trust", "storyblok": 81, "weight": 7 } ], "summary": "Storyblok scores 64.8 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "dotcms": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.", "storyblok": "The hosted MCP server covers the whole Management API with seven tools, OAuth scopes split into read, write and publish per space, and a confirmation step on deletes. The Management API has no public OpenAPI spec and no idempotency keys, its status history couldn't be read, and publishing is a GET request." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok", "json": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok.min.md" }, "markdown": "Storyblok scores 64.8 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. Both do content management.\n\n- dotCMS: grade C, 57.7/100, rank #780 of 1486. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json\n- Storyblok: grade B, 64.8/100, rank #451 of 1486. Markdown https://www.anchorterminal.com/tools/storyblok.md · JSON https://www.anchorterminal.com/api/v1/tools/storyblok.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### dotCMS (C)\n\nGood for: Enterprises already on dotCMS who want an agent to manage content and pages.\n\nAlso in its favour:\n- Runs on your own machine\n- No incidents deducted, where Storyblok loses 3 points for them\n\nWatch for: Pre-1.0 package, with the dev docs still pointing at the beta tag\n\n### Storyblok (B)\n\nGood for: Teams already on Storyblok who want an agent to draft, translate and publish stories or change component schemas under scoped, per-space permissions.\n\nAhead on:\n- Reliability, 64 against 47\n- Agent ergonomics, 78 against 68\n- Security \u0026 auth, 73 against 63\n- Maintenance \u0026 community, 80 against 75\n- Transparency \u0026 trust, 81 against 54\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n\nWatch for: The Management API's OpenAPI spec sits in a private repository. Only the Content Delivery API has a public spec (OpenAPI 3.1, 14 operations)\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Storyblok +27\n\n- dotCMS (54): dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.\n- Storyblok (81): Closed service with published self-service and enterprise terms, and MIT client libraries (17). DPA effective 22 April 2026, privacy policy effective 6 October 2025, customer content kept up to 90 days after termination, log files 30 days, and AI terms saying input isn't used for training. We found no contradiction between them (25). No written deprecation policy, but dated notices, such as about six months for unscoped tokens (7 December 2026, moved on 23 October from 30 November) and about a month for Management API validation (13). Sub-processors with locations in DPA Annex 3 and data residency in the EU, US, Canada and Australia (18).\n\n### Reliability: Storyblok +17\n\n- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.\n- Storyblok (64): Graded on the Management API and the hosted MCP server. Public UptimeRobot status page at uptime.storyblok.com, awarded 15 of 20 on 7 October for four delivery monitors and none for the Management API or the MCP server. Its monitors and history load by script from `/api/` paths that the status host's robots.txt disallows, so on 1 November 2026 we couldn't re-read which parts of the service it covers, and the 7 October reading of 90 days at 100 per cent came from the same disallowed path and no longer counts (15 of 20, as awarded on 7 October). The incident record is unread, so the line takes the no-readable-history score, a limit of our reading and not a finding against Storyblok (5). Rate limits published, 3 requests a second on Starter and 6 on paid plans (15). The docs advise slowing down on 429 and retrying with exponential backoff, and the official client retries on 429. No Retry-After header in the API docs and no idempotency keys found (9). SLA of 97 per cent on Growth and Growth Plus, 99.9 on Premium and 99.99 on Elite, stated for the Content Delivery API (10). Management API v1 is generally available and the MCP docs carry no beta label (10). 15 + 5 + 15 + 9 + 10 + 10 = 64.\n\n### Agent ergonomics: Storyblok +10\n\n- dotCMS (68): 7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.\n- Storyblok (78): Seven MCP tools cover the whole Management API through search, describe and execute, and a `fields` filter trims responses before they return (25). `page` and `per_page` up to 1,000 with a `total` header, and about 30 filters on the story list (20). Error bodies aren't documented beyond HTTP status codes. Validation failures return 422 with the limit and the current value (8). No idempotency keys. Publish, unpublish and restore are GET requests that change state. MCP splits calls into read-only, mutating and destructive tools, and we couldn't read the tool annotations (10). Few required parameters, and official Management API clients for JavaScript and PHP plus universal clients for Swift and Kotlin (15).\n\n### Security \u0026 auth: Storyblok +10\n\n- dotCMS (63): JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.\n- Storyblok (73): OAuth with PKCE S256, dynamic client registration, refresh tokens, revocation and 29 scopes on a read, write and publish hierarchy, or personal access tokens with scopes, a space list and an expiry date (30). Less 5 because Content Delivery API tokens travel in the `token` query parameter. That is a judgement call. Those tokens are read-only and not the graded surface, so we took half the checklist's 10. Scopes separate read, write and publish per space, and `execute_destructive` needs explicit user confirmation. Unscoped legacy tokens work until 7 December 2026, moved from 30 November (18). The changelog names prompt-injected tokens as a risk that scoping limits, and the MCP page asks users to read plans back before writes. No guidance on treating stored content as untrusted (8). Activity log on every plan with an Activities endpoint, kept 1 day on Starter and 30 days on Growth (11). ISO 27001, TISAX, third-party penetration tests and a security contact address. No security.txt, bug bounty or SOC 2 report found (11).\n\n### Maintenance \u0026 community: Storyblok +5\n\n- dotCMS (75): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.\n- Storyblok (80): The changelog has an entry on 26 October 2026 and the Management API client 0.11.0 and CLI 4.26.0 were tagged on 30 October 2026 (30). 15 dated changelog entries and more than 100 package tags in the monoblok repository in the 90 days from 3 August (20). Public changelog with RSS, a help centre and a Discord community. Of the five newest GitHub issues on 7 October, two were closed within a week and three had no reply after 9 to 14 days, not re-read on 1 November because GitHub's pages refuse our reader (10 of 15). Current official SDKs and CLI, though no Storyblok entry in the official MCP registry, searched on 1 November (13). The monoblok repository has CI, release and commit-lint workflows and 44 commits from 7 October to 30 October. We didn't check that CI passes (7).\n\n## Score by category\n\n| Category | Weight | dotCMS | Storyblok | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 47 | 64 | Storyblok +17 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 65 | 68 | Storyblok +3 |\n| Agent ergonomics | 13% (16.2 this run) | 68 | 78 | Storyblok +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 73 | Storyblok +10 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 35 | 35 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 75 | 80 | Storyblok +5 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 54 | 81 | Storyblok +27 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **57.7 · C** | **64.8 · B** | |\n\n## Facts side by side\n\n| Fact | dotCMS | Storyblok |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | dotCMS LLC | Storyblok GmbH |\n| Hosted endpoint | no (local only) | `https://mapi.storyblok.com/v1` |\n| Transports | stdio | HTTP, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | BUSL-1.1 | Proprietary service under Storyblok's terms. The SDKs, API clients and CLI in storyblok/monoblok are MIT |\n| Tools exposed | 7 | 7 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-09-02 | 2026-10-30 |\n| Terms last updated | no date given | couldn't be read |\n| Privacy policy last updated | 2026-09-08 | 2025-10-06 |\n| Customer content may train models | not found in the text | couldn't be read |\n| Terms restrict automated access | not found in the text | couldn't be read |\n| Terms restrict benchmarking | not found in the text | couldn't be read |\n| Terms or service can change without notice | not found in the text | couldn't be read |\n| Arbitration or class-action waiver | not found in the text | couldn't be read |\n| Popularity | 43 npm/wk | 68 stars, 433k npm/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### dotCMS\n\nNo score change since it was listed.\n\n### Storyblok\n\n- -3.0 on 1 November 2026: correction\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.\n\n**Storyblok.** The hosted MCP server covers the whole Management API with seven tools, OAuth scopes split into read, write and publish per space, and a confirmation step on deletes. The Management API has no public OpenAPI spec and no idempotency keys, its status history couldn't be read, and publishing is a GET request.\n\n## Before you call either\n\n### dotCMS\n\n1. Search the spec with `search` before writing an `execute` call, and return only the fields you need\n2. Use a token for a dedicated user and role, not an administrator's\n3. Confirm with the user before execute calls that publish, archive or delete content\n4. Keep results small with pick and first, since output is capped at about 25,000 characters\n5. Use download_assets for theme folders so files land on disk instead of in context\n\n### Storyblok\n\n1. Pick the base URL by the space's region (mapi.storyblok.com for the EU, api-us, api-ca or api-ap otherwise). A token sent to the wrong region fails\n2. Create stories without `publish` to keep them as drafts, then call the publish endpoint. It is a GET, so never prefetch or blindly retry it\n3. Write translations as `field__i18n__\u003ccode\u003e` keys inside the same content object, and set the component field to translatable first\n4. Upload an asset in three steps (signed response, POST to S3, finish upload). Through MCP the S3 step needs shell access for curl\n5. Stay under 3 calls a second on Starter and 6 on paid plans, and back off exponentially on 429. Saves that break a field's max_length return 422\n6. Replace unscoped personal access tokens with scoped ones before 7 December 2026, when Storyblok revokes them\n\n## Questions\n\n### Which is better for AI agents, dotCMS or Storyblok?\n\nStoryblok scores 64.8 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.\n\n### Do dotCMS and Storyblok need an API key?\n\ndotCMS needs an API key. Storyblok takes an API key or an OAuth sign-in.\n\n### Can an agent call dotCMS and Storyblok without installing anything?\n\ndotCMS runs on your own machine, with no hosted endpoint listed. Storyblok has a hosted endpoint at https://mapi.storyblok.com/v1.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/dotcms-vs-storyblok.json, and with the fewest tokens: https://www.anchorterminal.com/compare/dotcms-vs-storyblok.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"dotcms\", \"b\": \"storyblok\"}`. From a terminal: `anchor compare dotcms storyblok`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/dotcms.json and https://www.anchorterminal.com/api/v1/tools/storyblok.json\n\n## Other comparisons with dotCMS or Storyblok\n\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Storyblok](https://www.anchorterminal.com/compare/bcms-vs-storyblok.md)\n- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)\n- [ButterCMS vs Storyblok](https://www.anchorterminal.com/compare/buttercms-vs-storyblok.md)\n- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)\n- [Contentstack vs Storyblok](https://www.anchorterminal.com/compare/contentstack-vs-storyblok.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Storyblok](https://www.anchorterminal.com/compare/cosmic-vs-storyblok.md)\n- [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md)\n- [DatoCMS vs Storyblok](https://www.anchorterminal.com/compare/datocms-vs-storyblok.md)\n- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)\n- [Directus vs Storyblok](https://www.anchorterminal.com/compare/directus-vs-storyblok.md)\n- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)\n- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)\n- [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md)\n- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)\n- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)\n- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)\n- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)\n- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)\n- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)\n- [Ghost vs Storyblok](https://www.anchorterminal.com/compare/ghost-vs-storyblok.md)\n- [Hygraph vs Storyblok](https://www.anchorterminal.com/compare/hygraph-vs-storyblok.md)\n- [Kontent.ai vs Storyblok](https://www.anchorterminal.com/compare/kontent-ai-vs-storyblok.md)\n- [Payload vs Storyblok](https://www.anchorterminal.com/compare/payload-vs-storyblok.md)\n- [Prismic vs Storyblok](https://www.anchorterminal.com/compare/prismic-vs-storyblok.md)\n- [Sanity vs Storyblok](https://www.anchorterminal.com/compare/sanity-vs-storyblok.md)\n- [Storyblok vs Strapi](https://www.anchorterminal.com/compare/storyblok-vs-strapi.md)\n- [Storyblok vs Webflow](https://www.anchorterminal.com/compare/storyblok-vs-webflow.md)\n- [Storyblok vs WordPress](https://www.anchorterminal.com/compare/storyblok-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "dotCMS vs Storyblok", "url": "" } ], "description": "Storyblok scores 64.8 (B) to dotCMS's 57.7 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "dotCMS C 57.7", "Storyblok B 64.8", "scores" ], "h1": "dotCMS vs Storyblok", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/dotcms-vs-storyblok", "published": "2026-10-01", "section": "tools", "title": "dotCMS vs Storyblok for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok" }, "tokens": { "markdown": 4400, "slim": 2580 }, "version": 1 }