{ "data": { "a": { "slug": "dotcms", "name": "dotCMS", "vendor": "dotCMS LLC", "vendorUrl": "https://www.dotcms.com", "kind": "mcp", "category": "cms", "summary": "dotCMS is an enterprise CMS with headless REST APIs, workflows and push publishing, run as dotCMS Cloud or self-hosted. Agents use the @dotcms/mcp-server package, which searches the instance's OpenAPI spec and runs API calls in a sandbox.", "url": "https://www.anchorterminal.com/tools/dotcms", "markdownUrl": "https://www.anchorterminal.com/tools/dotcms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/dotcms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/dotcms.json", "dns": "dotcms.grade.anchorterminal.com", "repo": "https://github.com/dotCMS/core", "license": "BUSL-1.1", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@dotcms/mcp-server" } ], "auth": "api-key", "authNotes": "The MCP server reads DOTCMS_URL and AUTH_TOKEN. API tokens are JWTs issued for a dotCMS user, carry that user's role permissions, take an expiry in days, and are created by administrators in the user manager or through /api/v1/authentication/api-token. The docs recommend a separate user and role per application; the MCP server needs write permission for content types, content and workflows. Tokens are injected outside the sandbox, so sandboxed code never sees them.", "pricing": "freemium", "pricingNotes": "dotCMS is free with every capability for companies under $5 million in revenue under its BSL licence, self-hosted. Cloud plans (Starter, Professional, Business, Enterprise) are priced on request, with monthly request and bandwidth allowances and SLAs of 99.5 to 99.9 per cent.", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP README, the dev docs or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 7, "popularity": { "githubStars": null, "npmWeekly": 43, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://dev.dotcms.com/docs/build/integrations/dotai/mcp-server", "llmsTxt": "https://dev.dotcms.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.schema", "cms.localisation" ], "tags": [ "official", "mcp", "stdio", "self-hosted", "hosted", "source-available", "llms-txt", "sales-led", "sla", "typescript" ], "lastRelease": "2026-09-02", "graded": true, "anchor": { "graded": true, "score": 57.7, "grade": "C", "agentReady": false, "rank": 784, "ranked": true, "rankOf": 1510, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.", "bestFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "strengths": [ "Seven tools in code mode, with the instance's OpenAPI spec searchable from the sandbox", "The API token stays outside the sandbox, which only receives results", "JWT tokens per user with role permissions and an expiry", "security.txt with PGP, a bounty-backed disclosure policy and LTS security backports", "Free with every capability for organisations under $5 million in revenue" ], "weaknesses": [ "Pre-1.0 package, with the dev docs still pointing at the beta tag", "The server needs a token with write permission for content types, content and workflows", "execute can call any endpoint, and no read-only mode or annotations were found", "Cloud prices are on request only", "Source-available under the BSL, not an OSI licence" ], "agentNotes": [ "Search the spec with `search` before writing an `execute` call, and return only the fields you need", "Use a token for a dedicated user and role, not an administrator's", "Confirm with the user before execute calls that publish, archive or delete content", "Keep results small with pick and first, since output is capped at about 25,000 characters", "Use download_assets for theme folders so files land on disk instead of in context" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.7 } ], "editorialScores": { "ergonomics": 68, "maintenance": 75, "payments": 35, "reliability": 47, "schema": 65, "security": 63, "transparency": 51 }, "provenanceScore": 57, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @dotcms/mcp-server", "config": { "mcpServers": { "dotcms": { "args": [ "-y", "@dotcms/mcp-server" ], "command": "npx", "env": { "AUTH_TOKEN": "your-api-token", "DOTCMS_URL": "https://your-dotcms-instance.com" } } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/dotcms" }, "area": "business", "provenance": { "legalEntity": "dotCMS LLC", "domain": "dotcms.com", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://github.com/dotCMS/core/blob/main/LICENSE", "privacy": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "statusPage": "", "changelog": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "The MCP server runs locally and calls the customer's own dotCMS instance, so the endpoint isn't on a dotCMS domain.", "The privacy policy, last updated 8 September 2026, covers dotCMS's websites only and names dotCMS Holdings, LLC, dotCMS Services LLC and dotCMS LLC.", "www.dotcms.com/robots.txt disallows /docs/ and /utils/; dev.dotcms.com allows all with Content-Signal ai-train=yes, search=yes, ai-input=yes.", "www.dotcms.com/terms-of-service and /privacy-policy returned 404; no cloud terms of service were found, so the licence stands in for terms.", "No status page answered (status.dotcms.com refused the connection)." ], "score": 57 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/dotcms.json", "live": { "slug": "dotcms", "versions": [ { "registry": "github", "name": "dotCMS/core", "version": "dotcms-cli-26.11.06-03", "released": "2026-11-06", "seenAt": "2026-11-06T23:22:22.409374032Z" }, { "registry": "npm", "name": "@dotcms/mcp-server", "version": "0.1.1", "seenAt": "2026-11-06T23:22:21.577680774Z" } ], "githubStars": 971, "npmWeekly": 43, "securityTxt": { "url": "https://dotcms.com/.well-known/security.txt", "state": "valid", "expires": "2027-06-09T23:59:59.000Z", "checkedAt": "2026-11-07T16:00:46.289271049Z" }, "llmsTxt": { "url": "https://dev.dotcms.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:19.058875451Z" }, "pages": [ { "url": "https://dev.dotcms.com/docs/reference/releases/product-versions/changelogs", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:02:43.439634709Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "14706a7e3d20" }, { "url": "https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:02:39.904485204Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b8fe703d4258" }, { "url": "https://raw.githubusercontent.com/dotCMS/core/main/LICENSE", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:20:41.976083247Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dd3baa6b46f" } ], "updatedAt": "2026-11-07T16:00:46.289271049Z" } }, "answer": "Strapi scores 67.7 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.", "b": { "slug": "strapi", "name": "Strapi", "vendor": "Strapi, Inc.", "vendorUrl": "https://strapi.io", "kind": "http-api", "category": "cms", "summary": "Strapi is an open-source headless CMS for Node.js that its owner hosts, with a paid cloud. Agents create, localise and publish entries through generated REST and GraphQL APIs or a built-in MCP server.", "url": "https://www.anchorterminal.com/tools/strapi", "markdownUrl": "https://www.anchorterminal.com/tools/strapi.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/strapi.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/strapi.json", "dns": "strapi.grade.anchorterminal.com", "repo": "https://github.com/strapi/strapi", "license": "MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "@strapi/strapi" }, { "registry": "npm", "name": "@strapi/client" } ], "auth": "api-key", "authNotes": "Self-serve tokens created in the admin panel of your own instance, with no app review or partner approval. API tokens authenticate the Content API under /api and are read-only, full access or custom per content type and action. Admin tokens authenticate admin routes and the MCP server at /mcp and hold a chosen subset of their owner's permissions, down to field and locale. Each kind is rejected on the other's routes. Both expire after 7, 30 or 90 days or never, can be regenerated, and travel as `Authorization: Bearer`. An Admin token is shown once.", "pricing": "freemium", "pricingNotes": "The Community Edition is free to self-host with unlimited seats, so an agent can start without a contract or a card. Growth is $45 a month for 3 seats ($15 per extra seat) with a 30-day trial and no card, and Enterprise is priced by sales. Strapi Cloud is $35, $90 or $450 a project a month, needs a card at project creation, and charges $1.50 per 25,000 API requests over the plan (checked 2026-10-07).", "priceSummary": "$45 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation index, the pricing pages or the repository's MCP code (checked 2026-10-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 73289, "npmWeekly": 258813, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://docs.strapi.io", "llmsTxt": "https://docs.strapi.io/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.localisation", "cms.assets", "cms.schema" ], "tags": [ "open-source", "self-hosted", "hosted", "mcp", "llms-txt", "webhooks", "graphql", "typescript", "status-page", "soc2" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 67.7, "grade": "B", "agentReady": false, "rank": 309, "ranked": true, "rankOf": 1510, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 87, "payments": 50, "reliability": 82, "schema": 80, "security": 66, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -4, "negativeNotes": [ "Strapi publishes its own advisories on GitHub, and this run counts them one by one. OSV lists five for Strapi's packages published in the last 12 months, all fixed in released versions and more than two months old. Two are critical, GHSA-3xcq-8mjw-h6mx (CVE-2026-22599, 13 May 2026, SQL injection in the Content-Type Builder, fixed in 5.33.2 and 4.26.1) and GHSA-rjg2-95x7-8qmx (CVE-2026-27886, 14 May 2026, sensitive data leaked through relation filters, fixed in 5.37.0), 1 each, the value this run gives a fixed critical or High more than two months old. Two are Moderate, GHSA-7mqx-wwh4-f9fw (CVE-2025-64526, 13 May, a rate-limit bypass in Users \u0026 Permissions, fixed in 5.45.0) and GHSA-pcw7-5633-82vv (CVE-2026-22707, 14 May, an upload MIME check bypass, fixed in 5.33.3), 1 each. GHSA-hvp3-26wx-g2w4 (Low, password reset kept refresh sessions) costs nothing. 1 + 1 + 1 + 1 = 4. https://api.osv.dev/v1/query ; https://github.com/strapi/strapi/security/advisories" ], "verdict": "The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is paid-only and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.", "bestFor": "Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.", "strengths": [ "Admin tokens carry a chosen subset of the owner's permissions, down to content type, action, field and locale, with 7, 30 or 90 day expiry", "The MCP server lists only the tools a token may use and narrows each input and output schema to permitted fields", "Media delete tools preview by default through `dryRun` and name what would be removed before anything is deleted", "Weekly releases, 14 tagged versions between 5 August and 28 October 2026, with release notes per version", "MIT Community Edition, free to self-host with unlimited seats, plus llms.txt, llms-full.txt and Markdown copies of every docs page" ], "weaknesses": [ "Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans", "Audit Logs and Review Workflows are Enterprise only, so the free edition has no record of what an agent changed", "A REST POST or PUT publishes immediately unless the request passes `status=draft`", "The MCP server can't upload files, describes dynamic zones as untyped arrays and sets no read-only or destructive annotations", "Five advisories were published in May 2026, two critical (SQL injection in the Content-Type Builder, a data leak through relation filters), all fixed in earlier releases" ], "agentNotes": [ "Pass `status=draft` on every REST POST and PUT. Without it the Content API publishes the entry at once", "Use an Admin token for `/mcp` and admin routes and an API token for `/api`. Each kind is rejected on the other's routes", "Upload files with multipart POST to `/api/upload` first, then reference the returned file id in the entry. MCP tools can't upload", "Call `media_delete_assets` and `media_delete_folder` without `dryRun` first to preview, and take asset ids only from `media_list_assets`", "Keep your own copy of an entry before updating it. API and MCP writes create no Content History version" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.7 } ], "editorialScores": { "ergonomics": 65, "maintenance": 87, "payments": 50, "reliability": 82, "schema": 80, "security": 66, "transparency": 75 }, "provenanceScore": 69, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx create-strapi@latest", "http": "curl 'http://localhost:1337/api/restaurants?status=draft' \\\n -H \"Authorization: Bearer $STRAPI_API_TOKEN\"", "claudeCode": "claude mcp add strapi-mcp --transport http http://localhost:1337/mcp -H \"Authorization: Bearer YOUR_ADMIN_TOKEN\"", "config": { "mcpServers": { "strapi-mcp": { "headers": { "Authorization": "Bearer YOUR_ADMIN_TOKEN" }, "type": "streamable-http", "url": "http://localhost:1337/mcp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/strapi" }, "area": "business", "unitPrices": [ { "item": "Community Edition, self-hosted", "unit": "month", "usd": 0, "note": "MIT, unlimited seats, you pay for your own hosting" }, { "item": "Growth, self-hosted", "unit": "month", "usd": 45, "note": "3 seats included, $15 per extra seat" }, { "item": "Strapi Cloud Starter", "unit": "month", "usd": 35, "note": "per project, 100,000 API requests" }, { "item": "Strapi Cloud Pro", "unit": "month", "usd": 90, "note": "per project, 1 million API requests" }, { "item": "Strapi Cloud Business", "unit": "month", "usd": 450, "note": "per project, 10 million API requests" }, { "item": "Strapi Cloud API requests over the plan", "unit": "1k-requests", "usd": 0.06, "note": "$1.50 per 25,000" } ], "provenance": { "legalEntity": "Strapi, Inc.", "domain": "strapi.io", "domainRegistered": "2015-09-21", "endpointOnVendorDomain": false, "terms": "https://strapi.io/cloud-legal", "privacy": "https://strapi.io/privacy", "statusPage": "https://status.strapi.io", "changelog": "https://github.com/strapi/strapi/releases", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The Strapi Cloud terms (effective 7 October 2026) name Strapi, Inc., 548 Market St, PMB 60577, San Francisco, California 94104. The repository's copyright line names Strapi Solutions SAS, and the privacy policy gives Strapi Solutions, 128 rue de la Boétie, 75008 Paris.", "A self-hosted install answers on its owner's domain. Strapi Cloud projects answer at https://\u003cproject\u003e.strapiapp.com.", "https://strapi.io/.well-known/security.txt returned 404 on 1 November 2026, as on 7 October. The repository holds a .well-known/security.txt with an Expires of 20 May 2027 and a Canonical line pointing at that URL.", "RDAP for strapi.io gives a registration date of 2015-09-21.", "The status page runs on Better Stack and covers Strapi Cloud, the website and the docs, not self-hosted installs." ], "score": 69 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/strapi.json", "live": { "slug": "strapi", "vendorStatus": { "page": "https://status.strapi.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:49.371257801Z" }, "versions": [ { "registry": "github", "name": "strapi/strapi", "version": "v5.61.0", "released": "2026-11-04", "seenAt": "2026-11-07T00:08:50.606092668Z" }, { "registry": "npm", "name": "@strapi/client", "version": "1.6.2", "seenAt": "2026-11-07T00:08:48.630156095Z" }, { "registry": "npm", "name": "@strapi/strapi", "version": "5.61.0", "seenAt": "2026-11-07T00:08:48.416025704Z" } ], "githubStars": 73439, "npmWeekly": 272760, "securityTxt": { "url": "https://strapi.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:29.878163067Z" }, "llmsTxt": { "url": "https://docs.strapi.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:03.195364993Z" }, "domain": { "domain": "strapi.io", "checkedAt": "2026-11-01T14:14:17.339178201Z" }, "pages": [ { "url": "https://strapi.io/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:21:04.710154099Z", "changedAt": "2026-10-21T00:35:29.759997175Z", "fingerprint": "ebba9951194b" }, { "url": "https://strapi.io/cloud-legal", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:21:02.008660727Z", "changedAt": "2026-10-21T00:35:27.142871952Z", "fingerprint": "79685bdc4a33" } ], "github": { "repo": "strapi/strapi", "checkedAt": "2026-11-02T09:28:28.153243123Z", "stars": 73423, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:28:09Z", "openIssues": 228, "openPRs": 437, "issuesOpened90d": 201, "issuesClosed90d": 231, "prsMerged90d": 456, "ci": { "branch": "develop", "runs": 50, "success": 30, "failure": 2, "other": 18, "latest": "success", "latestAt": "2026-11-02T09:27:48Z" }, "advisories": [ { "ghsa": "GHSA-rjg2-95x7-8qmx", "cve": "CVE-2026-27886", "severity": "critical", "published": "2026-05-13T13:39:31Z" }, { "ghsa": "GHSA-pcw7-5633-82vv", "cve": "CVE-2026-22707", "severity": "medium", "published": "2026-05-13T13:39:19Z" }, { "ghsa": "GHSA-7mqx-wwh4-f9fw", "cve": "CVE-2025-64526", "severity": "medium", "published": "2026-05-13T13:38:04Z" }, { "ghsa": "GHSA-hvp3-26wx-g2w4", "cve": "CVE-2026-22706", "severity": "low", "published": "2026-05-13T13:37:55Z" }, { "ghsa": "GHSA-3xcq-8mjw-h6mx", "cve": "CVE-2026-22599", "severity": "critical", "published": "2026-05-13T13:37:42Z" }, { "ghsa": "GHSA-495j-h493-42q2", "cve": "CVE-2024-56143", "severity": "high", "published": "2025-10-16T15:07:22Z" }, { "ghsa": "GHSA-2cjv-6wg9-f4f3", "cve": "CVE-2025-25298", "severity": "low", "published": "2025-10-16T15:07:06Z" }, { "ghsa": "GHSA-9329-mxxw-qwf8", "cve": "CVE-2025-53092", "severity": "high", "published": "2025-10-16T15:06:12Z" }, { "ghsa": "GHSA-v8wj-f5c7-pvxf", "cve": "CVE-2024-52588", "severity": "medium", "published": "2025-05-27T14:27:33Z" }, { "ghsa": "GHSA-wrvh-rcmr-9qfc", "cve": "CVE-2024-34065", "severity": "high", "published": "2024-06-12T13:03:16Z" }, { "ghsa": "GHSA-pm9q-xj9p-96pm", "cve": "CVE-2024-31217", "severity": "medium", "published": "2024-06-12T13:02:22Z" }, { "ghsa": "GHSA-6j89-frxc-q26m", "cve": "CVE-2024-29181", "severity": "low", "published": "2024-06-12T13:01:39Z" }, { "ghsa": "GHSA-gc7p-j5xm-xxh2", "cve": "CVE-2023-39345", "severity": "high", "published": "2023-11-03T07:43:47Z" }, { "ghsa": "GHSA-m284-85mf-cgrc", "cve": "CVE-2023-37263", "severity": "low", "published": "2023-09-13T15:15:38Z" }, { "ghsa": "GHSA-v8gg-4mq2-88q4", "cve": "CVE-2023-36472", "severity": "medium", "published": "2023-09-13T15:15:10Z" }, { "ghsa": "GHSA-24q2-59hm-rh9r", "cve": "CVE-2023-38507", "severity": "high", "published": "2023-09-13T15:15:03Z" }, { "ghsa": "GHSA-9xg4-3qfm-9w8f", "cve": "CVE-2023-34235", "severity": "high", "published": "2023-07-25T13:10:12Z" }, { "ghsa": "GHSA-chmr-rg2f-9jmf", "cve": "CVE-2023-34093", "severity": "medium", "published": "2023-07-25T13:10:08Z" }, { "ghsa": "GHSA-2h87-4q2w-v4hf", "cve": "CVE-2023-22621", "severity": "critical", "published": "2023-04-18T16:47:52Z" }, { "ghsa": "GHSA-jjqf-j4w7-92w8", "cve": "CVE-2023-22894", "severity": "critical", "published": "2023-04-18T16:47:44Z" }, { "ghsa": "GHSA-xv3q-jrmm-4fxv", "cve": "CVE-2023-22893", "severity": "high", "published": "2023-04-18T16:47:06Z" } ], "replies": { "sampled": 25, "unanswered": 18, "medianDays": 1.7 } }, "updatedAt": "2026-11-07T16:01:29.878163067Z" } }, "edges": [ { "by": 35, "category": "reliability", "leads": "strapi", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.", "b": "Read with the local-software lines, since the graded surface is the Community Edition its owner hosts. Strapi Cloud's status page isn't scored here. Official npm packages, with Node.js 20 to 26 stated in `engines` at v5.60.0 (20). A Tests workflow runs unit, API, CLI and end-to-end suites. Per the 7 October check, not re-read on 1 November (GitHub's pages refuse our reader), the latest push run on develop passed on 7 October 2026, and on main the 30 September run passed and the 7 October run failed (20 of 25). Per the same check, 217 open issues, 45 labelled severity high and one critical, with 283 closed against 208 opened since 9 July (15 of 25). Semver releases with notes per version and each v5 breaking change documented on its own page, but OpenAPI generation is declared outside semver. No commit from 5.51.2 to 5.60.0 is marked breaking (12 of 15). 5.x is the stable line and SECURITY.md marks it LTS (15)." }, "scores": { "a": 47, "b": 82 } }, { "by": 18, "category": "transparency", "leads": "strapi", "name": "Transparency \u0026 trust", "reasons": { "a": "dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.", "b": "MIT for the Community Edition, with ee/ directories under a separate Enterprise Edition licence that the LICENSE file explains (26 of 30). A self-hosted install keeps content on its owner's servers. For Strapi Cloud the terms delete customer content at termination but keep backups for unstated \"standard periods\", a DPA dated 21 November 2024 is part of the cloud terms, and the privacy policy is dated 1 March 2023. The Cloud Policies still describe a Free plan that the pricing page and docs no longer list (20 of 30). SECURITY.md dates each major's support, with v4 ended in October 2025 and security fixes until April 2026, and v5 breaking changes are documented one by one. No stated notice period for API changes (14 of 20). Telemetry is on by default and documented with an opt-out command and flag. The MCP usage events added in May 2026 aren't named on that page (15 of 20)." }, "scores": { "a": 54, "b": 72 } }, { "by": 15, "category": "schema", "leads": "strapi", "name": "Schema \u0026 documentation", "reasons": { "a": "The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.", "b": "No published OpenAPI file, because endpoints depend on each project's content types. `strapi openapi generate` writes an OpenAPI 3.1.0 file for a project and is marked experimental, and every MCP tool carries JSON Schema 2020-12 input and output schemas built from the content model (20 of 25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). The 10 media tools say when to use each one and when not to, while generated content tools get a single line such as `Content-manager list for api::article.article` (14 of 20). Schemas are narrowed per field, action and locale and sort values are enums, but dynamic zones are untyped arrays and circular components fall back to an open record (12 of 15). REST pages pair curl examples with responses, and the error format and error classes are documented, without a list of status codes per endpoint (12 of 15). Semver with release notes on GitHub. The REST paths carry no API version (12 of 15)." }, "scores": { "a": 65, "b": 80 } }, { "by": 15, "category": "payments", "leads": "strapi", "name": "Payments \u0026 pricing", "reasons": { "a": "Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.", "b": "Scored with the self-hosted rule, taking prices from the paid options beside the free edition. No x402, MPP or L402 (0). The Community Edition is free, Growth is $45 a month, and Strapi Cloud lists $35, $90 and $450 a project a month with $1.50 per further 25,000 API requests, all public (20). The Community Edition needs no card and Growth has a 30-day trial without one. Strapi Cloud asks for a card at project creation (20). Install and the first administrator can be scripted (`create-strapi`, `strapi admin:create-user`) with no account at Strapi, but the docs create API and Admin tokens only in the admin panel, so half (10)." }, "scores": { "a": 35, "b": 50 } }, { "by": 12, "category": "maintenance", "leads": "strapi", "name": "Maintenance \u0026 community", "reasons": { "a": "dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.", "b": "v5.60.0 was tagged on 28 October 2026 (30). 14 tagged versions between 5 August and 28 October, one a week (20). Per the 7 October check, not re-read on 1 November, 283 issues closed against 208 opened since 9 July and the newest pull requests carry labels and a reply the same day, with 217 issues open, 45 labelled severity high (18 of 25). @strapi/client 1.6.2 (4 June 2026) is still the newest tag and the only official client. The official MCP registry lists third-party Strapi servers only, which fits a server built into the product (10 of 15). Dependency bumps land weekly in the clone (5.60.0 moved in-range dependencies past published advisories). CI state per the 7 October check, when the Tests run on main failed (9 of 10)." }, "scores": { "a": 75, "b": 87 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "dotCMS LLC", "b": "Strapi, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "BUSL-1.1", "b": "MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms", "name": "Licence" }, { "a": "7", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-02", "b": "2026-10-28", "name": "Last release" }, { "a": "no date given", "b": "2026-10-07", "name": "Terms last updated" }, { "a": "2026-09-08", "b": "2023-03-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "43 npm/wk", "b": "73k stars, 259k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Strapi scores 67.7 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, dotCMS or Strapi?" }, { "answer": "Both need an API key.", "question": "Do dotCMS and Strapi need an API key?" }, { "answer": "dotCMS runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Strapi.", "question": "Can an agent call dotCMS and Strapi without installing anything?" }, { "answer": "No open-source release is listed for dotCMS. Strapi is open source (MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms).", "question": "Are dotCMS and Strapi open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Runs on your own machine", "No incidents deducted, where Strapi loses 4 points for them" ], "goodFor": "Enterprises already on dotCMS who want an agent to manage content and pages.", "slug": "dotcms", "watchFor": "Pre-1.0 package, with the dev docs still pointing at the beta tag" }, { "aheadOn": [ "Reliability, 82 against 47", "Schema \u0026 documentation, 80 against 65", "Payments \u0026 pricing, 50 against 35", "Maintenance \u0026 community, 87 against 75", "Transparency \u0026 trust, 72 against 54" ], "also": [ "Open source" ], "goodFor": "Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.", "slug": "strapi", "watchFor": "Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans" } ], "history": { "dotcms": null, "strapi": [ { "causes": [ "correction" ], "date": "2026-11-01", "delta": 2, "from": 65.7, "fromGrade": "B", "to": 67.7, "toGrade": "B" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": -0.2, "from": 65.9, "fromGrade": "B", "to": 65.7, "toGrade": "B" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.2, "from": 65.7, "fromGrade": "B", "to": 65.9, "toGrade": "B" } ] }, "job": { "capability": "cms.content", "name": "Content management" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bcms-vs-dotcms.json", "title": "BCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/bcms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/bcms-vs-strapi.json", "title": "BCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/bcms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms.json", "title": "ButterCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/buttercms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/buttercms-vs-strapi.json", "title": "ButterCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/buttercms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms.json", "title": "Contentstack vs dotCMS", "url": "https://www.anchorterminal.com/compare/contentstack-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-strapi.json", "title": "Contentstack vs Strapi", "url": "https://www.anchorterminal.com/compare/contentstack-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms.json", "title": "Cosmic vs dotCMS", "url": "https://www.anchorterminal.com/compare/cosmic-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/cosmic-vs-strapi.json", "title": "Cosmic vs Strapi", "url": "https://www.anchorterminal.com/compare/cosmic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-dotcms.json", "title": "DatoCMS vs dotCMS", "url": "https://www.anchorterminal.com/compare/datocms-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/datocms-vs-strapi.json", "title": "DatoCMS vs Strapi", "url": "https://www.anchorterminal.com/compare/datocms-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-dotcms.json", "title": "Directus vs dotCMS", "url": "https://www.anchorterminal.com/compare/directus-vs-dotcms" }, { "json": "https://www.anchorterminal.com/compare/directus-vs-strapi.json", "title": "Directus vs Strapi", "url": "https://www.anchorterminal.com/compare/directus-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-ghost.json", "title": "dotCMS vs Ghost", "url": "https://www.anchorterminal.com/compare/dotcms-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph.json", "title": "dotCMS vs Hygraph", "url": "https://www.anchorterminal.com/compare/dotcms-vs-hygraph" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.json", "title": "dotCMS vs Kontent.ai", "url": "https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-payload.json", "title": "dotCMS vs Payload", "url": "https://www.anchorterminal.com/compare/dotcms-vs-payload" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-prismic.json", "title": "dotCMS vs Prismic", "url": "https://www.anchorterminal.com/compare/dotcms-vs-prismic" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-sanity.json", "title": "dotCMS vs Sanity", "url": "https://www.anchorterminal.com/compare/dotcms-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok.json", "title": "dotCMS vs Storyblok", "url": "https://www.anchorterminal.com/compare/dotcms-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-webflow.json", "title": "dotCMS vs Webflow", "url": "https://www.anchorterminal.com/compare/dotcms-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress.json", "title": "dotCMS vs WordPress", "url": "https://www.anchorterminal.com/compare/dotcms-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-strapi.json", "title": "Ghost vs Strapi", "url": "https://www.anchorterminal.com/compare/ghost-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/hygraph-vs-strapi.json", "title": "Hygraph vs Strapi", "url": "https://www.anchorterminal.com/compare/hygraph-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/kontent-ai-vs-strapi.json", "title": "Kontent.ai vs Strapi", "url": "https://www.anchorterminal.com/compare/kontent-ai-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/payload-vs-strapi.json", "title": "Payload vs Strapi", "url": "https://www.anchorterminal.com/compare/payload-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/prismic-vs-strapi.json", "title": "Prismic vs Strapi", "url": "https://www.anchorterminal.com/compare/prismic-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-strapi.json", "title": "Sanity vs Strapi", "url": "https://www.anchorterminal.com/compare/sanity-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-strapi.json", "title": "Storyblok vs Strapi", "url": "https://www.anchorterminal.com/compare/storyblok-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-webflow.json", "title": "Strapi vs Webflow", "url": "https://www.anchorterminal.com/compare/strapi-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-wordpress.json", "title": "Strapi vs WordPress", "url": "https://www.anchorterminal.com/compare/strapi-vs-wordpress" } ], "panel": null, "scores": [ { "by": 35, "dotcms": 47, "edge": "strapi", "key": "reliability", "name": "Reliability", "strapi": 82, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 15, "dotcms": 65, "edge": "strapi", "key": "schema", "name": "Schema \u0026 documentation", "strapi": 80, "weight": 13 }, { "by": 3, "dotcms": 68, "edge": "dotcms", "key": "ergonomics", "name": "Agent ergonomics", "strapi": 65, "weight": 13 }, { "by": 3, "dotcms": 63, "edge": "strapi", "key": "security", "name": "Security \u0026 auth", "strapi": 66, "weight": 14 }, { "by": 15, "dotcms": 35, "edge": "strapi", "key": "payments", "name": "Payments \u0026 pricing", "strapi": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 12, "dotcms": 75, "edge": "strapi", "key": "maintenance", "name": "Maintenance \u0026 community", "strapi": 87, "weight": 7 }, { "by": 18, "dotcms": 54, "edge": "strapi", "key": "transparency", "name": "Transparency \u0026 trust", "strapi": 72, "weight": 7 } ], "summary": "Strapi scores 67.7 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. Both do content management.", "tasks": null, "tutorials": [], "verdicts": { "dotcms": "dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.", "strapi": "The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is paid-only and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/dotcms-vs-strapi", "json": "https://www.anchorterminal.com/compare/dotcms-vs-strapi.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/dotcms-vs-strapi.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/dotcms-vs-strapi.min.md" }, "markdown": "Strapi scores 67.7 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories. Both do content management.\n\n- dotCMS: grade C, 57.7/100, rank #784 of 1510. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json\n- Strapi: grade B, 67.7/100, rank #309 of 1510. Markdown https://www.anchorterminal.com/tools/strapi.md · JSON https://www.anchorterminal.com/api/v1/tools/strapi.json\n- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md\n- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md\n\n## Which one, for what\n\n### dotCMS (C)\n\nGood for: Enterprises already on dotCMS who want an agent to manage content and pages.\n\nAlso in its favour:\n- Runs on your own machine\n- No incidents deducted, where Strapi loses 4 points for them\n\nWatch for: Pre-1.0 package, with the dev docs still pointing at the beta tag\n\n### Strapi (B)\n\nGood for: Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.\n\nAhead on:\n- Reliability, 82 against 47\n- Schema \u0026 documentation, 80 against 65\n- Payments \u0026 pricing, 50 against 35\n- Maintenance \u0026 community, 87 against 75\n- Transparency \u0026 trust, 72 against 54\n\nAlso in its favour:\n- Open source\n\nWatch for: Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans\n\n\n## Why the edge\n\n### Reliability: Strapi +35\n\n- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.\n- Strapi (82): Read with the local-software lines, since the graded surface is the Community Edition its owner hosts. Strapi Cloud's status page isn't scored here. Official npm packages, with Node.js 20 to 26 stated in `engines` at v5.60.0 (20). A Tests workflow runs unit, API, CLI and end-to-end suites. Per the 7 October check, not re-read on 1 November (GitHub's pages refuse our reader), the latest push run on develop passed on 7 October 2026, and on main the 30 September run passed and the 7 October run failed (20 of 25). Per the same check, 217 open issues, 45 labelled severity high and one critical, with 283 closed against 208 opened since 9 July (15 of 25). Semver releases with notes per version and each v5 breaking change documented on its own page, but OpenAPI generation is declared outside semver. No commit from 5.51.2 to 5.60.0 is marked breaking (12 of 15). 5.x is the stable line and SECURITY.md marks it LTS (15).\n\n### Transparency \u0026 trust: Strapi +18\n\n- dotCMS (54): dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.\n- Strapi (72): MIT for the Community Edition, with ee/ directories under a separate Enterprise Edition licence that the LICENSE file explains (26 of 30). A self-hosted install keeps content on its owner's servers. For Strapi Cloud the terms delete customer content at termination but keep backups for unstated \"standard periods\", a DPA dated 21 November 2024 is part of the cloud terms, and the privacy policy is dated 1 March 2023. The Cloud Policies still describe a Free plan that the pricing page and docs no longer list (20 of 30). SECURITY.md dates each major's support, with v4 ended in October 2025 and security fixes until April 2026, and v5 breaking changes are documented one by one. No stated notice period for API changes (14 of 20). Telemetry is on by default and documented with an opt-out command and flag. The MCP usage events added in May 2026 aren't named on that page (15 of 20).\n\n### Schema \u0026 documentation: Strapi +15\n\n- dotCMS (65): The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.\n- Strapi (80): No published OpenAPI file, because endpoints depend on each project's content types. `strapi openapi generate` writes an OpenAPI 3.1.0 file for a project and is marked experimental, and every MCP tool carries JSON Schema 2020-12 input and output schemas built from the content model (20 of 25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). The 10 media tools say when to use each one and when not to, while generated content tools get a single line such as `Content-manager list for api::article.article` (14 of 20). Schemas are narrowed per field, action and locale and sort values are enums, but dynamic zones are untyped arrays and circular components fall back to an open record (12 of 15). REST pages pair curl examples with responses, and the error format and error classes are documented, without a list of status codes per endpoint (12 of 15). Semver with release notes on GitHub. The REST paths carry no API version (12 of 15).\n\n### Payments \u0026 pricing: Strapi +15\n\n- dotCMS (35): Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.\n- Strapi (50): Scored with the self-hosted rule, taking prices from the paid options beside the free edition. No x402, MPP or L402 (0). The Community Edition is free, Growth is $45 a month, and Strapi Cloud lists $35, $90 and $450 a project a month with $1.50 per further 25,000 API requests, all public (20). The Community Edition needs no card and Growth has a 30-day trial without one. Strapi Cloud asks for a card at project creation (20). Install and the first administrator can be scripted (`create-strapi`, `strapi admin:create-user`) with no account at Strapi, but the docs create API and Admin tokens only in the admin panel, so half (10).\n\n### Maintenance \u0026 community: Strapi +12\n\n- dotCMS (75): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.\n- Strapi (87): v5.60.0 was tagged on 28 October 2026 (30). 14 tagged versions between 5 August and 28 October, one a week (20). Per the 7 October check, not re-read on 1 November, 283 issues closed against 208 opened since 9 July and the newest pull requests carry labels and a reply the same day, with 217 issues open, 45 labelled severity high (18 of 25). @strapi/client 1.6.2 (4 June 2026) is still the newest tag and the only official client. The official MCP registry lists third-party Strapi servers only, which fits a server built into the product (10 of 15). Dependency bumps land weekly in the clone (5.60.0 moved in-range dependencies past published advisories). CI state per the 7 October check, when the Tests run on main failed (9 of 10).\n\n## Score by category\n\n| Category | Weight | dotCMS | Strapi | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 47 | 82 | Strapi +35 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 65 | 80 | Strapi +15 |\n| Agent ergonomics | 13% (16.2 this run) | 68 | 65 | dotCMS +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 66 | Strapi +3 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 35 | 50 | Strapi +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 75 | 87 | Strapi +12 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 54 | 72 | Strapi +18 |\n| Negative events | ≤15 | 0 | -4 | |\n| **Total** | | **57.7 · C** | **67.7 · B** | |\n\n## Facts side by side\n\n| Fact | dotCMS | Strapi |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | dotCMS LLC | Strapi, Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | stdio | HTTP, Streamable HTTP |\n| Auth | API key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | BUSL-1.1 | MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms |\n| Tools exposed | 7 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-09-02 | 2026-10-28 |\n| Terms last updated | no date given | 2026-10-07 |\n| Privacy policy last updated | 2026-09-08 | 2023-03-01 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 43 npm/wk | 73k stars, 259k npm/wk |\n| Agent reviews | none | 3.5/5 (4) |\n\n## How the scores have moved\n\n### dotCMS\n\nNo score change since it was listed.\n\n### Strapi\n\n- +2.0 on 1 November 2026: correction\n- -0.2 on 28 October 2026: correction\n- +0.2 on 28 October 2026: new evidence\n\n## Verdicts\n\n**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.\n\n**Strapi.** The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is paid-only and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.\n\n## Before you call either\n\n### dotCMS\n\n1. Search the spec with `search` before writing an `execute` call, and return only the fields you need\n2. Use a token for a dedicated user and role, not an administrator's\n3. Confirm with the user before execute calls that publish, archive or delete content\n4. Keep results small with pick and first, since output is capped at about 25,000 characters\n5. Use download_assets for theme folders so files land on disk instead of in context\n\n### Strapi\n\n1. Pass `status=draft` on every REST POST and PUT. Without it the Content API publishes the entry at once\n2. Use an Admin token for `/mcp` and admin routes and an API token for `/api`. Each kind is rejected on the other's routes\n3. Upload files with multipart POST to `/api/upload` first, then reference the returned file id in the entry. MCP tools can't upload\n4. Call `media_delete_assets` and `media_delete_folder` without `dryRun` first to preview, and take asset ids only from `media_list_assets`\n5. Keep your own copy of an entry before updating it. API and MCP writes create no Content History version\n\n## Questions\n\n### Which is better for AI agents, dotCMS or Strapi?\n\nStrapi scores 67.7 (B) on agent readiness against dotCMS's 57.7 (C), and leads in 6 of 7 scored categories.\n\n### Do dotCMS and Strapi need an API key?\n\nBoth need an API key.\n\n### Can an agent call dotCMS and Strapi without installing anything?\n\ndotCMS runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Strapi.\n\n### Are dotCMS and Strapi open source?\n\nNo open-source release is listed for dotCMS. Strapi is open source (MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/dotcms-vs-strapi.json, and with the fewest tokens: https://www.anchorterminal.com/compare/dotcms-vs-strapi.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"dotcms\", \"b\": \"strapi\"}`. From a terminal: `anchor compare dotcms strapi`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/dotcms.json and https://www.anchorterminal.com/api/v1/tools/strapi.json\n\n## Other comparisons with dotCMS or Strapi\n\n- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)\n- [BCMS vs Strapi](https://www.anchorterminal.com/compare/bcms-vs-strapi.md)\n- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)\n- [ButterCMS vs Strapi](https://www.anchorterminal.com/compare/buttercms-vs-strapi.md)\n- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)\n- [Contentstack vs Strapi](https://www.anchorterminal.com/compare/contentstack-vs-strapi.md)\n- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)\n- [Cosmic vs Strapi](https://www.anchorterminal.com/compare/cosmic-vs-strapi.md)\n- [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md)\n- [DatoCMS vs Strapi](https://www.anchorterminal.com/compare/datocms-vs-strapi.md)\n- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)\n- [Directus vs Strapi](https://www.anchorterminal.com/compare/directus-vs-strapi.md)\n- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)\n- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)\n- [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md)\n- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)\n- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)\n- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)\n- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)\n- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)\n- [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md)\n- [Ghost vs Strapi](https://www.anchorterminal.com/compare/ghost-vs-strapi.md)\n- [Hygraph vs Strapi](https://www.anchorterminal.com/compare/hygraph-vs-strapi.md)\n- [Kontent.ai vs Strapi](https://www.anchorterminal.com/compare/kontent-ai-vs-strapi.md)\n- [Payload vs Strapi](https://www.anchorterminal.com/compare/payload-vs-strapi.md)\n- [Prismic vs Strapi](https://www.anchorterminal.com/compare/prismic-vs-strapi.md)\n- [Sanity vs Strapi](https://www.anchorterminal.com/compare/sanity-vs-strapi.md)\n- [Storyblok vs Strapi](https://www.anchorterminal.com/compare/storyblok-vs-strapi.md)\n- [Strapi vs Webflow](https://www.anchorterminal.com/compare/strapi-vs-webflow.md)\n- [Strapi vs WordPress](https://www.anchorterminal.com/compare/strapi-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "dotCMS vs Strapi", "url": "" } ], "description": "Strapi scores 67.7 (B) to dotCMS's 57.7 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "dotCMS C 57.7", "Strapi B 67.7", "scores" ], "h1": "dotCMS vs Strapi", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/dotcms-vs-strapi", "published": "2026-10-01", "section": "tools", "title": "dotCMS vs Strapi for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/dotcms-vs-strapi" }, "tokens": { "markdown": 4150, "slim": 2330 }, "version": 1 }