Ghost vs Prismic

Ghost

A create needs only a title, updates are checked against updated_at so a stale write is refused, and a Contributor's staff token can draft without being able to publish. The Admin API has no OpenAPI file and one fixed permission set per integration, and 20 security advisories were published between 3 September and 1 October 2026.

Prismic

The hosted MCP server stages every write as a draft in a release, cannot delete, and publishes only when a user with the Publisher role asks. Write tokens for the Migration, Asset and Types APIs have no scopes, no OpenAPI file was found, writes are limited to one request a second, and the acceptable use policy forbids access by scripts.

Ghost

1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set kid to the key id, aud to /admin/ and exp at most 5 minutes ahead
2. Set status to draft on every create unless told to publish, and publish later with a PUT that sets status to published
3. GET the post before each PUT and send its updated_at back. Tags and authors in a PUT replace the existing lists
4. Send content as a Lexical JSON string, or add ?source=html and send html. The HTML conversion is lossy unless wrapped in an HTML card
5. Page through lists with limit up to 100 and page. Since Ghost 6.0 limit=all returns 100 items without an error

Prismic

1. Ask a repository Administrator to activate Prismic MCP in Settings first. Activation can take several minutes, and each environment has its own setting
2. Call list_repositories, then get_custom_type or get_shared_slice for the empty content template before create_document
3. Create a release with create_release and write into it. Call publish_release only on an explicit request, because a publish cannot be undone through MCP
4. For the Migration API send Authorization: Bearer <write token> and a repository header, one page a request, one request a second, and keep each returned id for later PUT calls
5. Upload media first (upload_asset or POST to https://asset-api.prismic.io/assets) and reference the asset id in image and media link fields