Ghost vs Sanity

Ghost

A create needs only a title, updates are checked against updated_at so a stale write is refused, and a Contributor's staff token can draft without being able to publish. The Admin API has no OpenAPI file and one fixed permission set per integration, and 20 security advisories were published between 3 September and 1 October 2026.

Sanity

Sanity publishes 26 OpenAPI specs covering 225 operations, and its hosted MCP server saves edits to drafts or release versions, with publishing as a separate call. The Content Lake does not run schema validation on API writes, and custom roles that limit a token to one dataset or document type are sold only on Enterprise plans.

Ghost

1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set kid to the key id, aud to /admin/ and exp at most 5 minutes ahead
2. Set status to draft on every create unless told to publish, and publish later with a PUT that sets status to published
3. GET the post before each PUT and send its updated_at back. Tags and authors in a PUT replace the existing lists
4. Send content as a Lexical JSON string, or add ?source=html and send html. The HTML conversion is lossy unless wrapped in an HTML card
5. Page through lists with limit up to 100 and page. Since Ghost 6.0 limit=all returns 100 items without an error

Sanity

1. Pin a static dated version in every URL, such as v2025-02-19. Omitting apiVersion in @sanity/client falls back to v1.
2. Validate documents against the schema yourself before an HTTP write, or run sanity documents validate afterwards. The Content Lake does not enforce schema rules.
3. Back off on 429 for mutations yourself. @sanity/client retries queries five times but never retries mutations. The limit is 25 mutations a second per IP.
4. Over MCP, call create_version before patch_documents when editing inside a release, then patch the returned version ID with the same releaseId.
5. Use GROQ projections and slices to size results. MCP query responses are limited to 64 KiB, and a blocked Free project answers 402 with plan_limit_reached.