Ghost vs Storyblok

Ghost

A create needs only a title, updates are checked against updated_at so a stale write is refused, and a Contributor's staff token can draft without being able to publish. The Admin API has no OpenAPI file and one fixed permission set per integration, and 20 security advisories were published between 3 September and 1 October 2026.

Storyblok

The hosted MCP server covers the whole Management API with seven tools, OAuth scopes split into read, write and publish per space, and a confirmation step on deletes. The Management API has no public OpenAPI spec, no idempotency keys and no monitor on the public status page, and publishing is a GET request.

Ghost

1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set kid to the key id, aud to /admin/ and exp at most 5 minutes ahead
2. Set status to draft on every create unless told to publish, and publish later with a PUT that sets status to published
3. GET the post before each PUT and send its updated_at back. Tags and authors in a PUT replace the existing lists
4. Send content as a Lexical JSON string, or add ?source=html and send html. The HTML conversion is lossy unless wrapped in an HTML card
5. Page through lists with limit up to 100 and page. Since Ghost 6.0 limit=all returns 100 items without an error

Storyblok

1. Pick the base URL by the space's region (mapi.storyblok.com for the EU, api-us, api-ca or api-ap otherwise). A token sent to the wrong region fails
2. Create stories without publish to keep them as drafts, then call the publish endpoint. It is a GET, so never prefetch or blindly retry it
3. Write translations as field__i18n__<code> keys inside the same content object, and set the component field to translatable first
4. Upload an asset in three steps (signed response, POST to S3, finish upload). Through MCP the S3 step needs shell access for curl
5. Stay under 3 calls a second on Starter and 6 on paid plans, and back off exponentially on 429. Saves that break a field's max_length return 422