Ghost vs Strapi

Ghost

A create needs only a title, updates are checked against updated_at so a stale write is refused, and a Contributor's staff token can draft without being able to publish. The Admin API has no OpenAPI file and one fixed permission set per integration, and 20 security advisories were published between 3 September and 1 October 2026.

Strapi

The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is a paid feature and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.

Ghost

1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set kid to the key id, aud to /admin/ and exp at most 5 minutes ahead
2. Set status to draft on every create unless told to publish, and publish later with a PUT that sets status to published
3. GET the post before each PUT and send its updated_at back. Tags and authors in a PUT replace the existing lists
4. Send content as a Lexical JSON string, or add ?source=html and send html. The HTML conversion is lossy unless wrapped in an HTML card
5. Page through lists with limit up to 100 and page. Since Ghost 6.0 limit=all returns 100 items without an error

Strapi

1. Pass status=draft on every REST POST and PUT. Without it the Content API publishes the entry at once
2. Use an Admin token for /mcp and admin routes and an API token for /api. Each kind is rejected on the other's routes
3. Upload files with multipart POST to /api/upload first, then reference the returned file id in the entry. MCP tools can't upload
4. Call media_delete_assets and media_delete_folder without dryRun first to preview, and take asset ids only from media_list_assets
5. Keep your own copy of an entry before updating it. API and MCP writes create no Content History version