{ "data": { "a": { "slug": "ghost", "name": "Ghost", "vendor": "Ghost Foundation", "vendorUrl": "https://ghost.org", "kind": "http-api", "category": "cms", "summary": "Ghost is an open-source publishing platform for websites, newsletters and paid memberships, self-hosted or run by the Ghost Foundation as Ghost(Pro). Agents create, edit and publish posts and pages and upload images through its Admin API.", "url": "https://www.anchorterminal.com/tools/ghost", "markdownUrl": "https://www.anchorterminal.com/tools/ghost.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ghost.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ghost.json", "repo": "https://github.com/TryGhost/Ghost", "license": "MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "ghost" }, { "registry": "npm", "name": "@tryghost/admin-api" }, { "registry": "npm", "name": "ghost-cli" } ], "auth": "api-key", "authNotes": "Self-serve, with no app review or partner approval. An owner or administrator creates a custom integration in Ghost Admin and copies its Admin API key, an id and a hex secret joined by a colon. The client signs an HS256 JSON Web Token with the secret (`kid` the id, `aud` `/admin/`, expiry at most 5 minutes) and sends it as `Authorization: Ghost \u003ctoken\u003e`. Integrations hold one fixed permission set with no scopes. A staff access token from a user's profile works the same way and carries that user's role. Session login with email and password is meant for clients where the user is present. On Ghost(Pro) the Admin API and custom integrations need the Publisher plan or above.", "pricing": "freemium", "pricingNotes": "The software is free under MIT to self-host, so an agent's owner can start without a contract or a card. Ghost(Pro) lists Starter at $18, Publisher at $29 and Business at $199 a month billed yearly for up to 1,000 members, rising with audience size, and Custom through sales. The Admin API isn't included in Starter. Plans show a free trial, and we couldn't read whether it needs a card (checked 2026-10-08).", "priceSummary": "$18 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation index, the pricing page or the repository's file list (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 55500, "npmWeekly": 23628, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.ghost.org/admin-api", "llmsTxt": "https://docs.ghost.org/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets" ], "tags": [ "open-source", "self-hosted", "hosted", "rest", "llms-txt", "webhooks", "newsletter", "memberships", "nodejs", "status-page" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 58.3, "grade": "C", "agentReady": false, "rank": 404, "ranked": true, "rankOf": 629, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 85, "payments": 50, "reliability": 80, "schema": 51, "security": 56, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": -7, "negativeNotes": [ "3 September to 1 October 2026. Ghost published 20 security advisories in five weeks, one critical, ten high, eight moderate and one low. They include GHSA-q734-xjgc-vpj9 (critical, suspended staff could reactivate accounts through password reset), GHSA-788w-68h3-cvxp (high, CVSS 8.8, remote code execution through bookmark card images in 6.56.0 to 6.65.0, fixed in 6.67.0) and GHSA-jj74-hc2q-xrvm (high, remote code execution through theme translation files). Several could be triggered by any staff user, Contributors included. All were published by the vendor with a fixed version, and we found no report of exploitation in the advisories we read, so we deduct 7 of a possible 15. https://github.com/TryGhost/Ghost/security/advisories ; https://github.com/TryGhost/Ghost/security/advisories/GHSA-788w-68h3-cvxp" ], "verdict": "A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without being able to publish. The Admin API has no OpenAPI file and one fixed permission set per integration, and 20 security advisories were published between 3 September and 1 October 2026.", "bestFor": "A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.", "strengths": [ "Admin API keys sign JSON Web Tokens that last at most 5 minutes and travel in the Authorization header, so the key itself is never sent", "A staff access token carries its user's role, and a Contributor can add and edit drafts but can't change a post's status", "Every PUT must send the post's current `updated_at`, which Ghost uses for collision detection", "19 versions reached npm between 10 July and 8 October 2026, with 6.69.0 on 7 October", "MIT licence, with llms.txt, llms-full.txt and a Markdown copy of every docs page" ], "weaknesses": [ "No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository", "A custom integration has one fixed permission set covering posts, members, settings, themes and users, with no scopes and no read-only Admin key", "20 advisories were published from 3 September to 1 October 2026, one critical and ten high, including remote code execution through bookmark card images", "No content locales or custom content types, and the Admin API has no documented route for restoring a post revision", "On Ghost(Pro) the Admin API and custom integrations start at the Publisher plan, not Starter" ], "agentNotes": [ "Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set `kid` to the key id, `aud` to `/admin/` and `exp` at most 5 minutes ahead", "Set `status` to `draft` on every create unless told to publish, and publish later with a PUT that sets `status` to `published`", "GET the post before each PUT and send its `updated_at` back. Tags and authors in a PUT replace the existing lists", "Send content as a Lexical JSON string, or add `?source=html` and send `html`. The HTML conversion is lossy unless wrapped in an HTML card", "Page through lists with `limit` up to 100 and `page`. Since Ghost 6.0 `limit=all` returns 100 items without an error" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.3 } ], "editorialScores": { "ergonomics": 69, "maintenance": 85, "payments": 50, "reliability": 80, "schema": 51, "security": 56, "transparency": 76 }, "provenanceScore": 68 }, "connect": { "install": "npm install @tryghost/admin-api", "http": "curl -H \"Authorization: Ghost $token\" -H \"Accept-Version: $version\" https://{admin_domain}/ghost/api/admin/{resource}/" }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/ghost" }, "area": "business", "unitPrices": [ { "item": "Self-hosted Ghost", "unit": "month", "usd": 0, "note": "MIT, you pay for your own hosting and email delivery" }, { "item": "Ghost(Pro) Starter", "unit": "month", "usd": 18, "note": "billed yearly, up to 1,000 members, no Admin API" }, { "item": "Ghost(Pro) Publisher", "unit": "month", "usd": 29, "note": "billed yearly, up to 1,000 members, 3 staff users, Admin API included" }, { "item": "Ghost(Pro) Business", "unit": "month", "usd": 199, "note": "billed yearly, up to 1,000 members, 15 staff users" } ], "provenance": { "legalEntity": "Ghost Foundation Ltd", "domain": "ghost.org", "domainRegistered": "2005-06-25", "endpointOnVendorDomain": false, "terms": "https://ghost.org/terms/", "privacy": "https://ghost.org/privacy/", "statusPage": "https://ghoststatus.org", "changelog": "https://github.com/TryGhost/Ghost/releases", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms govern the Ghost.org website, the Ghost software and the hosted service, and name the Ghost Foundation as owner and operator under the law of England and Wales. The privacy policy names Ghost Foundation Ltd. Neither page showed a dated revision that we could read.", "The privacy policy covers Ghost Foundation's own website and services. Content on a self-hosted site stays on its owner's server and isn't covered by it.", "A self-hosted install answers on its owner's domain. Ghost(Pro) sites use a `*.ghost.io` admin domain.", "https://ghost.org/.well-known/security.txt returned 404 on 8 October 2026. SECURITY.md in the repository and https://docs.ghost.org/security give security@ghost.org and a disclosure policy.", "RDAP for ghost.org gives a registration date of 2005-06-25 and a transfer on 2013-09-12.", "status.ghost.org redirects to ghoststatus.org, an incident.io page for Ghost(Pro), not for self-hosted installs. It listed three minor incidents between 10 July and 8 October 2026." ], "score": 68 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ghost.json", "live": { "slug": "ghost", "vendorStatus": { "page": "https://ghoststatus.org", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:06:40.232515614Z" }, "pages": [ { "url": "https://ghost.org/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:20:39.9398284Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "6de86a225cdd" }, { "url": "https://ghost.org/terms/", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:20:42.180060747Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "673039b71aa4" } ], "updatedAt": "2026-10-08T19:06:40.232515614Z" } }, "answer": "Strapi scores 65.7 (B) on agent readiness against Ghost's 58.3 (C), and leads in 4 of 7 scored categories.", "b": { "slug": "strapi", "name": "Strapi", "vendor": "Strapi, Inc.", "vendorUrl": "https://strapi.io", "kind": "http-api", "category": "cms", "summary": "Strapi is an open-source headless CMS for Node.js that its owner hosts, with a paid cloud. Agents create, localise and publish entries through generated REST and GraphQL APIs or a built-in MCP server.", "url": "https://www.anchorterminal.com/tools/strapi", "markdownUrl": "https://www.anchorterminal.com/tools/strapi.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/strapi.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/strapi.json", "repo": "https://github.com/strapi/strapi", "license": "MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "@strapi/strapi" }, { "registry": "npm", "name": "@strapi/client" } ], "auth": "api-key", "authNotes": "Self-serve tokens created in the admin panel of your own instance, with no app review or partner approval. API tokens authenticate the Content API under /api and are read-only, full access or custom per content type and action. Admin tokens authenticate admin routes and the MCP server at /mcp and hold a chosen subset of their owner's permissions, down to field and locale. Each kind is rejected on the other's routes. Both expire after 7, 30 or 90 days or never, can be regenerated, and travel as `Authorization: Bearer`. An Admin token is shown once.", "pricing": "freemium", "pricingNotes": "The Community Edition is free to self-host with unlimited seats, so an agent can start without a contract or a card. Growth is $45 a month for 3 seats ($15 per extra seat) with a 30-day trial and no card, and Enterprise is priced by sales. Strapi Cloud is $35, $90 or $450 a project a month, needs a card at project creation, and charges $1.50 per 25,000 API requests over the plan (checked 2026-10-07).", "priceSummary": "$45 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation index, the pricing pages or the repository's MCP code (checked 2026-10-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 73289, "npmWeekly": 258813, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://docs.strapi.io", "llmsTxt": "https://docs.strapi.io/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.localisation", "cms.assets", "cms.schema" ], "tags": [ "open-source", "self-hosted", "hosted", "mcp", "llms-txt", "webhooks", "graphql", "typescript", "status-page", "soc2" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 65.7, "grade": "B", "agentReady": false, "rank": 231, "ranked": true, "rankOf": 629, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 87, "payments": 50, "reliability": 82, "schema": 80, "security": 66, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-07" }, "negative": -6, "negativeNotes": [ "13 May 2026. Strapi published two critical advisories. GHSA-rjg2-95x7-8qmx (CVE-2026-27886) leaked sensitive data through relation filters in versions 4.0.0 to 5.36.1, and GHSA-3xcq-8mjw-h6mx (CVE-2026-22599) was SQL injection in the Content-Type Builder up to 5.33.1 and 4.26.0. Both were fixed in earlier releases (5.37.0, 5.33.2 and 4.26.1) and published by the vendor, and we found no report of exploitation, so we deduct 6 of a possible 15. https://github.com/strapi/strapi/security/advisories/GHSA-rjg2-95x7-8qmx ; https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx" ], "verdict": "The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is a paid feature and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.", "bestFor": "Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.", "strengths": [ "Admin tokens carry a chosen subset of the owner's permissions, down to content type, action, field and locale, with 7, 30 or 90 day expiry", "The MCP server lists only the tools a token may use and narrows each input and output schema to permitted fields", "Media delete tools preview by default through `dryRun` and name what would be removed before anything is deleted", "Weekly releases, 13 tagged versions between 15 July and 7 October 2026, with release notes per version", "MIT Community Edition, free to self-host with unlimited seats, plus llms.txt, llms-full.txt and Markdown copies of every docs page" ], "weaknesses": [ "Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans", "Audit Logs and Review Workflows are Enterprise only, so the free edition has no record of what an agent changed", "A REST POST or PUT publishes immediately unless the request passes `status=draft`", "The MCP server can't upload files, describes dynamic zones as untyped arrays and sets no read-only or destructive annotations", "Two critical advisories were published on 13 May 2026, a data leak through relation filters and SQL injection in the Content-Type Builder, both fixed earlier" ], "agentNotes": [ "Pass `status=draft` on every REST POST and PUT. Without it the Content API publishes the entry at once", "Use an Admin token for `/mcp` and admin routes and an API token for `/api`. Each kind is rejected on the other's routes", "Upload files with multipart POST to `/api/upload` first, then reference the returned file id in the entry. MCP tools can't upload", "Call `media_delete_assets` and `media_delete_folder` without `dryRun` first to preview, and take asset ids only from `media_list_assets`", "Keep your own copy of an entry before updating it. API and MCP writes create no Content History version" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 65.7 } ], "editorialScores": { "ergonomics": 65, "maintenance": 87, "payments": 50, "reliability": 82, "schema": 80, "security": 66, "transparency": 75 }, "provenanceScore": 68 }, "connect": { "install": "npx create-strapi@latest", "http": "curl 'http://localhost:1337/api/restaurants?status=draft' \\\n -H \"Authorization: Bearer $STRAPI_API_TOKEN\"", "claudeCode": "claude mcp add strapi-mcp --transport http http://localhost:1337/mcp -H \"Authorization: Bearer YOUR_ADMIN_TOKEN\"", "config": { "mcpServers": { "strapi-mcp": { "headers": { "Authorization": "Bearer YOUR_ADMIN_TOKEN" }, "type": "streamable-http", "url": "http://localhost:1337/mcp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/strapi" }, "area": "business", "unitPrices": [ { "item": "Community Edition, self-hosted", "unit": "month", "usd": 0, "note": "MIT, unlimited seats, you pay for your own hosting" }, { "item": "Growth, self-hosted", "unit": "month", "usd": 45, "note": "3 seats included, $15 per extra seat" }, { "item": "Strapi Cloud Starter", "unit": "month", "usd": 35, "note": "per project, 100,000 API requests" }, { "item": "Strapi Cloud Pro", "unit": "month", "usd": 90, "note": "per project, 1 million API requests" }, { "item": "Strapi Cloud Business", "unit": "month", "usd": 450, "note": "per project, 10 million API requests" }, { "item": "Strapi Cloud API requests over the plan", "unit": "1k-requests", "usd": 0.06, "note": "$1.50 per 25,000" } ], "provenance": { "legalEntity": "Strapi, Inc.", "domain": "strapi.io", "domainRegistered": "2015-09-21", "endpointOnVendorDomain": false, "terms": "https://strapi.io/cloud-legal", "privacy": "https://strapi.io/privacy", "statusPage": "https://status.strapi.io", "changelog": "https://github.com/strapi/strapi/releases", "securityTxt": "none", "checked": "2026-10-07", "notes": [ "The Strapi Cloud terms (effective 7 October 2026) name Strapi, Inc., 548 Market St, PMB 60577, San Francisco, California 94104. The repository's copyright line names Strapi Solutions SAS, and the privacy policy gives Strapi Solutions, 128 rue de la Boétie, 75008 Paris.", "A self-hosted install answers on its owner's domain. Strapi Cloud projects answer at https://\u003cproject\u003e.strapiapp.com.", "https://strapi.io/.well-known/security.txt returned 404 to our reader on 7 October 2026. The repository holds a .well-known/security.txt with an Expires of 20 May 2027 and a Canonical line pointing at that URL.", "RDAP for strapi.io gives a registration date of 2015-09-21.", "The status page runs on Better Stack and covers Strapi Cloud, the website and the docs, not self-hosted installs." ], "score": 68 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/strapi.json", "live": { "slug": "strapi", "vendorStatus": { "page": "https://status.strapi.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-08T17:51:13.949868717Z" }, "versions": [ { "registry": "github", "name": "strapi/strapi", "version": "v5.57.0", "released": "2026-10-07", "seenAt": "2026-10-08T16:30:39.413193839Z" }, { "registry": "npm", "name": "@strapi/client", "version": "1.6.2", "seenAt": "2026-10-08T16:30:37.897146773Z" }, { "registry": "npm", "name": "@strapi/strapi", "version": "5.57.0", "seenAt": "2026-10-08T16:30:37.072939352Z" } ], "githubStars": 73292, "npmWeekly": 258813, "securityTxt": { "url": "https://strapi.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-08T15:39:07.890617672Z" }, "pages": [ { "url": "https://strapi.io/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:24:54.221268289Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9a83a678305b" }, { "url": "https://strapi.io/cloud-legal", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:24:51.925906428Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e789fbc0c6c8" } ], "updatedAt": "2026-10-08T18:24:54.221268289Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Ghost Foundation", "b": "Strapi, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms", "b": "MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-07", "b": "2026-10-07", "name": "Last release" }, { "a": "no date given", "b": "2026-10-07", "name": "Terms last updated" }, { "a": "no date given", "b": "2023-03-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "56k stars, 24k npm/wk", "b": "73k stars, 259k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Strapi scores 65.7 (B) on agent readiness against Ghost's 58.3 (C), and leads in 4 of 7 scored categories.", "question": "Which is better for AI agents, Ghost or Strapi?" }, { "answer": "Both need an API key.", "question": "Do Ghost and Strapi need an API key?" }, { "answer": "No hosted endpoint is listed for Ghost. No hosted endpoint is listed for Strapi.", "question": "Can an agent call Ghost and Strapi without installing anything?" }, { "answer": "Yes. Ghost is open source (MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms). Strapi is open source (MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms).", "question": "Are Ghost and Strapi open source?" } ], "goodFor": [ { "aheadOn": null, "also": null, "goodFor": "A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.", "slug": "ghost", "watchFor": "No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository" }, { "aheadOn": [ "Schema \u0026 documentation, 80 against 51", "Security \u0026 auth, 66 against 56" ], "also": null, "goodFor": "Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.", "slug": "strapi", "watchFor": "Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans" } ], "job": { "capability": "cms.content", "name": "Cms content" }, "others": [ { "json": "https://www.anchorterminal.com/compare/contentstack-vs-ghost.json", "title": "Contentstack vs Ghost", "url": "https://www.anchorterminal.com/compare/contentstack-vs-ghost" }, { "json": "https://www.anchorterminal.com/compare/contentstack-vs-strapi.json", "title": "Contentstack vs Strapi", "url": "https://www.anchorterminal.com/compare/contentstack-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-sanity.json", "title": "Ghost vs Sanity", "url": "https://www.anchorterminal.com/compare/ghost-vs-sanity" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-storyblok.json", "title": "Ghost vs Storyblok", "url": "https://www.anchorterminal.com/compare/ghost-vs-storyblok" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-webflow.json", "title": "Ghost vs Webflow", "url": "https://www.anchorterminal.com/compare/ghost-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/ghost-vs-wordpress.json", "title": "Ghost vs WordPress", "url": "https://www.anchorterminal.com/compare/ghost-vs-wordpress" }, { "json": "https://www.anchorterminal.com/compare/sanity-vs-strapi.json", "title": "Sanity vs Strapi", "url": "https://www.anchorterminal.com/compare/sanity-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/storyblok-vs-strapi.json", "title": "Storyblok vs Strapi", "url": "https://www.anchorterminal.com/compare/storyblok-vs-strapi" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-webflow.json", "title": "Strapi vs Webflow", "url": "https://www.anchorterminal.com/compare/strapi-vs-webflow" }, { "json": "https://www.anchorterminal.com/compare/strapi-vs-wordpress.json", "title": "Strapi vs WordPress", "url": "https://www.anchorterminal.com/compare/strapi-vs-wordpress" } ], "scores": [ { "by": 2, "edge": "strapi", "ghost": 80, "key": "reliability", "name": "Reliability", "strapi": 82, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 29, "edge": "strapi", "ghost": 51, "key": "schema", "name": "Schema \u0026 documentation", "strapi": 80, "weight": 13 }, { "by": 4, "edge": "ghost", "ghost": 69, "key": "ergonomics", "name": "Agent ergonomics", "strapi": 65, "weight": 13 }, { "by": 10, "edge": "strapi", "ghost": 56, "key": "security", "name": "Security \u0026 auth", "strapi": 66, "weight": 14 }, { "by": 0, "edge": "", "ghost": 50, "key": "payments", "name": "Payments \u0026 pricing", "strapi": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 2, "edge": "strapi", "ghost": 85, "key": "maintenance", "name": "Maintenance \u0026 community", "strapi": 87, "weight": 7 }, { "by": 0, "edge": "", "ghost": 72, "key": "transparency", "name": "Transparency \u0026 trust", "strapi": 72, "weight": 7 } ], "summary": "Strapi scores 65.7 (B) on agent readiness against Ghost's 58.3 (C), and leads in 4 of 7 scored categories. Both do cms content.", "verdicts": { "ghost": "A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without being able to publish. The Admin API has no OpenAPI file and one fixed permission set per integration, and 20 security advisories were published between 3 September and 1 October 2026.", "strapi": "The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is a paid feature and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/ghost-vs-strapi", "json": "https://www.anchorterminal.com/compare/ghost-vs-strapi.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/ghost-vs-strapi.md", "slim": "https://www.anchorterminal.com/compare/ghost-vs-strapi.min.md" }, "markdown": "Strapi scores 65.7 (B) on agent readiness against Ghost's 58.3 (C), and leads in 4 of 7 scored categories. Both do cms content.\n\n- Ghost: grade C, 58.3/100, rank #404 of 629. Markdown https://www.anchorterminal.com/tools/ghost.md · JSON https://www.anchorterminal.com/api/v1/tools/ghost.json\n- Strapi: grade B, 65.7/100, rank #231 of 629. Markdown https://www.anchorterminal.com/tools/strapi.md · JSON https://www.anchorterminal.com/api/v1/tools/strapi.json\n\n## Which one, for what\n\n### Ghost (C)\n\nGood for: A publication, blog or newsletter where an agent drafts posts and a person or a higher role publishes.\n\nWatch for: No OpenAPI or other machine-readable description of the Admin API was found in the docs or the repository\n\n### Strapi (B)\n\nGood for: Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.\n\nAhead on:\n- Schema \u0026 documentation, 80 against 51\n- Security \u0026 auth, 66 against 56\n\nWatch for: Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans\n\n\n## Score by category\n\n| Category | Weight | Ghost | Strapi | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 80 | 82 | Strapi +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 51 | 80 | Strapi +29 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 65 | Ghost +4 |\n| Security \u0026 auth | 14% (17.5 this run) | 56 | 66 | Strapi +10 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 50 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 85 | 87 | Strapi +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 72 | even |\n| Negative events | ≤15 | -7 | -6 | |\n| **Total** | | **58.3 · C** | **65.7 · B** | |\n\n## Facts side by side\n\n| Fact | Ghost | Strapi |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Ghost Foundation | Strapi, Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | HTTP, Streamable HTTP |\n| Auth | API key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms | MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-07 | 2026-10-07 |\n| Terms last updated | no date given | 2026-10-07 |\n| Privacy policy last updated | no date given | 2023-03-01 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 56k stars, 24k npm/wk | 73k stars, 259k npm/wk |\n\n## Verdicts\n\n**Ghost.** A create needs only a title, updates are checked against `updated_at` so a stale write is refused, and a Contributor's staff token can draft without being able to publish. The Admin API has no OpenAPI file and one fixed permission set per integration, and 20 security advisories were published between 3 September and 1 October 2026.\n\n**Strapi.** The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is a paid feature and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.\n\n## Before you call either\n\n### Ghost\n\n1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set `kid` to the key id, `aud` to `/admin/` and `exp` at most 5 minutes ahead\n2. Set `status` to `draft` on every create unless told to publish, and publish later with a PUT that sets `status` to `published`\n3. GET the post before each PUT and send its `updated_at` back. Tags and authors in a PUT replace the existing lists\n4. Send content as a Lexical JSON string, or add `?source=html` and send `html`. The HTML conversion is lossy unless wrapped in an HTML card\n5. Page through lists with `limit` up to 100 and `page`. Since Ghost 6.0 `limit=all` returns 100 items without an error\n\n### Strapi\n\n1. Pass `status=draft` on every REST POST and PUT. Without it the Content API publishes the entry at once\n2. Use an Admin token for `/mcp` and admin routes and an API token for `/api`. Each kind is rejected on the other's routes\n3. Upload files with multipart POST to `/api/upload` first, then reference the returned file id in the entry. MCP tools can't upload\n4. Call `media_delete_assets` and `media_delete_folder` without `dryRun` first to preview, and take asset ids only from `media_list_assets`\n5. Keep your own copy of an entry before updating it. API and MCP writes create no Content History version\n\n## Questions\n\n### Which is better for AI agents, Ghost or Strapi?\n\nStrapi scores 65.7 (B) on agent readiness against Ghost's 58.3 (C), and leads in 4 of 7 scored categories.\n\n### Do Ghost and Strapi need an API key?\n\nBoth need an API key.\n\n### Can an agent call Ghost and Strapi without installing anything?\n\nNo hosted endpoint is listed for Ghost. No hosted endpoint is listed for Strapi.\n\n### Are Ghost and Strapi open source?\n\nYes. Ghost is open source (MIT, copyright Ghost Foundation. Ghost(Pro) is a paid hosting service under the Ghost Foundation's terms). Strapi is open source (MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/ghost-vs-strapi.json, and with the fewest tokens: https://www.anchorterminal.com/compare/ghost-vs-strapi.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"ghost\", \"b\": \"strapi\"}`. From a terminal: `anchor compare ghost strapi`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/ghost.json and https://www.anchorterminal.com/api/v1/tools/strapi.json\n\n## Other comparisons with Ghost or Strapi\n\n- [Contentstack vs Ghost](https://www.anchorterminal.com/compare/contentstack-vs-ghost.md)\n- [Contentstack vs Strapi](https://www.anchorterminal.com/compare/contentstack-vs-strapi.md)\n- [Ghost vs Sanity](https://www.anchorterminal.com/compare/ghost-vs-sanity.md)\n- [Ghost vs Storyblok](https://www.anchorterminal.com/compare/ghost-vs-storyblok.md)\n- [Ghost vs Webflow](https://www.anchorterminal.com/compare/ghost-vs-webflow.md)\n- [Ghost vs WordPress](https://www.anchorterminal.com/compare/ghost-vs-wordpress.md)\n- [Sanity vs Strapi](https://www.anchorterminal.com/compare/sanity-vs-strapi.md)\n- [Storyblok vs Strapi](https://www.anchorterminal.com/compare/storyblok-vs-strapi.md)\n- [Strapi vs Webflow](https://www.anchorterminal.com/compare/strapi-vs-webflow.md)\n- [Strapi vs WordPress](https://www.anchorterminal.com/compare/strapi-vs-wordpress.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Ghost vs Strapi", "url": "" } ], "description": "Strapi scores 65.7 (B) on agent readiness against Ghost's 58.3 (C), and leads in 4 of 7 scored categories. Both do cms content. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Ghost C 58.3", "Strapi B 65.7", "scores" ], "h1": "Ghost vs Strapi", "image": "https://www.anchorterminal.com/assets/og/compare-ghost-vs-strapi.png", "path": "/compare/ghost-vs-strapi", "published": "2026-10-01", "section": "tools", "title": "Ghost vs Strapi for AI agents, C 58.3 vs B 65.7 | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/compare/ghost-vs-strapi" }, "tokens": { "markdown": 2000, "slim": 580 }, "version": 1 }