Payload vs Prismic

Payload

Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. The vendor published 49 advisories in 12 months, 8 of them critical, so an install older than 3.90.0 is exposed. No OpenAPI file is published.

Prismic

The hosted MCP server stages every write as a draft in a release, cannot delete, and publishes only when a user with the Publisher role asks. Write tokens for the Migration, Asset and Types APIs have no scopes, no OpenAPI file was found, writes are limited to one request a second, and the acceptable use policy forbids access by scripts.

Payload

1. Check the installed version first. Anything below 3.90.0 carries published critical advisories, so ask the owner to upgrade before writing
2. Send REST keys as Authorization: {collection-slug} API-Key {key} and MCP keys as Authorization: Bearer {key}. The two key kinds are separate
3. To publish, set _status: 'published' in the data. The draft parameter only relaxes validation and chooses where an update is written
4. Upload files with multipart POST to the upload collection, with other fields as JSON in _payload. No MCP upload tool is documented
5. Roll back with POST /api/{collection-slug}/versions/:id after listing versions. Versions exist only where the collection config enables them

Prismic

1. Ask a repository Administrator to activate Prismic MCP in Settings first. Activation can take several minutes, and each environment has its own setting
2. Call list_repositories, then get_custom_type or get_shared_slice for the empty content template before create_document
3. Create a release with create_release and write into it. Call publish_release only on an explicit request, because a publish cannot be undone through MCP
4. For the Migration API send Authorization: Bearer <write token> and a repository header, one page a request, one request a second, and keep each returned id for later PUT calls
5. Upload media first (upload_asset or POST to https://asset-api.prismic.io/assets) and reference the asset id in image and media link fields