Head to head · Cms content · October 2026 research run
Payload vs Strapi
Strapi scores 65.7 (B) on agent readiness against Payload's 55.2 (C), and leads in every scored category. Both do cms content.
Which one, for what
Payload C
Good for Teams that build on Next.js and want the content model in TypeScript, with drafts, versions and localisation in the free core.
No category where it leads by five points or more, and no fact that sets it apart.
Watch for
49 security advisories in the 12 months to 8 October 2026, 8 critical, 38 of them published since 18 September 2026
Strapi B
Good for Teams that want to own their CMS and let an agent draft, localise and publish entries under a narrow token.
Ahead on
- Schema & documentation, 80 against 70
- Security & auth, 66 against 57
- Payments & pricing, 50 against 45
- Maintenance & community, 87 against 78
- Transparency & trust, 72 against 62
Watch for
Content History keeps no version for REST, GraphQL or MCP writes, and exists only on Growth and Enterprise plans
Score by category
| Category | Weight this run | Payload | Strapi | Edge |
|---|---|---|---|---|
| Reliability | 16%20 | 78 | 82 | Strapi +4 |
| Performance | 10%pending | pending | pending | not scored in this run |
| Schema & documentation | 13%16.2 | 70 | 80 | Strapi +10 |
| Agent ergonomics | 13%16.2 | 64 | 65 | Strapi +1 |
| Security & auth | 14%17.5 | 57 | 66 | Strapi +9 |
| Payments & pricing | 10%12.5 | 45 | 50 | Strapi +5 |
| Task success | 10%pending | pending | pending | not scored in this run |
| Maintenance & community | 7%8.8 | 78 | 87 | Strapi +9 |
| Transparency & trust | 7%8.8 | 62 | 72 | Strapi +10 |
| Negative events | ≤15 | -10 | -6 | |
| Total | 55.2 · C | 65.7 · B |
Facts side by side
| Fact | Payload | Strapi |
|---|---|---|
| Kind | HTTP API | HTTP API |
| Vendor | Payload CMS, Inc. (Figma) | Strapi, Inc. |
| Hosted endpoint | no (local only) | no (local only) |
| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | API key | API key |
| Pricing | Free | Freemium |
| x402 | no | no |
| Licence | MIT for the core and the official packages. Enterprise add-ons are sold separately through sales | MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-09-23 | 2026-10-07 |
| Terms last updated | no document linked | 2026-10-07 |
| Privacy policy last updated | 2024-03-28 | 2023-03-01 |
| Customer content may train models | not found in the text | |
| Terms restrict automated access | yes | |
| Terms restrict benchmarking | yes | |
| Terms or service can change without notice | yes | |
| Arbitration or class-action waiver | yes | |
| Popularity | 45k stars, 1.1M npm/wk | 73k stars, 259k npm/wk |
Verdicts
Payload
Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. The vendor published 49 advisories in 12 months, 8 of them critical, so an install older than 3.90.0 is exposed. No OpenAPI file is published.
Strapi
The built-in MCP server shows an agent only the tools, fields and locales its Admin token permits, and content tools create drafts by default. Rollback is the limit. Content History is a paid feature and records admin panel edits only, so API and MCP writes leave no version to restore, and the MCP server can't upload files.
Before you call either
Payload
- Check the installed version first. Anything below 3.90.0 carries published critical advisories, so ask the owner to upgrade before writing
- Send REST keys as
Authorization: {collection-slug} API-Key {key}and MCP keys asAuthorization: Bearer {key}. The two key kinds are separate - To publish, set
_status: 'published'in the data. Thedraftparameter only relaxes validation and chooses where an update is written - Upload files with multipart POST to the upload collection, with other fields as JSON in
_payload. No MCP upload tool is documented - Roll back with
POST /api/{collection-slug}/versions/:idafter listing versions. Versions exist only where the collection config enables them
Strapi
- Pass
status=drafton every REST POST and PUT. Without it the Content API publishes the entry at once - Use an Admin token for
/mcpand admin routes and an API token for/api. Each kind is rejected on the other's routes - Upload files with multipart POST to
/api/uploadfirst, then reference the returned file id in the entry. MCP tools can't upload - Call
media_delete_assetsandmedia_delete_folderwithoutdryRunfirst to preview, and take asset ids only frommedia_list_assets - Keep your own copy of an entry before updating it. API and MCP writes create no Content History version
Questions
Which is better for AI agents, Payload or Strapi?
Strapi scores 65.7 (B) on agent readiness against Payload's 55.2 (C), and leads in every scored category.
Do Payload and Strapi need an API key?
Both need an API key.
Can an agent call Payload and Strapi without installing anything?
No hosted endpoint is listed for Payload. No hosted endpoint is listed for Strapi.
Are Payload and Strapi open source?
Yes. Payload is open source (MIT for the core and the official packages. Enterprise add-ons are sold separately through sales). Strapi is open source (MIT for the Community Edition. Code under ee/ directories is under Strapi's Enterprise Edition licence, and Strapi Cloud is a paid service under its own terms).
Other comparisons with Payload or Strapi
Machine-readable
- This page as Markdown
/compare/payload-vs-strapi.md· slim.min.md· JSON.json(or sendAccept: text/markdown) - Each listing in full
/api/v1/tools/payload.json·/api/v1/tools/strapi.json - From a terminal
anchor compare payload strapi(the CLI) - Over MCP
compare_tools {"a": "payload", "b": "strapi"}at/mcp, no key