dotCMS

by dotCMS LLC MCP server in CMS & website publishing

Local

dotCMS LLC · dotcms.com · who's behind it

dotCMS is an enterprise CMS with headless REST APIs, workflows and push publishing, run as dotCMS Cloud or self-hosted. Agents use the @dotcms/mcp-server package, which searches the instance's OpenAPI spec and runs API calls in a sandbox.

Best for Enterprises already on dotCMS who want an agent to manage content and pages.

Write a review Compare Follow changes

Viewed under 500 times in the last 30 days · Claim it, free, to see who finds it

Claim this listing

Is this your product? Claim it to see how agents find it: lookups through the API, MCP and letme, the comparisons it's in, and what people search for in CMS. Free, and it never changes the grade. Or verify it, or log in if it's already claimed.

Assessment. dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.

Facts

Access how an agent reaches and pays for it

Transport: stdio
Auth: API key
Pricing: Freemium
x402: No
Licence: BUSL-1.1
Tools exposed: 7
Capabilities: cms.content cms.publish cms.assets cms.schema cms.localisation

Where it lives packages, source, docs and releases

Packages: npm @dotcms/mcp-server
Source: github.com/dotCMS/core
Docs: dev.dotcms.com/docs/build/integrations/dotai/mc…
llms.txt: published
Last release: 2026-09-02
npm / week: 43

From our research 6 facts checked against the vendor's pages

Surface listed: The @dotcms/mcp-server package and the REST API of a dotCMS instance it calls, read from the MCP server source and README in dotCMS/core, dev.dotcms.com (llms.txt and Markdown pages), npm, www.dotcms.com pricing and security.txt on 6 November 2026. www.dotcms.com/robots.txt disallows /docs/, so docs were read on dev.dotcms.com. No account was made and no tool was called
MCP tools: search, execute, download_assets, upload_assets, page_create, page_place_content and page_verify. Helpers in the sandbox include pick, table, count, sum and first
Content model: Content types, workflows with multiple-approval sub-actions, content versions with restore, multilingual content and push publishing between environments
Releases: Current releases and long-term supported (LTS) releases; security fixes are backported to LTS
Cloud plans: Starter (100,000 requests, 1 TB, 99.5 per cent SLA), Professional (500,000, 5 TB, 99.9), Business (2,000,000, 15 TB, 99.9) and Enterprise (10,000,000, 50 TB), all on request
Legal entity: dotCMS LLC as licensor; the privacy policy also names dotCMS Holdings, LLC and dotCMS Services LLC

Facts verified 6 November 2026 from vendor docs, repositories and package registries. JSON · Markdown

Strengths

Seven tools in code mode, with the instance's OpenAPI spec searchable from the sandbox
The API token stays outside the sandbox, which only receives results
JWT tokens per user with role permissions and an expiry
security.txt with PGP, a bounty-backed disclosure policy and LTS security backports
Free with every capability for organisations under $5 million in revenue

Weaknesses

Pre-1.0 package, with the dev docs still pointing at the beta tag
The server needs a token with write permission for content types, content and workflows
execute can call any endpoint, and no read-only mode or annotations were found
Cloud prices are on request only
Source-available under the BSL, not an OSI licence

Before you call it notes for agents

Search the spec with search before writing an execute call, and return only the fields you need
Use a token for a dedicated user and role, not an administrator's
Confirm with the user before execute calls that publish, archive or delete content
Keep results small with pick and first, since output is capped at about 25,000 characters
Use download_assets for theme folders so files land on disk instead of in context

Who's behind it provenance 57/100

Legal entity nameddotCMS LLC20/20
Domain agedotcms.com, no registry record we could read0/15
Endpoint on the vendor's domain is not on dotcms.com0/15
Terms of serviceread, states 0 of the 7 things a reader expects4/10
Privacy policyread, states 8 of the 8 things a reader expects10/10
Status pagenot found0/10
Changelogpublished10/10
security.txtvalid10/10
People named2 named with their role, none with a public profile7/10
Support routehelp pages, a community5/5

Terms and privacy, as read

Terms of service gives no date, states 0 of 7

TL;DR Gives no date. States 0 of the 7 things a reader expects, and we didn't find the governing law, a liability limit, how it ends, how changes are announced, what users may not do or a service level. The rules found no clause to flag.

Gives the date it was last updated

Not found in the text.

Without a date nobody can tell which version they agreed to.

Names the governing law or courts

Not found in the text.

Says where a dispute would be heard and under whose law.

States a limit on its liability

Not found in the text.

Says the most the vendor would owe if the service causes a loss.

Says how the agreement or account can be ended

Not found in the text.

Says when the vendor can cut off access and what notice it gives.

Says how changes to the terms are announced

Not found in the text.

Says whether a customer hears about a change before it binds them.

Lists what users may not do

Not found in the text.

The acceptable-use rules an agent acting for a user has to stay inside.

Refers to a service level or uptime commitment

Not found in the text.

Says whether availability is promised and where the promise is written.

The document · read 2026-11-06 · 918 words

Privacy policy dated 2026-09-08, states 8 of 8

TL;DR Dated 2026-09-08. States all 8 things a reader expects. The rules found no clause to flag.

Gives the date it was last updated Last updated 2026-09-08

Last Updated: September 08 2026

Without a date nobody can tell which version applied when data was collected.

Says what personal data is collected

This privacy policy details why we collect your information, what information we collect, how we use it, and how long we store it.

The basic statement a privacy policy exists to make.

Says how long data is kept Names a period of 30 days

If you are a GDPR data subject and have submitted a valid request to exercise your right to be forgotten, we will delete your data within 30 days of the request.

Says when data sent to the service is deleted.

Says who else receives the data

We may share information with vendors (processors and sub-processors) that act on our behalf, such as services we use to store and manage our data, process financial transactions, and provide communications services.

Names the sub-processors or service providers the data is passed to, or where they are listed.

Says whether personal data is sold or shared for advertising Says it does not sell personal data

We never sell or rent your personal information to third parties.

A plain statement either way.

Says what rights people have over their data

If you are a GDPR data subject and have submitted a valid request to exercise your right to be forgotten, we will delete your data within 30 days of the request.

Access, correction, deletion and objection, and how to use them.

Gives a privacy contact privacy@dotcms.com

If you believe any of our customers has engaged in unsolicited sending of mass email (or SPAM) and that they are using dotCMS products or services to do so, please contact us at privacy@dotcms.com.

An address or officer to send a request to.

Says where data is transferred or stored Data goes to the United States

Information we collect may be transferred and stored in the United States, United Kingdom, or European Union.

The countries data goes to and the safeguard used.

The document · read 2026-11-06 · 4,261 words

A reading by a fixed set of rules, each answered with the vendor's own sentence. It isn't legal advice, a rule can miss a clause or misread one, and the document itself is what binds. How it's read and scored.

The MCP server runs locally and calls the customer's own dotCMS instance, so the endpoint isn't on a dotCMS domain.

The privacy policy, last updated 8 September 2026, covers dotCMS's websites only and names dotCMS Holdings, LLC, dotCMS Services LLC and dotCMS LLC.

www.dotcms.com/robots.txt disallows /docs/ and /utils/; dev.dotcms.com allows all with Content-Signal ai-train=yes, search=yes, ai-input=yes.

www.dotcms.com/terms-of-service and /privacy-policy returned 404; no cloud terms of service were found, so the licence stands in for terms.

No status page answered (status.dotcms.com refused the connection).

Checked 2026-11-06 against the vendor's own pages and the domain registry. Provenance is half of Transparency & trust.

Humans behind the project who makes it and where to get help

Key people

Will EzellCo-founder and Chief Technology Officer, dotCMS
Zain IshaqChief Executive Officer, dotCMS

dotCMS LLC on LinkedIn @dotcms GitHub

Ownership Acquired by Appleby Succession Capital, 2021-10

Backed byPacific Lake Partners

Researched 6 November 2026 from public pages. dotCMS's author pages, read 6 November 2026, say Will Ezell co-founded dotCMS and is its Chief Technology Officer, and that Zain Ishaq is Chief Executive Officer and co-founded Appleby Succession Capital, "an investment firm that acquired dotCMS in 2021". No other co-founder is named on a dotCMS page, so the roster may be incomplete. The licence names dotCMS LLC and the privacy policy also names dotCMS Holdings, LLC and dotCMS Services LLC. CMSWire reported on 26 October 2021 that dotCMS announced a growth investment led by Pacific Lake Partners with Zain Ishaq as CEO and Vadym Kononenko as President; dotCMS's own copy of that release is no longer on its newsroom. No price was found, so no valuation is recorded. Shown for information, not part of the grade yet. People's accounts link to their own profiles; check them before you rely on one.

Sources (8)

Live watched around the clock · updated 2026-11-07 16:00 UTC

github dotCMS/core dotcms-cli-26.11.06-03, released 2026-11-06
npm @dotcms/mcp-server 0.1.1
GitHub stars 971
npm downloads a week 43
security.txt valid, expires 2027-06-09T23:59:59.000Z · 1 hour ago
llms.txt answers · 2 hours ago

Pages we watch

Page	Kind	Last checked	Last changed
dev.dotcms.com/docs/reference/releases/product-versions/cha…	changelog	3 hours ago · 200	no change seen
dev.dotcms.com/docs/manage/access-and-security/security-and…	privacy	3 hours ago · 200	no change seen
raw.githubusercontent.com/dotCMS/core/main/LICENSE	terms	3 hours ago · 200	no change seen

Live data comes from our pollers, trackers and scrapers and doesn't change the score until a benchmark run. What we watch · /api/v1/live/dotcms.json

Notable

The MCP server is code-mode: search runs JavaScript over the instance's filtered OpenAPI spec and execute runs authenticated API calls in an isolated sandbox, with output capped at about 25,000 characters source
The repository also has download_assets, upload_assets, page_create, page_place_content and page_verify tools source
@dotcms/mcp-server 0.1.1 on npm since 2 September 2026, GPL-3.0; the dev docs still tell readers to install the @beta tag source
dotCMS core is under the Business Source License with an additional use grant for organisations with under $5 million in annual finances source
security.txt with a PGP key, valid to 9 June 2027, and a responsible disclosure policy updated on 4 November 2026 that promises bounties and requires disclosure of AI tools used source
dotCMS core tags are cut several times a week, the newest v26.11.06-03 on 6 November 2026 source

Reviews by the Anchor panel

Every review here is a desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. The outcome says whether the reviewer's questions could be answered from public material. How reviews work.

n/a

0 desk reviews · from public material, no calls made

5★0

4★0

3★0

2★0

1★0

Where reviews came from

PanelOur reviewer panel. Desk reviews, no calls made

letme-checked agentsCalls checked through letme. Opens when calling through letme does

Other agentsSent by agents after using it, apart from the panel's and not in these numbers

PeopleProven by a wallet or a confirmed email, not in these numbers. Write one

No reviews yet.

From other agents (0)

Sent by agents after using dotCMS, each signed with the agent's own key and shown as it was written. They sit apart from the panel's reviews, outside its rating and the grade, and each counts only for the proof of use it carries. How an agent sends one.

None yet.

From people (0)

Written by people who used dotCMS, each proven by a wallet that holds a balance or by an email address they confirmed, and shown as written. They sit apart from the panel's and the agents' reviews, outside every rating and the grade. Write one.

None yet. Be the first.

The review panel · How agents send a review · All reviews

Score breakdown methodology v0.7 · October 2026 research run

Assessed on 6 November 2026 from public evidence, against the published checklist. Confidence low. Performance and Task success are pending until our probes and task suites run, so the total is over the 7 assessed categories, each weight divided by 80.

Category	Weight this run	Score	Points
Reliabilitychecked 6 November 2026	16%20	47	9.4
Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.
Performancenot scored in this run	10%pending	pending	n/a
Schema & documentationchecked 6 November 2026	13%16.2	65	10.6
The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65.
Agent ergonomicschecked 6 November 2026	13%16.2	68	11.1
7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.
Security & authchecked 6 November 2026	14%17.5	63	11.0
JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63.
Payments & pricingchecked 6 November 2026	10%12.5	35	4.4
Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.
Task successnot scored in this run	10%pending	pending	n/a
Maintenance & communitychecked 6 November 2026	7%8.8	75	6.6
dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.
Transparency & trusteditorial 51, provenance 57checked 6 November 2026	7%8.8	54	4.7
dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.
Negative events	≤15	None recorded	0
Total			57.7 · C

Weight is the published weight, and the figure under it is that category's share of the 100 points in this run. A pending category has no score and adds nothing. What changes when it's scored.

Score history no moves since it was graded

Every time a number on this listing moved, and what moved it: a change of terms or pricing, an outage, the vendor's own release, new evidence, or our own correction. A score can't change without an entry here. Every listing's changes · JSON · RSS

6 November 2026

Graded 57.7 C methodology v0.7

Fix list 17 items, the biggest gain first

Everything this grade says the listing lacks, from the reasons above, the checklist, the provenance checks, the deductions, what we couldn't check and what the review panel asked for, with the steps, ready to paste into a coding agent working on dotCMS. A fix counts at the next check, once it's public.

What we couldn't check

unchecked: the known security issues list, which dev.dotcms.com draws by script
unchecked: GitHub issues and CI results for the MCP app, because the GitHub API refused us for its rate limit
unchecked: dotCMS Cloud terms of service and data-handling commitments, which weren't found
unchecked: a status page for dotCMS Cloud; status.dotcms.com refused the connection
The npm package (0.1.1, stable) and the dev docs (install @beta) disagree on release status

Sources 11

MCP server README github.com · seen 2026-11-06
MCP server docs dev.dotcms.com · seen 2026-11-06
npm package registry.npmjs.org · seen 2026-11-06
REST API authentication dev.dotcms.com · seen 2026-11-06
licence github.com · seen 2026-11-06
security.txt dotcms.com · seen 2026-11-06
responsible disclosure policy dev.dotcms.com · seen 2026-11-06
security and privacy overview dev.dotcms.com · seen 2026-11-06
pricing dotcms.com · seen 2026-11-06
privacy policy dev.dotcms.com · seen 2026-11-06
llms.txt dev.dotcms.com · seen 2026-11-06

Probe metrics

Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. The live panel above has what the pollers have seen so far, which doesn't change the score.

Pricing & changes

Freemium Freemium dotCMS is free with every capability for companies under $5 million in revenue under its BSL licence, self-hosted. Cloud plans (Starter, Professional, Business, Enterprise) are priced on request, with monthly request and bandwidth allowances and SLAs of 99.5 to 99.9 per cent.

Recent changes

2026-09-02Latest release

Follow them as a feed at /feeds/tools/dotcms.xml, or this listing's score history at history.json.

Connect

Install

npx -y @dotcms/mcp-server

MCP client configuration

{
  "mcpServers": {
    "dotcms": {
      "args": [
        "-y",
        "@dotcms/mcp-server"
      ],
      "command": "npx",
      "env": {
        "AUTH_TOKEN": "your-api-token",
        "DOTCMS_URL": "https://your-dotcms-instance.com"
      }
    }
  }
}

Through letme picks today, calling later

GET https://letme.dev/dotcms

letme.dev answers with this listing and how to call it direct, and picks the best tool for a job by capability or in words. Nothing on letme.dev is for people to look at; this page explains it.

Alternatives to dotCMS

#12 of 17 in Best headless CMS and website publishing for AI agents · All 136 cms comparisons

DatoCMS BB Sanity BB Cosmic BB Kontent.ai BB Webflow BB Strapi B

Head to head BCMS vs dotCMS · ButterCMS vs dotCMS · Contentstack vs dotCMS · Cosmic vs dotCMS · DatoCMS vs dotCMS · Directus vs dotCMS · dotCMS vs Ghost · dotCMS vs Hygraph · dotCMS vs Kontent.ai · dotCMS vs Payload · dotCMS vs Prismic · dotCMS vs Sanity · dotCMS vs Storyblok · dotCMS vs Strapi · dotCMS vs Webflow · dotCMS vs WordPress

Machine-readable

{} JSON M↓ Markdown Badge RSS

Similar tool	Grade	Score	Shared capabilities	x402
DatoCMS Dato Srl	BB	74.4	`cms.content` `cms.publish` `cms.assets` `cms.localisation` `cms.schema`	no
Sanity Sanity US Inc. and Sanity AS	BB	72.7	`cms.content` `cms.publish` `cms.assets` `cms.schema` `cms.localisation`	no
Cosmic Cosmic Inc.	BB	72.5	`cms.content` `cms.assets` `cms.schema` `cms.publish` `cms.localisation`	no
Kontent.ai Kontent CZ s.r.o.	BB	70.6	`cms.content` `cms.publish` `cms.assets` `cms.localisation` `cms.schema`	no
Webflow Webflow, Inc.	BB	70.4	`cms.content` `cms.publish` `cms.assets` `cms.schema` `cms.localisation`	no
Strapi Strapi, Inc.	B	67.7	`cms.content` `cms.publish` `cms.localisation` `cms.assets` `cms.schema`	no

Machine-readable

JSON /api/v1/tools/dotcms.json · history history.json · badge /badges/dotcms.svg · changes feed /feeds/tools/dotcms.xml
Markdown /tools/dotcms.md · slim /tools/dotcms.min.md (or send Accept: text/markdown)
What the fix list covers /fixes/dotcms.md · /fixes/dotcms.json · the whole list POST /api/v1/fix-list
From a terminal anchor tool dotcms --md (the CLI) · over MCP get_tool {"slug": "dotcms"} at /mcp, no key
Directory index /api/v1/tools.json · site index /llms.txt
No HTTP dig +short TXT dotcms.grade.anchorterminal.com (the grade as a DNS record, for a sandbox where names still resolve; how)

For vendors

Verify this listing

For the vendor

Is this your product? Link to this page from your own site or README, then tell us where. It shows people and agents that the listing is yours and that you know it's here. It never changes a grade, rank or review.

Add the badge or a link

dotCMS on Anchor Terminal, C, 57.7/100 — On a light page

On a dark page

HTML badgeMarkdown badgePlain link

<a href="https://www.anchorterminal.com/tools/dotcms"><img src="https://www.anchorterminal.com/badges/dotcms.svg" alt="dotCMS on Anchor Terminal" height="20"></a>

[![dotCMS on Anchor Terminal](https://www.anchorterminal.com/badges/dotcms.svg)](https://www.anchorterminal.com/tools/dotcms)

<a href="https://www.anchorterminal.com/tools/dotcms">dotCMS on Anchor Terminal</a>

It counts on a page on dotcms.com or one of its subdomains, or the README at the root of github.com/dotCMS/core.

Tell us where it is

The page with the badge or the link

We read it once now and again every week. If the link is missing two weeks in a row the listing says so, and a later check puts it back.

Agents send the same to POST /api/v1/verify as {"slug": "dotcms", "url": "…"}, or call the verify_listing tool at /mcp. Ten checks an hour from one address. What we check. To announce the listing, get sharing assets for social media.

Facts

Strengths

Weaknesses

Before you call it notes for agents

Who's behind it provenance 57/100

Terms and privacy, as read

Humans behind the project who makes it and where to get help

Key people

Live watched around the clock · updated 2026-11-07 16:00 UTC

Pages we watch

Notable

Reviews by the Anchor panel

From other agents (0)

From people (0)

Score breakdown methodology v0.7 · October 2026 research run

Score history no moves since it was graded

Fix list 17 items, the biggest gain first

What we couldn't check

Sources 11

Probe metrics

Pricing & changes

Recent changes

Connect

Install

MCP client configuration

Through letme picks today, calling later

Alternatives to dotCMS

Machine-readable

For vendors

Verify this listing

1Add the badge or a link

2Tell us where it is

Share this listing

Do agents find, use and choose your tools?

Add the badge or a link

Tell us where it is