# dotCMS > dotCMS is an enterprise CMS with headless REST APIs, workflows and push publishing, run as dotCMS Cloud or self-hosted. Agents use the @dotcms/mcp-server package, which searches the instance's OpenAPI spec and runs API calls in a sandbox. - Canonical: https://www.anchorterminal.com/tools/dotcms - Pricing: https://www.anchorterminal.com/tools/dotcms#pricing - Reviews: https://www.anchorterminal.com/tools/dotcms#reviews - Markdown: https://www.anchorterminal.com/tools/dotcms.md (~6,300 tokens) - Slim: https://www.anchorterminal.com/tools/dotcms.min.md (~1,430 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/dotcms.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT dotcms.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-07 ## Overview **Grade C · 57.7/100 · rank #780 of 1486 · #12 in CMS & website publishing · not agent-ready · confidence low** ## Assessment dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request. ## Facts | Field | Value | | --- | --- | | Vendor | dotCMS LLC (https://www.dotcms.com) | | Kind | MCP server | | Category | CMS & website publishing (https://www.anchorterminal.com/categories/cms) | | Transport | stdio | | Auth | API key · The MCP server reads DOTCMS_URL and AUTH_TOKEN. API tokens are JWTs issued for a dotCMS user, carry that user's role permissions, take an expiry in days, and are created by administrators in the user manager or through /api/v1/authentication/api-token. The docs recommend a separate user and role per application; the MCP server needs write permission for content types, content and workflows. Tokens are injected outside the sandbox, so sandboxed code never sees them. | | Pricing | Freemium (Freemium) · dotCMS is free with every capability for companies under $5 million in revenue under its BSL licence, self-hosted. Cloud plans (Starter, Professional, Business, Enterprise) are priced on request, with monthly request and bandwidth allowances and SLAs of 99.5 to 99.9 per cent. | | x402 | No · No x402, MPP or L402 in the MCP README, the dev docs or the pricing page (checked 2026-11-06). | | Licence | BUSL-1.1 | | Tools exposed | 7 | | Packages | npm: `@dotcms/mcp-server` | | Source | https://github.com/dotCMS/core | | Docs | https://dev.dotcms.com/docs/build/integrations/dotai/mcp-server | | llms.txt | https://dev.dotcms.com/llms.txt | | Last release | 2026-09-02 | | npm downloads / week | 43 | | Surface listed | The @dotcms/mcp-server package and the REST API of a dotCMS instance it calls, read from the MCP server source and README in dotCMS/core, dev.dotcms.com (llms.txt and Markdown pages), npm, www.dotcms.com pricing and security.txt on 6 November 2026. www.dotcms.com/robots.txt disallows /docs/, so docs were read on dev.dotcms.com. No account was made and no tool was called | | MCP tools | search, execute, download_assets, upload_assets, page_create, page_place_content and page_verify. Helpers in the sandbox include pick, table, count, sum and first | | Content model | Content types, workflows with multiple-approval sub-actions, content versions with restore, multilingual content and push publishing between environments | | Releases | Current releases and long-term supported (LTS) releases; security fixes are backported to LTS | | Cloud plans | Starter (100,000 requests, 1 TB, 99.5 per cent SLA), Professional (500,000, 5 TB, 99.9), Business (2,000,000, 15 TB, 99.9) and Enterprise (10,000,000, 50 TB), all on request | | Legal entity | dotCMS LLC as licensor; the privacy policy also names dotCMS Holdings, LLC and dotCMS Services LLC | | Capabilities | cms.content, cms.publish, cms.assets, cms.schema, cms.localisation | | Tags | official, mcp, stdio, self-hosted, hosted, source-available, llms-txt, sales-led, sla, typescript | | JSON | https://www.anchorterminal.com/api/v1/tools/dotcms.json | ## Score breakdown (methodology v0.7, October 2026 research run) Assessed 2026-11-06 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: low. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 47 | 9.4 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 65 | 10.6 | | Agent ergonomics | 13% | 16.2 | 68 | 11.1 | | Security & auth | 14% | 17.5 | 63 | 11.0 | | Payments & pricing | 10% | 12.5 | 35 | 4.4 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 75 | 6.6 | | Transparency & trust (editorial 51, provenance 57) | 7% | 8.8 | 54 | 4.7 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **57.7 → C** | ### Why each score - Reliability 47 (checked 2026-11-06): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47. - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 65 (checked 2026-11-06): The search tool exposes the instance's own OpenAPI spec, so the contract is machine-readable, though the tools themselves take JavaScript code (20 of 25). llms.txt and Markdown pages on dev.dotcms.com (10). The README says what each tool is for and gives examples; when not to use them isn't stated (12 of 20). Code strings rather than typed parameters for search and execute (4 of 15). Examples for both tools; error behaviour of the sandbox isn't documented (9 of 15). dotCMS changelogs are dated; the MCP package has no changelog (10 of 15). 20+10+12+4+9+10 = 65. - Agent ergonomics 68 (checked 2026-11-06): 7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68. - Security & auth 63 (checked 2026-11-06): JWT API tokens per user with role permissions and an expiry, created only by administrators (25 of 30). A read-only token can be made through a restricted role, but the MCP server asks for write permission; workflows support multiple-approval steps (14 of 20). Content returned from the CMS reaches the agent, and the sandbox isolates the token, with no prompt-injection guidance (5 of 15). Audit logging for API calls wasn't established in the pages read (5 of 15). A valid security.txt with PGP, a responsible disclosure policy with bounties, LTS security backports and a public list of known security issues, which is drawn by script and couldn't be read. No certification was found (14 of 20). 25+14+5+5+14 = 63. - Payments & pricing 35 (checked 2026-11-06): Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35. - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 75 (checked 2026-11-06): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75. - Transparency & trust 54 (checked 2026-11-06): dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51. Fix list, everything this grade says the listing lacks, the biggest gain first (17 items). What it covers is at https://www.anchorterminal.com/fixes/dotcms.md (JSON https://www.anchorterminal.com/fixes/dotcms.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{"listing": "dotcms", "plan": "read"}`, free while the beta runs ### What we couldn't check - unchecked: the known security issues list, which dev.dotcms.com draws by script - unchecked: GitHub issues and CI results for the MCP app, because the GitHub API refused us for its rate limit - unchecked: dotCMS Cloud terms of service and data-handling commitments, which weren't found - unchecked: a status page for dotCMS Cloud; status.dotcms.com refused the connection - The npm package (0.1.1, stable) and the dev docs (install @beta) disagree on release status ### Sources - MCP server README: (seen 2026-11-06) - MCP server docs: (seen 2026-11-06) - npm package: (seen 2026-11-06) - REST API authentication: (seen 2026-11-06) - licence: (seen 2026-11-06) - security.txt: (seen 2026-11-06) - responsible disclosure policy: (seen 2026-11-06) - security and privacy overview: (seen 2026-11-06) - pricing: (seen 2026-11-06) - privacy policy: (seen 2026-11-06) - llms.txt: (seen 2026-11-06) ## Score history Every move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/dotcms/history.json - 2026-11-06: graded 57.7 C (methodology 0.7) ## Who's behind it (provenance 57/100, checked 2026-11-06) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | dotCMS LLC | 20/20 | | Domain age | dotcms.com, no registry record we could read | 0/15 | | Endpoint on the vendor's domain | is not on dotcms.com | 0/15 | | Terms of service | read, states 0 of the 7 things a reader expects | 4/10 | | Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 | | Status page | not found | 0/10 | | Changelog | published | 10/10 | | security.txt | valid | 10/10 | | People named | 2 named with their role, none with a public profile | 7/10 | | Support route | help pages, a community | 5/5 | The MCP server runs locally and calls the customer's own dotCMS instance, so the endpoint isn't on a dotCMS domain. The privacy policy, last updated 8 September 2026, covers dotCMS's websites only and names dotCMS Holdings, LLC, dotCMS Services LLC and dotCMS LLC. www.dotcms.com/robots.txt disallows /docs/ and /utils/; dev.dotcms.com allows all with Content-Signal ai-train=yes, search=yes, ai-input=yes. www.dotcms.com/terms-of-service and /privacy-policy returned 404; no cloud terms of service were found, so the licence stands in for terms. No status page answered (status.dotcms.com refused the connection). ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://github.com/dotCMS/core/blob/main/LICENSE), read 2026-11-06, gives no date, states 0 of the 7 things a reader expects. - Not found in the text. Gives the date it was last updated. - Not found in the text. Names the governing law or courts. - Not found in the text. States a limit on its liability. - Not found in the text. Says how the agreement or account can be ended. - Not found in the text. Says how changes to the terms are announced. - Not found in the text. Lists what users may not do. - Not found in the text. Refers to a service level or uptime commitment. **Privacy policy** (https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy), read 2026-11-06, dated 2026-09-08, states 8 of the 8 things a reader expects. - Gives the date it was last updated. Last updated 2026-09-08. - Says how long data is kept. Names a period of 30 days. - Says whether personal data is sold or shared for advertising. Says it does not sell personal data. - Gives a privacy contact. privacy@dotcms.com. - Says where data is transferred or stored. Data goes to the United States. ## Humans behind the project (researched 2026-11-06 from public pages, not part of the grade) ### Key people - Will Ezell, Co-founder and Chief Technology Officer, dotCMS - Zain Ishaq, Chief Executive Officer, dotCMS - Note: dotCMS's author pages, read 6 November 2026, say Will Ezell co-founded dotCMS and is its Chief Technology Officer, and that Zain Ishaq is Chief Executive Officer and co-founded Appleby Succession Capital, "an investment firm that acquired dotCMS in 2021". No other co-founder is named on a dotCMS page, so the roster may be incomplete. The licence names dotCMS LLC and the privacy policy also names dotCMS Holdings, LLC and dotCMS Services LLC. CMSWire reported on 26 October 2021 that dotCMS announced a growth investment led by Pacific Lake Partners with Zain Ishaq as CEO and Vadym Kononenko as President; dotCMS's own copy of that release is no longer on its newsroom. No price was found, so no valuation is recorded. - dotCMS LLC: LinkedIn https://www.linkedin.com/company/dotcms X https://x.com/dotcms GitHub https://github.com/dotCMS ### Ownership and investors - Ownership: Acquired by Appleby Succession Capital, 2021-10 - Backed by: Pacific Lake Partners ### Getting support - Help: https://dev.dotcms.com/ - Help: https://community.dotcms.com/ - Community (Community forum): https://community.dotcms.com/ - Community (GitHub issues): https://github.com/dotCMS/core/issues - General contact: security@dotcms.com - Sources: https://www.dotcms.com/company/about-us, https://github.com/dotCMS/core/blob/main/LICENSE, https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/privacy-policy.md, https://www.dotcms.com/.well-known/security.txt, https://www.dotcms.com/authors/will-ezell, https://www.dotcms.com/authors/zain-ishaq, https://www.cmswire.com/digital-experience/dotcms-announces-growth-investment-and-new-leadership-board-members/, https://www.dotcms.com/news/dotcms-expands-to-pakistan ## Live (updated 2026-11-07 16:00 UTC) - github `dotCMS/core` dotcms-cli-26.11.06-03, released 2026-11-06 - npm `@dotcms/mcp-server` 0.1.1 - security.txt: valid, expires 2027-06-09T23:59:59.000Z - Watching changelog - Watching privacy - Watching terms - Always current: https://www.anchorterminal.com/api/v1/live/dotcms.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Strengths - Seven tools in code mode, with the instance's OpenAPI spec searchable from the sandbox - The API token stays outside the sandbox, which only receives results - JWT tokens per user with role permissions and an expiry - security.txt with PGP, a bounty-backed disclosure policy and LTS security backports - Free with every capability for organisations under $5 million in revenue ## Weaknesses - Pre-1.0 package, with the dev docs still pointing at the beta tag - The server needs a token with write permission for content types, content and workflows - execute can call any endpoint, and no read-only mode or annotations were found - Cloud prices are on request only - Source-available under the BSL, not an OSI licence ## Before you call it (notes for agents) 1. Search the spec with `search` before writing an `execute` call, and return only the fields you need 2. Use a token for a dedicated user and role, not an administrator's 3. Confirm with the user before execute calls that publish, archive or delete content 4. Keep results small with pick and first, since output is capped at about 25,000 characters 5. Use download_assets for theme folders so files land on disk instead of in context ## Connect Install: ```bash npx -y @dotcms/mcp-server ``` MCP client configuration: ```json { "mcpServers": { "dotcms": { "args": [ "-y", "@dotcms/mcp-server" ], "command": "npx", "env": { "AUTH_TOKEN": "your-api-token", "DOTCMS_URL": "https://your-dotcms-instance.com" } } } } ``` Through letme: https://letme.dev/dotcms. letme answers with the pick and how to call it direct. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | DatoCMS | BB | 74.4 | 85 | cms.content, cms.publish, cms.assets, cms.localisation, cms.schema | no | https://www.anchorterminal.com/tools/datocms.md | | Sanity | BB | 72.7 | 120 | cms.content, cms.publish, cms.assets, cms.schema, cms.localisation | no | https://www.anchorterminal.com/tools/sanity.md | | Cosmic | BB | 72.5 | 123 | cms.content, cms.assets, cms.schema, cms.publish, cms.localisation | no | https://www.anchorterminal.com/tools/cosmic.md | | Kontent.ai | BB | 70.6 | 193 | cms.content, cms.publish, cms.assets, cms.localisation, cms.schema | no | https://www.anchorterminal.com/tools/kontent-ai.md | | Webflow | BB | 70.4 | 199 | cms.content, cms.publish, cms.assets, cms.schema, cms.localisation | no | https://www.anchorterminal.com/tools/webflow.md | | Strapi | B | 67.7 | 308 | cms.content, cms.publish, cms.localisation, cms.assets, cms.schema | no | https://www.anchorterminal.com/tools/strapi.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The MCP server is code-mode: `search` runs JavaScript over the instance's filtered OpenAPI spec and `execute` runs authenticated API calls in an isolated sandbox, with output capped at about 25,000 characters (source: ) - The repository also has download_assets, upload_assets, page_create, page_place_content and page_verify tools (source: ) - @dotcms/mcp-server 0.1.1 on npm since 2 September 2026, GPL-3.0; the dev docs still tell readers to install the @beta tag (source: ) - dotCMS core is under the Business Source License with an additional use grant for organisations with under $5 million in annual finances (source: ) - security.txt with a PGP key, valid to 9 June 2027, and a responsible disclosure policy updated on 4 November 2026 that promises bounties and requires disclosure of AI tools used (source: ) - dotCMS core tags are cut several times a week, the newest v26.11.06-03 on 6 November 2026 (source: ) - #12 of 17 in Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md - All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md ## Compare - [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md): F 33.5 vs C 57.7 - [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md): D 51.4 vs C 57.7 - [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md): B 66.4 vs C 57.7 - [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md): BB 72.5 vs C 57.7 - [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md): BB 74.4 vs C 57.7 - [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md): C 58.1 vs C 57.7 - [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md): C 57.7 vs D 51.2 - [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md): C 57.7 vs B 67.4 - [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md): C 57.7 vs BB 70.6 - [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md): C 57.7 vs D 50.1 - [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md): C 57.7 vs C 56 - [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md): C 57.7 vs BB 72.7 - [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md): C 57.7 vs B 64.8 - [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md): C 57.7 vs B 67.7 - [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md): C 57.7 vs BB 70.4 - [dotCMS vs WordPress](https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md): C 57.7 vs C 58.8 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on dotcms.com or one of its subdomains, or the README at the root of github.com/dotCMS/core. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "dotcms", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html dotCMS on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![dotCMS on Anchor Terminal](https://www.anchorterminal.com/badges/dotcms.svg)](https://www.anchorterminal.com/tools/dotcms) ``` Plain link: ```html dotCMS on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say dotCMS is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/dotcms-dark.png - Light: https://www.anchorterminal.com/assets/share/dotcms-light.png --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp