Agility CMS

Agility ships about 15 field types (text, multi-line, HTML, dropdown, URL, number, decimal, date/time, boolean, linked content, image, gallery, file, list of files, hidden, custom section) plus custom fields built with the Apps SDK, and hide/when formulas for conditional fields. Models can be moved between instances with Agility CLI 1.0 and the Management API, but there is no native JSON, geo or union field and the text field is capped at 128 characters, which keeps it in the adequate band.

Linked Content fields reference shared lists or single items, or create nested child lists, and the Fetch API expands them with contentLinkDepth or expandAllContentLinks. References are one-way: there is no reverse lookup, and the taxonomy guide tells teams to filter on companion value fields with [contains] to find items that use a term. One-way references with no traversal sit just under the 60 line.

Pages are assembled from component models placed in page-model zones, components can hold nested linked content lists, and fields can be grouped into tabs and sections. Portable structured rich text exists only through the Block Editor app, so composition inside a single entry is shallower than platforms with native nested block fields.

Built-in validation covers required, maximum length, regex with custom messages, unique titles, and image/file type, size and dimension limits. Agility's own docs say cross-field and conditional rules need a custom field app built by the customer and that there are no server-side validation scripts, so API writes are not covered by custom rules.

Content items and pages keep version history with who and when, a field-by-field comparison view, and one-click revert into staging; deleted content items and assets can be restored from filters and the recycle bin. Deleted pages need a support ticket and there is no branching or release forking, so it stays in the adequate band.

There is no taxonomy feature: Agility's 'Designing a Taxonomy That Scales' guide builds categories and tags from Drop-down List fields and Linked Content fields pointing at hand-made term lists, with hierarchy modelled as a parent link and governance left to editorial rules. Terms are queryable through the API as linked items, which keeps it out of the bottom band.

Web Studio frames the customer's own preview deployment inside Agility with screen-size previews, and once components and fields carry data-agility attributes editors get hover outlines, click-to-edit and live updates as they type; Agility Decorate adds those attributes to Next.js components automatically. Preview works on any frontend with preview keys and a lang parameter, but needs CSP and SDK setup per site and has no documented shareable preview link, so it sits below the top band.

The HTML field is TinyMCE with power paste from Word, tables, image and link insertion, custom editor CSS and an HTML source view. Output is an HTML string rather than a portable AST, and inline embedding of content entries is not supported natively; a JSON Block Editor is available only as an app.

The media library has folders, alt text, an in-app image editor, focal point, and Fastly-backed URL transforms with WebP and AVIF, and since September 2026 shows where each asset is used and warns before deleting assets in use. Metadata and tagging on assets stay light, which keeps it at the bottom of the strong band.

Agility documents live multi-user editing of the same item: edits stream to other editors as they type, a field is locked while someone is focused in it, avatars and typing indicators show who is in which field, and Web Studio shows live cursors. Threaded comments with mentions, reactions, resolve and comment bubbles on the preview round it out; field locking means two people cannot co-type in one field, which keeps it under 80.

Approvals are switched on per page or content list: an editor requests approval, an Approver or Publisher approves or declines with notes, and tasks and notifications follow. There is one approval step with no custom states, no conditional or parallel routing and no per-type workflow definitions, so it sits in the lower part of the multi-step band.

Content items, pages and components take a release date and an expiry date, scheduling respects the user's timezone, pages can redirect while scheduled, and Batch Publishing (March 2026) publishes several selected items in one action. There are no scheduled release bundles or a calendar view in the product, which caps it below 75.

Locales are parallel copies of each item and page that share a contentID, publish independently, and can mark individual fields 'Constant across all languages'; slugs differ per locale and the Fetch API takes the locale in the path. Agility's docs state there is no automatic fallback to another locale and page structure is shared across locales, so it reads as document-level localization with a field-level opt-out.

There are ten built-in roles, Custom Roles built from ten base permissions, Teams, item-level security on pages and content lists, and Designer-only fields, with SAML, OIDC and WS-Federation SSO plus MFA. Custom Roles and SSO are Enterprise only, item security can only add rights, there is no per-role field hiding or locale permission, and SCIM provisioning is still on the roadmap.

Agility separates the Content Fetch REST API (live and preview keys), a GraphQL API covering content, pages, sitemaps and components, a Content Sync API and a Management API (115 operations, fully covered by the .NET Management SDK 2.0). Filtering is limited to basic operators such as eq, in and contains with a 250-item page size, which keeps it at the lower end of the REST plus GraphQL band.

All content APIs and assets sit behind Fastly, with custom API and asset domains on paid plans and five data regions. Agility publishes no purge latency figure and offers no edge compute or edge personalization, so it lands in the upper part of the CDN-backed band.

Webhooks cover save, publish, unpublish and delete events with per-webhook event filters, opt-in HMAC-SHA256 signing to the Standard Webhooks spec with secret rotation, configurable retries with backoff, and 90-day delivery history with full payloads. There are no schema-change events or streaming alternatives.

Agility is API-first with official JavaScript and .NET fetch and management SDKs, a sync SDK, a Next.js starter and an MCP server, and its docs cover apps, kiosks, email and in-app delivery. Official SDKs cover two language families and rich text is HTML, so it falls short of the 80+ bar.

Agility has no audience, segment or visitor profile concept, and its marketplace lists no CDP connector; its own personalization content describes segmentation as living in an external CDP or personalization engine wired up by the frontend team. That is an external engine end to end.

Variants can be modelled as linked components and chosen by an external decision engine in the frontend, as the PostHog app's code samples show for experiment variants. There are no native audience rules, variant fields or per-audience preview in the editor.

The PostHog Analytics & A/B Testing app, still in beta, lets editors create an experiment and its multivariate feature flag from the CMS and shows experiment status, variant performance and statistical significance in the content item sidebar. Traffic allocation and stats run in PostHog and variant rendering is coded in the frontend, so it is an integration still short of GA.

No recommendation engine, related-content algorithm or recommendation app appears in Agility's docs, marketplace or 2025 to 2026 changelog. Related content is curated manually with Linked Content fields.

Agility documents a provider-neutral pattern for indexing published content into Algolia, Azure AI Search, Elastic or Coveo through signed webhooks plus a scheduled full reindex, and a Next.js 'Add search to your site' guide. The customer builds and hosts the sync endpoint and search UI; there is no native visitor search or installable search connector.

Agility has no catalog, cart, checkout, pricing or inventory. Its ecommerce positioning is about pairing the CMS with an external commerce engine.

Marketplace apps for commercetools (browse and search via the Product Projection Search API), BigCommerce and Shopify let editors pick products and store a reference or encoded JSON on the content item. These are product pickers rather than live federation or sync, which is the 40 to 55 band.

Content performance shows up in the editor only through the Google Analytics and PostHog apps (page views, impressions, scroll depth, CTA clicks in the sidebar). Native reporting is operational: Recent Changes, Ready to Publish, User Activity and Permissions reports plus usage dashboards.

The first-party Google Analytics app is updated for GA4 and approved by Google, and the PostHog app brings analytics and experiments into the editor; tags otherwise go in through Additional Header Markup or the frontend. There is no Adobe Analytics, Segment or Amplitude connector, so it sits near the integration ceiling but not at it.

One instance can hold several page-management sitemaps, each with its own domain and deployment, sharing page models, components, content and assets; separate instances with a content hub cover stricter separation. Essentials allows one sitemap and Enterprise ten or more, and permissions and API keys are not scoped per site, which keeps it under 70.

A DeepL app (private beta) adds a field-level translation panel and machine translation during locale copies, alongside Google Translate and Zapier Translate options and Bulk Copy to Other Locales (May 2026). There are no connectors to Phrase, Smartling, Lokalise or other TMS products and no translation memory.

Teams cascade roles across instances in an organization, and Agility publishes a multi-brand reference architecture, but brand separation relies on naming conventions such as 'Global' and 'Brand B' prefixes, content folders and separate instances. There is no cross-brand policy enforcement, brand-scoped component library or brand-level reporting.

The built-in library has folders, an image editor, recycle bin and, since September 2026, where-used tracking, but no metadata schemas, rights or expiry, approvals or asset versioning. Enterprise DAM comes through Bynder (with transformation parameters) and Cloudinary apps, so the integration packaging applies.

Video reaches content through YouTube, Vimeo, Bynder and Cloudinary apps or embeds in rich text. Agility has no transcoding, adaptive streaming, captions or player.

Marketers build pages from page models with zones, add and reorder components by drag and drop in the page editor, control which components each zone allows, and edit components in context in Web Studio with live updates. Composition still happens in the page tree and side panels rather than by dragging blocks on the rendered canvas, so it stays below the full visual builder band.

Agility is headless and does not render or host the site: its docs recommend deploying the Next.js starter to Vercel, with guides for Netlify and Azure and a Vercel marketplace integration, plus a .NET starter for Azure. Sitemaps, routing data and redirects come from the API, but the frontend and its hosting belong to the customer.

Forms come from Typeform, Formstack, HubSpot and Salesforce Web-to-Lead apps that let editors pick a form to embed. There is no native form builder or submission storage beyond legacy input forms.

The HubSpot app is the only marketing connector, and Agility's docs treat email as another channel that reads content through the API. There is no subscriber sync, content push to an ESP, triggered sends or email preview.

Agility has no automation, nurture or lead scoring features, and the HubSpot and Salesforce apps only embed forms. Automation lives entirely in the external marketing tool.

Pages carry native SEO fields (title, meta description, keywords, header markup, sitemap and menu visibility), URL Redirections are managed in the CMS with 301/302, CSV import and export and a tester, and the SEO Analysis marketplace app runs Yoast checks on the rendered preview. Canonical tags, hreflang and structured data are left to the frontend, with guidance only.

Agility publishes llms.txt and Markdown versions of its own documentation and has an 'agent-friendly content model' guide, but the product gives customer sites no llms.txt generation, Markdown endpoints, crawler controls or AI citation reporting. Anything here is built in the customer's frontend without specific vendor guidance.

The in-product App Marketplace offers roughly two dozen apps, most of them first party (DeepL, Google Analytics, PostHog, Bynder, Cloudinary, commercetools, BigCommerce, HubSpot, SEO Analysis, Picker Fields), and private apps can be built with the Apps SDK and Plenum UI. It is a small, curated catalog rather than a 50+ ecosystem.

Agility's identity, Auth0-based SSO and roles cover CMS users only; there is no visitor login, member portal, gated content model or CIAM connector. Logged-in experiences are built entirely in the frontend.

A four-API design: the REST Content Fetch API (the main delivery API, page and sitemap aware), a GraphQL API with field selection, multiple queries per request and filtering, the Content Sync API, and a Management API. It is well-organised REST in the 65–80 band. Not higher because the GraphQL API still cannot fetch Pages, Page Templates or Page Modules, and REST filtering is fairly basic.

The Content Fetch and GraphQL APIs and the asset CDN (cdn.aglty.io) now sit behind Fastly, which invalidates cached content at the edge as soon as it is published. CDN hits do not count toward the rate limit, and the Content Sync API handles large-dataset and static-build patterns. Not higher because direct origin requests are still capped at 10 per second (429 on excess, 408 after 30 seconds), which is tight for heavy preview or server-rendered workloads, and no latency figures are published.

Official SDKs are the JavaScript/TypeScript @agility/content-fetch, a Content Sync SDK, a TypeScript Management SDK, a .NET SDK, and Next.js framework starters. That is about two official languages, in the 55–70 band. Not higher because there are no official Python, Ruby, PHP, Java or mobile SDKs.

The integrations page and apps cover commerce (Shopify, BigCommerce), DAM (Bynder, Cloudinary), search (Algolia), analytics (Google-approved GA4 app), CRM and marketing (HubSpot, Salesforce), translation (DeepL) and utilities (the Picker Fields app, Sept 2026). Most categories are covered, but the count is roughly in the 20–50 range. Not higher because there is no TMS connector, no CDP or experimentation apps, and far fewer apps than Contentful or Storyblok.

Agility Apps SDK v2 (@agility/app-sdk) supports custom fields, sidebar panels, dashboards and modals inside the CMS UI. Server-side extension is through signed webhooks (Standard Webhooks spec, retries, delivery history), and the MCP Server (GA June 2026) opens the platform to AI agents. Not higher because there is no hosted server-side function or action runtime like Contentful App Framework functions or Sanity Functions.

Enterprise SSO through Auth0 supports SAML, OIDC, WS-Federation, Active Directory, LDAP and ADFS, with named providers including Entra ID, Okta, Google Workspace and PingFederate. MFA, Personal Access Tokens for CLI and CI/CD, and OAuth 2.0 for the MCP server round it out. The docs state that Enterprise SSO is only available on Enterprise plans, and roles are still assigned inside Agility rather than through the IdP, which keeps it in the 60–75 band.

Nine built-in roles plus custom roles with granular permissions, Teams that cascade roles across instances, approval workflows and audit trails. The enterprise security page claims permissions down to field level. Not 80+ because content-instance (owner-only) access control is not documented.

SOC 2 Type II (current reporting period from 31 August 2025, report under NDA), GovRAMP registered and GDPR compliant, with AES-256 at rest and TLS 1.2+ in transit on Azure. Data residency is documented: an instance lives in one of five regions (US North Central, US East, Canada Central, West Europe, Australia), and DR replication stays inside the same country boundary. Not higher because ISO 27001 is only Azure's inherited certification rather than Agility's own, there is no HIPAA BAA, and customer-managed keys are not offered.

No known breaches or published CVEs for the SaaS platform, and security is communicated through the trust and enterprise security pages. No public bug bounty or published vulnerability disclosure policy turned up in search. Clean history with basic disclosure puts it in the 50–65 band.

SaaS only, on Microsoft Azure, and each instance is provisioned into a customer-selected region (US North Central, US East, Canada Central, West Europe or Australia) that holds all of its data at rest. There is no self-hosted or private-cloud option, so it stays in the SaaS-only band of 50–60. Having five selectable residency regions lifts it slightly above the minimum.

The marketing site advertises a 99.95% uptime SLA on Azure, and status.agilitycms.com publishes incidents and history with subscribable notices. The SLA docs split this into separate delivery and management SLAs, but the actual figures, maintenance terms and service credits are set per contract rather than published. Just under 80 because the published docs never commit to a number and the SLA is an enterprise contract term.

CDN-backed delivery on Azure, with CDN traffic exempt from rate limits. The Content Sync SDK suits static and ISR architectures, and pricing is fixed rather than usage-based. There are enterprise and public-sector customers. Not 75+ because there are no published scale limits (entries, RPS, concurrent editors) or large-scale references on the level of Contentful or Contentstack.

Agility now documents its DR model: automated backups with point-in-time restore, automated failover to a secondary Azure region inside the same country without any endpoint changes, a written BC/DR plan, and DR tests (including backup restores) at least once a year. The edge keeps serving published content during an origin outage. Content and models can be exported with Agility CLI 1.0 pull or the Management API. Not higher because the RTO/RPO figures, backup retention and regional pairings are only shared on request or under NDA, which keeps it at the top of the 50–65 band.

Agility CLI 1.0 (repo active Aug 2026) pulls models, content and pages to the local filesystem and pushes them back. The Content Sync SDK lets local builds run against synced files, and framework starters (Next.js, including a 2026 demo site) run locally against a cloud instance. Not 70+ because there is no local CMS emulator; the editing backend is always the cloud instance.

Separate instances act as environments, CLI 1.0 syncs models, content, pages and workflows between them, and Personal Access Token auth supports pipelines. Webhooks trigger site rebuilds. Not higher because there are no scripted schema migrations, environment aliasing, or branch-per-PR content environments.

agilitycms.com/docs covers the Content Fetch, GraphQL, Sync and Management APIs, plus the Apps SDK, webhooks and CLI (including a CI/CD guide with GitHub Actions pipelines). It now has an API reference generated from OpenAPI specs, an llms.txt index, Markdown versions of every article, and new architecture pages on security, residency, SLA, DR and CDN. There is also a GraphQL playground in each instance and an active changelog. Not higher because the examples are JS/Next.js-centric and some pages are stale (the GraphQL page still shows 2021 screenshots and says Pages support is coming).

The Content Fetch, Management and Apps SDKs ship TypeScript types, and the Next.js starters keep content types in lib/types. There is no official type generation from content models, so developers write interfaces by hand or with AI help. That puts it in the 60–75 typed-SDK-without-codegen band, near the low end.

The developer changelog has 13 dated entries in 2026 so far, four of them in September alone. Shipped work includes the MCP server (GA June 18 2026), Agility CLI 1.0 with token auth for CI/CD (July 6), Agility Decorate for Next.js click-to-edit tagging (July 23), signed webhooks with retries and delivery history (Sept 9), nested-content publishing (Sept 23) and asset where-used tracking (Sept 28). Not higher because much of this is editor polish and tooling rather than large platform capabilities. Not lower because meaningful features now land roughly monthly.

The docs changelog is dated and filterable by type (API, Bugs, Feature, Improvement, Integration, Platform, SDK), with a short explanation per change and links to docs. It does not flag breaking changes or link migration guides. A September 25 2026 'Catching Up: Features Released Since 2025 That We Didn't Log' entry admits that shipped features such as the MCP server, batch publishing and the USA East region were missing for months. Not higher because of those gaps; not lower because the structured, tagged feed is better than a blog-only one.

Agility publishes a public roadmap page with dated commitments, such as UI refresh feature parity by June 30 2026, and lists shipped versus upcoming items. No public community voting portal (Canny or GitHub Discussions) was found, which keeps it below 70. Clearly more open than roadmaps shared only in enterprise briefings.

The Content Fetch and Management APIs have stayed stable, and SaaS delivery shields customers from platform upgrades. The SDKs and CLI (now 1.0) use semver. No published deprecation-window policy or codemod tooling was found, and behaviour changes ship as defaults with an opt-out: since September 23 2026, publishing an item also publishes its nested linked content unless the editor ticks 'Publish this item only'.

Agility is a SaaS platform with a small open-source footprint: its starter and SDK repos each sit well under 1K GitHub stars, and npm downloads of @agility/content-fetch are modest. Stack Overflow volume is sparse. Its G2 base of roughly 200 reviews is respectable for a niche vendor, which keeps the score from dropping lower.

Agility runs a community Slack/Discord where staff and developer-relations people respond, and G2 reviewers repeatedly praise responsive support. The community is small, with few outside contributions to the SDK or starter repos. Engagement relies more on the vendor than on peers.

Agility runs a formal Implementation Partner Program with a public directory and free Agility Academy certification. MNP Digital, the digital arm of a large Canadian national consulting firm, joined in July 2025, and Deploi was added more recently, alongside boutique agencies such as Dotfusion, 9thCO and AdverNETS. No global SIs such as Accenture or Deloitte are named, and coverage is concentrated in Canada, the US and the UK.

Nearly all tutorials, videos and guides come from Agility's own blog, docs and Academy. Independent content is limited to occasional agency posts and CMS Critic coverage, with no significant Udemy or Pluralsight courses or conference-talk presence. This is typical of an obscure SaaS CMS.

Job postings that name Agility CMS are rare. Buyers instead hire general React/Next.js or .NET developers, who can pick up the API-first model quickly. Agility Academy offers certification, but the pool of certified practitioners is small and concentrated in partner agencies.

G2 gave Agility a Momentum Leader badge in Spring 2026 and Headless CMS Leader status again in Summer 2026, and it keeps publishing case studies such as Collabria Financial. G2 review count has been flat at about 204 through 2026, and no notable new enterprise logos or growth metrics were found independently, so the score stays below 65.

Agility is a long-running Toronto company (founded 2002) whose only disclosed outside capital is an August 2023 round with Venbridge, a non-dilutive growth lender, plus an earlier small round. There is no 2025 or 2026 funding, layoff or acquisition news (a December 2025 acquisition of 'Agility, Inc.' by Guide Technologies involved an unrelated manufacturing software firm). It keeps shipping, which points to modest but stable operations; little capital compared with VC-backed headless peers limits the score.

Agility positions itself as a marketer-friendly headless CMS with page management, a sitemap-driven model and Web Studio visual editing, a real but crowded niche next to Storyblok and Contentstack. It holds G2 Headless CMS Leader status across Spring and Summer 2026, but no Gartner Magic Quadrant or Forrester Wave inclusion was found. It has some differentiation and no analyst recognition.

Agility is rated about 4.4 to 4.5 out of 5 on G2 across roughly 204 reviews, which puts it at the top of the 60 to 72 guidance band. Reviewers praise ease of use, the visual page manager and responsive support. The recurring complaints are occasional UI clunkiness (being addressed by the ongoing UI refresh) and a smaller ecosystem. No strong negative sentiment was found on community forums.

The live pricing page now lists three packages: a free Proof of Concept, Essentials at $699/mo, and Enterprise at custom pricing. A full feature comparison table shows users, entries, storage, bandwidth, SLA and security features per tier. That ends the confusion from conflicting third-party prices ($1,249, $2,499) and sits at the industry norm of public lower tiers with a gated Enterprise tier. It stays mid-band because every CTA is 'Chat with Us', the page opens with 'before we talk numbers, let's talk about your project', and Enterprise has no published starting price.

The model is flat and predictable. Every package includes unlimited content models, unlimited locales and unlimited API and asset requests, with the limits set on users, entries (25k on Essentials), sitemaps and a 500GB monthly bandwidth allowance that covers assets and API traffic. The free-to-paid cliff is steep: $699/mo, billed annually, is the first paid step, with no cheaper middle tier. Essentials also keeps the same 5-user cap as the free POC, so growing past 5 editors means going to Enterprise. That is well above the $99 to $300 entry tiers at Storyblok, Sanity or DatoCMS.

Editorial and developer features ship on every package: page management, workflows, versioning, scheduling, DAM, REST and GraphQL APIs, webhooks, the Sync SDK and custom fields. Security and governance are gated, though. Enterprise SSO (Auth0, SAML, AD, LDAP) and a 99.9%+ SLA are Enterprise-only, custom roles and Teams are marked available on one tier only, and non-US data centres (Canada, Europe, Australia) need Enterprise. MFA and login-provider control are missing from the free POC. Essentials also caps users at 5, so any real team is pushed to Enterprise, which is the problematic pattern this item penalizes.

The pricing FAQ states that licensing packages are 'typically billed annually', payable by ACH, wire or credit card depending on the agreement. The FAQ confirms a nonprofit discount, available on request. No monthly option, startup program or published exit terms were found. Annual-only billing puts this below 50, and the confirmed nonprofit program keeps it from scoring lower.

The free-forever plan (5 users, 2,500 items) is no longer on the pricing page. In its place is a free 'Proof of Concept' package reached through 'Chat with Us', described as a custom POC built with Agility's team, plus a trial that lasts 30 days by default and can be extended by asking support. A self-serve signup link still works, but it is framed as a trial, not a permanent hobby plan. A time-limited, sales-assisted evaluation is not a genuine free tier, so the score drops sharply. It stays above 30 because the POC's limits (25k entries, 500GB) are generous while it lasts.

Self-serve trial signup still works, and Agility ships Next.js starter sites and SDKs (JS fetch SDK, Sync SDK, Management SDK, CLI, .NET) that return a working content query or starter site within an hour or two. G2 rates ease of setup at 8.5/10. Some reviewers call the initial setup and the page and module model confusing, and the pricing funnel now steers buyers toward a sales call, which holds it below 75.

G2 reviewers cite implementation speed as a strength. Built-in page and URL management, sitemaps and module composition cut the custom routing work that pure headless CMSs need for marketing sites. Agility claims an AI-assisted POC can be built 'in a couple days', but that is vendor marketing. Few public timeline reports exist and most builds are agency-led, so the estimate is inferred at roughly 4 to 8 weeks for a marketing site.

Implementations use mainstream skills: React and Next.js on the front end, REST and GraphQL APIs, and JavaScript or .NET SDKs, so generalist frontend developers can deliver without certification. The Agility talent pool and partner ecosystem are small compared with Contentful or Sanity, which adds some ramp-up and agency-dependence premium.

Agility is multi-tenant SaaS only. CMS hosting, the content APIs, the DAM and Fastly CDN delivery are in the subscription, with 500GB storage and 500GB monthly bandwidth on Essentials. Buyers still pay separately for front-end hosting on Vercel, Netlify or Azure, as with any headless CMS, which keeps it out of the top of the band.

Agility is managed SaaS with 24/7 infrastructure monitoring and 30-day point-in-time backups included, so the customer runs no servers, databases or CMS upgrades. The remaining ops work is the decoupled front end: build pipelines, preview environments and webhook-driven revalidation. That is standard for headless CMSs and does not need a dedicated ops role.

Content leaves easily. The Agility CLI and Content Sync SDK download all content and assets to the local file system as JSON, and the Management SDK and API support scripted migration. The page, module and sitemap model is Agility-specific, though, and front ends written against it need rework to move to another CMS. That is moderate effort, not severe lock-in.

Developers work with content models, content lists, page modules, page templates with module zones, and the sitemap, plus instances and the preview/live API key split. Each maps to a familiar web idea (pages, routes, components), but the page-management layer means there are more core concepts than in a pure content-API CMS. That puts it in the upper-middle band rather than 75+.

There are framework guides (the Next.js docs section and a walkthrough of how the starter works), a Web Studio 101 guide, template instances to sign up with (the Blog Template), and a 2026 blog series on building a site with AI assistance. No structured certification path or interactive in-console tutorial was confirmed, and reviewers say fuller documentation would help onboarding, so it sits in the adequate-docs band.

Agility offers standard REST (Content Fetch) and GraphQL APIs, TypeScript SDKs and a first-class Next.js starter using the App Router, draft mode and next/image, plus a .NET SDK. The one platform-specific pattern is mapping page modules to React components through a module registry. The GraphQL API cannot yet fetch pages or modules, which pushes page-driven sites onto the REST SDK, so the score stays just below 75.

The vendor maintains a Next.js starter that pairs with a pre-populated Blog Template instance (models, modules and example content), ships with TypeScript and Tailwind, includes preview wiring and deploys to Vercel with one click; a 2026 demo site and SSR and search variants also exist. Starters for other frameworks (Nuxt, Astro, Gatsby, Eleventy) are older and less actively maintained, which keeps it below 75.

A working integration needs the instance GUID, separate Preview and Fetch API keys, a Security Key for preview validation, and locale and sitemap/channel settings: about five to seven values, all under Settings > API Keys. Defaults are clear and the starter reads them from .env, but the count and the preview-specific key put it in the moderate band.

Models, modules and templates are defined in the UI (a visual model editor arrived in late 2025), and Agility CLI 1.0 syncs them between instances. There is no schema-as-code source of truth and no scripted content migrations, so renaming reference names or changing field types on live content needs manual care. Native field types are limited (no JSON, geo or union fields). This is workable with tooling support, so it sits mid-band rather than at the 30–50 level.

Preview needs frontend code: middleware catches ?agilitypreviewkey=, an /api/preview route turns on Next.js draft mode and injects the Web Studio SDK, and the site's CSP must allow app.agilitycms.com. The starter ships this pre-wired and Agility Decorate (2026) auto-tags Next.js components for click-to-edit. Agility's own post on Next.js 16's proxy.ts breaking preview shows the middleware path can be fragile, so it sits in the well-documented-but-code-required band.

Generalist TypeScript/React developers (or .NET developers using the .NET SDK) can be productive without a certification; the platform knowledge they need is limited to the page/module model and the preview flow. The starter is set up for AI coding assistants. It is just short of 75+ because the module-to-component mapping and page-routing conventions are still Agility-specific.

It is fully SaaS with no infrastructure to run, and the starter plus Blog Template and one-click Vercel deploy let a solo developer ship a production marketing site. Multi-locale, multi-site or enterprise rollouts usually add a content architect, which keeps the score just below the solo-developer 75+ band.

After go-live, editors create pages in the sitemap, choose templates, and add, reorder and remove modules in zones without a developer, and they can preview in Web Studio and schedule publishing. That self-service goes beyond most form-based headless CMSes. New module types or layouts still need developer work, and there is no free-form drag-and-drop canvas, so it stays at 70.

Agility CMS is multi-tenant SaaS on Microsoft Azure, so the Content Manager and the Fetch and Management APIs update continuously with no customer upgrade. The customer's upgrade work sits in the frontend SDKs: @agility/nextjs has moved to v16.x to track Next.js 16, so each Next.js major means an SDK bump and some starter-pattern changes. Scored below the 80–90 SaaS band because that SDK-tracking work is real and repeated.

The vendor handles all infrastructure patching on Azure, with Auth0 for identity. Agility holds SOC 2 Type II (SSAE 18), and the underlying infrastructure is ISO 27001/27018 and CSA STAR compliant. No CVEs or security incidents turned up for 2025–2026, and the status page lists none. Scored just below 90 because customers still own the security of their frontend app and SDK dependencies.

The core Content Fetch REST API has stayed stable (content-fetch is still on v2), and no community complaints about painful forced API migrations turned up. However, the old @agility/content-management-js-sdk has been deprecated and pulled from npm in favour of @agility/management-sdk, which is still pre-1.0 (v0.1.x). Management-API integrations therefore have to be rewritten against a young SDK. The Next.js and .NET SDK lines also track framework majors, so it sits a little lower than before.

Customers run no server-side CMS dependencies: database, search, CDN and media storage are all vendor-managed. The client-side footprint is a few small packages (@agility/content-fetch, @agility/nextjs, @agility/management-sdk, the app SDK and the CLI). Not higher because the Next.js SDK pins framework majors, so the customer's framework upgrades are tied to Agility's SDK release timing.

Webhooks gained per-webhook delivery history in September 2026 (each attempt, next retry time, full payload and response, kept 90 days), plus opt-in automatic retries with backoff and HMAC signing. The header sync indicator now reports failed preview syncs as well as live ones. A public Statuspage with email and Slack subscriptions covers platform health. There is still no usage dashboard or APM, and customers must monitor cache revalidation in their own frontend, so it stays in the upper 60s.

In September 2026 the media library started showing where each asset is used across pages, components and content. Deleting an in-use asset now requires explicit confirmation, and deleted assets can be restored from trash. Publishing also includes nested linked content by default, and batch publishing and bulk locale copy (2026) cut routine editorial work. Page and sitemap management, redirects, scheduling and workflows were already built in. Not higher because there is no content-health dashboard, expiry workflow or broken-reference alerting for entries.

APIs are served from Azure behind a CDN, so the vendor handles backend performance. The customer still manages delivery-side caching: the official Next.js starter has teams tune AGILITY_FETCH_CACHE_DURATION and webhook-based cache invalidation. Reviews report preview delays of 1–2 minutes, slow page publishing and occasional Content Manager slowness, which keeps this below the 75–85 SaaS band.

Support is well rated: G2 Quality of Support is 8.8/10, and reviewers repeatedly praise responsive, thorough investigation. Current pricing gives Basic Support on the free Proof of Concept, Standard Support and an SLA on Essentials ($699/mo annual), and Enterprise Support on Enterprise. 24x7 critical support, a Customer Success Manager, a private Slack channel and the 99.9%+ SLA are all Enterprise-only. That gate keeps it just below 70.

A public community Slack workspace gives direct access to Agility staff alongside users, and staff participation is its main strength. The community is small compared with Contentful, Sanity or Strapi: Stack Overflow coverage is sparse, few third-party tutorials exist, and GitHub activity is modest. Answers depend heavily on Agility staff being available.

As SaaS, fixes reach all customers at once, and the developer changelog has returned to a weekly cadence with named bug fixes, such as three root causes of duplicate webhook deliveries in September 2026. The status page has logged only one minor incident in 2026, against several major Fetch API incidents in late 2024. Held in the mid 60s because a September 2026 changelog entry admits features shipped since 2025 went unlogged, and reviews still cite long-standing preview and rich-text issues.

Agility's Page Management lets marketers create new pages in the sitemap, pick a developer-defined page template, and add, remove and reorder modules within its Content Zones without developer help. Web Studio (upgraded Oct 2025) adds live preview with click-to-edit on the real frontend. Not 70+ because there is no free-form drag-and-drop canvas: new templates and module types still need a developer, so marketers compose from a fixed palette.

Scheduled publish and unpublish (including redirect-on-unpublish for pages), per-locale schedules, and Batch Publishing (expanded March 2026) support coordinated campaign launches. There are no campaign objects, campaign calendars, multi-channel campaign coordination or campaign analytics. That is the typical headless band.

This is one of Agility's strongest marketing-site traits compared with other headless CMSes. Pages carry built-in SEO fields (meta title, description, keywords, visibility and sitemap inclusion), editors control page paths and URL slugs, a native URL Redirections manager handles 301 and 302 redirects with bulk import and testing, and sitemap-driven page management lets developers generate XML sitemaps automatically from CMS data. Structured Schema.org markup and canonical handling are left to the frontend, and there is no built-in SEO scoring, which keeps it below 75.

Agility has no native form builder, lead capture or conversion tracking. Its integrations directory now lists three form tools (HubSpot forms, Formstack and Typeform) alongside the Salesforce Sales Cloud connector, so embedding lead capture is a documented pattern rather than custom work. UTM and conversion tracking still live in GA4 or the marketing automation platform, which keeps it in the band for platforms that rely on external tools, near the top.

There is no native segmentation, behavioral or geo targeting. Agility positions the CMS as the content layer, with engines such as Conscia (listed in Agility's own integrations directory), Uniform (which maintains an Agility connector) or Optimizely resolving variants modeled as modules in Content Zones. Within the no-native-personalization band, at the top because two personalization engines have ready connectors.

There is no built-in experimentation, traffic splitting or significance reporting. A/B tests run in external tools (Optimizely Web Experimentation, Uniform, VWO) over Agility content variants. There is no first-party experimentation app, only Uniform's connector.

Marketers can add pages to the sitemap, reuse shared content lists and modules, and use page templates with default modules to launch pages without developers. Web Studio inline editing, Batch Publishing, Bulk Copy to Other Locales (May 2026), DeepL field translation and the MCP server for AI-assisted authoring speed up cycles. Not 70 because there is no true page or template cloning with one-click duplication of an entire layout family, and new layouts still need development.

Content models are channel-agnostic JSON delivered over the REST Fetch, GraphQL and Sync APIs, with an MCP server for AI-agent channels. However, Agility's page and sitemap model is web-first, core rich text stores HTML, and there are no channel-specific renditions or native email, social or push delivery. Web-first with API delivery puts it in the 40–60 band, near the top.

A Google-approved GA4 app surfaces website metrics on the Agility dashboard, a step beyond tag-only integration. There are no per-content performance metrics, engagement or content-decay reporting inside the editor, and other analytics tools rely on frontend tagging.

Page templates, predefined module types and Content Zones constrain what marketers can place, so pages stay component-based and on-brand. Role permissions can restrict who edits shared components. There are no locked design tokens, style guardrails or theme enforcement in the CMS, since styling lives in the frontend code.

OG and Twitter-card metadata can be modeled on page SEO or custom fields and rendered by the frontend. There is no social scheduling, push-to-social or social proof widget. This is basic OG metadata management only.

The Asset Manager (refreshed Oct 2025) provides folders, search, metadata, an image editor with focal point, zip upload and folder permissions, with CDN URL transforms for size and WebP. Bynder and Cloudinary integrations are available for enterprise DAM needs. There is no native video hosting, rights or expiry management, or usage tracking.

Unlimited locales on all plans, with connected per-locale copies that publish independently and have per-locale schedules. Regional variants (en-us, en-ca) are supported, and there is DeepL field and bulk translation plus Bulk Copy to Other Locales. This is generic localization applied to marketing content. There are no transcreation workflows, TMS connectors (Smartling, Phrase) or locale campaign variants.

The integrations directory covers CRM and marketing automation (HubSpot, Salesforce Sales Cloud), forms (Formstack, Typeform), analytics (GA4), SEO (Ahrefs), personalization (Conscia), search (Algolia, ai12z), DAM (Bynder, Cloudinary, Vimeo), commerce (Shopify, BigCommerce) and Zapier for no-code orchestration, plus signed, retrying webhooks (Standard Webhooks, 2026). That breadth spans more than three MarTech categories, but most connectors are embed or picker-level rather than deep bi-directional sync, and there are no Marketo, Pardot, CDP or ad-platform connectors, so it stays below 65.

Product editorial content is built with generic content models and linked-content lists, with Shopify and BigCommerce picker fields tying items to SKUs. Agility's guidance is to keep products and variants in the commerce system and relate content by product ID. There are no product-specific models, attribute sets or PIM-style variant content.

There is no category management, cross-sell or upsell tooling, search merchandising or product spotlights. Merchandising lives entirely in the commerce platform. Agility can only host editorial promo modules.

Official Shopify and BigCommerce apps provide product picker fields in the editor, storing selected product data as JSON on the item. That is marketplace picker depth, not API federation or real-time sync. There is no first-party commercetools or SFCC app, though a Shopify and StepZen tutorial shows GraphQL federation as a custom pattern.

Editors can build buying guides and lookbooks as pages composed of modules that include product-picker references, and the page and sitemap model suits editorial commerce landing pages. Shoppable content with inline purchase CTAs is a frontend implementation, not a first-class authoring pattern.

There is no mechanism to inject CMS content into commerce cart or checkout flows. Headless frontends can fetch Agility banners for custom cart pages, but hosted checkouts (Shopify, BigCommerce) remain outside CMS control.

Order confirmation, tracking and review-solicitation content is managed by the commerce platform or ESP. Agility has no order-event integration beyond generic webhooks.

There are no gated catalogs, account-based content or quote flows. Spec sheets and documentation can be modeled and served, but access gating must be implemented in the frontend. There is no delivery-side audience access control.

There is no delivery-side search. The official Algolia integration and webhook or Sync API indexing let teams build blended content and product search, and sitemap pages can serve as search landing pages. Synonyms and faceting live in Algolia, not the CMS.

Scheduled publish and unpublish with Batch Publishing supports time-activated sale banners and promo modules, and per-locale scheduling allows regional timing. There is no channel targeting, countdown or promo-code content type, so it sits in the scheduled-banners band.

Multiple sitemaps in one instance can serve several storefronts or regions, sharing content models, modules, assets and content lists while keeping storefront-specific pages. Locales add regional variation. There is no storefront-aware legal or editorial override layer, and product content is repeated where storefront-specific copy is needed.

The native media library offers images with focal point and transforms plus basic video upload. There is no 360 view, hotspot, 3D or AR, or transcoding. Cloudinary integration can add richer media, but that is external.

There are no seller profiles, seller-contributed content workflows or moderation tooling. Multi-author editing exists, but marketplaces are not a supported pattern.

Unlimited locales with regional variants and per-locale publishing apply to product editorial content, and DeepL speeds translation. There are no currency-aware blocks or regional regulatory content types. This is generic localization applied to product content.

There is no content-to-revenue attribution inside the CMS. The GA4 dashboard app shows site metrics but not commerce conversion by content. Attribution lives in GA4 or the commerce platform.

Author-side RBAC is strong: nine roles plus custom roles, permissions down to model, item, field and folder, and SSO (SAML, OIDC, ADFS). Agility has no delivery-side audience or department visibility, though. Restricting intranet content to departments requires frontend auth and filtering, so it scores in the 'public/private to RBAC' range for intranet purposes.

Structured content models, version history with restore, approval workflows and editor-side global search support knowledge articles. There are no review dates, expiry-driven lifecycle, knowledge taxonomy tooling or quality delivery search.

Agility has no portal features: no news feed, directory, notifications, social interaction, personalized dashboards or mobile app. An intranet requires a fully custom frontend. Note that 'AgilityPortal' is an unrelated intranet vendor.

News articles can be published via content lists, but there is no audience targeting, read receipts, acknowledgment tracking or mandatory-read workflows.

There are no directory, org-chart or HR integrations. A basic staff directory could be modeled as a content list, but there is nothing purpose-built.

Documents can be uploaded to the media library and policies modeled with version history and approval workflows plus audit trails. There is no acknowledgment tracking or review-date reminders. This is basic versioned document publishing.

There are no onboarding journeys, role-based progressive disclosure or task checklists. Onboarding pages would be fully custom-built.

There is no delivery search and no federation across SharePoint, Confluence or Drive. Search for an intranet would need Algolia or a separate enterprise search product.

Content can feed a custom mobile app via APIs, but Agility provides no native employee app, offline mode or push notifications. The editor itself is web-based.

There are no LMS integrations or completion tracking. Training content could be hosted as pages only.

Web Studio comments and @mentions are for editors, not employees. There are no end-user comments, reactions, forums or polls.

There are no Teams, Slack or Google Workspace apps. Signed webhooks could drive Slack or Teams notifications through custom middleware.

Scheduled unpublish (with redirect-on-unpublish for pages), version history and the recycle bin provide basic expiry. There are no review dates, stale-content flagging or ownership assignment.

There are no internal analytics, departmental views or failed-search reporting. The GA4 dashboard app shows generic site metrics only.

Separate instances are fully isolated (content, assets, editor teams, API keys, security and workflow), and Agility explicitly supports a one-to-one instance-to-site model. Separate regional Azure data silos add data isolation. This is silo-based rather than native multi-tenant brand architecture, so it falls in the 55–70 band.

Within one instance, multiple sitemaps share page templates, module definitions, content models, shared content lists and assets, which is genuine intra-instance sharing across brands. Across isolated instances, sharing relies on CLI 1.0 model sync or the Management API, not live cross-tenant references. Real shared authoring in single-instance mode, but a workaround across instances.

Organization-level Teams cascade roles across instances, and role-based permissions let a central team govern shared components while local teams manage their own pages. Approval workflows and audit trails are available. There is no cross-brand policy enforcement or cross-instance approval workflow.

Pricing is now published: Essentials is $699 per month for one sitemap, 5 users and 25k entries, while Enterprise (custom pricing) raises that to 10+ sitemaps, 50 users and 500k+ entries. Running several brands from one instance, the main economy of scale, therefore needs the Enterprise tier. Unlimited locales and API requests on every plan avoid per-market metering. With separate instances each billed on its own, a portfolio scales close to linearly, so this sits in the linear-cost band.

Theming is entirely frontend. Per-brand themes can be driven by a sitemap or instance-level settings item, but there are no theme tokens or per-brand style controls in the platform.

Locales can be scoped per instance, and workflows and permissions can differ per site or instance, which gives some brand-by-locale separation. Translation workflows are shared (DeepL, bulk copy), and there are no per-brand translation approval chains.

There are no portfolio or cross-brand analytics. GA4 dashboards are per instance.

Separate instances can run completely different security and workflow configurations, and custom workflow steps are available on higher plans. Within one instance, workflow and permissions can be set per site or section. Central audit across instances is not unified.

In single-instance mode, shared content lists and modules can appear on several sitemaps and update everywhere on publish, which is effectively syndication without per-site override control. Across instances there is no syndication, only CLI or API copy. There are no controlled override points.

Regional Azure data silos (e.g., Canada Central, US North Central) give data residency choice per instance. Consent, accessibility and cookie rules are frontend concerns, and there are no publishing guardrails.

Shared module definitions and page templates across sitemaps give a shared component contract, and CLI sync can propagate models between instances. Versioning and brand extensions of the design system live in frontend code.

Organization-level Teams cascade roles across instances, and SSO (Auth0-backed SAML, OIDC, ADFS) spans them. Single-instance multi-site setups share users with per-site permissions, which supports central admin plus autonomous brand teams. Teams, custom roles and SSO sit on the top pricing tier only, and SCIM was not confirmed, keeping it below 65.

Brands in one instance share the same content models and modules. Per-brand variation means optional fields or extra models, with no extension or inheritance of a base model. Across instances, models are forked and synced via CLI.

There is no portfolio reporting, freshness-by-brand metric or SLA tracking.

The Master Subscription Agreement includes a Data Processing Addendum as Exhibit A, which covers every customer subject to GDPR or CCPA and defines Data Subject Requests for access, erasure, rectification and portability. A West Europe data region exists, but the pricing page lists it under Enterprise only. The DPA says EEA personal data 'may be transferred to Canada and the United States' and never mentions Standard Contractual Clauses. No public sub-processor list was found, and erasure goes through a support ticket. It is not scored lower because a DPA is available to all customers. It is not scored higher because EU residency is Enterprise-only, SCCs are not referenced and the sub-processor list is not public.

None of the security page, Hosting, Security & Compliance docs, Trust Center links or pricing page mention a BAA, HIPAA-eligible configuration or healthcare guidance. Running on Azure does not transfer Azure's HIPAA eligibility to Agility. It is not scored lower because the SOC 2 Type II controls and encryption at rest give a baseline for healthcare marketing content that contains no PHI.

The DPA explicitly covers GDPR and the CCPA. As a Canadian company with a Canada Central data region guaranteed in-country (DR stays in Canada), Agility implicitly covers PIPEDA and Canadian public-sector-adjacent residency needs. The PCI claim is only a self-declaration that the Content Manager does not store card data, not a PCI DSS attestation. There is no FedRAMP, IRAP, C5, LGPD or HITRUST coverage. That is slightly above a GDPR + CCPA baseline because of the Canadian angle.

Agility has held its own SOC 2 Type II attestation since December 1, 2021 (auditor Prescient Assurance) and recertifies annually; the current reporting period began August 31, 2025. Vanta monitors controls continuously, and the report is available under NDA through trust.agilitycms.com. It is not scored higher because the public materials do not say which Trust Services Criteria beyond Security are in scope.

Agility's own compliance docs say ISO 27001 and ISO 27018 are Microsoft Azure platform certifications that Agility inherits, not certifications of Agility's own ISMS. The company does run a formal information-security policy program with internal and external audits, but it has no ISO certificate of its own. It sits below the infrastructure-only band because the prompt says not to credit inherited cloud certifications, and above the floor because Azure's certified foundation plus a documented policy set counts for something.

Beyond SOC 2 Type II, Agility holds no certifications of its own: CSA STAR Gold belongs to Azure and Auth0, and PCI is a self-declaration of scope exclusion rather than a DSS attestation. There is no Cyber Essentials, FedRAMP, IRAP, ENS or C5. Third-party pen testing and customer-collaborative pen tests offered to enterprise clients earn modest credit, but this is below the 45–55 base because no additional certifications exist.

Customers choose one of five Azure regions when the instance is provisioned (US North Central, US East, Canada Central, West Europe, Australia). The docs guarantee that data at rest, including media, users and version history, stays in-region, and that DR replication stays within the same country boundary. The docs openly state that the global CDN edge caches published content worldwide and cannot be geo-restricted. It is not scored higher because the pricing page offers non-US regions only on Enterprise, and changing region requires a statement of work.

Export options are an in-UI Excel export of each content list, the Agility CLI (full instance download for backup or migration) and the Content Sync API/SDK. Backups are point-in-time for 30 days, and Enterprise can extend that. The MSA commits only to 'timely' deletion or anonymization after termination, with no defined retention window, and personal-data erasure is handled through support tickets rather than self-service. It is not scored lower because the CLI and Sync API allow complete automated export.

Content and page version history is immutable and kept indefinitely (who, what, when, workflow state), and a Recent Changes report gives a view across items. By Agility's own admission there is no customer-facing admin or security event log: logins, role changes and API key issuance are not recorded. There is also no native SIEM connector; SIEM forwarding needs a partner-built webhook handler. That leaves it in the basic-logs band, raised a little by the indefinite immutable retention of content history.

Agility publishes no WCAG 2.1 AA or ATAG 2.0 commitment for the Content Manager authoring interface in its docs, security pages or site footer. The only accessibility results for 'Agility CMS' are third-party widgets for delivered websites, which do not count here. It is not scored lower because a modern SaaS UI probably has baseline keyboard support, but none is documented.

No VPAT, ACR, Section 508 statement or ATAG assessment was found on the Agility site, in the docs or in the Trust Center links. It is not scored lower only because a VPAT might be provided privately during enterprise procurement, which cannot be verified.

Agility's first native AI release added generative Compose and Edit buttons to the Rich Text editor, which draft new copy or summarize, re-compose, restyle or translate selected text (GA). Agility Intelligence adds an in-product assistant trained on the Agility docs. No brand voice controls, custom prompt template library or bulk generation were found, so this is basic built-in generation. Content-model-aware generation only happens through external AI clients over the MCP server.

The May 2025 release added Focal Point and an Enhanced Image Editor for renaming, cropping and alt text, but the focal point is set by hand and the alt text is typed manually. No native image generation or automated alt text was found. MCP clients can upload media, but the image AI runs in the external tool, not in Agility.

Agility has two machine translation apps, and each uses the customer's own API key. Google Translate (GA) translates selected fields in the content item sidebar. The DeepL app adds a field-level Translate panel and a Translate Content option when copying pages, items or whole lists into other locales, but its docs mark it as private beta and not yet on every instance. The Rich Text AI edit action can also translate selected text. It scores in the basic-MT band because the fuller DeepL workflow is still beta and there are no glossaries, brand voice controls or translation quality scoring.

The SEO Analysis marketplace app scores pages and dynamic-page content items in the editor sidebar before they are published. It runs the open-source YoastSEO.js checks on the rendered preview page (meta description length, SEO title width, a single H1, image alt text, keyphrase placement, readability) and lets editors set the focus keyphrase and meta description there. This is rule-based scoring, not AI: it generates no titles, descriptions, alt text or tags. Automatic metadata generation happens only when an external assistant builds content over the MCP server, so the score sits just above the no-automation band.

Inside the CMS, AI assistance is limited to rich text compose/edit and DeepL translation. There is no native auto-tagging, duplicate detection, smart scheduling or AI-driven content routing. Pre-configured MCP skills do field mapping, image upload and slug generation from plain-language prompts, but they run in the customer's AI client rather than as editorial automation woven into Agility.

Agility has no named in-platform agent product. Autonomous background agents for translation and content model checks are described as exploratory. Agentic, multi-step content creation does work through the GA MCP server: skills tuned to content models create items, upload images and return a preview URL for review before publishing, and Agility cites blog creation falling from 30–45 minutes to under five. It scores in the early band because the agent runtime, orchestration and governance all belong to the external client.

No AI-driven content gap analysis, topic clustering, content health or performance scoring was found in Agility. Analytics come from GA4 and other integrations rather than a native AI intelligence dashboard. Agility Intelligence is a documentation help assistant, not content analytics.

Agility has no native AI quality scoring, brand compliance checking or duplicate-content detection. The SEO Analysis app does automated pre-publish quality checks, covering readability (sentence and paragraph length, passive voice, subheading distribution), missing alt text and heading structure, but they are YoastSEO.js rules rather than AI. AI checks for SEO and accessibility on content models still appear only as a future autonomous-agent idea in Agility's AI strategy.

Agility has no native vector, semantic or embedding search on content, and no RAG-ready index. The UI refresh added a better global keyword search for editors, while delivery search goes to Algolia (whose NeuralSearch supplies the semantic layer) through the official integration and webhook or Sync API indexing. Semantic search therefore needs an external integration.

Agility has no native personalization engine, rule-based or ML. Its own personalization guide (Sept 2026) positions the CMS as the content layer of a stack whose segmentation and decisioning come from external CDPs. That puts it below the rule-based-only band.

The official hosted Agility CMS MCP Server (mcp.agilitycms.com/api/mcp, streamable HTTP) has been generally available since June 18, 2026. It has 32 tools covering discovery, content and component models, containers, content CRUD, publish and unpublish, workflow approval, pages, sitemaps and media. Auth is OAuth 2.0 with dynamic client registration and the user's Agility permissions as the ceiling. Destructive tools are flagged, and it is listed in Claude's official connector directory, with documented setups for VS Code, Cursor, ChatGPT, Gemini CLI, LM Studio and Microsoft 365 Copilot through Copilot Studio. A separate read-only Knowledgebase MCP server covers the docs. It stays below 90 because agents can only be limited by signing in as a less-privileged user: Personal Access Tokens inherit full user permissions, and there are no per-tool or read-only agent scopes.

The in-editor Rich Text AI and Agility Intelligence use a vendor-chosen model, and no settings for supplying an OpenAI, Anthropic, Azure or Gemini key were found. Customers do bring their own keys for machine translation (DeepL API key, Google Cloud Translation service account). Because the MCP server works with any client, including Claude, ChatGPT, Copilot, Gemini CLI and local models through LM Studio, customers can also use their own model for agentic authoring. That makes this partial BYOM: native generative features stay locked to the vendor model.

The MCP server exposes live content-model and component-model schemas so coding agents can generate structurally correct components, and Agility cites component build time falling from hours to minutes. Agility now publishes official OpenAPI specs for the Content Fetch API (11 operations) and the Management API (115 operations), plus a docs llms.txt index, Markdown versions of every article and a read-only Knowledgebase MCP server. A 'Building Apps with AI Coding Tools' guide supplies an AGENTS.md for the Apps SDK. It falls short of 70 because there is no dedicated AI SDK, RAG or embedding endpoint, or LangChain/LlamaIndex integration guide.

The MCP server is governed by OAuth, every call runs as the user through the Management API's permission checks, destructive tools carry destructiveHint flags, and the README gives explicit prompt-injection guidance. Workflow approval is exposed as a tool, and content pipelines save to staging with a preview link for human review. The hosted server logs each tool call with the user ID to Agility's own Application Insights, but that is vendor telemetry, not a customer-visible AI audit trail. No brand safety controls, prompt template governance or IP indemnification were found for the native AI features.

No AI usage dashboards, credit or quota tracking, or per-user AI consumption metrics were found for Agility's native AI or MCP usage. Standard content history shows what changed, but not how much AI was used or at what cost.