Cosmic

Object types (multiple or singleton) take about twenty Metafield types: text, number, rich text, markdown, JSON, select and multi-select, date, color, switch, media, parent and repeater groups and single or multiple Object relationships, manageable from the dashboard, the Object Types API and the CLI. Relationship fields target a single Object type, so there are no union or polymorphic references, and there is no typed schema-as-code layer, which keeps it in the adequate band.

Single and multiple Object Metafields give one-to-one and one-to-many references, resolved inline with the depth parameter, and reverse lookups are possible by querying on the relationship field. References are unidirectional and single-type, and circular references are prohibited, so graph-style traversal is not available.

Parent and repeater Metafields allow nested, repeatable groups of fields, and rich text supports Custom Blocks (synced or edit-on-page) and inline Object embeds. There is no typed component library or portable structured rich text, so composition stays field-group based rather than a true block tree.

Metafields support required, unique, regex with custom message, min and max length, media type validation and conditional show_when, and the rules apply to API writes as well as the editor. There is no custom rule engine, cross-field validation or pre-save hook, which caps it at standard built-in validation.

Objects keep revisions that can be viewed and restored from the editor or the Revisions API, daily Bucket backups with snapshot restore are available, and Promote content gives a staging-to-production copy between Buckets with a pre-flight report. Revision History and Backups are paid add-ons with plan-based retention and there is no field-level diff view, so it lands in the basic-revisions band.

Cosmic has no taxonomy feature; classification is done with select and multi-select Metafields (the docs model tags this way and query them with $in) or by creating a category Object type and referencing it. Media gets folders up to three levels deep but no tag vocabulary, so this sits at tags plus hand-modelled taxonomy.

Clicking Preview opens the real frontend in a split pane with a one-hour, Bucket-bound preview token that unlocks draft reads, with an SDK option and a Next.js helper that Autopilot and agent-built sites get automatically. There is no click-to-edit overlay or real-time update as the editor types, so it falls short of live in-context editing.

The rich text editor supports standard formatting, Custom Blocks and inline Object embeds, and markdown and HTML-textarea field types exist alongside it. Output is an HTML string rather than a portable AST, which limits custom rendering across channels.

The media library takes images, video, audio and documents, organises them in nested folders, has a built-in image editor and file replace that keeps the URL and purges CDN caches, and serves every image through imgix URL transforms. There is no focal point control or asset usage tracking, so it stays below the top band.

Comments can target an Object or a specific Metafield, with @mentions, media attachments, reactions and resolved and unresolved filters, available to all users. There is no presence, co-editing or edit locking, so concurrent edits are last-write-wins.

Content has draft and published states, Editors can be restricted to drafts and Contributors only save drafts for others to publish, and AI Workflows can run on content events with Approval Gates before a step continues. There are no custom workflow stages, assignments or per-stage role transitions for human review, so it remains a draft, review and publish model.

Objects take publish_at and unpublish_at timestamps from the editor, the REST API, the SDK and the MCP and agent tools, so scheduled publish and expiry are both native. There are no release bundles for atomic multi-item publishing and no calendar view.

Localization is enabled per Object type, locale versions share a slug and count as one Object, a priority locale can be made required, and the API filters by a locale parameter across hundreds of locale codes. It is document-level only with no fallback chain, and Localization is a paid add-on.

Access is layered across Workspace, Project and Bucket roles, with Contributors scoped to named Object types and their own Objects, Editors restrictable to drafts, an append-only audit log on every plan, and SAML SSO on Large Workspace and Enterprise. Roles are predefined, there are no field-level or locale-level permissions, and SCIM is not available yet.

The v3 REST API offers MongoDB-style query operators, props selection, depth for references, sorting, pagination, status and locale filters, with an OpenAPI spec published. There is no GraphQL endpoint and reads and writes share one host separated only by read and write keys.

Media is served from S3 behind Fastly and imgix with background cache purge on replace, and the Objects API offers a cache option. Purge timing for API content is not documented and there is no edge compute or edge personalization.

Webhooks fire on created, edited and deleted events for Objects and media, with a selectable props payload and custom headers for verification, and AI Workflows add richer triggers such as Object Unpublished. Outbound webhooks are not HMAC-signed, have no documented retries or delivery logs, cover no schema events and are a paid add-on.

Cosmic is API-first with a JavaScript SDK, a CLI, an MCP server, agent skills and a Content RAG API for bots and assistants. Official SDK coverage beyond JavaScript is thin and rich text is delivered as HTML, which limits non-web channels.

Cosmic documents no segments, visitor profiles or CDP connectors; Insights deliberately uses a salted, daily-rotating visitor hash, so there is no persistent profile to segment. Audiences would have to be built and evaluated entirely outside the platform.

There are no content variants or audience rules; personalization means the frontend picks between Objects fetched by query. That is generic API work with no editor support for audience preview.

No traffic allocation or significance testing exists. Insights custom events and conversions could measure a test the frontend runs, which nudges it slightly above nothing.

No recommendation engine or related-content ranking is documented; related content is curated by hand with Object relationship fields. Semantic search over content is an AI feature scored elsewhere.

Visitor search relies on the Algolia extension, which syncs Objects to an Algolia index, or on indexing the API with webhooks; dashboard search is title navigation for editors only. There is no native faceting, typo tolerance or search analytics.

Cosmic has no catalog, cart, checkout or pricing engine. Commerce demos are custom frontends calling Stripe or Shopify.

The Shopify page is an integration guide rather than a maintained connector, with no product picker field or live federation, and agents reach commerce APIs only through generic HTTP requests. Integrations are built per project on the APIs.

Cosmic Insights is included on every plan and gives cookieless pageviews, sessions, sources, custom events and revenue, with six dashboard tabs and a Performance card on each Object attributed via meta tags or an AI Build routes map. It lacks content health, lifecycle and author productivity reporting and keeps 90 days of usage data.

No GA4, Adobe Analytics or Segment connector is documented; external analytics is wired in by the frontend team or via webhooks. Insights is a replacement rather than a bridge to existing analytics stacks.

A Project holds any number of Buckets, one per site or environment, and Promote content copies Objects, schema and media between Buckets with conflict and schema strategies. Buckets cannot reference each other's content, so this is silo multi-site with a copy tool.

Editors of every role can auto-translate content with Cosmic AI and Workflows can create translations when content is added, which covers machine translation hooks. There are no TMS connectors, translation memory or export and import for translators.

Workspaces group Projects per brand with Workspace roles that control which brands a person sees, pooled usage and a workspace audit log. There are no shared component libraries, brand overrides or cross-brand policy controls.

The media library has folders, metadata and file replacement but no rights or expiry management, approvals, usage tracking, versioning or brand portals, and no DAM connector beyond imgix image processing. It is a basic library rather than enterprise asset management.

Video and audio files upload to the media library and are served from the CDN, and Metafields accept video and audio types. There is no transcoding, adaptive streaming, captions or player.

Authoring is form-based in the Object editor; Cosmic Pages only publishes a single Object to a shareable URL for review, and AI Build generates frontend code rather than offering marketers a composer. Page layouts are defined by developers in code.

Application Workflows connect GitHub, deploy through a Vercel integration with preview URLs, environment variables and logs, and let customers buy domains with automatic DNS and SSL inside Cosmic, while AI Build generates the frontend. Rendering and hosting are still run on Vercel, with no Cosmic site-level SLA.

There is no form builder; submissions are modelled as an Object type and written with the API, and the new Support Agent saves visitor questions the same way. Conditional logic, spam protection and lead routing are all frontend work.

No ESP connector exists; HubSpot is reached via Zapier and agents can call ESP APIs through generic HTTP requests. Subscriber sync and triggered sends must be built.

Workflows and agents automate content operations on content events, not visitor journeys, lead scoring or nurture flows. Marketing automation lives entirely in external tools.

SEO is modelled as ordinary Metafields such as seo_description, and AI can generate SEO metadata on publish. No sitemap generation, redirect manager, structured data authoring or search previews are provided.

Cosmic publishes llms.txt for its own documentation, but nothing generates llms.txt, Markdown endpoints or crawler controls for customer sites, and Insights does not report AI referrals. Answer-engine readiness depends on the frontend.

About two dozen integrations and installable iframe Extensions are listed, mostly deploy targets and small utilities, and October 2026 added Agent, Plugin (22 vendor MCP plugins) and Workflow marketplaces. The ecosystem is still a small directory compared with 50-plus quality connectors.

Identity in Cosmic covers dashboard users only; there is no visitor login, CIAM integration or gated content model. Member areas are built by the frontend team with its own auth provider.

Cosmic is now REST-only: the GraphQL API has been removed from the docs (the site nav reads "REST API & SDK"), and Cosmic presents REST-first as a deliberate choice for cacheability and AI-agent consumption. The REST surface is consistent and well documented, with props projection, depth control, preview tokens, revisions, a documented error table with retry guidance, and agent-specific endpoints such as /v3/agents/sign-up. Down from the prior score because GraphQL was part of that credit and there is no longer a query-language option like Sanity's GROQ or Contentful's GraphQL.

Cosmic delivers through a Fastly CDN and now documents its rate limits: 100 requests/second sustained and 200 burst on uncached requests, a 429 with a backoff recipe on overage, and 6MB/30s request ceilings. Cache-served requests do not count toward limits. There is still no sync or incremental delivery API like Contentful's, and the published uncached throughput is modest next to tier-1 headless vendors.

Two official SDKs: @cosmicjs/sdk for JavaScript/TypeScript (typed, zero dependencies) and cosmic-sdk-swift via Swift Package Manager, both used throughout the API reference. There are no official Python, Ruby, Java, PHP, Go or .NET SDKs, so those stacks call REST directly. The CLI, hosted MCP server and Agent Skills cover AI tooling rather than language reach, so this stays below Contentful, Sanity and Contentstack.

Cosmic now runs three marketplaces. The Plugin Marketplace lists 22 vendor MCP plugins its agents can use (Shopify, HubSpot, Stripe, Algolia, Zendesk, Intercom, Slack, GitHub, Figma, Notion, Sentry, PostHog, Vercel, Netlify, Cloudflare and others). It sits alongside about 30 installable agent templates (including the new AI Support Agent and a translator) and a Workflow Templates gallery, on top of the older iframe dashboard Extensions. That is broader commercial coverage than before, but these are agent tool connections rather than content-editor apps, and there is still no DAM, TMS or enterprise MarTech app catalog to match Contentful's or Storyblok's.

Cosmic Functions, the serverless layer behind the prior score, has been removed (/functions returns 404 and no docs page mentions it), and dashboard Extensions are back to iframe-only (a URL that receives bucket_slug and read/write keys). The extension model now leans on AI: event-triggered agents and Workflows (on Object created, edited, deleted or published), api_request and webhook tools, a hosted MCP server, Agent Skills and an Agent Plugin, and the new embeddable AI Support Agent. There is no first-party custom-code runtime or field-level UI SDK to match Contentful's App Framework or Sanity Studio.

SAML SSO now ships on Large Workspace ($2,999/mo) and Enterprise. Okta, Entra ID, Google Workspace or any SAML 2.0 IdP can be connected and SSO enforced, which blocks password, Google and GitHub sign-in. SCIM is still not available, so deprovisioning is manual. Free 2FA is an emailed one-time code only, with no TOTP or WebAuthn, and Team and Business buyers still have no SSO. API access uses separate per-Bucket read and write keys, rotated independently, plus personal access tokens.

Roles work in three layers that inherit downward: Workspace and Project admin/manager/user, and four Bucket roles (admin, developer, editor, contributor). Contributors can be scoped to named Object types, and each Bucket's read and write keys rotate independently. An append-only audit log on every plan, which attributes AI-agent actions by name, adds governance depth. There are still no field-level permissions or custom roles, which keeps this below Contentful and Sanity.

Cosmic's security page says plainly that it holds no SOC 2, ISO 27001 or HIPAA certification. The EU database region credited previously no longer appears: no region is published, residency is handled case by case by email, and every listed subprocessor is in the United States. What exists is a CAIQ/SIG-structured security questionnaire on request, a maintained subprocessor register with change notifications, and GDPR terms. Full compliance is scored in cat9.

No known breaches or CVEs, and the security page documents an incident process (investigate, contain, email affected customers) and logs support-staff access in the customer's audit log. Vulnerability reports go to the general support@cosmicjs.com address: there is no security.txt (/.well-known/security.txt returns 404), no bug bounty and no advisory feed. A clean record with basic disclosure.

Cosmic is SaaS-only on AWS, MongoDB Atlas and Fastly, with no self-hosted, private cloud or dedicated-tenancy option. The selectable database regions credited previously (us-east-1, us-west-2, eu-west-1, ap-southeast-1) are no longer published; content sits in one replicated Atlas cluster and residency commitments must be requested in writing. That removes the one deployment choice buyers had.

The SLA commits to 99.95% uptime with service credits, but only on Enterprise. No self-serve plan or Workspace plan has a contractual uptime commitment. The public status page (cosmicstatus.com, Atlassian Statuspage) covers only two components, API and Web Dashboard, and shows a light incident history.

Content comes from a replicated MongoDB Atlas cluster with automatic node promotion, and media comes from S3 through Fastly's edge. Request limits are now documented at 100 rps sustained and 200 burst on uncached traffic. The four-region topology with cross-region failover cited previously is no longer described, and Cosmic lacks the published scale limits and Fortune-500 references of Contentful or Contentstack.

Automatic daily Bucket backups (12AM UTC) with on-demand snapshots, download and restore are documented, but they are a $99/mo add-on on every self-serve plan. Every plan includes full JSON export of Object types, Objects and media, and the replicated database promotes a new node automatically. The cross-region failover cited previously is no longer described, and RTO/RPO figures are not public, so DR stays at the backups-plus-export level.

The Cosmic CLI is a capable remote-dev tool. It has an interactive shell, full Object type and Object CRUD (cosmic types create/update/duplicate), AI content and app generation, GitHub repo creation and Vercel deploys. It also supports agent-driven setup: an unauthenticated agent signup provisions a Project and Bucket that a human claims later, and Cosmic ships a hosted MCP server, Agent Skills and an Agent Plugin for coding assistants. There is still no local emulator or offline mode, so all development runs against a remote dev Bucket.

Buckets serve as environments, each with its own keys. The Promote content wizard copies Objects and schema between Buckets in the same Project, with a read-only pre-flight report and Merge, Overwrite or Strict schema strategies. Application Workflows connect GitHub repos with Vercel preview deploys, and the CLI can script Object type changes. There are no versioned migration scripts, environment aliasing or branch-per-PR content environments, and Promote is a dashboard wizard rather than an API pipeline step.

The docs cover the REST API reference, CLI, MCP server, agents, workflows, Insights and framework guides. Every page is also published as Markdown, with an llms.txt index and a full llms-full.txt dump, which is good for AI-assisted development. The docs removed GraphQL and Functions without a deprecation note, and coverage of migrations and enterprise patterns is thinner than Contentful's or Sanity's. There is no interactive API playground.

@cosmicjs/sdk is fully typed, with typed responses that give IDE autocomplete. There is no first-party type generation from the content model: the docs have no codegen or typegen tooling, so developers write the types for Object types and metafields by hand. That puts it in the typed-SDK band, below Sanity TypeGen or Contentful codegen.

Cosmic shipped ten changelog entries between Aug 10 and Oct 5 2026, roughly weekly: Workflow Templates, the Cosmic Agent Plugin, Live Preview, Agent Plugins (vendor MCP servers), an append-only Audit Log, SAML SSO, Claude Opus 5.5 support, revision diffs with agent attribution, and the AI Support Agent (Oct 5). The cadence now also covers governance and editor features, not only the AI-agent surface, which earns a small lift. Not higher because each release is incremental and the small team ships mostly one feature per week; not lower because sustained weekly delivery matches the most active headless peers.

Cosmic maintains a dedicated, paginated /changelog with clear dates and per-entry narrative posts. Entries are descriptive and discoverable but read more like blog posts than structured release notes; no clear semver tagging or dedicated migration guide per release. Not higher because breaking-change sections are absent; not lower because cadence and clarity are solid.

Cosmic now surfaces a public roadmap within the dashboard where users can add and vote on feature requests and submit bug reports, alongside a new in-dashboard feedback mechanism — a step up from purely retroactive blog/changelog signaling. Not higher because the roadmap sits behind the dashboard rather than as an open public backlog with visible timelines; not lower because a structured vote-and-request channel now exists and direction is clearly communicated.

As a managed SaaS with a stable REST/GraphQL API (and a versioned API v3), Cosmic absorbs most infrastructure churn for customers. SDK 2.0 (Apr 2026) shipped as a major version signaling the upgrade, but no public deprecation timeline or codemod is documented. Media-replace continues to demonstrate reference stability ('same URL and id'). Not higher because no formal API versioning/deprecation policy is published; not lower because end-users rarely report breakage.

Company LinkedIn shows ~358 followers; G2 has only 6 reviews; no prominent Discord, and the GitHub org has modest repos. Cosmic markets '75,000+ developers' but independent third-party signals remain thin compared to Strapi, Sanity, or Directus. Not lower because a Slack community, community-members page, and steady blog cadence exist; not higher because every external signal places Cosmic well below peers.

Cosmic operates a Slack community, publishes regular Community Deployments, added an in-dashboard Comments/feedback feature, and runs a 'Cosmic Rundown' news series alongside frequent tutorials. Team members participate visibly on blog and social. Not higher because there is no large public forum, no visible Stack Overflow activity, and no documented community SLA; not lower because the team is responsive and engagement density is healthy relative to base size.

Cosmic runs a formal Partner Program connecting a global network of agencies and technology providers, with a public directory of agency partners plus tech partners. No tier-1 global SIs (Accenture/Deloitte/Valtech), no certification exams, no referenceable named implementation practices. Not higher because depth is shallow; not lower because the program is real and includes both agency and technology partners.

Most tutorials, comparisons, and guides about Cosmic are first-party (cosmicjs.com/blog and /changelog). Limited YouTube coverage, no Pluralsight/Udemy courses surface in search, and conference talks are scarce, though independent review sites (Bejamas, StaticMania, Cuspera) profile it. Not higher because third-party amplification remains thin; not lower because listing/review sites still include Cosmic.

Cosmic is a niche platform with no mention in Stack Overflow developer surveys, no certification program, and few LinkedIn profiles listing it as a primary skill. Because Cosmic uses standard REST/GraphQL with a Next.js-friendly SDK, most React/Next.js developers ramp quickly, but specialized Cosmic experience is rare. Not higher because named Cosmic experts are hard to find; not lower because the generic skill overlap is broad.

Case studies profile customers like Prairie Robotics, marketing cites 75K+ developers, and Cosmic publishes content on YC companies adopting it, but no recent Fortune 500 logo announcements and the G2 review count remains static at 6. Heavy product velocity (Gemini 3 Pro, Team Agents, Hosted MCP) suggests continued signups. Not higher because enterprise traction signals are limited and there is no public ARR or customer-count update; not lower because the platform keeps publishing customer stories and shipping features that attract new builders.

Cosmic is a bootstrapped YC (W2019) company that reached ~$1.2M revenue by 2024 with no outside venture capital beyond YC's ~$150K, operating with a small ~8-person team as of Apr 2026. Self-funding means no burn/runway distress and no layoffs, but also a tiny team and no war chest to outspend well-funded rivals. Not higher because scale and financial cushion are limited; not lower because the company is revenue-generating, stable, and shipping heavily with no distress signals.

Cosmic has executed clearly on its 'AI-Powered Headless CMS' thesis — Hosted MCP, Event-Triggered Agents, Team Agents, and Gemini 3 Pro support all shipped in 2026, and it is actively repositioning the category ('Why Headless CMS Is the Wrong Category'). No Gartner MQ / Forrester Wave recognition in Headless CMS. Not higher because analyst validation is absent and the AI-CMS space is crowded; not lower because the AI-native narrative is differentiated and visibly delivered, not just promised.

G2 rating is 4.3/5 but based on only ~6 reviews, well below the 100-review threshold for mid-tier scoring. Reviews are generally positive (praising the headless approach, ease of use, workflow automation) with minor complaints about pricing for startups and limited versioning tooling. Not higher because sample size is too thin to establish strong sentiment; not lower because what exists is favorable and no widespread negative signal appears on Reddit or HN.

Cosmic publishes every self-serve price: Free $0, Builder $99/mo, Team $299/mo, Business $499/mo, Workspace Small $999/mo and Large $2,999/mo, plus a full allowance-and-overage table for every metered resource, add-on prices, token-pack prices and an on-page pricing calculator. Only Enterprise is sales-gated, which is the industry norm. Not higher because a buyer has to combine roughly ten metered dimensions with optional $99/mo add-ons to predict a real bill.

Flat monthly tiers have clear allowances, the Builder to Team step is now 3x ($99 to $299), and Cosmic says usage is 'metered, never blocked'. Insights events are capped at 200% to prevent runaway bills, and the new AI Support Agent ships with a configurable daily token cap (default 500k). But overage is billed on about ten separate meters (uncached and cached API requests, API bandwidth, media files, storage, requests and bandwidth, Objects, Buckets, seats) and the included allowances are thin: Business includes only 150k uncached requests a month. Corrected from the prior run, which cited a $49 Builder tier and a single $10 per 1M CDN-event rate; neither exists. Not lower because every rate is published and small; not higher because the free-to-paid step is $0 to $99 and bills move with traffic on many axes.

Webhooks, Localization, Revision History and Automatic Backups are $99/mo add-ons each ($199 bundle; $199 each and $399 bundle on Workspaces) on every self-serve plan, which is aggressive for a headless CMS where webhooks and revision history are table stakes. SAML SSO is Enterprise-only and SCIM is still 'Coming soon'. On the positive side, AI agents and workflows (including the new website Support Agent), audit log, comments, all four roles and Insights are included on every plan, Free included. Not lower because core APIs and AI features are ungated; not higher because basic operational features and SSO sit behind paywalls.

Plans are month to month with no contract and no cancellation fee, yearly billing saves 10%, the Free plan needs no card, and Workspace plans carry a 30-day free trial. Enterprise can be invoiced or paid by purchase order. Not higher because there is no standard nonprofit, education or startup program (only an invitation to email support) and no prorated refunds on mid-cycle cancellation; not lower because there is no lock-in on any self-serve plan.

The free-forever plan includes 2 members, 1 Bucket, 1,000 Objects, 300k in / 300k out AI tokens, 1 agent and 1 workflow, the full REST API, SDK, CLI and MCP server, audit log and Insights, with no card required. One agent is enough to run the new website Support Agent on a free project. Not higher because Free has hard ceilings with no overage path (1GB API and media bandwidth, 10k uncached requests) and add-on features like webhooks still cost $99/mo; not lower because it is permanent, commercially permissive and genuinely capable.

REST API with MongoDB-style query operators (no proprietary query language), TypeScript SDK, CLI, MCP server and Next.js support make a first content query achievable in well under an hour for a JS developer. Add-on capabilities follow the same pattern: the new Support Agent installs with one script tag and a publishable, domain-locked key. Not higher because Bucket and Object-type modeling still need upfront decisions.

Case studies cite 67% faster time-to-market vs. WordPress for a React team, consistent with simple marketing sites landing in 2 to 4 weeks, and AI agents, workflows and the MCP server compress scaffolding. Not higher because there is no G2 Implementation award signal at the scale of Storyblok or Hygraph, and migration assistance is Enterprise-only; not lower because the stack is deliberately lightweight.

Cosmic relies on mainstream skills: REST, JSON, TypeScript, React/Next.js and MongoDB-style filters. There is no proprietary query language and no certification program, so any competent JS developer becomes productive quickly; premium is roughly 10 to 15% over generalist web development. Not higher because agent, workflow and Blocks conventions still need some Cosmic-specific familiarity for advanced work.

Fully managed SaaS: API, media CDN, storage and AI infrastructure are included in the plan price, and buyers only add front-end hosting. Not higher because included delivery allowances are small (10GB API and 10GB media bandwidth on Builder, 250GB/500GB on Business) and overage is $0.36/GB API and $0.30/GB media bandwidth, well above commodity CDN rates, so high-traffic sites effectively pay extra hosting through Cosmic. Corrected from the prior run's single $10 per 1M events rate.

Pure managed SaaS with no servers, databases, patching or scaling for the CMS; a solo developer can run a production Cosmic site. Not higher because teams still own build/deploy pipelines and caching on the consuming app, should watch metered usage across many dimensions, and self-serve plans have no uptime SLA.

Content is standard JSON over REST, SDKs and CLI, and a full Bucket exports and re-imports as a single bucket.json; Cosmic states content can be exported in full at any time. Not higher because agents, workflows, Custom Block shortcodes in rich text and Bucket-scoped relationships need rework on exit; not lower because raw data is fully portable with documented tooling.

Cosmic's content model is compact: Buckets (which double as environments, so there is no separate Environment concept), Object Types, Objects, Metafields and Media, under a Workspace > Project > Bucket hierarchy. Responses are clean JSON with a MongoDB-style query syntax and nothing proprietary to unwrap. Not higher because the AI layer (capability-based agents, AI Workflows, Agent Skills, MCP) and Custom Blocks in rich text add a second set of concepts once teams move beyond simple sites.

A 7-step quickstart, framework guides, an AI onboarding page that lets a coding assistant sign up, create a Bucket and model content through the CLI or MCP server, plus Agent Skills (npx skills add cosmicjs/skills) give AI-assisted developers a very fast ramp. Project creation can start from a template. Not higher because there is still no structured learning path, certification or interactive in-console tutorial track comparable to Contentful or Sanity, and community support is a Discord server.

A standard REST API with a fully typed TypeScript SDK (chainable queries, native fetch, zero dependencies), first-class Next.js App Router and server-component patterns, and an MCP server plus CLI that put content and schema operations inside Cursor, Claude Code and Copilot. Lowered slightly because the GraphQL API that earlier assessments credited is no longer documented, so the platform is now REST and SDK only. Not higher because schema lives in the dashboard or CLI commands rather than as typed schema-as-code in the repo, unlike Sanity or Payload.

Official templates install a content model and example content into a new Project (Simple Next.js Blog, Simple Astro Blog, Next.js Marketplace with Stripe, podcast, portfolio and a Blocks-based template), and Autopilot or a code agent can generate a full site with content model, preview route and Vercel deploy config wired in. Not higher because the catalog is small and Next.js-heavy, with thinner Astro coverage and no maintained Nuxt or SvelteKit starters at the polish of Storyblok's or Sanity's sets.

Zero-to-working integration needs three values: Bucket slug, read key and (for writes) write key, all available in the dashboard in under a minute, and the agent signup flow can even provision them for an AI assistant. The SDK has sane defaults and no dependency tree, which is simpler than Contentful's space, environment and token matrix. Not higher because each environment is a separate Bucket with its own keys, so multi-environment setups multiply credentials, and webhooks are a paid add-on that needs its own configuration.

Metafields can be added, changed or removed without downtime or migration scripts, there is no field-count ceiling, and schema is now scriptable through CLI commands (cosmic types create/update/duplicate) and MCP type tools. Promote content copies Object Types and content between Buckets with a read-only pre-flight report and Merge, Overwrite or Strict schema strategies, which gives a real path for promoting schema from staging to production. Not higher because there is no versioned migration-file framework like contentful-migration, Overwrite can delete data on target Objects, promotion only works between Buckets in one Project, and field renames still break consuming queries.

Preview now uses short-lived, Bucket-bound preview tokens: the editor clicks Preview, the site opens in a split pane inside the dashboard, and the frontend reads the token and fetches with status=any. The docs supply a drop-in Next.js helper, and sites built by Autopilot or a Cosmic agent get the preview route and link template set automatically. Raised because this is a documented split-pane flow rather than the hand-built preview mode credited before. Not higher because existing apps still need a server route, cookie handling and CSP frame-ancestors changes, and there is no click-to-edit overlay like Storyblok, Sanity Presentation or Hygraph.

A generalist TypeScript or React developer can ship a Cosmic-backed site within hours, with no certification, no proprietary query or templating language, and AI coding tools able to do much of the wiring through the MCP server, CLI and Agent Skills. Some headless modeling knowledge is needed for Object Type relationships and Custom Blocks. Not higher because extending the editor means building iframe Extensions, and getting value from the agent and workflow layer is a Cosmic-specific skill.

SaaS-only hosting removes DevOps and backend roles, and a solo developer can model content, build the frontend and deploy to Vercel end to end; Autopilot, code agents that open pull requests on a connected GitHub repo, and the CLI compress that further. Multi-locale or multi-Bucket promotion workflows may warrant two or three people, not a five-role DXP team. In line with Sanity and Storyblok.

Editors create and update Objects in existing Object Types without developers, can reuse Custom Blocks inside rich text, and Content Agents plus multi-step AI Workflows (scheduled or event-triggered, with approval gates) can draft, localize and publish content on their own. The October 2026 AI Agents rollout does not change the editor picture much, because agents are limited to Admin and Developer Bucket roles, so Editors and Contributors cannot run them. New page patterns, component types or layouts still need developer-defined Object Types, and Cosmic Pages is a publish-to-URL share page rather than a visual page composer.

Cosmic is SaaS with continuous vendor-managed deployment, so the core platform needs no version upgrades. The last generational move (dashboard v1 and REST/GraphQL v1–v3 discontinued Dec 2023) required customers to swap the deprecated 'cosmicjs' npm package for '@cosmicjs/sdk' and new API keys, though v3 was isolated from v1 production and backed by an upgrade guide with a compatibility report. Not higher because SDK/API generation changes have required customer code work; not lower because the managed platform itself never needs an upgrade project.

Vendor-managed SaaS on replicated MongoDB Atlas, S3 and Fastly, so infrastructure patching needs no customer action, and no Cosmic CMS CVEs appear in public databases (CosmicSting CVE-2024-34102 is an unrelated Adobe Commerce bug). Cosmic documents an incident response process and emails affected customers, and will send a CAIQ/SIG questionnaire on request. Not higher because /security states plainly that Cosmic holds no SOC 2, ISO 27001 or HIPAA certification and there is no public security advisory feed or bulletin cadence.

Cosmic's formal deprecations (2018-era Functions removed Mar 2022; dashboard v1 and API v1–v3 discontinued Dec 2023) came with dated notices of about six months and a compatibility tool. But in 2026 the GraphQL API, the Cosmic Functions serverless beta and Merge Requests all disappeared from the docs and site with no deprecation notice, leaving teams that used them to move to REST/SDK projections, external serverless and the Promote content wizard on Cosmic's timeline. Not higher because unannounced feature withdrawals are the most disruptive kind of forced migration and windows are well short of 12 months; not lower because the core REST v3 API and SDK have stayed stable since 2023.

SaaS model with no database, search, cache or CDN for the customer to operate; the client-side footprint is the '@cosmicjs/sdk' package, optionally the CLI and the npx-run MCP server. The new AI Support Agent installs as a single hosted script tag with a domain-locked publishable key, adding no build dependency. Not higher because customers must keep the SDK current and absorbed the legacy 'cosmicjs' package deprecation.

Cosmic runs a public Statuspage (cosmicstatus.com) with only two components, API and Web Dashboard, plus usage meters, Insights and an append-only audit log in the dashboard. Outbound webhooks have no delivery log, retries or HMAC signing (docs point to third-party Beeceptor for inspection), and roughly ten separately metered overage dimensions mean customers must watch quota consumption themselves. Not higher because webhook health and API error monitoring are left to the customer; not lower because the platform itself needs no infrastructure monitoring.

AI Workflows chain content, code and browser agents with approval gates and scheduled or event-driven triggers, and Cosmic ships templates such as a weekly job that analyzes hundreds of articles for outdated content and an Auto-SEO on Publish flow, so routine hygiene can be automated without custom code. The new AI Support Agent also logs every human-handoff question to a Support questions Object Type, surfacing content gaps. Not higher because there is still no native orphan detection, broken-reference alerting or content-expiry workflow, and agents are restricted to Admin/Developer roles; Revision History and Backups are paid add-ons on self-serve plans.

Content is served through a cached API layer with Fastly CDN and imgix for media, so customers do no query optimization, index tuning or cache configuration server-side; Cosmic reports 10x+ response-time gains from its caching layer. Not higher because uncached requests are limited to 100 rps sustained / 200 burst and allowances are thin (Business includes 150k uncached requests a month), so teams must design front ends around caching and ISR/SSG.

Cosmic's pricing table gives Free and Builder community support only, chat from Team ($299/mo) upward, and 24/7 support, a 99.95% uptime SLA and migration assistance only on Enterprise. The Oct 2026 AI Support Agent ('Leo') on cosmicjs.com now gives every user round-the-clock answers drawn from the live docs and knowledge base, with an email handoff that lands in Cosmic's support inbox, which improves first-line access on every plan. Not higher because no self-serve plan carries any response or uptime commitment; not lower because chat on mid-tier plans plus the AI front line covers most routine questions.

Cosmic's community is small next to Contentful, Sanity or Storyblok: a handful of G2 reviews, a modest community channel and thin Stack Overflow and GitHub discussion volume, though the founder and team engage directly. Not higher because edge-case answers are hard to find in public; not lower because team participation is visible and the docs are complete enough (llms.txt, markdown per page) to answer many questions without community help.

Fixes deploy immediately on the SaaS, the changelog shows a fast public release cadence through 2026 (Workflows, SSO, audit log, marketplaces, the AI Support Agent), and the status page records three incidents in 2025 and none so far in 2026. Not higher because there is no public bug tracker or critical-bug SLA, and recent feature removals went uncommunicated; not lower because reviews do not report stuck bugs.

Cosmic is explicitly structured-content/developer-first and does not ship a drag-and-drop visual page builder; it positions itself as an alternative to page-builder tools like Builder.io. Marketers can edit page field values and AI Content Agents can auto-generate landing-page copy/images, but creating new layouts still requires developer (or Code Agent) work on the frontend. That puts Cosmic in the 'marketers can edit content but not create new layouts' band, slightly lifted by AI scaffolding.

No native campaign calendar, multi-channel campaign orchestration, or campaign analytics. Cosmic provides scheduled publishing and AI-agent-scheduled content runs, which is closer to the 'scheduled publishing as the only campaign feature' band typical of headless CMS.

SEO is delivered via an SEO Fields extension/Block rather than built-in first-class SEO fields with validation. No native sitemap generation, redirect management, or canonical/Schema.org tooling — those are left to the frontend. Content model maps cleanly to schema.org (e.g., BlogPosting) but requires manual implementation. Fits the 'manual SEO field creation without built-in validation' band.

Lifted slightly. The new AI Support Agent (Oct 2026) puts a one-script-tag chat on the site that, when it cannot answer, collects the visitor's email and question, emails them to a set inbox and saves each one to a Support questions Object Type in the Bucket. That is a real, if narrow, lead-capture path. Cosmic Insights also breaks traffic out by Source / Medium / Campaign with revenue, so UTM awareness and conversion tracking now exist natively. Still no form builder, CTA management or landing-page lead forms, so it stays near the bottom of the external-tools band.

No native personalization, audience segmentation, or rule-based targeting engine. Any personalization requires pairing with an external CDP/personalization tool and frontend logic (Cosmic publishes only sample personalization apps, not a platform feature).

No native A/B testing, variant testing, or experimentation framework. Any content experiments must be orchestrated via external tools (Optimizely, VWO, LaunchDarkly) on the frontend.

This is a relative Cosmic strength: four agent types (Content, Code, Team, Computer Use) can draft landing pages, blog posts, and images autonomously, open PRs for new pages, and chain into multi-agent brief-to-publish workflows. Revision history, inline editing, bulk operations, and scheduled publishing are supported. Still relies on developer/Code-Agent implementation of new templates, keeping it below best-in-class visual-builder platforms.

Structured content via REST API and SDK feeds web, mobile and email from one source. Agents add chat channels (Slack, WhatsApp, Telegram) and browser-automation cross-posting, and the October 2026 AI Support Agent adds a website chat channel that answers from live published content, also reachable over REST and an inbound webhook. No native push, SMS or social renditions, so it remains web-first with API delivery elsewhere, at the upper end of that band.

Materially improved: Cosmic Insights is now a native, cookieless web-analytics layer built into the dashboard. Every Object gets its own Insights page (pageviews, visitors, sessions, bounce rate, sources, devices, geography) with period-over-period comparison and a real-time online count, and AI agents can read this data to close the content loop. This is exactly the 'analytics dashboards within the CMS with content performance metrics' pattern. Held below the top band because it is Cosmic's own first-party tracker (requires a one-line JS instrument) rather than pre-built GA4/Adobe/Mixpanel connectors, and there is no content-decay flagging.

Component-based content modeling (repeaters, relationships, 20+ field types) allows structured brand reuse, but there are no native design-token enforcement, locked component palettes, or restricted-override guardrails at the platform level. Consistency is enforced by frontend implementation and editor discipline.

OG/Twitter card meta can be handled via the SEO Fields extension, and AI Content Agents generate social copy. The new Computer Use Agents can now cross-post media between platforms via browser automation, giving a genuine (if unconventional) push-to-social capability beyond just meta-tag management. Still no dedicated social scheduling calendar or UGC embed workflows, keeping it at the top of the OG-plus band rather than into best-in-class social tooling.

Cosmic has a media library with imgix-backed image transforms (resize/crop/format), tagging/folders, and AI-generated alt text in bulk. No usage tracking, rights management, or full DAM capabilities. Covers basic DAM needs but not enterprise marketing asset governance.

Localization is a paid add-on ($99/mo standalone, $199/mo bundle) supporting 400+ locales as first-class in the content model with locale-aware API queries. AI Workflows can propagate source-language updates to all localized versions automatically. No native transcreation workflow or locale-specific campaign variant tooling, but practical for most marketing localization.

Cosmic now runs a plugin marketplace of about 22 vendor MCP plugins for its agents, including HubSpot (CRM/MAP), Shopify and Stripe (commerce), PostHog (analytics), Algolia, Intercom, Zendesk and Slack. These give agents pre-built connections across several MarTech categories and can be triggered by content events through AI Workflows. They are agent tool connections, not editor-side integrations or bidirectional data syncs, and there is nothing for Salesforce, Marketo, Pardot or a CDP. Outbound webhooks are a paid add-on on self-serve plans and cover only created/edited/deleted events, with no signing, retries or delivery log. Mid-band: some integrations plus generic webhooks and API.

Flexible content modeling with repeaters, relationships, and nested objects enables custom product-content types (PDP, category, variants, attributes), and Cosmic now ships a production-grade e-commerce storefront template (full catalog, collection pages, dynamic routing, SSR, imgix optimization). Not purpose-built for commerce — no product attribute library, variant inheritance, or PIM-grade features. Generic modeling repurposed for product content fits the 40–60 band.

No native merchandising: no category management UI, no cross-sell/upsell tooling, no search merchandising, no product spotlight curation. These belong to the paired commerce platform (e.g., Shopify), not Cosmic.

Shopify is documented as an integration pattern (product data mirrored into Cosmic for faster delivery), and agents can now call Shopify through a vendor MCP plugin or the generic api_request tool. There is still no product-picker UI in the editor and no live API federation; integration is per project. No first-class connectors for commercetools, SFCC or BigCommerce.

Rich content modeling supports buying guides, lookbooks, and editorial pages. Product embeds are possible via relationship fields but shoppable-content authoring is not a first-class pattern — no inline product picker with purchase CTA component out of the box.

Cart/checkout in a Cosmic+Shopify setup lives in the commerce platform; Cosmic can host banners, trust badges, and shipping callouts as content but there is no native pattern for injecting CMS content into transactional flows.

No documented post-purchase content features (order-confirmation editorial, onboarding sequences, loyalty content tied to order events). Would require custom build on top of the commerce platform's order webhooks.

Basic role-based access control (Admin/Developer/Editor) and API key management, but no B2B-specific features: no account-based catalog gating, no customer-specific pricing display, no quote-request flows, no gated spec-sheet delivery.

Content RAG (beta) now embeds every Object into a vector index and exposes a semantic search endpoint with relevance scores and snippets, filterable by type, locale and status, and an Algolia plugin exists for agents. That is basic content search with some enrichment. There is still no faceting, synonym management, search landing pages or blended content-and-product results, so commerce teams still pair Cosmic with a dedicated search engine.

Scheduled publishing enables time-activated banners and promo blocks. No native countdown timers, channel-specific targeting, or tiered-pricing table automation. AI agents can schedule promotional content generation.

Multiple Buckets can serve separate storefronts by brand or region, and Promote content copies selected Objects and schema between Buckets in the same Project. There is no shared product content with storefront-specific editorial overlays, so content is duplicated across Buckets.

imgix-powered image transforms, AI image/video generation, basic galleries and video embeds. No native 360-degree view, AR/3D model, or hotspot/zoom tooling — those require frontend libraries or third-party media services.

Multi-author content and role-based permissions allow basic marketplace-style content, but no seller-profile management, review aggregation, or moderation-at-scale tooling. Not marketplace-specific.

Localization add-on enables locale-specific product content at the content layer. Not commerce-specific — no currency-aware content blocks, regional regulatory content (EU labels, Prop 65), or market promo calendars built in.

Materially improved: Cosmic Insights now tracks conversions and revenue with one line of JS — passing revenue_cents auto-rolls the event up against the content Object that drove it, giving genuine content-to-revenue attribution within the CMS. This directly matches the content-to-revenue-attribution criterion. Held below the top of the band because it is general first-party web analytics rather than deep commerce-funnel integration (no cart/checkout funnel analytics or per-SKU product-content performance tied to the commerce backend).

Roles now span three inheriting layers (Workspace, Project, Bucket), and Contributors can be scoped to named Object types, which gives RBAC on content types. SAML SSO is now documented for Large Workspace and Enterprise; SCIM is still coming soon. There is no audience-based content visibility for end users, no field-level sensitivity and no department targeting. Bottom of the RBAC-on-content-types band.

Content modeling, revision history with a Changes diff that shows which agent wrote each revision, approval gates in AI Workflows and a documented weekly workflow template that reviews hundreds of articles for outdated content all help. The new AI Support Agent also turns published knowledge content into a live Q&A surface without a separate knowledge base. There are still no native review dates, expiry ownership or knowledge taxonomy tooling, so it remains in the adequate-modeling band.

Pure headless CMS, not purpose-built or adapted for employee portals. Building a full EX portal (news feed, directory, notifications, personalized dashboards, mobile app) requires extensive custom frontend development.

No targeted internal-comms tooling: no read receipts, acknowledgment tracking, or mandatory-read workflows. Content could be modeled as internal announcements but distribution, targeting, and tracking are not built in.

No native people directory, org chart, or HRIS connector (Workday, BambooHR). A directory could be modeled as a content type but requires full custom build.

Revision history (a paid add-on) with a per-revision diff, an append-only audit log and approval gates give basic versioned document publishing. There is no mandatory acknowledgment tracking and no review or expiry reminders.

No onboarding-specific features (role-based paths, 30/60/90-day progressive disclosure, HR-triggered new-hire portals). Would be a from-scratch frontend build.

Content RAG adds AI-relevance semantic search over CMS content, and the AI Support Agent answers questions from published content. Both are limited to Cosmic's own content: no federation across SharePoint, Confluence or Drive, no faceted filtering and no search analytics. The support agent's publishable key is built for public websites, not authenticated intranets. Still in the poor-to-basic band for internal search.

No native mobile app for editors or employees; sub-100ms REST API supports responsive frontend delivery. Team Agents in WhatsApp/Telegram/Slack give a distinct chat-based mobile access path but are agent interactions rather than a deskless-worker app.

No LMS integration (Cornerstone, Workday Learning), no native micro-learning, no completion/certification tracking. Training content can be authored as content types but tracking is out of scope.

Editor-side collaboration (comments, approvals) exists for content teams, but no end-user social layer: no public comments, reactions, forums, polls, or recognition tooling.

Team Agents run inside Slack, WhatsApp, and Telegram with persistent memory and custom personas, executing content tasks from chat. Not a full Teams/Google Workspace embedded-card experience, but the chat-native agent integration is stronger than most headless CMS peers — fits the middle 35–55 band at the top end.

Objects support scheduled publish and unpublish dates, and AI Workflows can run a scheduled job that flags outdated content (a documented template). That is basic expiry plus agent-driven staleness review. There are no native review-date fields, ownership assignment or archival workflows.

Cosmic Insights now provides real page-view analytics (visitors, sessions, sources, geography) per content Object, lifting this above 'no analytics.' However, Insights is public-web-oriented — it lacks the intranet-specific measures this item targets: department-level views, failed-search-term tracking, engagement heatmaps, and adoption dashboards. Sits in the 'basic page view analytics' band.

Cosmic's Bucket-per-brand model gives clean silo-based isolation: independent content models, environments, and API keys per Bucket, with no cross-bucket data leakage. It is not a native multi-tenant data model (no shared schema with row-level tenancy), placing it in the 55–70 silo-based-isolation band.

Promote content copies Object types and Objects between Buckets in the same Project, and Custom Blocks can be synced across instances within a Bucket, but there is no live shared global content or design tokens across brands. Cross-Project sharing has no native path. Shared frontend component libraries live in code.

The Workspace > Project > Bucket hierarchy gives central user and team management with roles that inherit downward, a Workspace-scoped append-only audit log and, on Large Workspace, SAML SSO. Cross-brand enforced content standards, approval chains and global policy configuration are still absent. Organization-level management with limited enforcement.

Workspace plans pool Buckets, Objects and usage across every Project on one bill: Small at $999/mo (5 Projects, 10 Buckets) and Large at $2,999/mo (10 Projects, 30 Buckets), with extra Buckets at $29/mo. Adding a brand costs far less than a new subscription. Usage is metered on about ten separate overage meters, and the Webhooks, Localization and Revision History add-ons cost extra, which keeps this below the volume-pricing band.

Each bucket can define its own brand theme-token content types consumed by the frontend. No platform-level theming engine that applies per-brand styles to shared rendered components. Theming is effectively frontend configuration per brand.

Localization add-on enables per-locale content in each bucket. No brand-aware translation approval workflow or regional legal governance layered on top. Brand × locale governance is handled manually per bucket.

Cosmic Insights now provides content-performance analytics scoped to the current project or bucket (its real-time online count is explicitly bucket-scoped), so per-brand analytics exist where there were none before. But there is still no portfolio-level dashboard aggregating engagement across buckets — cross-brand comparison remains a manual aggregation exercise. Fits the 'basic per-brand analytics with manual aggregation' band.

Each Project and Bucket configures its own approval gates, scheduled publishing and agent workflows, and the Workspace-scoped audit log provides central visibility, including attribution of agent actions. Approvals live in AI Workflows rather than in a configurable editorial workflow engine. Some workflow variants per brand with partial central audit.

Promote content copies selected Objects between Buckets in the same Project, with Merge, Overwrite or Strict schema strategies, after which content can be adapted locally. It works only within a Project and is a one-time copy, not live corporate-to-brand syndication with push updates.

There are no per-brand compliance rules, consent tooling, cookie-policy management or publishing guardrails. Cosmic states plainly that it holds no SOC 2, ISO 27001 or HIPAA certification, and every subprocessor is US-located, so there is no per-brand or EU data residency choice. Cookieless Insights eases consent somewhat but is not a compliance control. Generic compliance across all brands.

No platform-level design-system registry with brand-extension and version propagation. Design systems are maintained in frontend codebases and consumed across brand sites.

Central Workspace admin covers every Project and Bucket, with three role layers that inherit downward so brand teams can run autonomously. SAML SSO is now documented on Large Workspace and Enterprise, but SCIM is still coming soon, so deprovisioning is manual, and there are no shared cross-brand contributor permission sets.

Object types can be copied between Buckets in the same Project with Promote content as a shared starting point, but there is no inheritance model where a global schema is extended per brand without forking. Changes to a shared model must be promoted again by hand.

No executive portfolio reporting (freshness by brand, SLA adherence, cost allocation, capacity planning) inside Cosmic. Per-bucket views only; aggregation is a manual exercise.

Cosmic now maintains a public subprocessor register with entity locations and an opt-in advance-change notification list, and states that a DPA is available on request, which offsets the loss of the EU hosting option prior runs credited. The DPA itself is unpublished (/dpa 404s), no SCCs or transfer mechanism are documented even though all 13 subprocessors, including the AI providers agents call, are US entities, and erasure is a support-ticket flow, so it stays in the no-published-DPA band.

Cosmic states plainly that it holds no HIPAA certification, offers no BAA, and publishes no healthcare guidance. It is not positioned for PHI workloads.

Coverage is GDPR plus a California Civil Code 'Shine the Light' disclosure in the privacy policy; there is no real CCPA/CPRA notice and no FedRAMP, IRAP, C5, PIPEDA, LGPD, PCI-DSS, or HITRUST reference. That keeps it just above the GDPR-only floor.

Cosmic explicitly states it holds no SOC 2 attestation of either type. It now offers a completed CAIQ/SIG-structured security questionnaire on request, which helps procurement but is self-attested, not an audit.

Cosmic states it holds no ISO 27001 certification. AWS and MongoDB Atlas carry ISO 27001/27018, but provider certifications do not transfer to the SaaS platform.

No CSA STAR registry entry, PCI DSS, Cyber Essentials, FedRAMP, IRAP, ENS, or C5. The CAIQ-structured questionnaire is not a STAR listing and earns no certification credit.

The four selectable AWS regions (including eu-west-1) that the prior run credited are no longer listed anywhere on /security, which now describes a single replicated MongoDB Atlas cluster with media in S3 behind Fastly, and every subprocessor is a US entity. Residency is negotiated case by case ('we will tell you what we can commit to in writing'), and the Insights analytics store is explicitly US-only with EU residency deferred to a future version, placing it in the US-only, contract-only band.

Content is fully exportable via the REST API, CLI and downloadable backups (backup downloads are themselves audit-logged), giving genuine portability. Deletion is still a manual flow (deactivate the account, then email support) with no API or self-service erasure, and the stated retention is 'indefinitely unless you request deletion' rather than a committed post-termination window.

A documented audit log on every plan covers authentication, Cosmic staff support access, roles, keys, billing, content publish/delete, webhooks, integrations and data egress, is append-only with deletes rejected at the database layer, and keeps retention of 30 to 365 days by plan, with credential events held 365 days everywhere. The new AI agents are attributed under their own name, with the prompting human or an 'unattended run' marker, which matters now that agents act autonomously through Slack, WhatsApp and Telegram. Not higher because there is no log export, API, or SIEM integration, and reads, uploads and draft edits are not logged.

No WCAG 2.1 AA conformance statement or ATAG 2.0 reference exists for the Cosmic dashboard. The only accessibility-adjacent content is delivery-side (AI alt text, TTS narration), which does not count toward authoring accessibility.

No VPAT, ACR, Section 508 statement, or accessibility page is published, and the security questionnaire scope does not cover accessibility. Procurement teams needing a conformance report have no artifact.

Cosmic ships native AI text generation with real-time streaming (March 2025), an AI Content Studio (August 2025), and the Cosmic Content Assistant for SEO-friendly long-form content. Brand Guidelines (October 2025) enforce voice/style across generated content, and the API exposes multiple top-tier models (Claude Opus/Sonnet 4.5, Gemini 3.1 Pro, GPT-5 series) with chat/message support. Held below 85 because bulk editorial workflows and prompt template libraries are less formalized than Contentful AI Actions or Sanity Create.

Native image generation via Gemini 3.1 Flash Image and DALL-E 3 (up to 4K, reference-image consistency up to 14 images), native AI video via Veo 3.1 with 720p/1080p and extend endpoint, OpenAI TTS with 9 voices, plus AI-generated alt text including bulk. Generated media is auto-stored in the bucket with alt_text, folder, and metadata fields. One of the most complete media-AI stacks in the headless CMS market — score capped shy of 90 because there is no built-in Firefly-equivalent IP-safe generator or smart focal-point cropping specifically marketed.

Cosmic AI auto-translates content natively from the dashboard for all roles, and the documented Content Localization Pipeline workflow template chains agents to translate and localize content automatically, with Brand Guidelines carried into agent context to preserve voice across locales. Raised from 68 to 70 for the workflow-level bulk translation path. Held at 70 because there is still no translation memory, glossary enforcement or per-segment quality scoring.

Alt text generation (single and bulk), AI summaries and SEO-optimized content generation are built in, and the documented Auto-SEO on Publish workflow template runs an agent on the Object Published event to fill SEO metadata automatically. Raised from 65 to 67 for event-triggered SEO automation. Held below 70 because there is no on-page SEO scoring, schema markup suggestion or competitive title/description analysis.

Automations run on demand, on schedules or on content events (Object Created, Edited, Deleted, Published), and Workflows chain agents sequentially or in parallel with templates for SEO on publish, localization and editorial triage routing across properties. Bulk alt text and bulk content updates are GA. Raised from 72 to 74 for event-driven triggers and documented routing patterns; held below 80 because duplicate detection and auto-tagging against a taxonomy are not native features.

Cosmic agents are now capability-based (content, code, computer_use browser, web_browse, notifications, api_request) with request_approval as a first-class tool, persistent channels in Slack, WhatsApp and Telegram, and a Marketplace of 30 installable agent templates plus 22 vendor MCP plugins. The October 2026 AI Support Agent adds a production website channel: one script tag, a domain-locked publishable key, answers from live published content, and email handoff to a human when unsure. Raised from 80 to 82 because the agent ecosystem gap cited previously is now partly closed; short of 88 as agents remain Admin/Developer-only and marketplace depth is early.

Media asset chat, AI summaries and content-model generation provide content understanding, and a documented workflow template analyzes 500+ articles weekly for outdated content, validates links and updates flagged articles. Cosmic Insights adds source, medium and campaign attribution. Raised from 50 to 52 for agent-driven stale-content detection; held near 50 because there is no built-in content intelligence dashboard for gaps, topic clusters or editorial priorities.

Brand Guidelines (Oct 2025) provide AI-enforced brand voice compliance across generation, and Cosmic's platform-level content policy blocks disallowed outputs (celebrities, copyright, policy violations) with SynthID watermarking on generated video. No comprehensive audit scanner for accessibility, thin content, or compliance across existing published pages is advertised — auditing is focused on what AI produces, not what exists.

Content RAG embeds Bucket Objects into a native vector index on write and keeps it in sync; POST /v3/buckets/:slug/ai/search returns semantically ranked results with score and snippet, filterable by type, locale, status and min_score, and the same retrieval powers the agents search_content tool and the new AI Support Agent. It is on by default for new projects, with free embedding and token-metered queries. Raised from 38 to 56 because the prior claim of no native semantic search was wrong; held below 60 because Content RAG is still labeled Beta and lacks hybrid ranking, faceting, synonyms and query analytics.

Cosmic does not ship an ML-driven personalization engine: no audience scoring, predictive segment assignment, next-best-content recommendations, or CDP. As a pure headless CMS it expects personalization to happen in the presentation layer or via a dedicated CDP (Segment, Hightouch, etc.). Score sits at the typical 'no AI personalization' floor for headless CMS peers.

Cosmic ships an official first-party MCP server exposing 18 tools across four categories (content CRUD, media management, schema modification, and AI text/image/video generation), now offered as a zero-install hosted endpoint at mcp.cosmicjs.com plus a local stdio npm package (@cosmicjs/mcp). Access uses bucket-scoped read/write API keys so an agent holds only the permission it needs, and Cosmic markets an 'MCP control plane' governing agent access. Raised from 80 to 84 on this new evidence of granular permission scoping and governance; short of 90 pending organization-wide multi-tenant policy tooling.

More than 20 models across four providers (Anthropic, Google, OpenAI, Moonshot Kimi) are selectable per request for text, image, video and audio, but all native generation is brokered and metered through Cosmic tokens. There is no BYOK setting, custom endpoint or data-residency control for built-in AI; agent Secrets let an agent call external APIs with customer credentials, which is not BYOK for generation. Score reflects broad model choice with no key or model ownership.

Dedicated AI endpoints for text, image, video and audio, the JS SDK with streaming, hosted and local MCP server, Agent Skills for 16+ coding assistants, an agent signup API, an agent messages REST API with inbound webhooks, and now a semantic search endpoint that gives agents RAG-ready retrieval. Raised from 82 to 85 because the missing vector retrieval layer cited previously is now native via Content RAG; short of 90 without first-party LangChain or LlamaIndex integration guides.

The append-only audit log records destructive agent actions under the agent own name, names the human prompter where one existed and marks unattended scheduled runs, and since September 2026 revision history shows per-field diffs with person-via-agent attribution. Governance also includes Brand Guidelines, request_approval and workflow Approval Gates, encrypted Secrets never exposed to the model, content policy filters and SynthID on video, and the Support Agent is told to hand off rather than guess, with domain-locked keys and a daily token cap. Raised from 63 to 70; held below 75 because there is no IP indemnification, confidence scoring or prompt-template governance.

Dashboard Usage section tracks AI token consumption with input/output split, plan-based allowances (e.g., 300K free, 2M on Team, 6M on Business), token-pack overages at $9.50/M, and per-team usage monitoring. AI Agent limits are metered per plan. Score held below 75 because prompt-effectiveness analytics, model performance dashboards, and quality-trend monitoring specific to AI output are not surfaced today.