Cosmic

Object Types support about 22 Metafield types (text, textarea, rich-text, html-textarea, markdown, JSON, number, date, switch, color, emoji, select/multi-select/dropdown/radio/checkbox, file/files with media-type validation, single and multiple Object relationships, repeater and parent groups) plus conditional show_when visibility and unique constraints. Object Types can be created and updated through the REST API and the Cosmic CLI from JSON files, and agents can generate content models, but there is no native typed schema-as-code workflow. Each relationship Metafield takes a single object_type, so union/polymorphic fields are not available, which keeps it in the adequate band.

The object and objects Metafields provide one-to-one and one-to-many references, expandable on read with the depth parameter, and rich-text values can now embed live Objects inline. Reverse lookups are done with filtered queries rather than schema-level bidirectional relations, circular references are prohibited in depth expansion, and each relationship targets a single Object type, so there are no polymorphic references.

Beyond repeater and parent groups and JSON fields, the rich-text Metafield now supports reusable Custom Blocks embedded as shortcode tokens, either synced to a shared definition or detached as editable per-page instances with Reset to synced, plus inline embeds of live Objects inserted via slash command. This adds real component reuse inside entries, but blocks are untyped markdown/plain/HTML snippets defined per Bucket rather than schema-typed components with unlimited nesting, so it stays below the Portable Text/Storyblok tier.

Built-in validation covers required, unique (top-level text/number/date/select, locale-aware), regex with a custom error message, minlength/maxlength, media type restriction on file fields, and option enumerations, with show_when hidden fields skipping required checks. There is no custom validator hook, pre-save webhook or cross-field rule engine, so it sits in the standard built-in band.

Every Object keeps immutable revisions with rollback in the dashboard and a REST/SDK Revisions API (list, get, add), and scheduled publish/unpublish is native. Merge Requests, previously credited for Git-style branching, are gone from the docs; the replacement, Promote content, copies Objects and schema between Buckets in the same Project with a read-only pre-flight report and merge/overwrite/strict schema strategies, which is environment promotion rather than branching with approval. Revision retention is only 30 days on Free and Builder (90/180/365 on higher plans), Revision History is a paid add-on on self-serve plans, and there is no snapshot diff UI.

Editing is form-based; Preview opens the live site in a split pane beside the editor using a one-hour preview token and a configurable URL template, and Cosmic Pages can publish an Object to a shareable URL. There is no click-to-edit overlay or drag-and-drop page composition, so marketers cannot rearrange layouts without developer-defined Object Types; a preview iframe is not visual editing.

The recommended rich-text Metafield now stores markdown interleaved with block tokens, supports reusable synced or per-instance Custom Blocks and slash-command inline Object embeds, preserves unknown tokens verbatim, and is paired with AI writing assistance in the editor. Markdown with shortcodes is more portable than an HTML blob, but it is not a typed AST, rendering requires app-side token resolution, and developers cannot define custom node or mark types beyond flat blocks.

The media library supports images, video, audio and documents with folders (dashboard, API and CLI), a built-in image editor, in-place file replacement that keeps the URL and id while purging CDN caches, AI alt-text generation for every role, and imgix URL transforms (resize, crop, auto format to WebP/AVIF, quality). There is no focal-point editor and organization relies on folders rather than DAM-grade tagging, capping it below 75.

Comments can be left on an Object or a specific Metafield with @mentions, attachments, emoji reactions and resolved/unresolved tracking, which covers async review. The docs describe no entry locking, conflict detection or live presence for concurrent human editors, so simultaneous edits fall back to last write wins.

Editorial control is role-based: four Bucket roles, Editors restrictable to drafts, Contributors limited to their own drafts in assigned Object types, scheduled publish/unpublish, comments and an append-only audit log. The October 2026 AI agents and Workflows add event-triggered automations with approval gates and a request_approval tool, and content agents can draft and publish within existing schemas, but these are automation controls available to Admin/Developer roles only, not a configurable editorial stage builder. With Merge Requests removed there is no approval step on content promotion either, so it is a basic approval model.

Cosmic is now REST-only: the GraphQL API has been removed from the docs, leaving only a GraphQL-like props projection syntax in the JS SDK. The REST API is well designed, with MongoDB-style query operators, props field selection, relationship depth, locale queries, cursor pagination, batch operations, read and write keys and a separate semantic search endpoint. As a well-designed REST-only API it sits at the top of the 60–70 band rather than the REST-plus-GraphQL tier.

API responses are cached by default (useCache can be disabled for real-time reads) with sub-100ms global delivery claimed, media is served from S3 behind Fastly with imgix transforms, and replacing media purges CDN caches in the background. There is no edge compute or edge personalization layer of Cosmic's own, keeping it below 80.

Outbound webhooks fire on created, edited and deleted events for Objects and media, with event selection, a configurable props payload and custom headers. Verification relies on a shared secret in a custom header; HMAC signing exists only for inbound AI-agent webhooks, the docs describe no retry policy or delivery log (they point to Beeceptor for inspecting requests), and webhooks are a paid add-on on self-serve plans. That places it in the basic band.

Content is channel-agnostic over REST, with official JavaScript/TypeScript and Swift SDKs, a CLI, a hosted MCP server, Agent Skills and an Agent Plugin for AI clients, and the new agents can publish content out to Slack, WhatsApp, Telegram and email. Rich text is markdown with shortcode tokens, more portable than HTML but requiring custom resolution. Only two official language SDKs keeps it well short of the 80+ band.

No native audience segmentation engine. Cosmic has no built-in rules engine for defining audiences, no CDP integration, and no behavioral tracking. Audience definitions must live entirely in an external CDP or personalization layer and be applied by the consuming frontend.

No native content-variant-per-audience primitive. Personalization is achievable only by modeling variant Objects and selecting them in the frontend via external decision logic (Ninetailed, custom code). There is no in-editor preview per audience and no decision engine in the CMS.

No native A/B or multivariate testing. No traffic allocation, no statistical significance, no experiment management UI. Teams must plug in an external tool (LaunchDarkly, Optimizely, Vercel Edge Config) and manage test content via generic Objects.

No native algorithmic recommendation engine — no ML ranking, no collaborative filtering, no editorial recommendation weighting. Related content must be manually curated via Object references or computed externally via Algolia Recommend, AWS Personalize, or custom logic.

The REST/GraphQL query API supports filtering and basic full-text search via query parameters (title, metadata field matches, advanced query operators). No relevance tuning, no faceting, no typo tolerance, no autocomplete. Functional filter-based retrieval but not a production search experience out of the box.

Official Algolia integration documented as both a marketplace Extension and an integration guide, with webhook-driven index sync on Object publish/unpublish/delete events. Webhook infrastructure supports Elasticsearch/Typesense patterns through custom endpoints. No broad native search-app marketplace but the first-party Algolia pattern is well-documented.

No native commerce capabilities — no product catalog schema, no cart, no checkout, no pricing, no inventory, no order management. Cosmic is a pure headless content platform and explicitly positions commerce as an integration concern (typically Shopify, or a Stripe-enabled custom frontend).

Shopify integration is marketed and documented as a pattern — Cosmic manages rich product content while Shopify handles catalog/cart/checkout — but the connection is largely content-modeling + API fetch in the frontend rather than a packaged product picker app with live product data federation. No bidirectional sync, no first-party commercetools/BigCommerce/SFCC connectors documented.

Flexible Object Types and metafields (repeaters, references, rich text, image galleries) can model product descriptions, enriched copy, variant content and image assets, and Cosmic explicitly markets structured product content as a strong fit. No purpose-built PIM field types (SKU, pricing rules, stock, variant option matrix) — generic content types repurposed for product content.

Cosmic Insights is a first-party, cookieless analytics layer included on every plan, including Free. It captures pageviews, sessions, visitors, bounce rate, sources (source/medium/campaign), devices and countries from any deployed app, plus custom events and conversions with revenue, and joins them back to the Cosmic Objects that produced the content: each Object gets a Performance card with pageviews, visitors and revenue, and a Content tab ranks Objects by performance. That is genuine content performance analytics, well beyond the API/bandwidth usage metrics previously credited. Gaps: no author productivity or time-to-publish lifecycle metrics, no content health dashboard, and attribution depends on installing the tracker script (automatic only on Cosmic-built apps). Event retention is 30/90/365 days by tier.

Webhook system can push content lifecycle events to Segment, GA4 server-side, or custom analytics pipelines. No official marketplace connectors for GA4/Segment/Amplitude — integrations are pattern documentation + webhook wiring. Being headless, frontend analytics integrate at the application layer without CMS constraint.

Buckets are independent content repositories (used per site or per environment) grouped under Projects, and Workspace plans pool Buckets and usage across multiple Projects. Content moves between sites only by copy: Promote content is a dashboard wizard that copies selected Objects, schema and referenced media to another Bucket in the same Project, with a pre-flight report and merge/overwrite/strict schema strategies. There are no live cross-Bucket references or shared component libraries, so multi-site remains silo-based.

Localization is treated as a first-class concept with locale identifiers on Objects and locale-based API queries, enabling parallel content development per locale. However, localization is a paid add-on (part of the $199/month Feature Bundle, or included on the Team plan) rather than a free core feature, and localization is document-level (locale-specific Object copies) rather than field-level.

No official marketplace integrations with major TMS platforms (Phrase, Smartling, Lokalise, Crowdin) documented. Translation is accomplished primarily via AI-driven localization workflows or via custom webhook-based pipelines, with bulk export/import possible through the Management API. No enterprise TMS connectors exist.

Workspaces add an org layer above Projects: Workspace > Project > Bucket, with three role layers that inherit downward and Workspace roles explicitly described as controlling 'which brands a person can see'. Workspace plans pool Buckets, Objects and usage across up to 10 Projects with one bill, and the append-only audit log spans every Project in the Workspace. This is real organization-level multi-brand administration. Still no cross-brand shared component or content library, no cross-brand approval workflow, and Promote content only works between Buckets in the same Project, so there is no native cross-brand syndication or global policy enforcement.

Media library supports folders, metadata, tagging, role-based access, and signed (time-limited) URLs for protected content. Revision/version history is a paid add-on and applies to content revisions; binary asset versioning is not documented. No rights/expiry management, no cross-content usage tracking, no enterprise asset workflows. Decent metadata-aware library but not a purpose-built DAM.

Native imgix integration auto-converts every uploaded image to an imgix URL with global CDN delivery. Full on-the-fly transforms via URL parameters: resize, crop, format conversion (WebP/AVIF/JPEG), quality, compression, intelligent cropping. An imgix Editor Extension enables in-dashboard visual editing with focal point controls. Strong result for a headless CMS — native CDN + modern formats + focal points clears the 70+ bar.

Video files can be uploaded and served via the media CDN, and YouTube can be connected for embedding, but there is no native transcoding, no adaptive bitrate streaming (HLS/DASH), no captions/subtitles management, no thumbnail generation. Production video use cases require external services (Mux, Cloudflare Stream, YouTube, Vimeo). Consistent with headless CMS peers.

Dashboard offers drag-and-drop media management and structured block composition via repeater metafields, with preview URLs per deployment and preview mode for draft content. However, there is no in-context visual editor overlaying the live frontend (no Sanity Presentation / Storyblok Visual Editor equivalent) and no drag-and-drop page canvas — authoring is form-based with a preview pane.

The git-style Merge Requests workflow credited previously is no longer part of the product: it is absent from the documentation and has been replaced by Promote content, which copies content between Buckets without a review or approval step. What remains is a basic draft/publish separation enforced by roles (Editors can be restricted to drafts, Contributors can only create drafts in assigned Object types), Object-level comments with @mentions and a resolve/unresolve system for review feedback, and revisions on publish. Approval Gates exist only inside AI Workflows, pausing automated pipelines for human sign-off; they do not apply to human editorial content. No custom workflow states, task assignment, due dates or multi-step routing.

Scheduled publish and scheduled unpublish are supported on Objects, with each automatic publish event creating a new revision for auditability, giving functional embargo via scheduled unpublish. No dedicated calendar/timeline UI showing scheduled items; no named release bundle for atomic multi-object publishing.

Comments attach to Objects or specific metafields with @mentions, emoji reactions, media attachments and an unresolved/resolved filter. Revision History tracks changes with restore (a paid add-on on self-serve plans). No simultaneous multi-author editing (no CRDT/OT) and no presence indicators are documented, so collaboration is comments plus revisions rather than real-time co-editing.

No native form builder. Forms are implemented by defining a Submission Object Type and using the REST/GraphQL API from the frontend to write submissions into Cosmic. No CAPTCHA, no conditional logic, no progressive profiling, no hosted form pages. Developer-only API workaround, not a marketer tool.

No native email sending or campaign management. HubSpot and other ESPs (Mailchimp, Brevo) are connectable via Zapier or custom webhooks but there is no in-CMS subscriber list sync, no triggered-send UI, and no email preview. All connections are basic API/webhook plumbing.

No native marketing automation — no behavioral triggers tied to visitor activity, no drip campaigns, no lead scoring, no lifecycle orchestration. AI Workflows automate content operations but this is content automation, not marketing automation. Marketing workflows live entirely in external tools (HubSpot, Marketo) connected via Zapier.

No certified CDP marketplace integrations (Segment, mParticle, Tealium, Salesforce CDP). Segment-style event forwarding is possible via webhooks but no bidirectional profile sync, no unified customer profiles in Cosmic, no in-CMS audience resolution. Custom integration patterns only.

The Cosmic integrations directory lists about 26 integrations, and most are deployment-host guides (Vercel, Netlify, Cloudflare, AWS, GCP, Azure, Render, DigitalOcean, Kinsta, GitHub, GitLab, Bitbucket). The functional ones are imgix, Algolia, Shopify, Stripe, Mux, YouTube, Vimeo, Loom, Descript, Instagram, Slack, Zapier, Resend and Raycast. Extensions are iframe-only (a URL receiving bucket keys as query parameters), installable at Project level in a few editor locations. Agents add Slack, WhatsApp, Telegram and email channels. This is a small integration directory rather than a marketplace with a partner ecosystem.

Outbound webhooks are basic: resources are objects or media, events are only created, edited and deleted (no distinct publish/unpublish events), the payload is shaped with a props selector, and verification relies on user-defined custom headers acting as a shared secret. There is no HMAC signing, no documented retry policy and no delivery log; the docs point users to the third-party Beeceptor to inspect deliveries. Webhooks remain a paid add-on on every self-serve plan. The signed X-Webhook-Signature header in the docs applies only to inbound AI-agent webhooks. Event-driven AI Workflows (triggered on Object created/edited/deleted/published) give some in-platform automation but are not an outbound event stream.

Each Object type takes a preview URL template; clicking Preview opens the live site in a split pane beside the editor with a one-hour preview token appended, and agent-built sites configure this automatically. Draft/published states, scheduled publishing and Bucket-as-environment staging (Production/Staging/Testing Buckets) are supported, with Promote content copying content from staging to production and Application Workflows providing GitHub-connected Vercel deploys with preview URLs. Cosmic Pages can publish any Object to a public URL for stakeholder review. No multi-channel simultaneous preview and no native release environment beyond Bucket copies.

SAML single sign-on now ships: a dedicated docs page describes Workspace Admins enabling SAML (Okta, Entra ID, Google Workspace or any SAML 2.0 IdP) with SSO-enforced login, and the pricing table marks it Included on Enterprise (and the docs add Large Workspace). SCIM is still marked Coming soon, so deprovisioning is manual. Roles span three inheriting layers (Workspace, Project, Bucket), Bucket roles include Admin, Developer, Editor and Contributor, Editors can be restricted to drafts, Contributors are scoped to named Object types and their own Objects, and there is an immutable audit log. Still no custom role builder, no field-level or locale-level permissions.

Cosmic is now REST-only: the GraphQL API has been removed from the docs (the site nav reads "REST API & SDK"), and Cosmic presents REST-first as a deliberate choice for cacheability and AI-agent consumption. The REST surface is consistent and well documented, with props projection, depth control, preview tokens, revisions, a documented error table with retry guidance, and agent-specific endpoints such as /v3/agents/sign-up. Down from the prior score because GraphQL was part of that credit and there is no longer a query-language option like Sanity's GROQ or Contentful's GraphQL.

Cosmic delivers through a Fastly CDN and now documents its rate limits: 100 requests/second sustained and 200 burst on uncached requests, a 429 with a backoff recipe on overage, and 6MB/30s request ceilings. Cache-served requests do not count toward limits. There is still no sync or incremental delivery API like Contentful's, and the published uncached throughput is modest next to tier-1 headless vendors.

Two official SDKs: @cosmicjs/sdk for JavaScript/TypeScript (typed, zero dependencies) and cosmic-sdk-swift via Swift Package Manager, both used throughout the API reference. There are no official Python, Ruby, Java, PHP, Go or .NET SDKs, so those stacks call REST directly. The CLI, hosted MCP server and Agent Skills cover AI tooling rather than language reach, so this stays below Contentful, Sanity and Contentstack.

Cosmic now runs three marketplaces. The Plugin Marketplace lists 22 vendor MCP plugins its agents can use (Shopify, HubSpot, Stripe, Algolia, Zendesk, Intercom, Slack, GitHub, Figma, Notion, Sentry, PostHog, Vercel, Netlify, Cloudflare and others). It sits alongside about 30 installable agent templates (including the new AI Support Agent and a translator) and a Workflow Templates gallery, on top of the older iframe dashboard Extensions. That is broader commercial coverage than before, but these are agent tool connections rather than content-editor apps, and there is still no DAM, TMS or enterprise MarTech app catalog to match Contentful's or Storyblok's.

Cosmic Functions, the serverless layer behind the prior score, has been removed (/functions returns 404 and no docs page mentions it), and dashboard Extensions are back to iframe-only (a URL that receives bucket_slug and read/write keys). The extension model now leans on AI: event-triggered agents and Workflows (on Object created, edited, deleted or published), api_request and webhook tools, a hosted MCP server, Agent Skills and an Agent Plugin, and the new embeddable AI Support Agent. There is no first-party custom-code runtime or field-level UI SDK to match Contentful's App Framework or Sanity Studio.

SAML SSO now ships on Large Workspace ($2,999/mo) and Enterprise. Okta, Entra ID, Google Workspace or any SAML 2.0 IdP can be connected and SSO enforced, which blocks password, Google and GitHub sign-in. SCIM is still not available, so deprovisioning is manual. Free 2FA is an emailed one-time code only, with no TOTP or WebAuthn, and Team and Business buyers still have no SSO. API access uses separate per-Bucket read and write keys, rotated independently, plus personal access tokens.

Roles work in three layers that inherit downward: Workspace and Project admin/manager/user, and four Bucket roles (admin, developer, editor, contributor). Contributors can be scoped to named Object types, and each Bucket's read and write keys rotate independently. An append-only audit log on every plan, which attributes AI-agent actions by name, adds governance depth. There are still no field-level permissions or custom roles, which keeps this below Contentful and Sanity.

Cosmic's security page says plainly that it holds no SOC 2, ISO 27001 or HIPAA certification. The EU database region credited previously no longer appears: no region is published, residency is handled case by case by email, and every listed subprocessor is in the United States. What exists is a CAIQ/SIG-structured security questionnaire on request, a maintained subprocessor register with change notifications, and GDPR terms. Full compliance is scored in cat9.

No known breaches or CVEs, and the security page documents an incident process (investigate, contain, email affected customers) and logs support-staff access in the customer's audit log. Vulnerability reports go to the general [email protected] address: there is no security.txt (/.well-known/security.txt returns 404), no bug bounty and no advisory feed. A clean record with basic disclosure.

Cosmic is SaaS-only on AWS, MongoDB Atlas and Fastly, with no self-hosted, private cloud or dedicated-tenancy option. The selectable database regions credited previously (us-east-1, us-west-2, eu-west-1, ap-southeast-1) are no longer published; content sits in one replicated Atlas cluster and residency commitments must be requested in writing. That removes the one deployment choice buyers had.

The SLA commits to 99.95% uptime with service credits, but only on Enterprise. No self-serve plan or Workspace plan has a contractual uptime commitment. The public status page (cosmicstatus.com, Atlassian Statuspage) covers only two components, API and Web Dashboard, and shows a light incident history.

Content comes from a replicated MongoDB Atlas cluster with automatic node promotion, and media comes from S3 through Fastly's edge. Request limits are now documented at 100 rps sustained and 200 burst on uncached traffic. The four-region topology with cross-region failover cited previously is no longer described, and Cosmic lacks the published scale limits and Fortune-500 references of Contentful or Contentstack.

Automatic daily Bucket backups (12AM UTC) with on-demand snapshots, download and restore are documented, but they are a $99/mo add-on on every self-serve plan. Every plan includes full JSON export of Object types, Objects and media, and the replicated database promotes a new node automatically. The cross-region failover cited previously is no longer described, and RTO/RPO figures are not public, so DR stays at the backups-plus-export level.

The Cosmic CLI is a capable remote-dev tool. It has an interactive shell, full Object type and Object CRUD (cosmic types create/update/duplicate), AI content and app generation, GitHub repo creation and Vercel deploys. It also supports agent-driven setup: an unauthenticated agent signup provisions a Project and Bucket that a human claims later, and Cosmic ships a hosted MCP server, Agent Skills and an Agent Plugin for coding assistants. There is still no local emulator or offline mode, so all development runs against a remote dev Bucket.

Buckets serve as environments, each with its own keys. The Promote content wizard copies Objects and schema between Buckets in the same Project, with a read-only pre-flight report and Merge, Overwrite or Strict schema strategies. Application Workflows connect GitHub repos with Vercel preview deploys, and the CLI can script Object type changes. There are no versioned migration scripts, environment aliasing or branch-per-PR content environments, and Promote is a dashboard wizard rather than an API pipeline step.

The docs cover the REST API reference, CLI, MCP server, agents, workflows, Insights and framework guides. Every page is also published as Markdown, with an llms.txt index and a full llms-full.txt dump, which is good for AI-assisted development. The docs removed GraphQL and Functions without a deprecation note, and coverage of migrations and enterprise patterns is thinner than Contentful's or Sanity's. There is no interactive API playground.

@cosmicjs/sdk is fully typed, with typed responses that give IDE autocomplete. There is no first-party type generation from the content model: the docs have no codegen or typegen tooling, so developers write the types for Object types and metafields by hand. That puts it in the typed-SDK band, below Sanity TypeGen or Contentful codegen.

Cosmic shipped ten changelog entries between Aug 10 and Oct 5 2026, roughly weekly: Workflow Templates, the Cosmic Agent Plugin, Live Preview, Agent Plugins (vendor MCP servers), an append-only Audit Log, SAML SSO, Claude Opus 5.5 support, revision diffs with agent attribution, and the AI Support Agent (Oct 5). The cadence now also covers governance and editor features, not only the AI-agent surface, which earns a small lift. Not higher because each release is incremental and the small team ships mostly one feature per week; not lower because sustained weekly delivery matches the most active headless peers.

Cosmic maintains a dedicated, paginated /changelog with clear dates and per-entry narrative posts. Entries are descriptive and discoverable but read more like blog posts than structured release notes; no clear semver tagging or dedicated migration guide per release. Not higher because breaking-change sections are absent; not lower because cadence and clarity are solid.

Cosmic now surfaces a public roadmap within the dashboard where users can add and vote on feature requests and submit bug reports, alongside a new in-dashboard feedback mechanism — a step up from purely retroactive blog/changelog signaling. Not higher because the roadmap sits behind the dashboard rather than as an open public backlog with visible timelines; not lower because a structured vote-and-request channel now exists and direction is clearly communicated.

As a managed SaaS with a stable REST/GraphQL API (and a versioned API v3), Cosmic absorbs most infrastructure churn for customers. SDK 2.0 (Apr 2026) shipped as a major version signaling the upgrade, but no public deprecation timeline or codemod is documented. Media-replace continues to demonstrate reference stability ('same URL and id'). Not higher because no formal API versioning/deprecation policy is published; not lower because end-users rarely report breakage.

Company LinkedIn shows ~358 followers; G2 has only 6 reviews; no prominent Discord, and the GitHub org has modest repos. Cosmic markets '75,000+ developers' but independent third-party signals remain thin compared to Strapi, Sanity, or Directus. Not lower because a Slack community, community-members page, and steady blog cadence exist; not higher because every external signal places Cosmic well below peers.

Cosmic operates a Slack community, publishes regular Community Deployments, added an in-dashboard Comments/feedback feature, and runs a 'Cosmic Rundown' news series alongside frequent tutorials. Team members participate visibly on blog and social. Not higher because there is no large public forum, no visible Stack Overflow activity, and no documented community SLA; not lower because the team is responsive and engagement density is healthy relative to base size.

Cosmic runs a formal Partner Program connecting a global network of agencies and technology providers, with a public directory of agency partners plus tech partners. No tier-1 global SIs (Accenture/Deloitte/Valtech), no certification exams, no referenceable named implementation practices. Not higher because depth is shallow; not lower because the program is real and includes both agency and technology partners.

Most tutorials, comparisons, and guides about Cosmic are first-party (cosmicjs.com/blog and /changelog). Limited YouTube coverage, no Pluralsight/Udemy courses surface in search, and conference talks are scarce, though independent review sites (Bejamas, StaticMania, Cuspera) profile it. Not higher because third-party amplification remains thin; not lower because listing/review sites still include Cosmic.

Cosmic is a niche platform with no mention in Stack Overflow developer surveys, no certification program, and few LinkedIn profiles listing it as a primary skill. Because Cosmic uses standard REST/GraphQL with a Next.js-friendly SDK, most React/Next.js developers ramp quickly, but specialized Cosmic experience is rare. Not higher because named Cosmic experts are hard to find; not lower because the generic skill overlap is broad.

Case studies profile customers like Prairie Robotics, marketing cites 75K+ developers, and Cosmic publishes content on YC companies adopting it, but no recent Fortune 500 logo announcements and the G2 review count remains static at 6. Heavy product velocity (Gemini 3 Pro, Team Agents, Hosted MCP) suggests continued signups. Not higher because enterprise traction signals are limited and there is no public ARR or customer-count update; not lower because the platform keeps publishing customer stories and shipping features that attract new builders.

Cosmic is a bootstrapped YC (W2019) company that reached ~$1.2M revenue by 2024 with no outside venture capital beyond YC's ~$150K, operating with a small ~8-person team as of Apr 2026. Self-funding means no burn/runway distress and no layoffs, but also a tiny team and no war chest to outspend well-funded rivals. Not higher because scale and financial cushion are limited; not lower because the company is revenue-generating, stable, and shipping heavily with no distress signals.

Cosmic has executed clearly on its 'AI-Powered Headless CMS' thesis — Hosted MCP, Event-Triggered Agents, Team Agents, and Gemini 3 Pro support all shipped in 2026, and it is actively repositioning the category ('Why Headless CMS Is the Wrong Category'). No Gartner MQ / Forrester Wave recognition in Headless CMS. Not higher because analyst validation is absent and the AI-CMS space is crowded; not lower because the AI-native narrative is differentiated and visibly delivered, not just promised.

G2 rating is 4.3/5 but based on only ~6 reviews, well below the 100-review threshold for mid-tier scoring. Reviews are generally positive (praising the headless approach, ease of use, workflow automation) with minor complaints about pricing for startups and limited versioning tooling. Not higher because sample size is too thin to establish strong sentiment; not lower because what exists is favorable and no widespread negative signal appears on Reddit or HN.

Cosmic publishes every self-serve price: Free $0, Builder $99/mo, Team $299/mo, Business $499/mo, Workspace Small $999/mo and Large $2,999/mo, plus a full allowance-and-overage table for every metered resource, add-on prices, token-pack prices and an on-page pricing calculator. Only Enterprise is sales-gated, which is the industry norm. Not higher because a buyer has to combine roughly ten metered dimensions with optional $99/mo add-ons to predict a real bill.

Flat monthly tiers have clear allowances, the Builder to Team step is now 3x ($99 to $299), and Cosmic says usage is 'metered, never blocked'. Insights events are capped at 200% to prevent runaway bills, and the new AI Support Agent ships with a configurable daily token cap (default 500k). But overage is billed on about ten separate meters (uncached and cached API requests, API bandwidth, media files, storage, requests and bandwidth, Objects, Buckets, seats) and the included allowances are thin: Business includes only 150k uncached requests a month. Corrected from the prior run, which cited a $49 Builder tier and a single $10 per 1M CDN-event rate; neither exists. Not lower because every rate is published and small; not higher because the free-to-paid step is $0 to $99 and bills move with traffic on many axes.

Webhooks, Localization, Revision History and Automatic Backups are $99/mo add-ons each ($199 bundle; $199 each and $399 bundle on Workspaces) on every self-serve plan, which is aggressive for a headless CMS where webhooks and revision history are table stakes. SAML SSO is Enterprise-only and SCIM is still 'Coming soon'. On the positive side, AI agents and workflows (including the new website Support Agent), audit log, comments, all four roles and Insights are included on every plan, Free included. Not lower because core APIs and AI features are ungated; not higher because basic operational features and SSO sit behind paywalls.

Plans are month to month with no contract and no cancellation fee, yearly billing saves 10%, the Free plan needs no card, and Workspace plans carry a 30-day free trial. Enterprise can be invoiced or paid by purchase order. Not higher because there is no standard nonprofit, education or startup program (only an invitation to email support) and no prorated refunds on mid-cycle cancellation; not lower because there is no lock-in on any self-serve plan.

The free-forever plan includes 2 members, 1 Bucket, 1,000 Objects, 300k in / 300k out AI tokens, 1 agent and 1 workflow, the full REST API, SDK, CLI and MCP server, audit log and Insights, with no card required. One agent is enough to run the new website Support Agent on a free project. Not higher because Free has hard ceilings with no overage path (1GB API and media bandwidth, 10k uncached requests) and add-on features like webhooks still cost $99/mo; not lower because it is permanent, commercially permissive and genuinely capable.

REST API with MongoDB-style query operators (no proprietary query language), TypeScript SDK, CLI, MCP server and Next.js support make a first content query achievable in well under an hour for a JS developer. Add-on capabilities follow the same pattern: the new Support Agent installs with one script tag and a publishable, domain-locked key. Not higher because Bucket and Object-type modeling still need upfront decisions.

Case studies cite 67% faster time-to-market vs. WordPress for a React team, consistent with simple marketing sites landing in 2 to 4 weeks, and AI agents, workflows and the MCP server compress scaffolding. Not higher because there is no G2 Implementation award signal at the scale of Storyblok or Hygraph, and migration assistance is Enterprise-only; not lower because the stack is deliberately lightweight.

Cosmic relies on mainstream skills: REST, JSON, TypeScript, React/Next.js and MongoDB-style filters. There is no proprietary query language and no certification program, so any competent JS developer becomes productive quickly; premium is roughly 10 to 15% over generalist web development. Not higher because agent, workflow and Blocks conventions still need some Cosmic-specific familiarity for advanced work.

Fully managed SaaS: API, media CDN, storage and AI infrastructure are included in the plan price, and buyers only add front-end hosting. Not higher because included delivery allowances are small (10GB API and 10GB media bandwidth on Builder, 250GB/500GB on Business) and overage is $0.36/GB API and $0.30/GB media bandwidth, well above commodity CDN rates, so high-traffic sites effectively pay extra hosting through Cosmic. Corrected from the prior run's single $10 per 1M events rate.

Pure managed SaaS with no servers, databases, patching or scaling for the CMS; a solo developer can run a production Cosmic site. Not higher because teams still own build/deploy pipelines and caching on the consuming app, should watch metered usage across many dimensions, and self-serve plans have no uptime SLA.

Content is standard JSON over REST, SDKs and CLI, and a full Bucket exports and re-imports as a single bucket.json; Cosmic states content can be exported in full at any time. Not higher because agents, workflows, Custom Block shortcodes in rich text and Bucket-scoped relationships need rework on exit; not lower because raw data is fully portable with documented tooling.

Cosmic's content model is compact: Buckets (which double as environments, so there is no separate Environment concept), Object Types, Objects, Metafields and Media, under a Workspace > Project > Bucket hierarchy. Responses are clean JSON with a MongoDB-style query syntax and nothing proprietary to unwrap. Not higher because the AI layer (capability-based agents, AI Workflows, Agent Skills, MCP) and Custom Blocks in rich text add a second set of concepts once teams move beyond simple sites.

A 7-step quickstart, framework guides, an AI onboarding page that lets a coding assistant sign up, create a Bucket and model content through the CLI or MCP server, plus Agent Skills (npx skills add cosmicjs/skills) give AI-assisted developers a very fast ramp. Project creation can start from a template. Not higher because there is still no structured learning path, certification or interactive in-console tutorial track comparable to Contentful or Sanity, and community support is a Discord server.

A standard REST API with a fully typed TypeScript SDK (chainable queries, native fetch, zero dependencies), first-class Next.js App Router and server-component patterns, and an MCP server plus CLI that put content and schema operations inside Cursor, Claude Code and Copilot. Lowered slightly because the GraphQL API that earlier assessments credited is no longer documented, so the platform is now REST and SDK only. Not higher because schema lives in the dashboard or CLI commands rather than as typed schema-as-code in the repo, unlike Sanity or Payload.

Official templates install a content model and example content into a new Project (Simple Next.js Blog, Simple Astro Blog, Next.js Marketplace with Stripe, podcast, portfolio and a Blocks-based template), and Autopilot or a code agent can generate a full site with content model, preview route and Vercel deploy config wired in. Not higher because the catalog is small and Next.js-heavy, with thinner Astro coverage and no maintained Nuxt or SvelteKit starters at the polish of Storyblok's or Sanity's sets.

Zero-to-working integration needs three values: Bucket slug, read key and (for writes) write key, all available in the dashboard in under a minute, and the agent signup flow can even provision them for an AI assistant. The SDK has sane defaults and no dependency tree, which is simpler than Contentful's space, environment and token matrix. Not higher because each environment is a separate Bucket with its own keys, so multi-environment setups multiply credentials, and webhooks are a paid add-on that needs its own configuration.

Metafields can be added, changed or removed without downtime or migration scripts, there is no field-count ceiling, and schema is now scriptable through CLI commands (cosmic types create/update/duplicate) and MCP type tools. Promote content copies Object Types and content between Buckets with a read-only pre-flight report and Merge, Overwrite or Strict schema strategies, which gives a real path for promoting schema from staging to production. Not higher because there is no versioned migration-file framework like contentful-migration, Overwrite can delete data on target Objects, promotion only works between Buckets in one Project, and field renames still break consuming queries.

Preview now uses short-lived, Bucket-bound preview tokens: the editor clicks Preview, the site opens in a split pane inside the dashboard, and the frontend reads the token and fetches with status=any. The docs supply a drop-in Next.js helper, and sites built by Autopilot or a Cosmic agent get the preview route and link template set automatically. Raised because this is a documented split-pane flow rather than the hand-built preview mode credited before. Not higher because existing apps still need a server route, cookie handling and CSP frame-ancestors changes, and there is no click-to-edit overlay like Storyblok, Sanity Presentation or Hygraph.

A generalist TypeScript or React developer can ship a Cosmic-backed site within hours, with no certification, no proprietary query or templating language, and AI coding tools able to do much of the wiring through the MCP server, CLI and Agent Skills. Some headless modeling knowledge is needed for Object Type relationships and Custom Blocks. Not higher because extending the editor means building iframe Extensions, and getting value from the agent and workflow layer is a Cosmic-specific skill.

SaaS-only hosting removes DevOps and backend roles, and a solo developer can model content, build the frontend and deploy to Vercel end to end; Autopilot, code agents that open pull requests on a connected GitHub repo, and the CLI compress that further. Multi-locale or multi-Bucket promotion workflows may warrant two or three people, not a five-role DXP team. In line with Sanity and Storyblok.

Editors create and update Objects in existing Object Types without developers, can reuse Custom Blocks inside rich text, and Content Agents plus multi-step AI Workflows (scheduled or event-triggered, with approval gates) can draft, localize and publish content on their own. The October 2026 AI Agents rollout does not change the editor picture much, because agents are limited to Admin and Developer Bucket roles, so Editors and Contributors cannot run them. New page patterns, component types or layouts still need developer-defined Object Types, and Cosmic Pages is a publish-to-URL share page rather than a visual page composer.

Cosmic is SaaS with continuous vendor-managed deployment, so the core platform needs no version upgrades. The last generational move (dashboard v1 and REST/GraphQL v1–v3 discontinued Dec 2023) required customers to swap the deprecated 'cosmicjs' npm package for '@cosmicjs/sdk' and new API keys, though v3 was isolated from v1 production and backed by an upgrade guide with a compatibility report. Not higher because SDK/API generation changes have required customer code work; not lower because the managed platform itself never needs an upgrade project.

Vendor-managed SaaS on replicated MongoDB Atlas, S3 and Fastly, so infrastructure patching needs no customer action, and no Cosmic CMS CVEs appear in public databases (CosmicSting CVE-2024-34102 is an unrelated Adobe Commerce bug). Cosmic documents an incident response process and emails affected customers, and will send a CAIQ/SIG questionnaire on request. Not higher because /security states plainly that Cosmic holds no SOC 2, ISO 27001 or HIPAA certification and there is no public security advisory feed or bulletin cadence.

Cosmic's formal deprecations (2018-era Functions removed Mar 2022; dashboard v1 and API v1–v3 discontinued Dec 2023) came with dated notices of about six months and a compatibility tool. But in 2026 the GraphQL API, the Cosmic Functions serverless beta and Merge Requests all disappeared from the docs and site with no deprecation notice, leaving teams that used them to move to REST/SDK projections, external serverless and the Promote content wizard on Cosmic's timeline. Not higher because unannounced feature withdrawals are the most disruptive kind of forced migration and windows are well short of 12 months; not lower because the core REST v3 API and SDK have stayed stable since 2023.

SaaS model with no database, search, cache or CDN for the customer to operate; the client-side footprint is the '@cosmicjs/sdk' package, optionally the CLI and the npx-run MCP server. The new AI Support Agent installs as a single hosted script tag with a domain-locked publishable key, adding no build dependency. Not higher because customers must keep the SDK current and absorbed the legacy 'cosmicjs' package deprecation.

Cosmic runs a public Statuspage (cosmicstatus.com) with only two components, API and Web Dashboard, plus usage meters, Insights and an append-only audit log in the dashboard. Outbound webhooks have no delivery log, retries or HMAC signing (docs point to third-party Beeceptor for inspection), and roughly ten separately metered overage dimensions mean customers must watch quota consumption themselves. Not higher because webhook health and API error monitoring are left to the customer; not lower because the platform itself needs no infrastructure monitoring.

AI Workflows chain content, code and browser agents with approval gates and scheduled or event-driven triggers, and Cosmic ships templates such as a weekly job that analyzes hundreds of articles for outdated content and an Auto-SEO on Publish flow, so routine hygiene can be automated without custom code. The new AI Support Agent also logs every human-handoff question to a Support questions Object Type, surfacing content gaps. Not higher because there is still no native orphan detection, broken-reference alerting or content-expiry workflow, and agents are restricted to Admin/Developer roles; Revision History and Backups are paid add-ons on self-serve plans.

Content is served through a cached API layer with Fastly CDN and imgix for media, so customers do no query optimization, index tuning or cache configuration server-side; Cosmic reports 10x+ response-time gains from its caching layer. Not higher because uncached requests are limited to 100 rps sustained / 200 burst and allowances are thin (Business includes 150k uncached requests a month), so teams must design front ends around caching and ISR/SSG.

Cosmic's pricing table gives Free and Builder community support only, chat from Team ($299/mo) upward, and 24/7 support, a 99.95% uptime SLA and migration assistance only on Enterprise. The Oct 2026 AI Support Agent ('Leo') on cosmicjs.com now gives every user round-the-clock answers drawn from the live docs and knowledge base, with an email handoff that lands in Cosmic's support inbox, which improves first-line access on every plan. Not higher because no self-serve plan carries any response or uptime commitment; not lower because chat on mid-tier plans plus the AI front line covers most routine questions.

Cosmic's community is small next to Contentful, Sanity or Storyblok: a handful of G2 reviews, a modest community channel and thin Stack Overflow and GitHub discussion volume, though the founder and team engage directly. Not higher because edge-case answers are hard to find in public; not lower because team participation is visible and the docs are complete enough (llms.txt, markdown per page) to answer many questions without community help.

Fixes deploy immediately on the SaaS, the changelog shows a fast public release cadence through 2026 (Workflows, SSO, audit log, marketplaces, the AI Support Agent), and the status page records three incidents in 2025 and none so far in 2026. Not higher because there is no public bug tracker or critical-bug SLA, and recent feature removals went uncommunicated; not lower because reviews do not report stuck bugs.

Cosmic is explicitly structured-content/developer-first and does not ship a drag-and-drop visual page builder; it positions itself as an alternative to page-builder tools like Builder.io. Marketers can edit page field values and AI Content Agents can auto-generate landing-page copy/images, but creating new layouts still requires developer (or Code Agent) work on the frontend. That puts Cosmic in the 'marketers can edit content but not create new layouts' band, slightly lifted by AI scaffolding.

No native campaign calendar, multi-channel campaign orchestration, or campaign analytics. Cosmic provides scheduled publishing and AI-agent-scheduled content runs, which is closer to the 'scheduled publishing as the only campaign feature' band typical of headless CMS.

SEO is delivered via an SEO Fields extension/Block rather than built-in first-class SEO fields with validation. No native sitemap generation, redirect management, or canonical/Schema.org tooling — those are left to the frontend. Content model maps cleanly to schema.org (e.g., BlogPosting) but requires manual implementation. Fits the 'manual SEO field creation without built-in validation' band.

Lifted slightly. The new AI Support Agent (Oct 2026) puts a one-script-tag chat on the site that, when it cannot answer, collects the visitor's email and question, emails them to a set inbox and saves each one to a Support questions Object Type in the Bucket. That is a real, if narrow, lead-capture path. Cosmic Insights also breaks traffic out by Source / Medium / Campaign with revenue, so UTM awareness and conversion tracking now exist natively. Still no form builder, CTA management or landing-page lead forms, so it stays near the bottom of the external-tools band.

No native personalization, audience segmentation, or rule-based targeting engine. Any personalization requires pairing with an external CDP/personalization tool and frontend logic (Cosmic publishes only sample personalization apps, not a platform feature).

No native A/B testing, variant testing, or experimentation framework. Any content experiments must be orchestrated via external tools (Optimizely, VWO, LaunchDarkly) on the frontend.

This is a relative Cosmic strength: four agent types (Content, Code, Team, Computer Use) can draft landing pages, blog posts, and images autonomously, open PRs for new pages, and chain into multi-agent brief-to-publish workflows. Revision history, inline editing, bulk operations, and scheduled publishing are supported. Still relies on developer/Code-Agent implementation of new templates, keeping it below best-in-class visual-builder platforms.

Structured content via REST API and SDK feeds web, mobile and email from one source. Agents add chat channels (Slack, WhatsApp, Telegram) and browser-automation cross-posting, and the October 2026 AI Support Agent adds a website chat channel that answers from live published content, also reachable over REST and an inbound webhook. No native push, SMS or social renditions, so it remains web-first with API delivery elsewhere, at the upper end of that band.

Materially improved: Cosmic Insights is now a native, cookieless web-analytics layer built into the dashboard. Every Object gets its own Insights page (pageviews, visitors, sessions, bounce rate, sources, devices, geography) with period-over-period comparison and a real-time online count, and AI agents can read this data to close the content loop. This is exactly the 'analytics dashboards within the CMS with content performance metrics' pattern. Held below the top band because it is Cosmic's own first-party tracker (requires a one-line JS instrument) rather than pre-built GA4/Adobe/Mixpanel connectors, and there is no content-decay flagging.

Component-based content modeling (repeaters, relationships, 20+ field types) allows structured brand reuse, but there are no native design-token enforcement, locked component palettes, or restricted-override guardrails at the platform level. Consistency is enforced by frontend implementation and editor discipline.

OG/Twitter card meta can be handled via the SEO Fields extension, and AI Content Agents generate social copy. The new Computer Use Agents can now cross-post media between platforms via browser automation, giving a genuine (if unconventional) push-to-social capability beyond just meta-tag management. Still no dedicated social scheduling calendar or UGC embed workflows, keeping it at the top of the OG-plus band rather than into best-in-class social tooling.

Cosmic has a media library with imgix-backed image transforms (resize/crop/format), tagging/folders, and AI-generated alt text in bulk. No usage tracking, rights management, or full DAM capabilities. Covers basic DAM needs but not enterprise marketing asset governance.

Localization is a paid add-on ($99/mo standalone, $199/mo bundle) supporting 400+ locales as first-class in the content model with locale-aware API queries. AI Workflows can propagate source-language updates to all localized versions automatically. No native transcreation workflow or locale-specific campaign variant tooling, but practical for most marketing localization.

Cosmic now runs a plugin marketplace of about 22 vendor MCP plugins for its agents, including HubSpot (CRM/MAP), Shopify and Stripe (commerce), PostHog (analytics), Algolia, Intercom, Zendesk and Slack. These give agents pre-built connections across several MarTech categories and can be triggered by content events through AI Workflows. They are agent tool connections, not editor-side integrations or bidirectional data syncs, and there is nothing for Salesforce, Marketo, Pardot or a CDP. Outbound webhooks are a paid add-on on self-serve plans and cover only created/edited/deleted events, with no signing, retries or delivery log. Mid-band: some integrations plus generic webhooks and API.

Flexible content modeling with repeaters, relationships, and nested objects enables custom product-content types (PDP, category, variants, attributes), and Cosmic now ships a production-grade e-commerce storefront template (full catalog, collection pages, dynamic routing, SSR, imgix optimization). Not purpose-built for commerce — no product attribute library, variant inheritance, or PIM-grade features. Generic modeling repurposed for product content fits the 40–60 band.

No native merchandising: no category management UI, no cross-sell/upsell tooling, no search merchandising, no product spotlight curation. These belong to the paired commerce platform (e.g., Shopify), not Cosmic.

Shopify is documented as an integration pattern (product data mirrored into Cosmic for faster delivery), and agents can now call Shopify through a vendor MCP plugin or the generic api_request tool. There is still no product-picker UI in the editor and no live API federation; integration is per project. No first-class connectors for commercetools, SFCC or BigCommerce.

Rich content modeling supports buying guides, lookbooks, and editorial pages. Product embeds are possible via relationship fields but shoppable-content authoring is not a first-class pattern — no inline product picker with purchase CTA component out of the box.

Cart/checkout in a Cosmic+Shopify setup lives in the commerce platform; Cosmic can host banners, trust badges, and shipping callouts as content but there is no native pattern for injecting CMS content into transactional flows.

No documented post-purchase content features (order-confirmation editorial, onboarding sequences, loyalty content tied to order events). Would require custom build on top of the commerce platform's order webhooks.

Basic role-based access control (Admin/Developer/Editor) and API key management, but no B2B-specific features: no account-based catalog gating, no customer-specific pricing display, no quote-request flows, no gated spec-sheet delivery.

Content RAG (beta) now embeds every Object into a vector index and exposes a semantic search endpoint with relevance scores and snippets, filterable by type, locale and status, and an Algolia plugin exists for agents. That is basic content search with some enrichment. There is still no faceting, synonym management, search landing pages or blended content-and-product results, so commerce teams still pair Cosmic with a dedicated search engine.

Scheduled publishing enables time-activated banners and promo blocks. No native countdown timers, channel-specific targeting, or tiered-pricing table automation. AI agents can schedule promotional content generation.

Multiple Buckets can serve separate storefronts by brand or region, and Promote content copies selected Objects and schema between Buckets in the same Project. There is no shared product content with storefront-specific editorial overlays, so content is duplicated across Buckets.

imgix-powered image transforms, AI image/video generation, basic galleries and video embeds. No native 360-degree view, AR/3D model, or hotspot/zoom tooling — those require frontend libraries or third-party media services.

Multi-author content and role-based permissions allow basic marketplace-style content, but no seller-profile management, review aggregation, or moderation-at-scale tooling. Not marketplace-specific.

Localization add-on enables locale-specific product content at the content layer. Not commerce-specific — no currency-aware content blocks, regional regulatory content (EU labels, Prop 65), or market promo calendars built in.

Materially improved: Cosmic Insights now tracks conversions and revenue with one line of JS — passing revenue_cents auto-rolls the event up against the content Object that drove it, giving genuine content-to-revenue attribution within the CMS. This directly matches the content-to-revenue-attribution criterion. Held below the top of the band because it is general first-party web analytics rather than deep commerce-funnel integration (no cart/checkout funnel analytics or per-SKU product-content performance tied to the commerce backend).

Roles now span three inheriting layers (Workspace, Project, Bucket), and Contributors can be scoped to named Object types, which gives RBAC on content types. SAML SSO is now documented for Large Workspace and Enterprise; SCIM is still coming soon. There is no audience-based content visibility for end users, no field-level sensitivity and no department targeting. Bottom of the RBAC-on-content-types band.

Content modeling, revision history with a Changes diff that shows which agent wrote each revision, approval gates in AI Workflows and a documented weekly workflow template that reviews hundreds of articles for outdated content all help. The new AI Support Agent also turns published knowledge content into a live Q&A surface without a separate knowledge base. There are still no native review dates, expiry ownership or knowledge taxonomy tooling, so it remains in the adequate-modeling band.

Pure headless CMS, not purpose-built or adapted for employee portals. Building a full EX portal (news feed, directory, notifications, personalized dashboards, mobile app) requires extensive custom frontend development.

No targeted internal-comms tooling: no read receipts, acknowledgment tracking, or mandatory-read workflows. Content could be modeled as internal announcements but distribution, targeting, and tracking are not built in.

No native people directory, org chart, or HRIS connector (Workday, BambooHR). A directory could be modeled as a content type but requires full custom build.

Revision history (a paid add-on) with a per-revision diff, an append-only audit log and approval gates give basic versioned document publishing. There is no mandatory acknowledgment tracking and no review or expiry reminders.

No onboarding-specific features (role-based paths, 30/60/90-day progressive disclosure, HR-triggered new-hire portals). Would be a from-scratch frontend build.

Content RAG adds AI-relevance semantic search over CMS content, and the AI Support Agent answers questions from published content. Both are limited to Cosmic's own content: no federation across SharePoint, Confluence or Drive, no faceted filtering and no search analytics. The support agent's publishable key is built for public websites, not authenticated intranets. Still in the poor-to-basic band for internal search.

No native mobile app for editors or employees; sub-100ms REST API supports responsive frontend delivery. Team Agents in WhatsApp/Telegram/Slack give a distinct chat-based mobile access path but are agent interactions rather than a deskless-worker app.

No LMS integration (Cornerstone, Workday Learning), no native micro-learning, no completion/certification tracking. Training content can be authored as content types but tracking is out of scope.

Editor-side collaboration (comments, approvals) exists for content teams, but no end-user social layer: no public comments, reactions, forums, polls, or recognition tooling.

Team Agents run inside Slack, WhatsApp, and Telegram with persistent memory and custom personas, executing content tasks from chat. Not a full Teams/Google Workspace embedded-card experience, but the chat-native agent integration is stronger than most headless CMS peers — fits the middle 35–55 band at the top end.

Objects support scheduled publish and unpublish dates, and AI Workflows can run a scheduled job that flags outdated content (a documented template). That is basic expiry plus agent-driven staleness review. There are no native review-date fields, ownership assignment or archival workflows.

Cosmic Insights now provides real page-view analytics (visitors, sessions, sources, geography) per content Object, lifting this above 'no analytics.' However, Insights is public-web-oriented — it lacks the intranet-specific measures this item targets: department-level views, failed-search-term tracking, engagement heatmaps, and adoption dashboards. Sits in the 'basic page view analytics' band.

Cosmic's Bucket-per-brand model gives clean silo-based isolation: independent content models, environments, and API keys per Bucket, with no cross-bucket data leakage. It is not a native multi-tenant data model (no shared schema with row-level tenancy), placing it in the 55–70 silo-based-isolation band.

Promote content copies Object types and Objects between Buckets in the same Project, and Custom Blocks can be synced across instances within a Bucket, but there is no live shared global content or design tokens across brands. Cross-Project sharing has no native path. Shared frontend component libraries live in code.

The Workspace > Project > Bucket hierarchy gives central user and team management with roles that inherit downward, a Workspace-scoped append-only audit log and, on Large Workspace, SAML SSO. Cross-brand enforced content standards, approval chains and global policy configuration are still absent. Organization-level management with limited enforcement.

Workspace plans pool Buckets, Objects and usage across every Project on one bill: Small at $999/mo (5 Projects, 10 Buckets) and Large at $2,999/mo (10 Projects, 30 Buckets), with extra Buckets at $29/mo. Adding a brand costs far less than a new subscription. Usage is metered on about ten separate overage meters, and the Webhooks, Localization and Revision History add-ons cost extra, which keeps this below the volume-pricing band.

Each bucket can define its own brand theme-token content types consumed by the frontend. No platform-level theming engine that applies per-brand styles to shared rendered components. Theming is effectively frontend configuration per brand.

Localization add-on enables per-locale content in each bucket. No brand-aware translation approval workflow or regional legal governance layered on top. Brand × locale governance is handled manually per bucket.

Cosmic Insights now provides content-performance analytics scoped to the current project or bucket (its real-time online count is explicitly bucket-scoped), so per-brand analytics exist where there were none before. But there is still no portfolio-level dashboard aggregating engagement across buckets — cross-brand comparison remains a manual aggregation exercise. Fits the 'basic per-brand analytics with manual aggregation' band.

Each Project and Bucket configures its own approval gates, scheduled publishing and agent workflows, and the Workspace-scoped audit log provides central visibility, including attribution of agent actions. Approvals live in AI Workflows rather than in a configurable editorial workflow engine. Some workflow variants per brand with partial central audit.

Promote content copies selected Objects between Buckets in the same Project, with Merge, Overwrite or Strict schema strategies, after which content can be adapted locally. It works only within a Project and is a one-time copy, not live corporate-to-brand syndication with push updates.

There are no per-brand compliance rules, consent tooling, cookie-policy management or publishing guardrails. Cosmic states plainly that it holds no SOC 2, ISO 27001 or HIPAA certification, and every subprocessor is US-located, so there is no per-brand or EU data residency choice. Cookieless Insights eases consent somewhat but is not a compliance control. Generic compliance across all brands.

No platform-level design-system registry with brand-extension and version propagation. Design systems are maintained in frontend codebases and consumed across brand sites.

Central Workspace admin covers every Project and Bucket, with three role layers that inherit downward so brand teams can run autonomously. SAML SSO is now documented on Large Workspace and Enterprise, but SCIM is still coming soon, so deprovisioning is manual, and there are no shared cross-brand contributor permission sets.

Object types can be copied between Buckets in the same Project with Promote content as a shared starting point, but there is no inheritance model where a global schema is extended per brand without forking. Changes to a shared model must be promoted again by hand.

No executive portfolio reporting (freshness by brand, SLA adherence, cost allocation, capacity planning) inside Cosmic. Per-bucket views only; aggregation is a manual exercise.

Cosmic now maintains a public subprocessor register with entity locations and an opt-in advance-change notification list, and states that a DPA is available on request, which offsets the loss of the EU hosting option prior runs credited. The DPA itself is unpublished (/dpa 404s), no SCCs or transfer mechanism are documented even though all 13 subprocessors, including the AI providers agents call, are US entities, and erasure is a support-ticket flow, so it stays in the no-published-DPA band.

Cosmic states plainly that it holds no HIPAA certification, offers no BAA, and publishes no healthcare guidance. It is not positioned for PHI workloads.

Coverage is GDPR plus a California Civil Code 'Shine the Light' disclosure in the privacy policy; there is no real CCPA/CPRA notice and no FedRAMP, IRAP, C5, PIPEDA, LGPD, PCI-DSS, or HITRUST reference. That keeps it just above the GDPR-only floor.

Cosmic explicitly states it holds no SOC 2 attestation of either type. It now offers a completed CAIQ/SIG-structured security questionnaire on request, which helps procurement but is self-attested, not an audit.

Cosmic states it holds no ISO 27001 certification. AWS and MongoDB Atlas carry ISO 27001/27018, but provider certifications do not transfer to the SaaS platform.

No CSA STAR registry entry, PCI DSS, Cyber Essentials, FedRAMP, IRAP, ENS, or C5. The CAIQ-structured questionnaire is not a STAR listing and earns no certification credit.

The four selectable AWS regions (including eu-west-1) that the prior run credited are no longer listed anywhere on /security, which now describes a single replicated MongoDB Atlas cluster with media in S3 behind Fastly, and every subprocessor is a US entity. Residency is negotiated case by case ('we will tell you what we can commit to in writing'), and the Insights analytics store is explicitly US-only with EU residency deferred to a future version, placing it in the US-only, contract-only band.

Content is fully exportable via the REST API, CLI and downloadable backups (backup downloads are themselves audit-logged), giving genuine portability. Deletion is still a manual flow (deactivate the account, then email support) with no API or self-service erasure, and the stated retention is 'indefinitely unless you request deletion' rather than a committed post-termination window.

A documented audit log on every plan covers authentication, Cosmic staff support access, roles, keys, billing, content publish/delete, webhooks, integrations and data egress, is append-only with deletes rejected at the database layer, and keeps retention of 30 to 365 days by plan, with credential events held 365 days everywhere. The new AI agents are attributed under their own name, with the prompting human or an 'unattended run' marker, which matters now that agents act autonomously through Slack, WhatsApp and Telegram. Not higher because there is no log export, API, or SIEM integration, and reads, uploads and draft edits are not logged.

No WCAG 2.1 AA conformance statement or ATAG 2.0 reference exists for the Cosmic dashboard. The only accessibility-adjacent content is delivery-side (AI alt text, TTS narration), which does not count toward authoring accessibility.

No VPAT, ACR, Section 508 statement, or accessibility page is published, and the security questionnaire scope does not cover accessibility. Procurement teams needing a conformance report have no artifact.

Cosmic ships native AI text generation with real-time streaming (March 2025), an AI Content Studio (August 2025), and the Cosmic Content Assistant for SEO-friendly long-form content. Brand Guidelines (October 2025) enforce voice/style across generated content, and the API exposes multiple top-tier models (Claude Opus/Sonnet 4.5, Gemini 3.1 Pro, GPT-5 series) with chat/message support. Held below 85 because bulk editorial workflows and prompt template libraries are less formalized than Contentful AI Actions or Sanity Create.

Native image generation via Gemini 3.1 Flash Image and DALL-E 3 (up to 4K, reference-image consistency up to 14 images), native AI video via Veo 3.1 with 720p/1080p and extend endpoint, OpenAI TTS with 9 voices, plus AI-generated alt text including bulk. Generated media is auto-stored in the bucket with alt_text, folder, and metadata fields. One of the most complete media-AI stacks in the headless CMS market — score capped shy of 90 because there is no built-in Firefly-equivalent IP-safe generator or smart focal-point cropping specifically marketed.

Cosmic AI auto-translates content natively from the dashboard for all roles, and the documented Content Localization Pipeline workflow template chains agents to translate and localize content automatically, with Brand Guidelines carried into agent context to preserve voice across locales. Raised from 68 to 70 for the workflow-level bulk translation path. Held at 70 because there is still no translation memory, glossary enforcement or per-segment quality scoring.

Alt text generation (single and bulk), AI summaries and SEO-optimized content generation are built in, and the documented Auto-SEO on Publish workflow template runs an agent on the Object Published event to fill SEO metadata automatically. Raised from 65 to 67 for event-triggered SEO automation. Held below 70 because there is no on-page SEO scoring, schema markup suggestion or competitive title/description analysis.

Automations run on demand, on schedules or on content events (Object Created, Edited, Deleted, Published), and Workflows chain agents sequentially or in parallel with templates for SEO on publish, localization and editorial triage routing across properties. Bulk alt text and bulk content updates are GA. Raised from 72 to 74 for event-driven triggers and documented routing patterns; held below 80 because duplicate detection and auto-tagging against a taxonomy are not native features.

Cosmic agents are now capability-based (content, code, computer_use browser, web_browse, notifications, api_request) with request_approval as a first-class tool, persistent channels in Slack, WhatsApp and Telegram, and a Marketplace of 30 installable agent templates plus 22 vendor MCP plugins. The October 2026 AI Support Agent adds a production website channel: one script tag, a domain-locked publishable key, answers from live published content, and email handoff to a human when unsure. Raised from 80 to 82 because the agent ecosystem gap cited previously is now partly closed; short of 88 as agents remain Admin/Developer-only and marketplace depth is early.

Media asset chat, AI summaries and content-model generation provide content understanding, and a documented workflow template analyzes 500+ articles weekly for outdated content, validates links and updates flagged articles. Cosmic Insights adds source, medium and campaign attribution. Raised from 50 to 52 for agent-driven stale-content detection; held near 50 because there is no built-in content intelligence dashboard for gaps, topic clusters or editorial priorities.

Brand Guidelines (Oct 2025) provide AI-enforced brand voice compliance across generation, and Cosmic's platform-level content policy blocks disallowed outputs (celebrities, copyright, policy violations) with SynthID watermarking on generated video. No comprehensive audit scanner for accessibility, thin content, or compliance across existing published pages is advertised — auditing is focused on what AI produces, not what exists.

Content RAG embeds Bucket Objects into a native vector index on write and keeps it in sync; POST /v3/buckets/:slug/ai/search returns semantically ranked results with score and snippet, filterable by type, locale, status and min_score, and the same retrieval powers the agents search_content tool and the new AI Support Agent. It is on by default for new projects, with free embedding and token-metered queries. Raised from 38 to 56 because the prior claim of no native semantic search was wrong; held below 60 because Content RAG is still labeled Beta and lacks hybrid ranking, faceting, synonyms and query analytics.

Cosmic does not ship an ML-driven personalization engine: no audience scoring, predictive segment assignment, next-best-content recommendations, or CDP. As a pure headless CMS it expects personalization to happen in the presentation layer or via a dedicated CDP (Segment, Hightouch, etc.). Score sits at the typical 'no AI personalization' floor for headless CMS peers.

Cosmic ships an official first-party MCP server exposing 18 tools across four categories (content CRUD, media management, schema modification, and AI text/image/video generation), now offered as a zero-install hosted endpoint at mcp.cosmicjs.com plus a local stdio npm package (@cosmicjs/mcp). Access uses bucket-scoped read/write API keys so an agent holds only the permission it needs, and Cosmic markets an 'MCP control plane' governing agent access. Raised from 80 to 84 on this new evidence of granular permission scoping and governance; short of 90 pending organization-wide multi-tenant policy tooling.

More than 20 models across four providers (Anthropic, Google, OpenAI, Moonshot Kimi) are selectable per request for text, image, video and audio, but all native generation is brokered and metered through Cosmic tokens. There is no BYOK setting, custom endpoint or data-residency control for built-in AI; agent Secrets let an agent call external APIs with customer credentials, which is not BYOK for generation. Score reflects broad model choice with no key or model ownership.

Dedicated AI endpoints for text, image, video and audio, the JS SDK with streaming, hosted and local MCP server, Agent Skills for 16+ coding assistants, an agent signup API, an agent messages REST API with inbound webhooks, and now a semantic search endpoint that gives agents RAG-ready retrieval. Raised from 82 to 85 because the missing vector retrieval layer cited previously is now native via Content RAG; short of 90 without first-party LangChain or LlamaIndex integration guides.

The append-only audit log records destructive agent actions under the agent own name, names the human prompter where one existed and marks unattended scheduled runs, and since September 2026 revision history shows per-field diffs with person-via-agent attribution. Governance also includes Brand Guidelines, request_approval and workflow Approval Gates, encrypted Secrets never exposed to the model, content policy filters and SynthID on video, and the Support Agent is told to hand off rather than guess, with domain-locked keys and a daily token cap. Raised from 63 to 70; held below 75 because there is no IP indemnification, confidence scoring or prompt-template governance.

Dashboard Usage section tracks AI token consumption with input/output split, plan-based allowances (e.g., 300K free, 2M on Team, 6M on Business), token-pack overages at $9.50/M, and per-team usage monitoring. AI Agent limits are metered per plan. Score held below 75 because prompt-effectiveness analytics, model performance dashboards, and quality-trend monitoring specific to AI output are not surfaced today.