# Cosmic — DXP Scorecard

> AI-native headless CMS focused on developer simplicity, fast API delivery, and minimal DevOps overhead.

**Category:** Headless CMS · **Tier:** 4 · **Suite Capability:** 51/100 (ranked #38 of 45)

Source: https://www.dxpscorecard.com/platform/cosmic
Last reviewed: 2026-10-10

## Summary

Cosmic is a small, cloud-only headless CMS that has rebuilt itself around AI: agents, a hosted Model Context Protocol (MCP) server, event-triggered workflows and native text, image and video generation are included on every plan, Free included. A JavaScript team can go from signup to a working Next.js site in an afternoon, with no servers to run and published, month-to-month pricing from $99. The trade-offs are real: webhooks, localization, revision history and backups each cost $99 a month extra, SSO starts at $2,999 a month, there is no personalization, experimentation or visual page builder, and Cosmic holds no SOC 2, ISO 27001 or HIPAA certification and publishes no EU hosting option. It suits startups and developer-led teams who want an AI-native content backend, not regulated enterprises or marketing teams who need an experience layer.

## Composite Scores

- Suite Capability: 51/100
- Cost Efficiency: 68/100
- Build Simplicity: 68/100
- Operational Ease: 62/100
- Platform Velocity: 52/100
- Compliance & Trust: 35/100
- AI Enablement: 65/100

## Use-Case Fit

- Marketing: 40/100
- Commerce: 34/100
- Intranet: 28/100
- Multi-Brand: 38/100

## Category Scores

- 1. Core Content Management: 57/100
- 2. Additional Platform Capabilities (DXP Features): 32/100
- 3. Technical Architecture: 58/100
- 4. Platform Velocity & Health: 52/100
- 5. Total Cost of Ownership: 68/100
- 6. Build Simplicity: 68/100
- 7. Operational Ease: 62/100
- 8. Use-Case Fit: 35/100
- 9. Regulatory Readiness & Trust: 35/100
- 10. AI Enablement: 65/100

## Strengths

- **AI agents, MCP and workflows are the core product, not a bolt-on** (79/100) — Cosmic agents run with content, code, browser and HTTP capabilities, can ask a human for approval before acting, and live in Slack, WhatsApp and Telegram as well as the dashboard. An official MCP server is available hosted at mcp.cosmicjs.com or as a local npm package, exposing 18 tools for content, media, schema and generation to Cursor, Claude Code and similar assistants. Workflows chain agents on content events such as Object Published, and marketplaces list about 30 agent templates and 22 vendor plugins. For buyers who want automation that reads and writes the CMS directly, this is one of the most complete agent stacks among the platforms we score.
- **Native generation of text, images, video and audio** (76.7/100) — Cosmic brokers more than 20 models across Anthropic, Google, OpenAI and Moonshot for text, and generates images (Gemini Flash Image and DALL-E 3 with reference images), video (Veo 3.1 with an extend endpoint) and speech (OpenAI TTS) straight into the media library with alt text and metadata. Brand Guidelines carry voice and style into every generation, and auto-translate works for every editor role. Buyers get a usable media-AI stack without stitching together separate vendors.
- **Almost nothing to operate** (79.2/100) — Cosmic is fully managed SaaS on MongoDB Atlas, S3 and Fastly, with a cached API layer and imgix image transforms, so there is no database, cache, CDN or patching for the customer to run. The client footprint is one zero-dependency SDK package, and the new AI Support Agent installs as a single script tag. A solo developer can run a production site; the only cost to watch is usage overage on bandwidth and requests.
- **Fast ramp for JavaScript and Next.js teams** (75/100) — The content model is compact (Buckets, Object types, Objects and Metafields), the REST API uses MongoDB-style query operators rather than a proprietary language, and a typed TypeScript SDK, CLI and Agent Skills let a coding assistant provision a Bucket and model content on its own. A first query takes three values from the dashboard and under an hour of work, and case studies cite a 67% faster time to market than WordPress. No certification or specialist hiring is needed.
- **Published pricing, a real free plan and no contracts** (70.7/100) — Every self-serve price is on the pricing page: Free, Builder at $99, Team at $299, Business at $499 and Workspace plans at $999 and $2,999 a month, plus a full table of allowances, overage rates and token packs with a calculator. The free plan needs no card and includes 1,000 Objects, the full API, SDK, CLI, MCP server, audit log, Insights and one agent, which is enough to run the Support Agent on a live site. Plans are month to month with no cancellation fee and a 10% discount for annual billing.
- **Cookieless analytics built into the CMS** (59/100) — Cosmic Insights ships on every plan and reports pageviews, sessions, sources, campaigns, custom events and revenue, with a Performance card on each content Object so editors see what their work drives. Passing a revenue value with an event attributes it back to the content that produced the conversion, and agents can read the data to act on it. Most headless CMS peers leave this entirely to an external analytics tool.

## Weaknesses

- **No certifications, no accessibility report** (27.4/100) — Cosmic's security page states plainly that it holds no SOC 2, ISO 27001 or HIPAA certification and offers no Business Associate Agreement. It has no CSA STAR listing, PCI DSS, FedRAMP or Cyber Essentials, and publishes no VPAT or accessibility statement for the editing dashboard. A self-attested security questionnaire structured on CAIQ and SIG is available on request, but procurement teams that require an audited attestation have nothing to file.
- **US-only hosting with residency by negotiation** (42.5/100) — The selectable EU and Asia-Pacific regions Cosmic once offered are gone; content now lives in a single replicated MongoDB Atlas cluster and all 13 subprocessors, including the AI providers agents call, are US entities. Residency commitments are made case by case in writing, the Insights analytics store is explicitly US-only until a future version, and the Data Processing Agreement is unpublished and sent on request. European buyers or anyone with a sovereignty requirement should treat this as a blocker until confirmed in contract.
- **Table-stakes features sold as paid add-ons** (49/100) — Webhooks, Localization, Revision History and Automatic Backups are each a $99 a month add-on on every self-serve plan, or $199 bundled, and double that on Workspace plans. Outbound webhooks are also unsigned, with no retries or delivery log, and localization is document-level only with no fallback locale. SAML SSO appears only on the $2,999 a month Large Workspace plan and Enterprise, and SCIM provisioning is not yet available, so a Team or Business customer with a handful of editors pays well above the headline price for basics that competitors include.
- **No marketing experience layer** (19.4/100) — Cosmic has no audience segments, visitor profiles, content variants, A/B testing, recommendations or form builder; Insights even rotates its visitor hash daily, so there is no persistent profile to target. Personalization means the frontend chooses between Objects it fetches, and lead capture means modelling a form as an Object type and writing to the API. Marketing teams that expect these in the platform will need a CDP, an experimentation tool and a forms vendor alongside Cosmic.
- **Form-based authoring with a thin editorial workflow** (44.2/100) — Editors work in a field form; there is no drag-and-drop page composer, and Cosmic Pages only publishes a single Object to a shareable review URL. Preview opens the real site in a split pane with a one-hour token, but there is no click-to-edit overlay or live update as you type. Workflow is draft and published only, with approvals available through AI Workflow gates rather than configurable stages, assignments or custom roles, so editorial teams with sign-off chains will model them outside the tool.
- **A small vendor that removes features without notice** (43.4/100) — Cosmic is a bootstrapped, roughly eight-person company with about $1.2M in revenue and a thin public footprint: six G2 reviews, a few hundred LinkedIn followers and no analyst coverage. In 2026 the GraphQL API, Cosmic Functions and Merge Requests all disappeared from the docs with no deprecation notice, leaving users to move to REST projections, external serverless and the Promote content wizard on Cosmic's timeline. Specialist talent and community answers are scarce, so buyers rely on the docs and the vendor's own responsiveness.

## Ideal For

- Startups and small JavaScript teams building marketing sites, blogs or docs on Next.js or Astro (fit 84/100) — A free plan with the full API, templates that install a content model, Vercel deploys from the dashboard and a typed SDK get a site live in days with no infrastructure, and the $99 to $499 plans scale with it.
- Teams that want AI agents to run content operations (fit 80/100) — Capability-based agents with approval gates, event-triggered workflows, a hosted MCP server, Agent Skills and a plugin marketplace make Cosmic one of the few CMSs where brief-to-publish automation, translation pipelines and stale-content audits work out of the box.
- Solo developers and small agencies shipping many lightweight sites (fit 76/100) — Managed hosting, a zero-dependency SDK, agent-driven setup and a one-script-tag Support Agent keep per-site effort low, and Workspace plans pool Buckets and usage across projects on one bill.
- Developer-led companies that want built-in analytics without a separate tracker (fit 68/100) — Cosmic Insights gives cookieless traffic, campaign and revenue attribution per content item on every plan, which is enough for teams that would otherwise bolt on a privacy-friendly analytics tool.

## Look Elsewhere If

- Regulated industries and public sector buyers (fit 12/100) — No SOC 2, ISO 27001 or HIPAA, no Business Associate Agreement, no VPAT, an unpublished DPA and US-only hosting with residency negotiated case by case fail most procurement checklists outright.
- Marketing teams that need personalization, experimentation or a visual page builder (fit 20/100) — Cosmic has none of these; layouts are coded by developers and targeting, testing and forms all require external tools wired into the frontend.
- Intranets and employee portals (fit 22/100) — There is no visitor identity, gated content, people directory, acknowledgment tracking or federated search, and the Support Agent's publishable key is designed for public websites rather than authenticated audiences.
- Large enterprises with strict governance and uptime requirements (fit 28/100) — Custom roles, field-level permissions, SCIM, log export and a contractual uptime SLA are absent or Enterprise-only, SSO starts at $2,999 a month, and features have been withdrawn without deprecation notices.

## Alternatives

Looking for alternatives to Cosmic? The DXP Scorecard analyst team rates 9 replacement platforms in "Best Cosmic Alternatives in 2026" (https://www.dxpscorecard.com/editorials/cosmic-alternatives), with a recommendation on who should move and who should stay. Ratings updated 2026-10-10.

## Implementation Partners

Agencies, development shops and systems integrators listed on The DXP Scorecard as implementation partners for Cosmic: Webkul. The partner network is sponsored: Premier and Featured placements are paid, Listed placements are free. Partner listings are never read by scoring and do not affect Cosmic's scores or rank. Listing: https://www.dxpscorecard.com/platform/cosmic#partners

- **Webkul** (Implementation Partner, free listing) · https://webkul.com

---
Scored by The DXP Scorecard — an independent site; scorecards and platform inclusion are unsponsored, while the implementation partner network is sponsored and never read by scoring. Reproduce with attribution (CC BY 4.0). https://www.dxpscorecard.com