# Directus — DXP Scorecard

> Database-first, source-available content platform with dual REST/GraphQL APIs and granular permissions.

**Category:** Headless CMS · **Tier:** 4 · **Suite Capability:** 53/100 (ranked #36 of 46)

Source: https://www.dxpscorecard.com/platform/directus
Last reviewed: 2026-10-10

## Summary

Directus is a database-first content platform that turns any SQL database into a set of collections with auto-generated REST and GraphQL APIs, a Vue-based Data Studio and policy-based permissions down to the field and row. It is strongest as a developer-controlled content and data backend: modeling, relationships, extensibility and exit cost are all excellent, and its official MCP server with OAuth 2.1 puts it ahead of most platforms we score for AI agent access. It offers almost nothing above the content layer: no personalization, experimentation, forms, commerce or scheduled publishing without self-built Flows. The June 2026 move to the MSCL license, which gates SSO and custom permission rules behind the $499 per month Team plan and enforces a 3-seat, 25-collection free tier, is the biggest change buyers must weigh.

## Composite Scores

- Suite Capability: 53/100
- Cost Efficiency: 64/100
- Build Simplicity: 69/100
- Operational Ease: 46/100
- Platform Velocity: 68/100
- Compliance & Trust: 51/100
- AI Enablement: 48/100

## Use-Case Fit

- Marketing: 36/100
- Commerce: 32/100
- Intranet: 29/100
- Multi-Brand: 34/100

## Category Scores

- 1. Core Content Management: 67/100
- 2. Additional Platform Capabilities (DXP Features): 33/100
- 3. Technical Architecture: 69/100
- 4. Platform Velocity & Health: 68/100
- 5. Total Cost of Ownership: 64/100
- 6. Build Simplicity: 69/100
- 7. Operational Ease: 46/100
- 8. Use-Case Fit: 33/100
- 9. Regulatory Readiness & Trust: 51/100
- 10. AI Enablement: 48/100

## Strengths

- **Dual REST and GraphQL APIs on top of a deep extension system** (79.5/100) — Every collection is exposed instantly through REST, GraphQL and WebSocket subscriptions, with deep relational queries, JSON path filters, aggregation and an OpenAPI spec. Developers can add custom endpoints, hooks, Flow operations, interfaces, panels, modules and themes, all scaffolded by the CLI and distributed through an in-app Marketplace of roughly 700 extensions. For a buyer this means the API rarely blocks a frontend requirement and gaps can be closed in ordinary TypeScript.
- **Content modeling that mirrors your database, with very low lock-in** (77/100) — Collections are real SQL tables, relationships are real foreign keys (many-to-one, one-to-many, many-to-many and polymorphic many-to-any), and schema can be versioned and promoted with snapshot, diff and the @directus/cli sync workflow added in v12.3. Removing Directus leaves your data intact in standard PostgreSQL or MySQL tables and your files in any S3-compatible store. Teams with an existing database can put an editorial UI on it without migrating anything.
- **Field-level and row-level access control** (70/100) — Policy-based permissions grant create, read, update and delete per collection, restrict individual fields, and apply row-level rules using filters and dynamic variables such as the current user. IP allow lists, enforced two-factor authentication and SSO through SAML, OpenID Connect, OAuth 2.0 and LDAP round it out. This is among the most granular permission models in the headless market, though custom rules and SSO now require a paid plan.
- **Production-grade MCP server and governed bring-your-own-key AI** (75/100) — The official Model Context Protocol (MCP) server lets agents such as Claude, ChatGPT and Cursor read and write items, manage schema and files, and trigger Flows, and v12 added OAuth 2.1 so agents act under a real user's permissions after an explicit consent step. Every AI action lands in the activity log, drafts stay unpublished until a human publishes, and administrators supply their own OpenAI, Anthropic or Gemini keys. Translate with AI covers every configured locale at once with a glossary and style guide.
- **Mainstream stack a single developer can run** (75/100) — Directus is Node.js, TypeScript, Vue and plain SQL, with no proprietary query language or certification to learn. Directus Cloud provisions in about 90 seconds, Docker Compose is a one-file self-hosted setup, and official starters exist for Next.js, Nuxt, Astro and SvelteKit. A solo full-stack developer can realistically own modeling, API, auth and frontend for a production project.
- **Fast, well-documented release cadence and SOC 2 Type II cloud** (79.5/100) — Minor releases ship roughly monthly and the v12 cycle went from release candidate to GA to a follow-on minor within six weeks, with a structured changelog, a separate breaking-changes page and a public roadmap. Directus Cloud holds a SOC 2 Type II report from A-LIGN covering all five trust criteria, available under NDA through its Trust Center. Buyers get a product that moves quickly and a cloud option that clears a baseline security review.

## Weaknesses

- **No experience layer: personalization, testing and recommendations are absent** (17/100) — Directus ships no segment builder, targeting rules, A/B testing, recommendation engine or customer data integration, and none of the official integrations or Directus Labs extensions fills the gap. A frontend or edge layer has to make every audience decision using an external tool. Marketing teams expecting a DXP will find only a content repository.
- **The v12 relicense gates SSO and custom permissions and creates a steep price cliff** (50.8/100) — In June 2026 Directus moved from BSL to the MSCL license with active key enforcement: the free Core tier is capped at 3 seats and 25 collections, SSO is unavailable on Core and cannot be bought as an add-on, custom permission rules are ignored without a license, and self-hosted LLM endpoints are Enterprise only. The next step up is the Team plan at $499 per month annual, with only an Open Innovation Grant for companies under $5M revenue and 50 employees softening the cliff. Some self-hosters are forking older versions or moving to Payload and Strapi, so buyers should model the licensing cost before committing.
- **Heavy security advisory stream and non-semver breaks in minor releases** (43.8/100) — 2026 brought a run of high-severity disclosures, including a file upload authorization bypass, a file API path traversal, a GraphQL denial of service and a CVSS 8.7 SSO interception flaw, on top of a CVSS 9.3 critical in 2025. Patching is prompt but v12.1 removed two utility endpoints in a minor release, and there is no paid bug bounty or separate hotfix branch. Self-hosted operators must plan for frequent upgrades and run their own monitoring, since no native APM or health dashboard exists.
- **Scheduling, approvals and taxonomy are recipes, not features** (48/100) — There is no native scheduled publish or unpublish: the documented path is a cron-triggered Flow that polls a date field, which also counts against the Flow cap (5 on Core, 20 on Team). Approval routing is assembled from a status field, per-state permissions and Flows rather than a workflow designer, and taxonomies are hand-built self-referencing collections with no synonym or bulk reclassification tools. Editorial teams used to Contentful or Kontent.ai release and workflow tooling will feel the gap.
- **Compliance stops at SOC 2** (34/100) — Directus holds no ISO 27001 of its own (only its AWS hosting does), offers no HIPAA business associate agreement, and lists no FedRAMP, PCI-DSS, HITRUST or C5 attestations. A GDPR data processing agreement is available only on Enterprise Cloud, and there is no VPAT or WCAG conformance statement for the Data Studio. Regulated buyers will need to self-host and carry the compliance burden themselves.
- **Nothing for intranets or employee experiences out of the box** (21.8/100) — Directus has no news feed, people directory, org chart, internal search, acknowledgment tracking or engagement analytics. It can serve as the backend for a custom-built internal tool, but every employee-facing screen is frontend work and search requires an external engine such as Algolia or Meilisearch synced through Flows. Organizations wanting a packaged intranet should look elsewhere.

## Ideal For

- Development teams that already own a SQL database and want an editorial UI and API over it (fit 88/100) — Directus wraps existing PostgreSQL, MySQL or SQLite tables without migration, exposes them over REST and GraphQL instantly, and leaves the data untouched if the team later removes it.
- Startups and small agencies under $5M revenue and 50 employees (fit 80/100) — The Open Innovation Grant unlocks the full platform, including SSO and custom permissions, at no license cost, and self-hosting on a small VPS with managed Postgres runs for tens of dollars a month.
- Product and operations teams building internal tools, PIM or data-heavy applications (fit 76/100) — Collections, relations, Insights dashboards, Flows automation and row-level permissions make Directus a strong data platform, and real deployments use it as a product information hub feeding Shopify, Amazon and Zalando.
- AI-forward engineering teams that want agents working inside the CMS under real permissions (fit 72/100) — The official MCP server with OAuth 2.1 consent, per-agent roles, full activity logging and bring-your-own-key model configuration is more complete than almost any other platform we score.

## Look Elsewhere If

- Marketing teams that need personalization, experimentation or campaign tooling in the platform (fit 15/100) — There is no segmentation, targeting, A/B testing, form builder or marketing automation, so every one of these must be bought and wired in separately.
- Organizations buying an intranet or employee portal (fit 18/100) — No employee directory, news feed, internal search, acknowledgment tracking or engagement analytics exists; an intranet would be an entirely custom build on top of a data backend.
- Commerce teams that need merchandising, cart content or checkout management (fit 20/100) — Directus has no catalog, cart, pricing, promotion or merchandising features and no pre-built connectors to Shopify, commercetools or SAP; commerce is a Stripe tutorial built on Flows.
- Healthcare, government or other regulated buyers needing vendor-side compliance coverage (fit 25/100) — No HIPAA business associate agreement, no FedRAMP, no company-level ISO 27001 and no accessibility conformance report leave the customer carrying the compliance burden alone.

## Alternatives

Looking for alternatives to Directus? The DXP Scorecard analyst team rates 9 replacement platforms in "Best Directus Alternatives in 2026" (https://www.dxpscorecard.com/editorials/directus-alternatives), with a recommendation on who should move and who should stay. Ratings updated 2026-10-25.

---
Scored by The DXP Scorecard — an independent site; scorecards and platform inclusion are unsponsored, while the implementation partner network is sponsored and never read by scoring. Reproduce with attribution (CC BY 4.0). https://www.dxpscorecard.com