Strapi

The Content-type Builder offers a broad field set (text, rich text, Blocks, JSON, media, relations, enumerations, components, dynamic zones, custom fields) with schema stored as code in schema.json, and conditional fields. v5.57.0 closed the long-standing gap where renaming an attribute lost its data, and v5.55.0 added content type folders. Not higher because there are no union or polymorphic references outside dynamic zones and no native location field.

One-to-one, one-to-many, many-to-many and bidirectional relations are native and populatable through REST and GraphQL, and v5.51.2 made relations able to be required. The release stream shows steady relation fixes (draft-relation warnings, ordering, nested create-on-the-fly). Not higher because reverse traversal requires declaring the relation bidirectional and there are no general polymorphic references.

Reusable components nest inside entries and dynamic zones let editors assemble ordered blocks from an allowed component list; the Blocks rich text field stores JSON rather than HTML. v5.51.2 added optional component screenshots to the dynamic zone picker. Not higher because component nesting depth is limited in practice and the Blocks JSON format is Strapi-specific rather than a portable standard.

Required, unique, min/max, length, regex and enumeration validations are built in and enforced on API writes as well as the editor; v5.51.1 added opt-in strictRelations to enforce required media and relations through the API. Custom validation is possible with lifecycle hooks and middleware. Not higher because there is no declarative cross-field rule engine; conditional fields only control visibility.

Content History lets editors browse versions with author, timestamp and status and restore one, but it is Growth or Enterprise only, keeps versions 14 days on Growth (30 to 90 on Enterprise), and records only edits made in the admin panel. The free Community edition has draft and published states with no history. Not higher because there is no field diff, no branching and no restore of deleted entries.

Strapi has no taxonomy feature or tags field in core; teams model categories and tags as their own collection types joined by relations, which are then queryable through the API. Community plugins (Tags Custom Field, tagsinput) add a tags input. Scores at the floor of the tags-only band because hierarchy, governed vocabularies and bulk reclassification all have to be built by hand.

Preview renders draft or published content from any configured frontend inside the admin panel with desktop and mobile modes; on Growth and Enterprise, Live Preview sits beside the edit view and editors double-click content in the preview to edit it, driven by content source maps. v5.54.0 added Blocks support and v5.57.0 fixed click-to-edit when the script is injected twice. Not higher because inline editing is plan-gated, works only with REST (not GraphQL) responses, and per-locale shareable preview links are not documented.

The Blocks editor outputs structured JSON with headings, lists, quotes, code, images and links, and since v5.46 developers can register custom blocks. Official rendering is via a React renderer. Not higher because the core block set is thin (tables, colours and embeds come from community plugins such as Better Blocks) and the format is not a portable standard.

The rebuilt Media Library became the default in v5.54.0 with a persistent folder tree, drag and drop, non-blocking uploads, bulk move and delete, focal point, crop and (v5.57.0) rotate, plus AI captions and alt text on Growth. Sharp generates responsive breakpoint sizes on upload. Not higher because there are no URL-based transforms, WebP/AVIF conversion needs a plugin or an external service, and asset usage tracking is not native.

Core Strapi has no presence indicators, co-editing, comments or mentions; concurrent saves are last-write-wins. Review Workflows assignees and audit logs give some attribution on Enterprise, and the community Record Locking plugin adds entry locks. Scores below the locking band because locking is not first-party.

Review Workflows (Enterprise) supports multiple named workflows per content type with custom stages, roles allowed to move content into and out of each stage, assignees, list filters and, since v5.57.0, workflow and review actions recorded in audit logs. Not higher because it is Enterprise-only (Community and Growth have draft and publish only), stage and workflow counts are license-limited, and there are no due dates, parallel approvals or conditional routing.

Releases (Growth and Enterprise) bundle entries across content types and locales, each marked to publish or unpublish, and publish them together manually or on a schedule with a configurable timezone; release actions are audit logged since v5.53.0. Not higher because there is no calendar view, a release references the latest draft rather than a pinned version, and the free edition has no scheduling without a plugin.

i18n is a free core feature enabled per content type, with a per-field 'Enable localization for this field' toggle so non-localized fields are shared across locales, locale variants of each document, fill-from-locale, locale-aware API queries and locale-specific role permissions. Not higher because there are no fallback locale chains and custom locales cannot be created beyond the predefined list.

Admin RBAC supports custom roles with per-content-type actions, field-level permission toggles, locale-scoped permissions and conditions such as 'is creator'; audit logs cover tokens, accounts, webhooks and MCP actions on Enterprise. SSO is Enterprise or a paid add-on on Growth. Not higher because there is no SCIM provisioning, no environment-scoped roles and custom conditions require code.

REST and GraphQL are both generated from the schema with rich filtering, sorting, pagination, populate, status and locale parameters, plus the Document Service API, the Strapi Client and an optional OpenAPI spec route. Not higher because delivery and management share one API surface scoped by tokens rather than separate endpoints.

Self-hosted Strapi has no CDN layer, and Strapi Cloud does not cache dynamic API responses by default. Media can be offloaded to S3 or Cloudinary providers fronted by a CDN. Scores in the self-hosted band because there is no publish-triggered cache purge or edge logic.

Webhooks cover entry create, update, delete, publish and unpublish, media events and review stage changes, with per-webhook and default headers; webhook changes are audit logged since v5.56.0. Not higher because there is no retry, no delivery log, no payload filtering and no native HMAC signing; the docs only describe how to implement signature checks yourself.

Strapi is purpose-built headless with channel-agnostic content, JSON Blocks rich text, an OpenAPI spec route usable for client generation and official starters for Next.js, Astro, Nuxt and TanStack. Not higher because the only official client SDK is JavaScript and the rich text renderer is React-only.

Strapi has no visitor profiles, segments or CDP connector in any plan; the integrations directory points to Croct, Uniform and GrowthBook, which run segmentation entirely outside Strapi. Scored just below the fully-external band because nothing about audiences is surfaced inside the CMS.

Variant content can be modelled with components or relations and resolved by an external decision engine such as Croct or Uniform, but Strapi itself has no variant-per-audience feature or audience preview. Bottom of the headless fully-external band.

Testing relies on external tools; Strapi blog guides cover GrowthBook and Optimizely with content variants modelled in Strapi. No traffic allocation or results reporting in the product.

There is no recommendation engine or recommendation connector; related content is curated by hand with relation fields.

Visitor search comes through marketplace connectors that sync content to an index: the Meilisearch plugin (maintained by Meilisearch, the most-downloaded on the market), Algolia, Elasticsearch, Orama Cloud and Upstash Search. The core API only offers filter-based $contains queries. Not higher because no connector is Strapi-maintained and none ships UI components.

Strapi has no catalog, cart, checkout, pricing or inventory; commerce is always a separate platform.

Official Shopify and BigCommerce plugins built with VirtusLab add product-picker custom fields, and a Medusa integration syncs products into Strapi. This is picker-level depth, not live API federation or bidirectional sync with commercetools or SAP.

Strapi Cloud shows usage graphs for API requests, bandwidth and storage, and Enterprise audit logs track admin actions. These are operational metrics; there is no content or page performance analytics.

Community plugins embed GA4, Matomo and Plausible dashboards in the admin panel, but tag management and event tracking are entirely the frontend's job. No first-party analytics connector.

Strapi has no site entity; multiple sites are handled by modelling a site field or relation on content, or by running one instance per site as Strapi's own multi-tenancy guide recommends. No per-site configuration or shared-content governance.

TMS connectivity comes from marketplace plugins: Localazy (verified), translationstudio, plus LLM and DeepL translators; there are no official Phrase, Smartling or Crowdin connectors and no translation job UX in core. AI Translations is scored with AI features elsewhere.

There is no brand or tenant layer; brands are separated by modelling or by separate instances with roles per instance. No shared component library with brand overrides or cross-brand policy.

The new Media Library adds folders, bulk actions, cross-library search and AI alt text, but no metadata schemas, rights or expiry, approvals or asset versioning. Enterprise DAM comes through the official Cloudinary integration and community connectors. Scored in the marketplace-connector band because the native library is basic by enterprise standards.

Video uploads are stored as plain files; transcoding, adaptive streaming and players come from Mux through the verified Mux Video Uploader plugin. No native captions or transcoding.

Editors assemble pages from dynamic zone components, now with component screenshots in the picker, and see them in Live Preview, but they cannot drag and drop layout on the frontend canvas. A structured block editor with preview, the bottom of the band.

Strapi renders no pages. Strapi Cloud hosts the CMS backend only, and frontends are deployed to Vercel, Netlify or similar using the official LaunchPad starters and deploy guides.

There is no native form builder; a community 'Form Builder CMS' plugin and custom collection types for submissions are the workarounds.

The Email feature sends transactional mail through providers such as Nodemailer, SendGrid and Mailgun; marketing ESP integration is limited to a small community Brevo template sender. No subscriber sync or campaign push.

There is no marketing automation; webhooks can trigger external automation tools, which is a build-it-yourself pattern.

The official SEO plugin adds a meta component with SERP and social previews and content analysis, and community plugins add XML sitemaps (Webtools Sitemap, verified) and 301/302 redirect managers. Fields are exposed through the API for the frontend to render. Not higher because none of it is in core and structured data authoring is manual JSON.

Strapi produces no llms.txt, per-page Markdown, AI crawler controls or AI citation reporting; answer-engine readiness is entirely the frontend's responsibility. No marketplace plugin covers it.

The in-admin Marketplace lists 265 Strapi 5 plugins plus upload and email providers, with 23 verified, 17 from official partners and first-party integrations for Shopify, BigCommerce and Cloudinary. Not higher because most listings are community-made with low adoption and first-party connectors are few.

The core Users & Permissions plugin gives visitors registration, login, JWT sessions, email confirmation and social or OIDC providers (Google, GitHub, Auth0, Cognito, Keycloak), with roles that gate API access to content. The frontend team builds all portal and account pages, and there is no consent or preference management.

Strapi v5 REST has flattened responses, documentId access, 24+ filter operators, page/offset pagination, a GraphQL plugin, the v5.47 publicationFilter param, and the v5.48 optional OpenAPI spec route with config-based endpoint gating. The official @strapi/plugin-documentation (still shipping, v5.53.0 on 2026-09-09) generates an OpenAPI 3.1.0 document and bundles Swagger UI where endpoints can be invoked — so an interactive playground does exist, contrary to the prior assessment, though it is opt-in rather than default. Not higher because the built-in OpenAPI generation is explicitly flagged experimental (outside semver), and cursor-based pagination and API versioning are still absent.

No vendor-provided CDN delivery layer and no published rate limits or throughput benchmarks; performance is whatever the deployer provisions. Strapi documents ETag/Cache-Control headers so a CDN or gateway can be placed in front, and Strapi Cloud adds its own caching layer, but the reference pattern is Redis + CDN + the community REST Cache plugin assembled by the customer. Not higher because CDN-backed delivery is not native and there is still no batch/bulk API; not lower because pagination is configurable and v5.40 parallelized and cached dynamic-zone populate queries.

Exactly one official SDK: the JavaScript/TypeScript client, renamed from @strapi/sdk-js to @strapi/client (github.com/strapi/client). No official Python, Ruby, Go, Java, .NET, PHP, Swift, or Android SDKs; the older strapi/strapi-sdk-javascript is archived as unmaintained. Per rubric, 2–3 official SDKs earns 55–70, so a single-language offering sits below that; not lower because the REST surface is simple enough for raw HTTP clients and the one SDK is TypeScript-first.

The in-app marketplace was removed in v5.35, pushing discovery to market.strapi.io, community.strapi.io/marketplace, and npm. 100+ plugins span email, uploads, search, SEO, DAM, and now MCP, and key integrations (Cloudinary, S3, Meilisearch, SendGrid, Okta/Auth0) are present. Not higher because the April 2026 supply-chain incident — 36 malicious npm packages impersonating Strapi plugins without the @strapi/ scope — exposed real trust gaps in an ecosystem where discovery now happens off-platform.

Best-in-class for open-source headless CMS and materially stronger this cycle: the built-in MCP server reached GA in v5.49.0 (June 2026) — stable, free, self-hosted, no tier gating — and is itself extensible, with plugins registering custom agent tools via strapi.ai.mcp.registerTool() during register()/bootstrap(), including per-request resolveInputSchema/resolveOutputSchema that narrow the schema to the token's permissions. v5.54.0 proved the pattern by shipping upload-plugin MCP tools (asset update, folder management, move, delete). This sits on top of the v5 Plugin SDK (admin extensions, server hooks, custom fields, controllers/services, middleware, lifecycle hooks) with full source access. Not higher because plugin distribution still has no in-app marketplace and the ecosystem trust issues above apply.

SSO (SAML 2.0, OIDC — Okta, Entra ID, Google Workspace, Auth0, Keycloak) is no longer Enterprise-only: it is purchasable as an add-on on the mid-tier CMS Growth plan, which per rubric lifts this above the 60–75 Enterprise-only band, though the add-on price (~$150/mo or ~$50/seat/mo on top of Growth's $45) keeps the friction real. Session security improved substantially: admin auth moved to secure httpOnly cookies (v5.24.0), v5.50.0 added Active Devices session listing with revoke-one/revoke-all plus generated JWT_SECRET and httpOnly refresh-token scaffolding, and v5.51.0 made admin password-reset tokens expire (previously they never did). Not higher because Strapi still ships no native TOTP/MFA for the admin panel — MFA is only obtainable by delegating to an IdP, which means paying for the SSO add-on.

Community RBAC gives custom roles with per-content-type CRUD+publish permissions; Enterprise adds conditions-based field-level and content-instance control. The admin API token model introduced for the MCP server is a genuine improvement: each token has an owner, carries permissions strictly bounded to that owner's ceiling, is automatically re-clamped when the owner's roles change, and is revoked the moment the owner is deactivated — delegated agent access inherits human authorization rather than escaping it. Not higher because field-level and instance-level controls remain Enterprise-gated and audit logs (which make the model verifiable) are also Enterprise.

SOC 2 Type 2 attestation (achieved June 2024, clean report) is available via the Trust Center on request, and Strapi Cloud supports GDPR. ISO 27001 is being actively pursued but is not certified, and there is no HIPAA BAA. Per rubric SOC 2 Type 2 + GDPR without ISO 27001 maps to 65–78, but the score sits below that range because the attestation covers Strapi Cloud only — the majority self-hosted install base carries the entire compliance burden itself.

The May 2026 coordinated disclosure remains the dominant signal — five CVEs including CVE-2026-22599 (CVSS 9.3 SQL injection in Content-Type Builder) and CVE-2026-27886 (CVSS 9.2, unauthenticated boolean-oracle exfiltration of admin reset-password tokens via relational filtering, enabling full admin takeover) — on top of the April 2026 npm supply-chain attack. Recovering from 50 because the June–September window has been clean with no new advisories, and v5.50–v5.52 shipped secure-by-default hardening that directly targets the exploited classes: httpOnly refresh-token auth, upload allow/deny lists, explicit SVG denial for new projects, generated JWT_SECRET, expiring password-reset tokens, and MCP write actions landing in audit logs. Not higher because there is still no bug bounty and a 9.2 unauthenticated account-takeover finding this year is a serious mark; not lower because disclosure quality is genuinely strong (detailed blogs crediting Bishop Fox and WildWest, backports to v4 LTS) and no production breach is confirmed.

Exceptional deployment flexibility: self-host free on any cloud, Docker, Kubernetes, VPS, or bare metal with official guides for Docker, AWS, GCP, Azure, Railway, and Render, alongside Strapi Cloud managed SaaS. Per rubric both self-hosted and SaaS earns 70–80; scored slightly above for the breadth of supported targets and unrestricted private-cloud deployment. Not lower despite the Cloud Free plan being retired on 1 July 2026 (existing free projects had to upgrade or be deleted by 1 September), because that removes a managed on-ramp, not a deployment option — the self-hosted path remains fully featured and free.

Self-hosted deployments carry no vendor SLA at all — the customer owns uptime — which per rubric anchors this item low regardless of Cloud quality. Strapi Cloud publishes an uptime SLA at strapi.io/cloud-legal with terms varying by plan, backed by a public status page, and the recent record is markedly better than the prior window: only two incidents in 2026 (API response delays resolved 22 May, deployment failures resolved 17 June) with nothing since mid-June and typical resolution around 26 minutes. Recovering from 45 on that improvement, but not higher because the SLA reaches only the top Cloud tiers and the February 2026 incidents (14h39m magic-link outage, 1h15m project-creation outage) remain inside the trailing-year window.

Scaling is the operator's job: horizontal scaling works behind a load balancer or via Kubernetes HPA but requires externalized media (S3/Azure Blob/GCS), a shared database, and Redis-backed session state to make instances stateless. There is no built-in auto-scaling and no vendor CDN delivery tier. Not higher because Strapi publishes no throughput limits or enterprise-scale reference architecture, and third-party operators report degradation past roughly 200k–500k records without deliberate indexing or beyond ~100 concurrent users without horizontal scaling — 1M+ records is achievable but only with self-assembled Postgres tuning, Redis caching, and connection pooling.

Strapi Cloud runs automated backups on Pro and Business plans plus manual on-demand backups, and the data-management CLI is solid across both models: strapi export (AES-128 encrypted, compressed, --exclude/--only), strapi import, and strapi transfer between local and remote instances, with the v5.42 directory export/import format added. Standard PostgreSQL/MySQL backends mean conventional DB backup tooling applies to self-hosted. Per rubric this is the automated-backups-with-export band (50–65); not higher because Strapi documents no RTO or RPO targets and offers no multi-region failover.

Strong local-first workflow: create-strapi-app scaffolds in minutes, the dev server hot-reloads both admin and API, and development is fully offline. Because the local instance is the real server rather than an emulator, dev-prod parity is high, and the GA MCP server runs self-hosted so agent-assisted workflows work locally with no cloud dependency. Not higher because there is no containerized dev environment out of the box and no official devcontainer.

Environment handling relies on NODE_ENV plus config/env/{environment}/ directories, with v5.36 non-interactive mode and --no-build-admin making CI builds scriptable, and Strapi Cloud added data transfer between environments so promoting content no longer requires a manual dump. Schema changes are code-based and travel with the repo, which suits git-driven pipelines. Not higher because there are no branch-based content environments or deploy previews, no schema migration CLI with up/down semantics, and content transfer between environments remains Enterprise-gated in the CMS licensing tiers.

docs.strapi.io is comprehensive, well-structured, and searchable, covering REST/GraphQL, the 24 filter operators, the Plugin SDK, deployment, TypeScript, and data management, and it kept pace this cycle with new pages for the OpenAPI specification, the MCP server, and extending MCP via plugins, plus maintained release-notes and what's-new sections. Raising from 72 because an interactive playground is in fact available — @strapi/plugin-documentation bundles Swagger UI that can execute endpoints — which the prior scoring recorded as absent. Not higher because the playground is an opt-in plugin rather than hosted reference documentation, OpenAPI generation is labelled experimental, and Cloud and Enterprise documentation stays noticeably thinner than the core docs.

Strapi v5 core is written in TypeScript, new projects are TypeScript by default, and the @strapi/client SDK is typed. Raising from 64 because code generation from the content model is better than previously credited: strapi ts:generate-types emits declarations for every content-type and component, and setting autogenerate: true in config/typescript regenerates them on every server restart, so types track the admin-panel schema automatically. Not higher because the generated declarations primarily serve backend Document Service code — there is no first-class typed frontend query surface comparable to Sanity's or Contentful's codegen, and consuming the types in a separate frontend project still takes manual wiring.

Strapi shipped 10 tagged releases between v5.50.2 (Jul 15) and v5.54.0 (Sep 17) — roughly weekly — and these are feature drops, not just patches: the rebuilt Media Library went GA as the default in v5.54.0, the built-in MCP server graduated from beta to GA with audit-logged agent actions and typed builders for plugin authors (v5.52.0), and admin session management landed in v5.50.0. Delivering two flagship rewrites in a quarter while holding weekly cadence is the strongest shipping tempo in the headless segment; a small bump over the prior quarter is warranted.

The quarterly 'release roundup' series is now an established habit (Jan–Feb, Mar–Jun, and Jun–Aug 2026 editions), layered over categorized GitHub releases, docs release notes, and the Canny-backed changelog portal. The Jun–Aug roundup does call out behavioral changes explicitly (255-char default on string fields, image/svg+xml denied in new v5.52.2 scaffolds), but that surfacing happens in a quarterly blog rather than a per-release breaking-change section, so the score holds rather than climbing.

feedback.strapi.io is a Canny-powered portal running seven boards (Feature Requests, Content Editing XP, Developer Experience, Strapi Cloud, Plugin Requests, Documentation, Security) with community voting and a Candidate → Planned → In Progress → Complete status pipeline — this is a genuine public roadmap board, which the prior score under-credited. Strapi also publicly ties its 2026 'User Experience / Quality First' theme to the top-voted requests (error handling, performance, data transfer, media library stability), and the Media Library GA this quarter delivered on that. No dated timeline commitments keeps it out of the 80s.

v4.26.2 (Jun 9, 2026) is confirmed as the final v4 release — the branch is frozen at the April 30, 2026 EOL, so the prior read that maintenance was quietly extending past the cutoff does not hold, and CVE-2026-90561 (stored XSS in the content-manager WYSIWYG preview, CVSS 8.7, published Sep 13, 2026) lists all 4.x as affected with no v4 patch available despite third-party trackers citing a nonexistent '4.26.3'. v5 minors also carried behavioral changes — string fields defaulting to maxLength 255 in v5.51.0, webhooks no longer populating relations in v5.50.0 — which is loose semver discipline. Mature codemod/upgrade tooling and the absence of a new major break keep it from falling further.

Strapi sits at ~72.7k GitHub stars with ~23.8k Discord members (up from 22.7k last quarter) and 20M+ cumulative downloads across 3,000+ companies, and the npm gap is the decisive signal: ~100k weekly downloads versus Payload's ~50k and Directus's ~30k. It remains the clear adoption leader of the open-source headless segment by a 2–3× margin. Star growth has flattened to under 1% per quarter, which is why this holds rather than rises.

Strapi's own 2025 retrospective reports 30K+ commits and 9.4K PRs merged, and this quarter added contributor documentation for the MCP server (v5.52.0) — a concrete investment in making external contribution tractable rather than just accepting drive-by PRs. Discord added roughly 1.2k members in a quarter and the Community Stars program was relaunched. Offsetting that, no StrapiConf 2026 edition has been announced as of September 2026 after the first in-person event drew 350+ attendees in May 2025, so the flagship community moment has gone a full cycle without a repeat.

The Channel Partner Program retains its Solutions Partner and Reseller tiers alongside the Agency Playbook and a public partner directory, but no expansion, new tier, or certification exam surfaced this quarter. The directory still lists mid-market SIs and agencies rather than named tier-1 GSIs (Accenture, Deloitte, Valtech), which is the gap versus enterprise CMS networks. Steady but not deepening.

Strapi is the fixed reference point in essentially every 2026 open-source headless comparison — ElmapiCMS, dasroot.net, DSRPT, PkgPulse, TECHSY, FocusReactive and glukhov.org all run Strapi vs Payload vs Directus pieces, alongside Sanity's 'Top 5 Headless CMS 2026' and findstack reviews. Being the default benchmark others position against is a stronger signal than raw tutorial volume. Content is plentiful but skews toward comparison listicles over deep technical courses.

The Node.js/TypeScript foundation means the effective hiring pool is the general JavaScript developer market with no platform certification gating most work, and ~100k weekly npm downloads — double Payload's and triple Directus's — is the best available proxy for the size of the active practitioner base. Partner agencies cover implementation and Strapi Cloud removes most ops expertise from the equation. Deep plugin and customization work still requires Strapi-specific knowledge, which caps this below the 80s.

The logo roster remains strong — Société Générale, L'Équipe, Toyota, Adidas, Airbus, Amazon, NASA, PostHog across 3,000+ companies — and G2 review flow grew from ~189 to ~205 in a quarter. But the June 2026 commercial restructure works against the acquisition funnel: Cloud hosting and CMS feature licenses became separate purchases, new Essential subscriptions dropped to 50k API requests/mo at $18, and the free Cloud tier now suspends projects on limit breach. With Payload described as the default Next.js-community recommendation and no marquee new logo or StrapiConf this quarter, momentum reads as consolidating rather than accelerating.

Total raised sits at roughly $47–50M across six rounds, but the $31M Series B closed June 2022 and the only subsequent event is a $1.27M unattributed round in January 2024 — over four years without a priced round. Headcount is stable at 87–97 with no layoffs reported and shipping velocity is up, which is the reassuring side. The June 2026 move to decouple licensing from hosting, introduce yearly plans and tighten free-tier limits reads as a push toward revenue efficiency to extend runway, so the widening funding gap now carries slightly more weight than last quarter.

Strapi's claim as the leading open-source headless CMS is intact on adoption (~72.7k stars, ~100k weekly npm vs Directus 35.8k stars/~30k weekly) and it has opened a genuinely differentiated agent-native angle — a first-party GA MCP server whose write operations land in audit logs alongside human actions is ahead of anything comparable in the segment. That gain is offset by Payload, now Figma-backed, becoming the default recommendation in Next.js communities, which attacks Strapi precisely at the greenfield-developer entry point. No Gartner MQ or Forrester Wave placement keeps it from the analyst-recognition bump.

G2 holds 4.5/5 and the review base crossed 200 (~205, up from ~189), clearing the 4.5+/200+ band and staying ahead of Contentful (~4.2), with Gartner Peer Insights and Capterra corroborating. Praise consistently cites the genuinely feature-rich MIT Community Edition — unlimited entries and locales with both REST and GraphQL — plus fast content-type setup. Persistent upgrade-friction and customization learning-curve complaints, now joined by pushback on the tightened Cloud free/Essential limits, keep it in the high 70s rather than the mid 80s.

Disclosure improved this cycle: both pricing pages now carry full comparison tables publishing per-tier limits, runtime behavior, backup frequency/retention, and every overage rate (+$1.50/25k API requests, +$0.60/GB storage, +$30/100GB bandwidth, +$1.50/100 Strapi AI credits), plus add-on prices for extra environments ($60–$300/mo) and SSO ($150/mo +$50/seat). Only Enterprise ('Let's talk') and the custom-limit Business+ tier are sales-gated. Not higher because the two-axis model persists — Cloud hosting and CMS feature licensing are separate purchases, so no single page shows a buyer's true total.

The managed model got materially worse: the entry Cloud tier nearly doubled from Essential $18 to Starter $35 per project/month, pricing is per project (multi-site teams multiply), the yearly discount fell from up to 20% to up to 17%, and a fourth usage meter arrived in Strapi AI credits alongside API requests, asset storage and bandwidth overages. Starter also still 'Sleeps when idle' — the exact defect Strapi cited when killing the Free plan — so a realistic always-on production project starts at Pro $90/mo plus a $45 CMS license. Self-hosted Community stays flat, free and unmetered, which is how most Strapi teams deploy and is the only reason this isn't lower.

Gating regressed on three fronts: the SSO add-on was repriced from $50/seat/mo to a $150/mo base plus $50/mo/seat (a 3-seat team pays ~$345/mo all-in just to add SSO to Growth), Content History on Growth is now explicitly capped at 14 days retention, and Strapi AI is credit-metered at 1,000/month. Review Workflows and Audit Logs remain Enterprise-only and Enterprise is wire-transfer-only with no card payment, while Strapi AI is listed 'Not yet available' on Enterprise — the top tier cannot buy the newest features. Not lower because Community is genuinely capable: unlimited seats, content types, locales, roles and components, RBAC, i18n, REST/GraphQL, webhooks, custom fields, Blocks editor, CRON and data transfer, all MIT.

Community requires no contract and can be self-hosted anywhere, so the baseline exit cost is zero. Cloud plans bill monthly or yearly (up to 17% off, down from 20%), Growth CMS licenses are monthly card payments with no annual lock, and Strapi runs a documented discount program for qualifying open-source and non-profit organizations. Held flat rather than raised because Enterprise is wire-transfer-only with no self-serve path and there is no published startup program.

Strapi eliminated the Strapi Cloud Free plan — closed to new signups July 1 2026 and all existing free projects deleted September 1 2026 — so there is now no zero-cost managed option at all, not even a time-limited Cloud trial. What remains is the self-hosted Community edition: MIT-licensed, permanent, commercially unrestricted, unlimited seats and unlimited usage, and fully production-capable, which still clears the prompt's top band comfortably. Lower than before because the free on-ramp now requires the buyer to provision and run their own infrastructure.

The dominant path is unchanged and fast: npx create-strapi-app scaffolds locally in minutes, the Content-Type Builder gives visual schema design, and REST/GraphQL APIs are auto-generated, keeping zero-to-working-API under 30 minutes for a Node.js developer. Recent releases add DX polish — the redesigned Media Library became the default in v5.54.0 and draft/publish keyboard shortcuts landed in v5.49.0. Not higher because the accelerants that would most help a first-time evaluator are paywalled or removed: the AI Content-Type Builder needs a $45/mo Growth license, and there is no longer any free managed instance to try.

Simple sites land in days to 2 weeks, mid-complexity marketing sites and content hubs in 2–6 weeks, and complex enterprise builds with custom plugins and workflows in 2–4 months. Schema changes still require redeployment, which slows iteration once a project is in production. The sustained weekly release cadence through v5.54 has not removed that friction, so this holds flat.

Strapi is plain Node.js/TypeScript on Koa with standard PostgreSQL/MySQL/MariaDB, no proprietary language, toolchain or certification requirement, so any competent JavaScript developer is productive within days. Freelance Strapi rates run roughly $25–75/hr (averaging $65–75), which is generalist web-dev territory rather than a platform premium, and Toptal, Upwork, Arc and UpStack all maintain vetted pools with 24–72 hour matching. Not higher only because deep expertise in custom plugin architecture and v4→v5 migration is thinner than the raw Node.js pool suggests.

Self-hosting remains genuinely cheap — a $6–12/mo Hetzner or $12–24/mo DigitalOcean/Render VPS plus $7–15/mo managed Postgres puts a single-environment production floor at roughly $10–25/mo — and that is the likely deployment path for most Strapi buyers. The managed path got notably more expensive: the entry tier rose from $18 to $35 per project/month, Starter ships with no backups and sleeps when idle, so a realistic always-on production project is Pro at $90/mo plus $60/mo for a staging environment, and the free tier is gone. Lower than before because the managed floor roughly doubled and staging is now a separate line item.

Self-hosted Strapi is not zero-ops: server maintenance, database management, backups, SSL, monitoring, scaling and schema-change redeployments all fall to the team, and published TCO analyses find self-hosting only beats Cloud if DevOps labor stays under roughly 55 hours/year. The May 2026 five-CVE coordinated disclosure — including critical CVE-2026-27886 (9.2) and CVE-2026-22599 SQL injection (9.3) — plus a weekly release cadence means self-hosters carry real patch urgency rather than optional upgrades. Slightly lower than before because that patch burden is now evidenced, and even the paid Starter Cloud tier ships with no backups at all.

Lock-in remains among the lowest in the CMS market: content lives in a standard PostgreSQL, MySQL or MariaDB database you own, the codebase is MIT-licensed and forkable, and Data Import/Export/Transfer is listed as a Community-tier feature rather than a paid gate. The v5.42.0 directory export format produces readable JSON suitable for version control and diffing, and the September 2026 free-project shutdown explicitly offered self-serve export before deletion. No proprietary storage formats or binary blobs.

Strapi v5's mental model still maps cleanly to standard web dev: content types are database tables, components are reusable field groups, relations are foreign keys, and the Document Service API is the single content abstraction. The v5.49-v5.54 releases (rebuilt Media Library, MCP tool builders, audit-log exports, session management) are UI and surface work that introduce no new required core concepts—the v5.54 Media Library even ships a one-line `useLegacyMediaLibrary` escape hatch in `config/features`. Dynamic zones remain the only genuinely Strapi-specific paradigm, so the score holds rather than rising.

The docs site now ships an 'Ask AI' assistant (kapa.ai widget backed by a docs MCP endpoint at strapi-docs.mcp.kapa.ai), a clean Markdown version of every page via a `.md` suffix, reading/content-width modes and a redesigned 2-column API reference—materially better self-serve onboarding than the docs-only state scored in June. Framework-specific getting-started paths also widened now that LaunchPad documents seed, env-check and per-framework dev commands for four frontends. Still no certification, no structured learning path, and no in-console guided tour, which is what keeps it below the 75+ band.

Strapi v5 is 100% TypeScript with Vite bundling and talks to any frontend over standard REST/GraphQL; the v5.48 optional OpenAPI spec route lets teams generate typed clients with off-the-shelf tooling. Official first-party coverage now spans Next.js, Astro, Nuxt and TanStack Start—the LaunchPad monorepo carries a directory per framework and Strapi's own homepage markets those four by name—alongside the typed Strapi Client Library. No proprietary templating or query language anywhere, which is the key separation from traditional DXPs.

LaunchPad PR #150 (merged 2026-09-09) folded Astro, Nuxt and TanStack Start into the official demo repo, so one vendor-maintained monorepo now ships four frontends against a single Strapi backend with pre-built content types, a `yarn seed` demo dataset, per-framework dev commands and a `yarn check:env` preflight—plus Vercel and Strapi Cloud deploy paths. That closes the 'no official Astro starter' gap that capped this item in June. Held below 75 because the multi-frontend work is barely a week old, with the live-preview fix (PR #154) and the create-launchpad-app framework-selection CLI (PR #152) both still unmerged, and there is still no SvelteKit starter.

Dev setup stays quick via create-strapi-app with auto-generated .env, and v5.50 added security defaults to those scaffold templates, but production still needs roughly ten-plus values: APP_KEYS, API_TOKEN_SALT, ADMIN_JWT_SECRET, JWT_SECRET, TRANSFER_TOKEN_SALT, DATABASE_*, upload provider and session/cookie settings. The June-September releases added optional config surface rather than removing any—`config/features` for the Media Library toggle, Koa proxy settings in v5.52—so the total stays in the rubric's moderate 55-70 band.

The long-standing gotcha is still unfixed: PR #26749 'Preserve data on renaming attributes' remains open as of 2026-09-18 (milestoned 5.54.1, not merged), so renaming a Content-Type Builder attribute still orphans existing data and schema sync still drops managed columns without a prompt. v5.51 also tightened modeling by enforcing a default 255 maxLength on string fields, a constraint that can surprise existing models. Offsetting this, v5.52 replaced umzug with an internal migration runner, CTB relation-edit bugs were fixed in v5.52, and Strapi AI's GA Content-Type Builder generates schemas from natural language, code or Figma—but none of that de-risks changing an already-populated model, so the score holds.

Preview is documented as a free feature, but the docs are explicit that Live Preview is Growth/Enterprise-only, so Community builds get the static open-in-new-tab flow; either way setup means a `preview` block in config/admin (enabled flag, allowedOrigins, handler) plus CLIENT_URL and PREVIEW_SECRET and draft-mode fetching in the frontend. Fragility is real enough that LaunchPad ships a dedicated `yarn check:env` to catch the PREVIEW_SECRET mismatch that returns 401, and its own four-frontend preview fix is still an open PR. That keeps it in the 55-70 'requires frontend code changes but well-documented' band rather than plug-and-play.

Generalist Node.js/TypeScript developers are productive immediately—v5 is 100% TypeScript, there is no certification to obtain, and the GA MCP server plus v5.49's defineTool/defineResource/definePrompt builders let developers scaffold and drive content with standard agent tooling instead of platform-specific glue. Held at 82 rather than higher because G2 and Capterra reviewers consistently flag a steeper curve for admin-panel customization, custom plugins and version upgrades, which is where platform-specific knowledge still bites.

One developer can still ship production Strapi: the Content-Type Builder plus auto-generated APIs and admin panel cover modeling, API and content ops, and 2026 Cloud additions (self-service project transfers, downloadable backups, proactive usage alerts, environment-to-environment data transfer) remove more solo-operator toil. Small 2-3 person teams handle complex builds comfortably. Self-hosted deployments still carry DB and server ops that a pure SaaS peer avoids, which is why this stops short of the top of the band.

Day-to-day editor autonomy improved materially this quarter: v5.54's rebuilt Media Library adds an always-visible folder tree, drag-and-drop into folders, non-blocking uploads, bulk move/delete and infinite scroll, v5.53 gives admins a self-serve audit-log export, and GA Strapi AI auto-generates alt text/captions and translates on save. But the structural ceiling is unchanged—Strapi has no visual page builder, and creating new content types, components or dynamic zones remains a developer task the docs restrict to the development environment, so marketers cannot stand up a new page template on their own.

Minor upgrades remain straightforward via npm version bumps and upgrade-CLI codemods, and v5.54.0 (Sept 16 2026) showed good upgrade hygiene by swapping the Media Library default mid-minor while shipping a `useLegacyMediaLibrary: true` escape hatch in config/features; v5.52.0 also replaced the third-party umzug migration runner with an internal one. Offsetting this, PR #26749 — preserving data when renaming a Content-Type Builder attribute — has been open since June 23 2026 and slipped to milestone 5.54.1, so a routine schema change still risks data loss. Not lower because minor-version tooling and opt-out flags are reliable; not higher because the v4→v5 Document Service/response-shape migration remains manual and v5 has now accumulated 54 minors of drift ahead of an eventual v6.

No new CVEs have been published to the strapi/strapi advisory database since the May 13 2026 five-CVE batch — four clean months — while quiet hardening shipped continuously: security defaults in create-strapi-app templates, active-device session management, IP addresses dropped from session metadata and expiring admin reset-password tokens (v5.50.0–v5.51.0), path.posix.normalize route sanitization (v5.52.3), attachment file/URL access disabled in email-sendmail and private CTB fields defaulting to non-searchable (v5.53.0), plus all GitHub Actions pinned to commit SHAs. Not higher because self-hosters still apply patches manually against a weekly release train and the critical CVE-2026-27886/CVE-2026-22599 batch is only four months old; not lower because advisories are coordinated with fixes pre-shipped and proactive hardening now lands most weeks without needing a CVE to force it.

The v4 LTS backport softener credited in the prior score has expired: v4.26.2 (June 9 2026) remains the last v4 release and npm's `legacy` dist-tag still points at it three months later, so organizations still on v4 are now effectively unsupported and must complete the breaking v4→v5 migration. Commercial pressure compounds this — the free Strapi Cloud tier was removed Sept 1 2026 and Essential subscriptions dropped to 50k API requests/month with project suspension on breach, a plan change existing customers absorb on the vendor's timeline. Not lower because deprecation windows have historically been generous and the Media Library default swap shipped with an opt-out rather than a forced cutover; not higher because v4 security backports have stopped and the ~two-year major cadence points toward another disruptive v6 migration.

Dependency surface narrowed modestly this quarter: v5.52.0 replaced umzug with an internal migration runner and deduped react-dnd, v5.52.3 dropped a runtime @strapi/types import and removed unused nodemon packages, routine Dependabot bumps continued (fast-uri, ip-address), and pinning every GitHub Action to a commit SHA closed a real supply-chain vector. The S3 provider also gained credential-provider-function support (v5.50.0) alongside existing S3-compatible endpoints, keeping storage portable. Not higher because the Node dependency tree is still large and community plugins pull less-vetted transitive packages into production; not lower because core dependencies are actively pruned and patched on a weekly cycle.

Strapi Cloud shipped its first real telemetry in July 2026 — an Observability dashboard (July 13) with a usage overview, consumption graphs, traffic insights naming the five most-consuming endpoints, and live memory/CPU load, followed by revamped Cloud logs (July 20) with log search, plan-tiered retention and a details drawer exposing response time and size. Self-hosted deployments, still the dominant model, ship none of this: G2 reviewers explicitly cite the absence of native rate-limiting, API-usage analytics and built-in monitoring as something they had to build themselves. Not higher because the rubric caps self-hosted-no-monitoring at 30–45 and Cloud telemetry is paid-tier only now that the free plan is gone; not lower because the Cloud path finally offers first-party APM-grade visibility rather than bare resource counters.

Audit-log coverage expanded materially on paid tiers — an export-to-file button and content-release actions (v5.53.0), MCP agent actions (v5.52.0) and i18n locale management (v5.54.0) are now recorded, with MySQL out-of-sort-memory failures on audit-log and history listings fixed in v5.52.2 — and the v5.54.0 Media Library GA addresses a long-standing asset-hygiene pain point with an always-visible folder tree, bulk move/delete, non-blocking background uploads, infinite scroll and sort-by-file-size. Not higher because there is still no orphaned-content detection, broken-reference alerting or content-health dashboard, audit logs are licence-gated rather than core, and Content History records only Content Manager edits so programmatic writes leave no version trail; not lower because asset and audit tooling measurably cut daily operational friction this quarter.

Concrete query and memory fixes landed this quarter — v5.49.0 eliminated a full-schema component_type IN scan on dynamic-zone populate and now throws a ValidationError when populate exceeds the qs arrayLimit, v5.52.0 merged query populate paths, v5.51.2 escaped LIKE wildcards in filters and switched uploads to stream to disk instead of buffering in memory, and v5.52.2 fixed slow admin startup with many roles — while Strapi Cloud's new CPU/memory graphs and top-endpoint traffic insights finally make load visible without third-party APM. Not higher because self-hosted deployments still own all caching (Redis, CDN, reverse proxy), index tuning and deep-population discipline with no built-in cache layer; not lower because the quality-first program is demonstrably removing pathological query patterns rather than only patching symptoms.

Support tiering is structurally unchanged — Community edition has no formal support, Cloud includes basic support, and dedicated support with response SLAs remains Enterprise-only — but the entry point narrowed when the free Strapi Cloud tier was withdrawn Sept 1 2026, leaving no zero-cost route to any vendor-backed channel, and licensing now splits across two paid axes (Cloud hosting Essential $18/Pro $90/Scale $450 plus a separate CMS licence at Growth $45 + $15/seat or quote-only Enterprise). G2 sentiment stays split between reviewers calling support responsive and detailed and those noting it needs a team of technical people to bug fix and support. Not higher because meaningful SLAs still require Enterprise and the free on-ramp is gone; not lower because Enterprise support is competent and the coordinated May 2026 disclosure was handled professionally.

Community engagement remains among the strongest in open-source CMS: 467 PRs merged and 326 issues closed between June 20 and Sept 18 2026, only 219 open issues for a repo this size, and every release credits a dozen-plus named external contributors alongside active Discord, forum and GitHub Discussions channels with core-team participation. Not higher because 320 open PRs now outnumber open issues and Discord carries no team-response guarantee; not lower because contribution velocity is measurable and maintainers demonstrably merge outside work every week.

The weekly release train ran unbroken from v5.49.0 (June 24) through v5.54.0 (Sept 16 2026) with no skipped weeks, carrying 326 closed issues and 467 merged PRs in the quarter plus continuous security hardening and zero new CVE disclosures since May. Not higher because PR #26749 — the fix preserving data when renaming a Content-Type Builder attribute, a data-loss-class defect — has sat open since June 23 2026 and slipped to milestone 5.54.1, and 112 open issues (51% of the backlog) are over a year old; not lower because shipped throughput is high, visible and verifiable release by release.

Strapi v5 still has no native visual page builder — landing pages are assembled from Dynamic Zones with form-based editing. v5.51.2 added an optional `preview` key to a component's `info` block in schema.json pointing at a committed image or CDN URL, so the dynamic-zone picker renders a component screenshot thumbnail in place of the generic icon, with a larger preview on hover (falling back to the icon when absent or broken). That is a genuine marketer-facing gain — editors can now recognise what they are inserting visually rather than decoding component names — but it is developer-configured and does not change the underlying model: no drag-and-drop canvas, no in-place layout composition, and new page layouts still require a developer to define components and zones. Stackbit adds visual assembly as a partner product and Vercel-powered Visual Editing remains a beta, Enterprise/Cloud-gated integration. Sits at the top of the 25–45 'every new layout requires a developer' band.

Strapi offers Releases with scheduling — content bundled and published automatically at a chosen date/time in a chosen timezone, integrated with Review Workflows for approval-based publishing. Strapi markets a 'Campaign-Ready CMS Platform' page, but there is still no campaign analytics, no multi-channel campaign coordination, and no content calendaring view. Scheduled publishing remains the only campaign-adjacent feature, and content scheduling/unscheduling beyond Releases is still served by community plugins (Publisher, Content Scheduling). No campaign tooling in v5.49–v5.54.

No built-in SEO tooling in core. SEO is served by the plugin ecosystem, which did consolidate in Strapi's favour: the SEO plugin now lives under the strapi-community GitHub org as @strapi-community/plugin-seo (billed as 'the official plugin to make your Strapi content SEO friendly'), providing meta tag management, Open Graph and content analysis, and the standalone sitemap plugin has been folded into the Webtools suite, supported from Strapi 5 onward only as the webtools-addon-sitemap. A production SEO setup therefore still means composing plugin-seo + a sitemap addon + Webtools + custom JSON-LD. Correcting a prior over-credit: Strapi AI does not ship an SEO recommendation engine — the shipped AI surfaces are the Content-Type Builder assistant, AI Media Library (alt text/captions, which aids SEO indirectly) and AI Translations; 'SEO meta tags on demand' appears only as aspirational blog framing, not a released feature. No native SEO fields, sitemap generation, or redirect management in v5.49–v5.54.

No built-in form handling, CTA management, lead capture, conversion tracking, or UTM awareness. Community form builder plugins exist for Strapi v5 (strapi-plugin-form-builder-cms provides an admin-panel visual form builder; strapi-api-forms-v5 offers multi-step form creation with submission handling), but these are third-party and still require frontend integration to render. All lead capture and conversion measurement beyond basic form definition lives in external tools. v5.49–v5.54 add no native form or conversion tracking features.

No native personalization engine — zero audience segmentation, behavioural targeting, or geo-targeting in the admin. Integration pages exist for Optimizely and GrowthBook, and Croct publishes Strapi-specific personalization templates, but every targeting decision must be implemented at the frontend or inside a separate personalization platform. Independent comparisons place Strapi in the 'requires fully external tools' bucket for personalization. No changes in v5.49–v5.54.

No native A/B testing — no traffic allocation, no statistical analysis, no experiment management, no winner selection inside the Strapi admin. GrowthBook (with a dedicated GrowthBook-authored Strapi + Next.js guide) and Optimizely are the documented paths, but implementation means modelling experiment variants as content and routing traffic at the frontend or testing-platform layer. v5.42.0 removed A/B testing from the CLI prompt, and nothing in v5.49–v5.54 reverses that direction.

Strapi's editorial velocity tooling continues to compound. Existing: Live Preview (GA, including images/video since v5.46.0), Draft & Publish with per-locale lifecycle, multi-stage Review Workflows with assignee/stage list filters, Content History with diff/rollback, Conditional Fields, and Strapi AI for modelling and metadata. New in this window: the redesigned Media Library shipped as the default in v5.54.0 (always-visible folder tree, drag-to-file, non-blocking upload progress so editors keep working during uploads, search/sort/filter spanning assets and folders), component preview thumbnails in the dynamic-zone picker (v5.51.2) that cut the guesswork out of assembling pages, and publish-time warnings when an entry references unpublished entries — surfaced in both the edit view and list-view bulk publish, and since refined to stay quiet when the relation is already published or was disconnected in the same edit — which removes a common rework loop. MCP reached GA in v5.49.0, letting agents drive content operations. Headless architecture still requires a developer for new layouts, capping the score below the 70+ band.

REST and GraphQL APIs deliver structured content to web, mobile, kiosk, IoT, or any other consumer. The MCP server graduated from beta (v5.47.0) to GA in v5.49.0 and became extensible, exposing content types as agent-callable tools scoped by an Admin token — AI agents and assistants are now a first-class, supported programmatic surface rather than an experiment, and as of v5.52.0 MCP relation output returns identity-only shapes so responses stop dragging entire related documents along. The v5.48.0 optional OpenAPI spec route keeps the REST API self-documenting for arbitrary downstream consumers. Still firmly web-first-with-API-delivery: no native push-to-channel workflows (no publish-to-social, no email/SMS send) and no channel-specific renditions.

No native analytics. A plug-and-play Google Analytics 4 dashboard plugin for Strapi 5.x is available on Strapi Market — install, add credentials, and GA metrics render in the admin panel — but it is a community plugin, not core, and surfaces GA reporting rather than content-level performance or decay data. Google Tag Manager remains the recommended pattern (frontend initialises GTM and pushes Strapi content metadata to the data layer), and Mixpanel connectivity goes through n8n. All reporting lives in external tools. v5.49–v5.54 add nothing here.

No native brand style guide, design token enforcement, or approved-component-palette restriction. Dynamic zones do let a developer constrain which components a given page type may use, and v5.51.2 component thumbnails make those choices legible, but nothing validates brand compliance of the values an editor types — free-text fields accept anything. Brand guardrails are enforced at the frontend layer or by editorial process, not by the CMS.

No built-in social features. @strapi-community/plugin-seo handles Open Graph and Twitter Card meta fields, giving basic social preview management. No social scheduling, no push-to-social workflow, and no UGC embed support exists natively or as a maintained marketplace plugin. Social remains entirely a frontend implementation concern.

The single largest improvement in this window. The redesigned Media Library became the default for everyone in v5.54.0 (16–17 September 2026) after a beta period behind the `betaMediaLibrary` flag: every screen and flow was rebuilt, folders now live in an always-visible sidebar tree where editors create, rename and navigate them, assets drag onto any folder including deep nested ones from either the list or the sidebar, the upload progress panel no longer blocks work while transfers run, and search/sort/filter apply across assets and folders alike. At marketing asset volumes that is the difference between a usable library and breadcrumb archaeology. Layered on top: AI Media Library auto-generates alt text and captions on upload with retroactive backfill (v5.34.0) on the Growth plan, official Cloudinary custom-field integration browses and inserts Cloudinary assets in-admin, focal-point picking (v5.35), and S3-compatible storage. Real gaps keep it out of the 65+ DAM band: no rights management, no brand portals, no asset usage tracking, no distribution workflows. Minor friction: apps scaffolded by create-strapi-app now reject SVG uploads by default on security grounds.

i18n is core in Strapi v5 (a plugin in v4) with independent draft/publish state per locale, and Releases schedule per locale, which supports regionally-timed campaign activation. AI Translations (Growth plan) auto-translate content into every selected locale when the default-locale version changes, and this window fixed a real reliability defect: AI-generated localizations now respect field length constraints instead of overflowing them — material for marketing copy where headline and meta fields carry hard character limits. Bulk publish actions also apply only to the selected locale, giving per-market publication control. Limits: AI translation is machine translation, not transcreation; there are no locale-specific campaign variant workflows and no market-level regulatory/consent content tooling.

Breadth is good and generic programmatic connectivity keeps improving, but the catalogue's provenance is worth stating plainly: the integrations directory now lives at community.strapi.io/integrations and is framed as community-built integrations, alongside a community marketplace — the HubSpot, Salesforce, Optimizely and GrowthBook listings all resolve there. A genuinely vendor-built subset exists (Shopify, BigCommerce and Cloudinary were launched by Strapi with VirtusLab). Email marketing (Drip, MailerLite, GetResponse), Zapier and n8n cover the long tail. Generic connectivity strengthened this window: MCP went GA in v5.49.0 for agent-driven orchestration and the v5.48.0 OpenAPI spec route makes the REST API self-documenting for connector and iPaaS authoring. Direct Salesforce data sync still requires middleware or custom lifecycle hooks, and no new pre-built MarTech connectors shipped, so per-connector depth remains uneven.

Flexible content modelling represents products via custom content types, components for variants, and media per SKU — generic types well adapted to product content. The official Shopify and BigCommerce custom-field integrations let editors browse and select products from the commerce store inside the admin without extra plugins or custom code, but that is a reference picker, not PIM depth: no variant/SKU management, no attribute management, no product taxonomy primitives, no purpose-built product relationship types. Commerce remains the system of record for product data. No product-modelling additions in v5.49–v5.54.

No merchandising capabilities. No category or collection management beyond generic content relationships, no cross-sell/upsell content management, no search result merchandising, no product spotlight tooling. Merchandising sits outside Strapi's scope and no marketplace plugin addresses it. v5.49–v5.54 confirm no merchandising additions.

The official Shopify and BigCommerce integrations (built with VirtusLab) expose custom fields that browse and select products from the connected store directly in the Strapi admin with no extra plugins or custom code — a real product picker UI, which lands this squarely at the floor of the 40–60 band. Depth stops at product reference and sync: no API-level federation, no real-time inventory or pricing surfacing, no co-authoring of content and product in one editor. commercetools and Salesforce Commerce Cloud have no first-party integration. No new commerce integrations in v5.49–v5.54.

Editorial commerce is a stated Strapi use case — buying guides, lookbooks, campaign landing pages and product spotlights are achievable with Dynamic Zones, the customizable Blocks editor and media components, and the Shopify/BigCommerce product picker allows embedding product references inside editorial content. Component preview thumbnails (v5.51.2) make assembling these editorial layouts less opaque. But shoppable content with inline purchase CTAs and shop-the-look are not first-class authoring patterns — the product reference carries identity, and rendering it as a buyable unit is custom frontend work.

Strapi does not manage checkout flows or cart logic — those live in Shopify, BigCommerce or commercetools. Promotional banners and trust badges can be authored in Strapi and fetched by the commerce frontend via API, but there is no CMS-native mechanism for injecting content into checkout templates and no awareness of cart state. Anything beyond a statically fetched banner is custom integration work.

Order confirmation content, delivery updates and product onboarding sequences can be modelled as content types and delivered via API, but Strapi's webhooks fire on content lifecycle events (create/update/publish), not on order lifecycle events. There is no integration with order management systems for event-triggered content delivery, so sequencing post-purchase content against real order state is entirely custom.

RBAC with field-level permissions can gate B2B catalogue sections or spec-sheet content by role, and the Users & Permissions plugin can scope end-user API access, which covers the 'basic access control applicable to B2B' notion. But there are no purpose-built B2B features: no quote-request flows, no customer-specific pricing display, no account-based content management, and no spec sheet or technical documentation tooling. Nothing added in v5.49–v5.54.

Built-in search is API-level filtering only. No content-side faceted enrichment, no synonym management, no search landing pages. Algolia is available as an integration enabling product-content blended search, and SearchBlox is listed, but both require custom implementation and indexing pipelines. The v5.54.0 Media Library redesign improved search across assets and folders, but that is asset discovery inside the admin, not end-user commerce search.

Releases with date/time scheduling in a chosen timezone let promotional content — sale banners, countdown pages, promo landing pages — be bundled and activated at a set moment, gated behind Review Workflow approval, with per-locale scheduling for regional promos. Publish-time warnings for unpublished relations reduce the risk of a promo going live with broken references. Gaps keep it mid-band: no countdown timer components, no channel-specific targeting for promos, and no promo-code or tiered-pricing messaging primitives — this is generic content scheduling applied to promotions.

No native multi-storefront content management. Strapi's own guidance is one instance per project or client; a single instance serving several storefronts means content-type discriminators and tenant-aware middleware, which Strapi explicitly advises against unless absolutely required and well understood. There is no shared-product-content-with-storefront-specific-editorial pattern in the product. This is the 'separate instance per storefront' band.

Commerce media handling improved materially this window. The redesigned Media Library became the default in v5.54.0, and at product-catalogue scale its always-visible folder tree, drag-to-file (including onto nested folders), and search/sort/filter spanning assets and folders make organising per-SKU imagery genuinely tractable where the old breadcrumb navigation did not. Cloudinary's official custom field browses, inserts and transforms assets in-admin; focal-point picking (v5.35) and AI-generated alt text/captions on the Growth plan round it out. Still short of commerce-grade: no 360-degree views, no AR/3D model references, no image hotspots or zoom primitives, no native product video hosting. Minor friction — new create-strapi-app projects reject SVG uploads by default, which affects vector brand and spec assets.

RBAC allows multiple users and roles with scoped permissions, so basic multi-author content management is possible and different sellers could in principle own different content areas. But there are no marketplace features: no seller profiles, no seller-contributed product descriptions with a moderation queue, no review aggregation, and no content quality workflow built for marketplace scale. Review Workflows could approximate moderation but are not designed for external contributor throughput.

Core i18n with per-locale draft/publish state enables locale-specific product content on independent publication schedules, and Releases schedule per locale, which supports market-specific promo calendars. AI Translations (Growth plan) auto-translate product descriptions into all selected locales and now respect field length constraints — relevant where product titles and meta fields carry hard limits. Bulk publish applies only to the selected locale. Gaps: no currency-aware content blocks and no native regulatory content management for EU labelling or CA Prop 65.

No connection between Strapi content and commerce outcomes. No revenue attribution to content pages, no content-assisted conversion tracking, no product content performance reporting. The Shopify and BigCommerce integrations are product pickers — reference selection inbound, with no analytics flowing back. Commerce analytics lives entirely in the commerce platform or external tools, and editors see none of it in Strapi.

Granular admin RBAC with field-level permissions and conditions-based access control, plus SSO on Enterprise supporting Active Directory, Okta, Auth0 and Keycloak. Session control improved concretely this window: v5.50.0 added Active devices under the profile menu, listing every session on the account with a device label, start time and last-used time, marking the current session and allowing revocation of one or all — and in the Users & Permissions plugin's refresh mode, authenticated end users can list and revoke their own sessions via REST API, the first session control that reaches portal consumers rather than only admins. Since v5.24.0 admin auth data sits in secure HTTP-only cookies. Earlier additions (admin user list/delete CLI, RBAC-aware populate, API-token support for admin permissions) still apply. The ceiling stands: audience-based content visibility for intranet consumers — restricting a page to a department or team — remains custom frontend work, so this sits at the top of the 40–60 'RBAC on content types' band rather than the 65+ band.

Content History with diff and rollback, Draft & Publish, and multi-stage Review Workflows cover versioning and approval for knowledge articles. The MCP server reaching GA in v5.49.0 — content types exposed as agent-callable tools scoped by an Admin token, now extensible — makes Strapi a credible retrieval backend for AI knowledge assistants, and v5.52.0's identity-only relation shapes keep agent responses from dragging whole related documents along. Strapi AI assists with drafting and metadata. What is still missing is the knowledge lifecycle itself: no content expiry or archival workflow, no built-in knowledge taxonomy, and internal search limited to API filtering. Note also that Content History records only Content Manager edits — programmatic writes create no version — so an API-fed knowledge base has gaps in its own history.

Strapi is a backend for employee-facing portals, not a portal platform. No notification system, no social features, no employee directory, no personalised dashboards. The admin panel serves content editors, not portal consumers. The Tesco deployment — a 500k-user employee portal across 24 channels — demonstrates this is achievable, but Tesco built the portal experience and custom plugins themselves on top of Strapi's API. That is the correct reading for this item: the platform supplies content infrastructure, the experience is custom.

Strapi's intranet solutions page advertises announcement systems with targeted delivery and read-receipt tracking, but the Tesco case study confirms that layer was custom-built on Strapi's API, not consumed as a feature. RBAC-based role and group content scoping can approximate audience-targeted announcements, and Releases can schedule company news. There is no native notification system, no read-receipt tracking, and no mandatory-read workflow in the admin — all require custom frontend implementation.

The intranet solutions page lists employee directories with org charts and skills databases, but this means modelling employee profiles as content types with relation fields for hierarchy — buildable, not native. No directory browsing UI, no org chart visualisation, and no HR system integration (Workday, BambooHR) exists in the product or marketplace. Sits in the 25–45 'buildable via content modelling' band.

The compliance evidence trail improved meaningfully this window. v5.53.0 added an audit-log export button: users holding the Audit Logs export permission can export the current filtered set as CSV, each export is itself recorded as an audit-log.export event that appears in the exported file, and exports run to 1,000,000 rows by default. v5.52.0 stamps an origin key on every logged action — mcp or admin — so a policy change made by an agent is distinguishable from one made by a person. Retention is configurable, though only from config/admin with no UI. Combined with Content History diff/rollback and Review Workflows as approval stages, that covers versioned policy publishing with a defensible audit trail. Still missing the features that define the 60+ band: no mandatory acknowledgment tracking, no automated review-date or expiry reminders, no document expiry enforcement.

Onboarding journeys can be modelled as content collections — role-specific pages, sequenced content types, task list components — and delivered via API to a custom portal. Releases could stage content over a 30/60/90 window. But there is no onboarding module, no progressive disclosure mechanism tied to a start date, and no HR-triggered new-hire workflow. Buildable with substantial custom development, which is the 25–45 band.

Built-in search is string filtering over content type fields — adequate for small collections, weak at intranet volumes. Algolia is available as an integration and delivers faceting, relevance tuning and search analytics for intranet content, with SearchBlox also listed, but both require indexing pipelines and custom implementation. Federated search spanning Strapi plus SharePoint, Confluence or Drive is not achievable with off-the-shelf integrations, which is the defining capability of this item.

Content delivered over API reaches any mobile frontend, and Strapi's intranet page references mobile optimisation and PWA support. Admin responsiveness continued to improve through this window — the Content Manager edit view, list view, content history forms, subnav and main navigation all received targeted small-screen work — but that benefits editors, not frontline consumers. There is no native Strapi mobile app, no offline support, no push notification system, and no kiosk or shared-device mode. Tesco's frontline PWA was custom-built.

No LMS integration and no native learning features. Training content can be structured as content types and delivered via API to a custom learning portal, but there is no integration with Cornerstone, Workday Learning or any LMS for completion tracking, certification or course assignment, and no SCORM/xAPI support. Everything beyond content hosting is custom.

No built-in social layer. No comments, reactions, discussion forums, polls, peer recognition, idea submission, or community spaces in the admin or as deliverable features. A community comments-moderation plugin exists in the marketplace but moderates comments an application collects rather than providing an engagement layer. All social engagement is custom frontend development — a consistent gap across headless CMS platforms.

No native Microsoft Teams, Slack, or Google Workspace integration. n8n workflow templates connect Strapi to Slack and Google Workspace Admin, enabling custom notifications on publish, and Strapi's webhooks can post to an incoming webhook URL, but that is generic plumbing. Community forum threads requesting Teams and Slack integration remain without an official offering. Embedded content cards, bots and single-pane experiences are entirely custom.

Review Workflows enforce review cycles through configurable stages, Content History gives diff and rollback, and Draft & Publish takes content offline. Governance evidence improved this window: audit logs are now exportable as CSV from v5.53.0 with retention configurable via config/admin, and v5.52.0's origin key separates agent-driven from human changes — useful for proving who changed what and when across an intranet's content estate. Publish-time warnings when an entry references unpublished entries (edit view and bulk publish, since narrowed to cases that warrant it) prevent a class of broken-state publishing. What is still absent defines the ceiling: no automated review dates, no stale content flagging, no archival workflow, no ownership assignment, and no expiry scheduling in core — Strapi's own guidance points to community scheduling plugins for unpublish automation.

No built-in internal analytics. Tesco's read-receipt tracking was custom-built on Strapi's API, not a platform capability. There are no department-level content views, no failed search term reporting, no engagement heatmaps and no adoption dashboards inside Strapi. The community GA4 dashboard plugin surfaces web analytics in the admin but reports public site metrics, not intranet engagement by audience. Internal measurement is entirely custom.

No native multi-tenant architecture. Strapi's own guidance in 2026 is one instance per project or client, explicitly advising teams to avoid complex single-instance multi-tenancy unless absolutely required and well understood; where a shared instance is unavoidable, it means custom tenant-aware data models, middleware and role-based access control that demand deep customisation and ongoing maintenance. Community plugins offer pseudo-tenancy without official support. The multi-site feature request (issue #1465) and the feedback-portal multi-tenancy request both remain open with no roadmap commitment. Separate instances give real isolation but that is deployment topology, not platform architecture — the 30–50 'no native isolation' band.

Components are shared across content types within one instance but cannot be shared across instances. No cross-instance template sharing, no global design tokens, no brand-level overrides at the CMS layer. Data transfer between Strapi Cloud environments and the v5.42 directory export/import format move content and schema as payloads, not as a live federated library — a copy, after which the two diverge. Multi-brand component sharing requires custom synchronisation.

No centralised governance across brands or instances. Review Workflows are per-instance, audit logs are per-instance (CSV export added in v5.53.0 helps assemble evidence but the aggregation across brands is manual), and there is no cross-brand approval hierarchy, global policy enforcement, or centralised user management. Multi-brand governance is an organisational process layered over independent installations, not a platform capability.

Economics moved against multi-brand deployments this window. The Strapi Cloud Free plan was removed on 1 July 2026, with existing free projects given until 1 September 2026 to upgrade or be deleted — the zero-cost path for spinning up an additional brand project on Cloud is gone. Pricing is also now two axes rather than one: Cloud hosting is billed per project (Essential/Pro/Scale) and CMS features are a separate licence (Community/Growth/Enterprise) with per-seat charges on Growth, so adding a brand adds a project fee plus seats, and Strapi AI runs on a credit system on top. There are no volume discounts and each brand typically needs its own instance, so cost scales linearly at best. The genuine counterweight remains real: self-hosting the Community edition carries no licence cost per brand at all, which is a material advantage over per-brand-licensed DXPs. That keeps this at the bottom of the linear-scaling band rather than dropping into super-linear.

No per-brand theming at the platform level. Brand visual identity — themes, colours, typography, logos — is entirely a frontend concern because Strapi delivers raw structured content over API. The admin panel supports a custom logo and colour scheme, but that brands the editor UI, not the delivered experience. No shared component structures with brand-level style overrides exist.

No brand-locale governance distinction. With one instance per brand, each instance configures its own locales and translation workflow independently, and there is no mechanism to coordinate translation approvals across brands, enforce shared versus isolated translation workflows, or govern regional legal content at portfolio level. AI Translations operate per instance. Cross-brand localisation governance is fully manual.

No cross-instance analytics. Each instance operates independently with no centralised reporting — no portfolio dashboard, no content velocity comparison across brands, no publishing cadence benchmarking. Strapi Cloud gives per-project visibility only. Audit log CSV export (v5.53.0) makes per-instance data extractable, but aggregating it into a portfolio view is custom work outside the platform.

Review Workflows are configurable per content type within an instance, so different approval chains per content area are possible, and with one instance per brand each brand gets fully independent workflows — including the assignee and stage list filters added in v5.46.1. What is missing is the other half of the item: central auditability. There is no cross-instance workflow audit view, so independent configuration comes at the cost of any portfolio-level oversight.

No cross-brand syndication. Press releases, legal disclaimers and shared announcements cannot be pushed from a corporate instance to child brand instances with controlled override points — that requires custom API-to-API pipelines or webhook-driven sync. Data transfer between Cloud environments and the directory export/import format support one-time migration and environment promotion, not ongoing syndication with override control. Strapi has no content federation module.

Self-hosting gives full control over data residency per brand, which satisfies GDPR and CCPA placement requirements at the infrastructure level, and Tesco's on-premise deployment is a worked example of meeting GDPR with SSO, API tokens, per-endpoint custom policies and audit logs. Audit-log CSV export (v5.53.0) with configurable retention improves the evidence trail for regulators. But per-brand compliance guardrails — blocking non-compliant publishing, enforcing cookie consent per brand, checking accessibility standards per region — are not platform features. Generic compliance infrastructure is present; per-brand enforcement is not, which is the 25–45 band.

No federated design system management. Component types give consistency within one instance, but components cannot be maintained centrally and consumed by multiple brand instances, and there is no versioning or update propagation across tenants. The v5.51.2 component preview thumbnails improve how a component library reads to editors inside one instance but do nothing for cross-brand federation. No brand-level extension model exists.

Strapi Cloud holds multiple projects under one account, giving portfolio-level visibility of instances, but user management stays per-instance — editors are granted access to each brand's instance separately and SSO is configured per instance. Session controls added this window (Active devices with revoke-one-or-all in v5.50.0) are likewise per-instance: an admin revoking a compromised user's sessions must do it in every brand instance that user touches. No central admin role spanning brands, no cross-brand SSO mapping, no cross-brand contributor roles.

Content types are scoped to a single instance with no schema inheritance or cross-instance model sharing. With separate instances per brand, each brand maintains its own content model independently — there is no global product page model that Brand A extends with video and Brand B extends with comparison tables without forking. The v5.45 extended Content-Type Builder plugin API makes schemas more programmatically manipulable, which helps a team script consistency across instances, but that is tooling a customer builds, not shared models with per-brand extension.

No portfolio-level reporting. Each instance operates independently with no aggregation of content freshness, publishing SLA adherence, or cost allocation across brands. Strapi Cloud shows per-project billing, and the split of Cloud hosting from per-seat CMS licensing actually makes portfolio cost allocation harder to assemble in one view. Executive reporting across brands requires custom data aggregation.

Verification of the primary sources shows a stronger posture than previously scored: the Strapi Data Processing Addendum (effective 21 Nov 2024) is published in full on strapi.io/cloud-legal and applies to all Cloud tiers without negotiation, it obliges the parties to rely on EU-approved standard contractual clauses for any transfer out of the EEA, clause 5 grants notification of and objection to new subprocessors, Annex III links a public subprocessor register, an Article 27 EU representative is appointed, and Europe (West) is a selectable hosting region. Held below 82 because DPA clause 10.1 expressly permits processing outside the Protected Area including the US, there is no UK IDTA or UK addendum named anywhere, and data-subject rights are exercised only by emailing [email protected] with a one-month response window — no self-service DSR or erasure tooling in the product.

No BAA is offered for Strapi Cloud and no healthcare or PHI guidance exists in the docs, the security page, or the Vanta trust center — the Cloud Terms and DPA make no reference to health data at all. Self-hosting the MIT core inside a customer's own HIPAA boundary is technically possible, but every control, risk assessment, and BAA chain is the operator's to build with zero vendor support or documented reference architecture. Stays at 22 rather than the 40–60 'could be configured' band because there is no vendor-published path at all, not merely a missing BAA.

GDPR is the only regulatory framework with explicit coverage: the privacy policy contains no CCPA/CPRA notice or 'Do Not Sell' disclosure despite Strapi, Inc. being the US contracting entity, and there is no UK GDPR IDTA, PIPEDA, LGPD, or EU–US Data Privacy Framework certification. No FedRAMP, IRAP, C5, ENS, PCI-DSS, or HITRUST. Sits at the top of the 'GDPR only' band because the GDPR coverage itself is contractually solid, but nothing else is addressed.

Strapi holds SOC 2 Type 2 (achieved June 2024, moving from Type 1 to Type 2) covering all five Trust Service Criteria — Security, Availability, Processing Integrity, Confidentiality, Privacy — with the auditor issuing a final report with zero noted exceptions. The report is distributed through a Vanta-operated trust center at trust.strapi.io, which also provides continuous control monitoring rather than a point-in-time snapshot. Not higher because Strapi does not publish the audit period or an explicit annual re-certification cadence, so report currency has to be confirmed by requesting it.

No ISO 27001 certification exists for Strapi or Strapi Cloud — the word ISO appears nowhere on strapi.io/security, and the trust center surfaces only SOC 2 and GDPR. A secondary claim that Strapi is 'actively pursuing' ISO 27001 could not be corroborated on any first-party page, and per this category's evidence standard an unattested intention earns nothing. No ISO 27018 for cloud PII processing either. Adjusted down 2 points to sit alongside peers in the same position (Sanity 38, Directus 35) rather than above them.

Beyond SOC 2 Type 2 there are no additional certifications — no CSA STAR, PCI DSS, Cyber Essentials Plus, FedRAMP, IRAP, ENS, or C5. Raised substantially from 22 because the previous score sat far below both the rubric's no-additional-certs floor and comparable peers (Directus 45, Sanity 48, DatoCMS 42) while ignoring that Strapi does operate a real self-serve compliance artifact channel: a Vanta trust center with NDA-gated document sharing and continuous monitoring. Not higher because that channel distributes SOC 2 only — it adds no independent attestation.

Current Cloud documentation lists three hosting regions — US (East), Europe (West), Asia (Southeast) — correcting the prior four-region figure, which came from a 2023 launch blog announcing Singapore and Australia; Australia no longer appears in the deployment docs. Self-hosting the MIT core gives unconstrained residency control, which is the real strength here. Lowered 2 points because, alongside losing a region, the hosting region is fixed at project creation and cannot be changed afterwards, and DPA §10.1 explicitly reserves the right to process personal data outside the Protected Area including in the US — so the residency choice is an infrastructure placement, not a contractual guarantee.

Export tooling is genuinely complete and self-service: `strapi export` produces an encrypted, compressed tar.gz containing entities, relations, assets, schemas, and project configuration, `strapi transfer` streams between instances over transfer tokens, and Cloud added environment-to-environment data transfer in 2026 — all CLI-driven and automatable. Retention is documented on both sides: personal data is deleted six years after a customer relationship ends, and destroying a Cloud project erases all project data irrecoverably. Held below 60 because erasure of personal data remains an email DSR to [email protected] with no API or portal, and the Cloud ToS only says backups are kept for 'standard periods' without naming one.

Two prior gaps have closed: retention is configurable via the auditLogs.retentionDays parameter (90-day default, not a fixed ceiling), and Strapi 5.53 shipped CSV export of the filtered log set behind a dedicated Export permission, with every export itself recorded as an audit-log.export event and a configurable 1,000,000-row cap. Coverage spans content types, entries including publish/unpublish, media, login success/failure, releases, roles, and users, and 5.52 added an origin key distinguishing MCP-server actions from admin-panel ones — meaningful as agents gain write access. Capped at 64 because the feature is Enterprise-plan and Super Admin only, and there is still no streaming API or native SIEM connector, so ingestion means scheduled manual CSV pulls.

Strapi 5's Design System v2 is documented in first-party migration notes as 'completely updated with a focus on accessibility', with Accordion, Avatar, Checkbox, Dialog, Modal, Popover, Radio, Tabs, and Tooltip migrated to Radix-UI primitives — which bring WAI-ARIA roles, focus trapping, and keyboard interaction to the admin panel by construction rather than by audit. That is a concrete engineering commitment beyond the 'no documented commitment' band. Kept below 60 because Strapi has never stated a WCAG 2.1 AA conformance target or ATAG 2.0 position, the long-standing community thread asking about authoring-UI accessibility is still unanswered, and no release in the v5.44–v5.54 window carries an accessibility-specific change.

No VPAT or ACR exists for the Strapi admin interface, strapi.io/accessibility returns 404, and there is no Section 508 conformance statement or ATAG 2.0 assessment anywhere in the docs or trust center. The only accessibility artifact associated with Strapi is a third-party marketplace widget (All in One Accessibility) that overlays delivered websites — not the authoring UI, and therefore out of scope here. This is a hard blocker for public-sector and EAA-driven procurement that requires conformance documentation up front.

Strapi AI's scope is explicitly content modeling, media metadata, and translations — the AI Content-Type Builder generates schemas from natural language, Figma files, or frontend code, not editorial prose. Nothing in v5.49–v5.54 (Jun–Sep 2026) added native text generation, rewriting, or summarization; the v5.54.0 headline was a redesigned Media Library UI. Text generation remains third-party (Content Creator With AI, strapi-plugin-ai-sdk, custom OpenAI fields), which the rubric caps at 20–35.

The AI-Powered Media Library auto-generates alt text, captions, and tags with full editorial control (GA Oct 2025), and retroactive enrichment of existing assets shipped v5.34; the GA MCP server now also exposes Media Library tools so agents can manage assets. Still no native image generation (DALL-E, Firefly, Stable Diffusion) and no AI video processing — the v5.54.0 Media Library rebuild was a UI/UX overhaul, not new media AI. Holds mid-band for auto alt text without generation.

AI Translations (GA v5.30) translate all configured locales — including dynamic zones and blocks — within seconds on save, billed against Growth-plan credits calculated dynamically from source plus output text volume. No brand voice preservation, no quality scoring, and the one-directional model still overwrites non-default-locale edits on the next default-locale save. No translation changes in v5.49–v5.54, so it stays mid-band for functional MT lacking advanced controls.

AI-generated alt text, captions, and tags cover asset-level metadata only. The official strapi-plugin-seo was archived Nov 2025 and has not been replaced; there is still no native title tag, meta description, OG tag, schema markup, or on-page SEO scoring automation, and nothing in v5.49–v5.54 addressed it. Third-party plugins supply SEO structure without AI generation.

The MCP server's move from beta to GA in v5.49.0 (29 Jun 2026) turns agent-driven content ops into a production path — schema-generated CRUD plus draft/publish tools across every content type and the Media Library — layered on the two existing native assists (save-time AI translation, bulk alt-text enrichment). Strapi itself still ships no auto-tagging beyond media, no smart scheduling, no content routing, no duplicate detection, and no AI publishing triggers; the orchestration in Strapi's own n8n and Claude Code guides runs outside the CMS. Rises within the lightweight-assists band on GA agent tooling rather than new native editorial AI.

Strapi ships no named agent product, no native agentic runtime, and no multi-step autonomous content pipeline inside the CMS — its content is agent-addressable via the GA MCP server, but per the rubric's anti-pattern MCP availability is protocol access, not agentic execution. Strapi's own research→draft→approval→publish pipeline guide runs the agent loop in n8n, and FlowGine's LLM decision nodes remain a community plugin in discovery. Sits at the top of the no-native-agentic band for production-grade agent-addressability without an execution engine.

No native AI content intelligence anywhere in Strapi core, the AI docs section, or official plugins: no content gap analysis, topic clustering, performance scoring, stale content detection, or editorial priority recommendations. Nothing in v5.49–v5.54 touched this area. Cloud dashboards report infrastructure usage, not AI-derived content insight.

No native AI content audit capability — no quality scoring, brand voice compliance checking, accessibility scanning, or duplicate/thin content detection at scale — and none added through v5.54. The archived SEO plugin never had an AI auditing layer, and community strapi-plugin-ai-sdk offers chat input guardrails rather than content auditing. Quality governance of AI output is entirely the implementer's responsibility.

Strapi core still ships no vector column, embedding generation, or semantic query API through v5.54, and the embeddings-index feature request remains open. The ecosystem is active — strapi-plugin-semantic-search, strapi-content-embeddings (pgvector on Neon with admin-panel sync and RAG chat), plus official tutorials for RAG with OpenAI, LangChain/Milvus, and Upstash Vector — but every path requires a community plugin and an external vector store. Stays in the 15–30 band for fully external integration.

No native ML personalization engine — no real-time audience scoring, predictive segment assignment, next-best-content recommendations, or personalization analytics in Strapi core or the AI feature set. Its headless architecture lets external layers (Ninetailed, Conscia.ai, custom recommenders) consume content over the API, but that is integration, not platform capability. Unchanged through v5.54.

The built-in MCP server reached GA in v5.49.0 (29 Jun 2026) after beta in v5.47 — first-party, in-core, free and untiered on self-hosted, opt-in via server.mcp.enabled. It generates tools directly from the schema (up to 8 per collection type: 5 CRUD plus 3 draft/publish; 6 for single types), adds Media Library and dev-mode utility tools, and runs stateless per-request auth where every handler re-checks Strapi's permission checker on the specific document, honoring condition-based rules and re-clamping or revoking tokens when owner roles change. With v5.52.0 MCP writes also land in Audit Logs. Withheld from 90+ only because GA is three months old, audit visibility is Enterprise-gated, and utility tools are dev-mode only.

Strapi's own AI features — Content-Type Builder, translations, media metadata — remain locked to a vendor-chosen, undisclosed provider metered by Growth-plan credits (1,000/month, overage $1.50 per 100) with no key input anywhere in settings. Against that, the GA MCP server makes the agent-side fully model-agnostic and free: any MCP client (Claude, Cursor, or a self-hosted model) drives content operations on your own account, and community plugins (strapi-llm-translator, strapi-plugin-ai-sdk) add true BYOK. Top of the partial-BYOK band — genuine model freedom for agent workflows, none for native AI features.

Strapi now has dedicated agent-extension machinery, not just a usable REST API: strapi.ai.mcp.registerTool() lets any plugin publish custom agent tools with auth policies and resolveInputSchema/resolveOutputSchema callbacks that narrow schemas per request against token permissions, documented at docs.strapi.io/cms/plugins-development/extend-mcp-server. Around it sit a separate Docs MCP server for AI dev tools, a dedicated docs.strapi.io/cms/ai section, the optional OpenAPI spec route (v5.48), REST + GraphQL + webhooks, and official integration guides for Claude Code, n8n agents, and LangChain/Milvus RAG. Clears the 70+ bar for dedicated AI extension points plus official agent integration guides; short of 85+ absent a first-party LangChain/LlamaIndex SDK or RAG-ready delivery endpoint.

v5.52.0 shipped a real AI audit trail: entry actions performed through MCP now appear in Audit Logs alongside admin-panel equivalents, each payload carrying an origin key reading "mcp" for agent-originated versus "admin" for human actions, with 120-day default retention — combined with opt-in enablement, admin-token scoping, runtime permission checks, and automatic re-clamping on role change. Still missing the whole quality half of the rubric: no brand voice enforcement, no hallucination detection or confidence scoring, no prompt template governance, no IP indemnification, and no mandatory human-review gate before AI content publishes. Further capped because MCP audit logging is CMS Enterprise-only, visible to Super Admins alone, and read operations are never logged.

Credit consumption is now surfaced in the admin panel under Settings → Overview with threshold notifications at 85% and 100% by email and dashboard alert, and credits are computed dynamically per run against total text processed, with overages billed monthly. That is account-level cost visibility only — no per-user or per-team consumption breakdown, no prompt effectiveness analytics, no quality trend monitoring, no model performance metrics, and MCP agent activity is not metered as AI usage at all (it surfaces in Audit Logs, not an AI dashboard). Top of the minimal-observability band.