Is dotCMS agent-ready?

dotCMS scores Band C on The Headless Index and rates Foundational on JAIRF (53.5/100). Its strongest area for agent use is headless operation; its weakest is webhooks and events.

Does dotCMS publish an OpenAPI spec?

Yes. dotCMS publishes an OpenAPI specification, scored under JAIRF v1.0.0. A published spec is what makes an API discoverable and callable by agents rather than only by developers reading docs.

What is dotCMS's Headless Index score?

dotCMS scores 74/100 on the Headless Index thesis-fit rubric and sits in Band C in the Content Management category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Content Management

dotCMS

Headless Index

74/100

JAIRF

53.5/100

Foundational

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

dotCMS earns Band C in the Content Management category of The Headless Index, with a thesis-fit score of 74/100 and a JAIRF rating of 53.5/100 (Foundational). Its strongest dimension is headless operation (18/20); its weakest scored dimension is webhooks and events (8/20). dotCMS publishes a machine-readable OpenAPI specification, which is what lets an agent discover and operate it without human glue code.

Editorial verdict

dotCMS is partially headless and partly UI-led. The Headless Index thesis-fit score of 74/100 puts it mid-table on the index, and JAIRF v1.0.0 puts it at 53.5/100 (Level 1, Foundational). In practice, vendors at this tier are partly machine-consumable: the core flows are reachable through code but several adjacent surfaces still expect a human at a dashboard, and the rest of this verdict explains where dotCMS lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. dotCMS publishes more API than most vendors document at all: 573 paths across 75 tags in its own spec, spanning content, workflow, publishing, permissions and job queue. Official clients cover the frontend well (@dotcms/client, @dotcms/react, @dotcms/angular, @dotcms/vue, @dotcms/types) plus a PHP SDK. The cost is version sprawl, with v1, v2 and v3 prefixes coexisting. An agent can drive parts of this product, but not all of it: integrators should plan for human-in-the-loop checkpoints where the headless surface stops short. On headless operability: This is the strongest part of the product. The CLI (@dotcms/dotcli) pulls and pushes content types, sites, languages and files as artifacts you can commit; Push Publishing moves bundles between environments; the Rules Engine and Workflow APIs are addressable over HTTP. Docker self-host is first-class. Very little in the admin lacks an HTTP counterpart, which is unusual for a Java platform of this age.^[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: DotCMS ships an MCP server out of its own monorepo (github.com/dotCMS/core), published as @dotcms/mcp-server by the devdotcms npm account, alongside @dotcms/ai, an agentic runtime that executes model-written code against an instance under one auth and policy boundary. The ambition is real; the maturity is not. The package sits at 0.0.13 and no MCP registry entry names dotCMS.^[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. For all that surface, dotCMS has no subscribable webhook catalogue. Nothing matching /webhook appears among the 573 spec paths; observation goes through a WebSocket feed (/api/ws/v1/system/events), a Notifications API and the Rules Engine, none of which give you signed payloads, typed event names or replay. Push Publishing covers environment sync, not third-party listeners. Net assessment: integrators can build agent flows against dotCMS, but the rough edge to plan around is webhooks and events^[3]. Expect to wrap missing pieces in bespoke glue or accept human-in-the-loop checkpoints. Workable but requires scaffolding.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent16/20

scored

dotCMS publishes more API than most vendors document at all: 573 paths across 75 tags in its own spec, spanning content, workflow, publishing, permissions and job queue. Official clients cover the frontend well (@dotcms/client, @dotcms/react, @dotcms/angular, @dotcms/vue, @dotcms/types) plus a PHP SDK. The cost is version sprawl, with v1, v2 and v3 prefixes coexisting.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
+OpenAPI specPublished, 728 operations
·GraphQL endpointDiscovered at https://www.dotcms.com/api/graphql, introspection disabled or scoped
·SDKs maintained1 (php); top by stars: dotCMS/dotcms-php-sdk (1 stars)

cite (1)

github.sdks@2026-08-19

Headless operation18/20

scored

This is the strongest part of the product. The CLI (@dotcms/dotcli) pulls and pushes content types, sites, languages and files as artifacts you can commit; Push Publishing moves bundles between environments; the Rules Engine and Workflow APIs are addressable over HTTP. Docker self-host is first-class. Very little in the admin lacks an HTTP counterpart, which is unusual for a Java platform of this age.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-08-19
+API operations exposed728 operations in OpenAPI spec
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

ai_review_browser.topics_found@2026-08-19

MCP & agent posture14/20

scored

dotCMS ships an MCP server out of its own monorepo (github.com/dotCMS/core), published as @dotcms/mcp-server by the devdotcms npm account, alongside @dotcms/ai, an agentic runtime that executes model-written code against an instance under one auth and policy boundary. The ambition is real; the maturity is not. The package sits at 0.0.13 and no MCP registry entry names dotCMS.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
−Official MCP serverNone found in vendor's GitHub org or the official MCP registry
−Community MCP serversNone found
−Agent-friendly SDKsNo TypeScript/JavaScript SDK published (agents commonly run in TS/JS)

cite (1)

ai_review_browser.pages_fetched@2026-08-19

Schema observability18/20

scored

Any dotCMS instance serves its own spec (demo.dotcms.com/api/openapi.json), OpenAPI 3.0.1 with 573 documented paths, which means an agent can generate a client against the exact build it is talking to. A GraphQL endpoint exists at /api/v1/graphql, but introspection is restricted on the demo, so the REST spec, not the graph, is the discovery path.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-08-19
+OpenAPIPublished at https://demo.dotcms.com/api/openapi.json (OpenAPI 3.0.1, 728 operations)
·GraphQL introspectionGraphQL endpoint at https://www.dotcms.com/api/graphql but introspection is disabled, scoped, or behind authentication

cite (1)

ai_review_browser.schema@2026-08-19

Webhooks & events8/20

scored

For all that surface, dotCMS has no subscribable webhook catalogue. Nothing matching /webhook appears among the 573 spec paths; observation goes through a WebSocket feed (/api/ws/v1/system/events), a Notifications API and the Rules Engine, none of which give you signed payloads, typed event names or replay. Push Publishing covers environment sync, not third-party listeners.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-08-19
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

ai_review_browser.pages_fetched@2026-08-19

JAIRF · 6 dimensions

FCFoundational Compliance

55/100

Structural validity, standards conformance, and parsability of the OpenAPI specification.

DXJDeveloper Experience & Tooling Compatibility

55.8/100

Documentation clarity, example coverage, response completeness, and ingestion health.

ARAXAI-Readiness & Agent Experience

47.2/100

Semantic clarity, intent expression, datatype specificity, and error standardization.

AUAgent Usability

68.7/100

Operational composability, complexity comfort, navigation affordances, and safety patterns.

SECSecurity

20/100

Authentication strength, transport security, secret hygiene, and OWASP risk posture.

AIDAI Discoverability

79.3/100

Descriptive richness, intent phrasing, workflow context, and registry signals.

Band rationale:C band: scores 40-75 range

04 / Embed

Show dotCMS's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Calibration

How THI compares to external scorers

Source	Score	Measures	Last checked
Fern Agent Score	not found	Documentation completeness and SDK shape (~22 checks)	—
CLIRank Agent Friendliness	not found	CLI readiness, docs quality, and overall agent affordances	—
Cloudflare Is It Agent Ready?	blocked	Cloudflare's manual agent-readiness heuristic per vendor URL	—
Jentic Scorecard	—	JAIRF-based scorecard requiring a public OpenAPI specification	—

THI 74 vs external median 0

No external scores available to calibrate against.

Peers in Content Management

ContentfulB

Headless Index 77/100

DatoCMSB

Headless Index 78/100

ContentstackA

Headless Index 78/100

See full Content Management ranking →

FAQ

dotCMS and agent readiness

Is dotCMS agent-ready?: dotCMS scores Band C on The Headless Index and rates Foundational on JAIRF (53.5/100). Its strongest area for agent use is headless operation; its weakest is webhooks and events.
Does dotCMS publish an OpenAPI spec?: Yes. dotCMS publishes an OpenAPI specification, scored under JAIRF v1.0.0. A published spec is what makes an API discoverable and callable by agents rather than only by developers reading docs.
What is dotCMS's Headless Index score?: dotCMS scores 74/100 on the Headless Index thesis-fit rubric and sits in Band C in the Content Management category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.