EmDash 1.0 releases an open-source CMS for Astro, with sandboxed plugins that cannot read your site by default

Every WordPress plugin your marketing team installs can read every post, every user record and every credential the site holds. That is the trade the platform has always asked for, and it is the one Cloudflare is trying to end with a new CMS.

Cloudflare released EmDash 1.0 on 28 September 2026 as a free, MIT-licensed CMS built for the Astro framework. The project has been in development for eight months as a public preview and now carries a stable version and a plugin marketplace. The repository lives at github.com/emdash-cms/emdash.

What is in the box

Cloudflare says EmDash 1.0 ships with editorial workflows, media handling, localisation, migration and deployment paths that have been used in production. A site owner runs npm create emdash@latest or deploys it from the Cloudflare dashboard. Editors work in an admin interface, developers build the site in Astro, and agents can drive the whole thing through a REST API, a CLI or a built-in Model Context Protocol server.

The project reports 175 or more contributors, 1,800 or more commits, translations into 25 languages, and 800 members in its Discord community. Cloudflare credits an intern maintainer named Noah Pham with 80 or more changes.

A different bargain for plugins

The plugin story is where EmDash diverges from every mainstream CMS. Plugins run in a sandboxed runtime and can reach nothing outside the sandbox by default: not site content, not media, not user records, not secrets, not the filesystem. Any access the plugin needs is a capability the site owner grants at install time. Cloudflare puts the contrast directly: "Unlike WordPress plugins, which have unrestricted access to the site."

The registry itself is unusual. Instead of a central store the vendor controls, EmDash uses AT Protocol, the same distributed identity system Bluesky sits on. Developers keep their own packages and release history under an Atmosphere account. Cloudflare says moderation can hide harmful entries from the catalog "but it does not rewrite a release": a plugin author's own history stays with the author.

The agent path

EmDash's built-in MCP server is the part a team building AI features will notice. An agent can list posts, create drafts, upload media and publish pages through the same interface a human editor uses, over MCP or the REST API. That is a working shape for a site whose content is partly written or arranged by a model, without granting the model the keys to the site in the process, because the sandbox rules apply to any plugin the agent installs on its own.

Two limits to state out loud. First, every adoption number in this item is Cloudflare's own count of its project, not an independent audit. Second, EmDash 1.0 is the first version marked stable: the security promises hold only for plugins that stay inside the sandbox, and any capability a site owner grants is a capability that plugin then has.

Still, a plugin ecosystem that starts with the smallest permission it can do the job with is a different bargain from the WordPress one, and the WordPress bargain is why teams that care about supply-chain risk stopped running plugin-heavy CMSes years ago. If EmDash's sandbox holds under real use, a content team can install a comments plugin without also handing it every draft, every user and every deploy token the site holds.

Source

• Cloudflare blog: EmDash 1.0: the stable CMS with a secure plugin registry
• Repository: emdash-cms/emdash on GitHub