EmDash 1.0: Cloudflare Releases Stable CMS With Decentralized Plugin Registry

Cloudflare has released EmDash 1.0, describing it as a stable, free, and open-source content management system built on Astro and designed for production websites, agencies, and hosting platforms.

The release follows five months of development involving contributors and production users. Cloudflare says that work focused on areas including data safety, database migrations, editorial workflows, localization, plugin security, performance, and the reliability of the CMS's admin, API, MCP, and media experiences.

EmDash was first introduced on April 1 as a "spiritual successor to WordPress." With the 1.0 release, Cloudflare is positioning the project as a production-ready CMS while also introducing a decentralized plugin registry and a sandboxed plugin architecture.

The platform combines conventional CMS management with developer tooling and agent access. Developers can build with Astro, editors can manage content through the EmDash admin interface, and agents can interact through the API, CLI, or built-in MCP server.

What EmDash 1.0 includes

Cloudflare describes EmDash 1.0 around several connected components:

• Astro-based development: Developers build websites using Astro.

• CMS administration: Editors manage content through the EmDash admin interface.

• API and CLI access: Developers and automated systems can interact with the CMS programmatically.

• MCP support: Agents can work with EmDash through its built-in MCP server.

• Editorial workflows: The release includes production-tested content management workflows.

• Media and localization: EmDash includes workflows for managing media and localized content.

• Migration and deployment: The project has focused on production migration and deployment requirements.

• Plugin ecosystem: Developers can publish plugins while site owners can discover and install them through the EmDash registry.

Cloudflare says EmDash is completely free and open source under the MIT license.

Five Months of Production-Focused Development

Cloudflare says the path to EmDash 1.0 was shaped by real deployments rather than only development testing.

According to the company, production users helped uncover edge cases and requirements that become visible when websites serve real traffic and are managed by real editorial teams.

One example is Avulux, which converted a custom microsite to EmDash after experiencing what it described as a maintenance burden with WordPress. Cloudflare says the migration took less than a day with the help of EmDash Agent Skills.

Cloudflare also migrated its own blog to EmDash in August as part of its "Customer Zero" approach.

The company says the migration provided practical feedback around localization, media management, the admin editor experience, and scaling.

Cloudflare reports that the Cloudflare Blog handled millions of pageviews per week, spikes of up to 5,000 requests per second of legitimate traffic, and occasional DDoS attacks during this testing and migration context.

The company says several features that emerged from the migration project are now broadly available, including optional KV object caching, the Hyperdrive database adapter, and Workers Cache compatibility.

Source note: These traffic figures and deployment details are claims made by Cloudflare about its own blog environment. They are not independent performance benchmarks for EmDash.

An Open-Source CMS With a Growing Community

Cloudflare says more than 175 people had contributed to EmDash at the time of publication, across more than 1,800 commits.

The project has also been translated into 25 languages, according to the company.

Cloudflare says its approach to agentic coding is intended to allow agents to assist human developers rather than overwhelm the open-source development process.

The company also highlights the role of contributors in areas beyond code, including translations, documentation, testing, design, issue triage, and community support.

Cloudflare says more than 800 people are part of the EmDash Discord community.

The project is available under the permissive MIT license, allowing developers and organizations to use and modify the software without relying on a proprietary CMS licensing model.

EmDash Builds an Ecosystem Around Themes and Plugins

Cloudflare says the EmDash ecosystem is already expanding beyond the core CMS.

Examples identified in the announcement include:

• Lexington Themes, which offers Astro themes with EmDash variants.

• Urumi, which is developing an eCommerce plugin for EmDash.

• Empress, which is developing a platform for managing multiple sites through natural language or a conventional CMS administration interface.

Cloudflare presents these projects as examples of companies building services and products around the EmDash platform.

The broader model is intended to allow EmDash to function not only as a CMS for individual websites, but also as a foundation for companies building website creation and hosting products.

A Decentralized Plugin Registry

One of the most significant parts of EmDash 1.0 is its new plugin registry.

Cloudflare says developers can publish sandboxed plugins while site owners can discover, inspect, and install those plugins directly from the EmDash registry.

The key difference from a traditional centralized marketplace is how ownership and distribution are separated.

Traditional plugin registries commonly combine publisher identity, package records, and the catalog used for discovery. Cloudflare argues that this creates a central point of control over both identity and distribution.

EmDash takes a different approach.

Publishers retain control of their packages and release histories, while EmDash provides a catalog through which users can discover and install plugins.

Other services can also index the same publications and create their own catalogs and policies.

The registry uses AT Protocol, the decentralized network protocol associated with Bluesky and other applications.

Cloudflare says plugin authors publish using an Atmosphere account, while package and release records are signed by the publisher and stored in the publisher's own account.

EmDash operates the default registry services, but Cloudflare has also open-sourced the services behind the registry. These include the aggregator used by the registry, a labeler service that uses Workers AI to moderate package descriptions, and an Astro live content loader for displaying plugin listings.

Security Verification Without a Central Marketplace

Decentralization does not mean that plugins are treated as automatically trustworthy.

Cloudflare says the EmDash registry can independently verify plugin records instead of simply trusting a catalog's copy.

According to the announcement, the process uses signed records and inclusion proofs associated with AT Protocol repositories.

EmDash then checks information including:

• Plugin checksum

• Package name

• Version

• Requested access

• Required build provenance

• Whether the downloaded bundle matches the signed record

Cloudflare says the registry's catalog also applies default content moderation to names, descriptions, links, and images displayed in the catalog.

Moderation can hide harmful or inappropriate material from the catalog, but it does not rewrite releases, take ownership of plugins, or remove the underlying publication.

The distinction is important: catalog moderation and software ownership are separate functions in the EmDash model.

Cloudflare says the registry currently supports free plugins. Support for paid plugins is planned for the future, although specific timing and implementation details were not provided.

Sandboxed Plugins Create Explicit Capability Boundaries

Cloudflare is also changing how plugins interact with the CMS itself.

The company describes traditional WordPress plugins as code that runs inside the same PHP process as the application, with direct access to resources such as the database, filesystem, and network.

EmDash uses a sandboxed model instead.

Each plugin runs inside an isolated runtime with access to its own private storage. Cloudflare says plugins do not automatically receive access to the site's content, media, users, secrets, environment, filesystem, or network.

Additional capabilities must be declared by the plugin and approved by the site administrator.

The model is designed around capability-based access.

For example, a plugin that indexes published articles may receive permission to read content and contact a search service. That permission does not automatically allow it to modify articles or communicate with unrelated hosts.

Similarly, a plugin that manages media can receive access to media without automatically gaining access to user content.

Cloudflare says these permissions are independent, meaning granting one capability does not implicitly grant unrelated capabilities.

The company compares the experience to installing a mobile application, where users can see what an application is requesting before granting access.

The Plugin Runtime Is Designed for Multiple Deployment Environments

The sandbox model is not limited to Cloudflare's own deployment environment.

On Cloudflare, EmDash runs each plugin as a Dynamic Worker through the Worker Loader.

On Node.js, Cloudflare says EmDash starts workerd, the open-source Workers runtime, as a separate process and runs each plugin as an isolated service inside it.

The same plugin manifests and capability-gated APIs are used across both environments, although the underlying runtime and setup differ.

This approach is intended to give developers a consistent plugin model while maintaining isolation between plugins and the CMS.

From a CMS to a Website Platform

Cloudflare says EmDash is also designed for companies building website creation and hosting platforms.

With Workers for Platforms, hosting providers can run individual customer sites as Workers on Cloudflare's global network.

EmDash provides the content layer for those experiences.

A platform can use the standard EmDash admin interface, create its own interface using the API and CLI, or place an agent in front of the built-in MCP server.

Cloudflare gives the example of a business owner asking an agent to update opening hours in plain language. The agent could then read, update, and save the relevant content.

The sandboxed plugin model is also intended to help platforms offer extensions across multiple customer sites.

Rather than allowing plugins unrestricted access to an entire application, the platform can provide approved access to specific resources such as content, media, users, email, or external services.

Platforms can also create their own plugin marketplaces or curate a selection of pre-approved plugins.

EmDash Build Adds an AI Site Builder

Alongside EmDash 1.0, Cloudflare is releasing an alpha version of EmDash Build, an open-source AI site builder.

Cloudflare says the tool is designed for hosting providers, website builders, and platforms that want to operate the site-building system themselves and integrate it with their own services.

EmDash Build uses an agent to create an EmDash site from a brief.

According to Cloudflare, the agent can design a content model, populate content through EmDash's MCP server, and create the pages that display that content.

Once the site exists, users can edit content directly on the page, schedule posts, or use an agent to make changes.

Each EmDash Build project receives its own Cloudflare Sandbox container. Cloudflare says the agent, built using the Agents SDK, verifies its own work.

Artifacts tracks changes through Git commits.

When a site is published, Cloudflare says its content moves into a production EmDash site and is deployed to the hosting provider's Workers for Platforms namespace.

This creates a workflow that connects AI-assisted site creation with a conventional CMS rather than leaving the finished website solely inside an AI generation interface.

Getting Started With EmDash

Cloudflare says EmDash 1.0 is available for developers who want to build websites locally or through Cloudflare's platform.

The source announcement provides the following command for creating a new EmDash site locally:

npm create emdash@latest

Developers can also create and publish plugins using EmDash's plugin development documentation.

The project is open source, and Cloudflare says contributions are welcome across development, documentation, translations, testing, design, issue triage, and community support.

Analysis: What EmDash 1.0 Signals for CMS Development

The EmDash 1.0 release highlights a broader shift in CMS architecture toward combining traditional content management with APIs, automation, agents, and more explicit software isolation.

The plugin model is particularly notable because it addresses two separate problems at the same time: ecosystem distribution and third-party code access.

The decentralized registry separates publisher identity and package ownership from the catalog used for discovery. Meanwhile, the sandbox model limits what installed plugins can access.

For developers, this could provide a more controlled foundation for extending a CMS without treating every plugin as having unrestricted access to the entire application.

For hosting platforms, the architecture is also relevant because EmDash is designed to operate beyond an individual website. Cloudflare is explicitly targeting companies that want to build website creation and hosting products around the CMS.

The AI component adds another layer. Rather than treating an AI site builder as the complete website environment, EmDash Build creates a site that continues into the EmDash CMS, where humans and agents can manage content after the initial generation process.

These are design choices described by Cloudflare. Their effectiveness across different deployments will depend on how developers, hosting providers, plugin authors, and site owners use and configure the platform.

What Cloudflare Has Not Disclosed

The announcement does not provide several types of information that would be needed for broader technical or commercial comparisons.

Cloudflare does not disclose pricing for EmDash 1.0, paid-plugin economics, independent security audit results, standardized performance benchmarks, or comparative performance measurements against other CMS platforms.

The company also does not provide independent measurements for the security impact of the plugin sandbox.

Additional details were not disclosed in the announcement.

Conclusion

EmDash 1.0 marks Cloudflare's transition of its Astro-based CMS from an earlier project into a stable open-source release.

The platform combines traditional editorial management with developer APIs, CLI access, MCP support, agent workflows, and an expanding plugin ecosystem.

Its most distinctive architectural elements are the decentralized plugin registry and sandboxed plugin model. The first separates plugin publishing and ownership from catalog control, while the second uses explicit capability boundaries to restrict what plugins can access.

Cloudflare is also extending the project beyond individual websites through Workers for Platforms and EmDash Build, its open-source AI site builder released in alpha.

For developers and hosting platforms evaluating modern CMS architectures, EmDash 1.0 represents Cloudflare's stated approach to combining open-source content management, decentralized software distribution, isolated extensions, and agent-assisted website development.