EmDash CMS is an open-source content management system that extends its core through sandboxed plugins. Each plugin declares its capabilities, hooks, and storage in a manifest file, and the runtime only grants what the manifest lists.

Yes. EmDash CMS is free and open source. The emdashcms.org community marketplace is also free to install from and free to publish to, and the marketplace code is MIT-licensed on GitHub.

What does emdashcms.org do?

emdashcms.org is the community marketplace for EmDash CMS plugins and themes. It hosts plugin and theme metadata, serves downloadable bundles, runs a fail-closed security audit on every uploaded version, and exposes the catalog as a browsable site, JSON API, Atom feeds, and an llms.txt index for AI crawlers.

How does EmDash compare to WordPress?

EmDash runs on a modern sandboxed runtime rather than PHP shared hosting, and its plugin model is manifest-first rather than permissive. Plugins declare every capability they use and can only do what the manifest lists. WordPress has a far larger plugin ecosystem and longer history; EmDash is a newer platform with stronger default isolation. See /compare/emdash-vs-wordpress for the full breakdown.

What is EmDash CMS?

EmDash CMS is an open-source content management system extended by sandboxed plugins that declare every capability, hook, and storage need in a manifest.json file. The runtime grants nothing the manifest does not list.

Who this is for: anyone evaluating EmDash, or a plugin author deciding where to publish.

The CMS itself

EmDash CMS is content-first and file-based. Content, media, and configuration live in the site’s own storage (its own R2 bucket for bundles, its own database for documents). Extension is the job of plugins, which are packaged, versioned, and installed through the admin dashboard — not through a CLI or package manager at the host level.

The core project lives at emdashcms.com.

The plugin model

Every EmDash plugin ships with a manifest that declares:

Capabilities — what the plugin can do (network fetch, read or write content, send email, etc.).
Hooks — named lifecycle points it attaches to (content:beforeSave, cron, page:metadata, etc.).
Storage — document collections and their indexes.
Admin surfaces — settings, dashboard widgets, custom field editors.

At runtime, the plugin only gets what the manifest lists. Call a method whose capability wasn’t declared and the call fails. There is no unscoped permission, no escape hatch.

Full reference: the manifest schema · the capabilities list.

This marketplace

emdashcms.org is the community marketplace for EmDash plugins and themes. It hosts:

A browsable plugin directory and theme directory.
A JSON API that any EmDash site calls during install.
A fail-closed audit pipeline — every uploaded version is unpacked, statically scanned, and AI-reviewed before it ships.
Atom feeds for new and updated items, plus a weekly digest of everything that landed.

The marketplace is free to use, free to publish to, and MIT-licensed on GitHub.

How installs work

There is no emdash CLI for installing plugins. A site operator opens the EmDash admin panel, navigates to Plugins → Marketplace, reviews the capabilities the plugin requests, and clicks Install. The CMS downloads the bundle from emdashcms.org into the site’s own storage and reports a successful install back to the marketplace for aggregate install counts.

Deeper reference: how EmDash plugins work · the manual install guide.

Why it exists

WordPress set the template for CMS plugins: a huge ecosystem, permissive-by-default, audited only by community attention. EmDash takes the opposite starting point — a manifest-first, capability-gated model where the runtime refuses what wasn’t declared, and a marketplace that treats every release as something to inspect before publishing. Smaller ecosystem today; stronger default isolation.

Updated 2026-04-24. Next: how EmDash plugins work →