Cloudflare Launches EmDash as Open-Source WordPress Rival

Cloudflare dropped EmDash on April 1 - and despite the date, it's real. The company's open-source CMS, written entirely in TypeScript on Astro 6.0, is aimed directly at WordPress, which currently powers 42.5% of all websites and 59.8% of the CMS market. The pitch isn't subtle: start from scratch and fix the three things WordPress never solved - plugin security, serverless scaling, and AI-native content management.

Matt Kane, the Cloudflare engineer who built EmDash over two months of full-time work starting in mid-January, put it plainly: "this isn't a vibe-coded weekend project." AI coding agents contributed heavily to the build - fitting, given that EmDash ships AI agent tooling on day one.

Cloudflare picked up Astro in January 2026. EmDash is the first major product to come from that acquisition.

How the Plugin Sandbox Works

The core claim is about security. Cloudflare cites a figure that 96% of WordPress security vulnerabilities originate in plugins. The root cause is structural: any WordPress plugin can touch the database, write to the filesystem, and make arbitrary network requests without restriction.

EmDash runs plugins in separate Cloudflare Dynamic Worker isolates. Before a plugin can do anything, it declares its full capability set in a manifest. The system enforces it at the V8 isolate level:

definePlugin({
  id: "notify-on-publish",
  capabilities: ["read:content", "email:send"],
  hooks: {
    "content:afterSave": async ({ content, emit }) => {
      await emit.email({ subject: `Published: ${content.title}` })
    }
  }
})

That plugin can read content and send email. Nothing else. It can't touch the database directly, write files, or call arbitrary external endpoints. Network access requires specific hostnames to be declared in the manifest.

The definePlugin() API supports lifecycle hooks, KV storage for plugin state, settings pages, admin pages, dashboard widgets, custom block types, and custom API routes.

The EmDash blog starter template. Content models are defined visually in the admin panel and generate real SQL tables. Source: github.com/emdash-cms/emdash

Running Without Cloudflare

The sandbox requires a paid Cloudflare Workers account, which starts at roughly $5/month. On free tier or self-hosted Node.js deployments, sandboxed plugins aren't available - EmDash falls back to an in-process safe mode without isolation. The security argument only holds when you're on Cloudflare's infrastructure. For local development and small hobby projects, the fallback is fine. For anything production-grade where you care about plugin containment, the paid plan isn't optional.

The Built-in MCP Server

Every EmDash instance ships with a built-in Model Context Protocol server at https://your-site.emdash.dev/mcp. Connecting an AI agent exposes tools for content CRUD, schema management, media handling, plugin administration, and user management - all scoped by API token permissions following the same least-privilege model as the plugin sandbox.

EmDash's built-in MCP server exposes the full CMS as an agent-accessible API. Each action is scoped by API token permissions. Source: modelcontextprotocol.io

Agent Skills

With the MCP server, EmDash bundles Agent Skills files - structured documentation designed for AI agent consumption rather than human reading. The Skills describe the full hooks reference, theme structure, content schemas, and WordPress migration instructions with enough context for an agent to build a plugin or port a WordPress theme autonomously.

The Block Kit Agent Skill handles the full migration path: import WXR content, transfer media, map custom post types to EmDash collections, and convert PHP templates to Astro components. Whether that workflow is reliable at v0.1.0 is a question that needs more real-world testing.

Getting Started

Installation uses the standard npm initializer:

npm create emdash@latest

For a local demo with seed data and no Cloudflare account:

pnpm --filter emdash-demo seed
pnpm --filter emdash-demo dev

Content models are created visually in the admin panel and stored as real SQL tables. TypeScript types for those models are produced separately:

npx emdash types

Cloudflare provides a one-click deploy button to Workers. The content editor uses TipTap with Portable Text (JSON-based) as the underlying format, decoupled from the DOM.

Requirements

EmDash also ships with native support for x402, the open micropayment protocol built on HTTP's 402 status code. Publishers configure which content requires payment, the price, and a wallet address to receive funds - no subscription infrastructure needed.

Where It Falls Short

At v0.1.0, EmDash is one engineer's two-month sprint. The architecture is coherent and the code is public, but the surface area of missing pieces is large. There's no community plugin marketplace, no ecosystem of themes, and none of the decade of documented solutions that makes WordPress findable on Stack Overflow. Migrating a complex site still requires meaningful theme and plugin recoding even with Agent Skills assistance.

Cloudflare positions EmDash as the CMS built for the serverless and agentic era, with passkey auth and sandbox isolation by default. Source: cloudflare.com

The passkey-only authentication model is forward-looking but creates friction for organizations where device-based credentials are complicated to manage at scale. Passwords were explicitly ruled out.

Kane also noted that WordPress's GPL license creates a genuine enterprise adoption barrier: "For a lot of enterprises, GPL software is free only if your lawyers are free." EmDash's MIT license solves that. But EmDash needs a lot more production mileage before legal teams have anything real to assess.

WordPress isn't losing 42.5% of the web this year. But the gap between what WordPress can do natively and what a serverless, agent-first CMS needs to do has been widening for years. EmDash is a technically honest attempt to close it - just at a very early stage.

Sources:

• Introducing EmDash - Cloudflare Blog
• Cloudflare previews EmDash, an AI-driven CMS - The Register
• emdash-cms/emdash - GitHub
• Usage Statistics of Content Management Systems - W3Techs