GoKawiilIt’s April 1st. A new CMS drops, built by Cloudflare, powered by Astro, pitched as a modern spiritual successor to WordPress. Sure. Very funny.
Except it wasn’t a joke. EmDash is real, and of course I had to take a look. Two posts got me started: Cloudflare’s own announcement and Joost’s take.
What is it?
EmDash is a fully open source CMS built on TypeScript and Astro 6.0. It runs serverless on Cloudflare Workers (or any Node.js server), uses SQLite locally and Cloudflare D1 in production, and stores content as portable text (structured JSON) instead of raw HTML.
The pitch? It’s what WordPress would look like if you built it today, from scratch, without 20 years of legacy decisions weighing it down.
Things I actually like
The security model is genuinely clever. In WordPress, plugins can do almost anything they want. That’s the root of a huge number of security issues, and I’ve written about this before. EmDash plugins run in sandboxed isolates and have to explicitly declare what they need access to, similar to how OAuth works. Honestly the most interesting thing about the whole project.
The DB structure seems solid. I had a look at the SQLite tables and I liked what I saw. Post types get their own separate tables instead of everything being crammed into a handful of generic ones. If you’ve ever debugged a WordPress database, you know how refreshing that is.
It’s AI-first in a real way. There’s an MCP server, a JSON CLI, and direct agent access baked in. Joost put it well:
It’s not a CMS with AI features bolted on. It’s a CMS where AI agents are first-class builders.
... continue reading