EmDash 1.0: agent-ready Astro CMS with sandboxed plugins

Cloudflare has declared EmDash 1.0 stable, and its main difference from WordPress, the system Cloudflare calls it a spiritual successor to, is that a sandboxed plugin no longer runs with the whole site's access. EmDash is a free, MIT-licensed content management system built on Astro: developers build the site with Astro, editors work in the EmDash admin, and AI agents can change content through an API, a command-line tool or a built-in MCP server, a standard interface agents use to read and act on a system. Cloudflare introduced EmDash in April with plugin security as its pitch, and says the months since went into data safety, database migrations, editorial workflows, localization and plugin security. In August it moved the Cloudflare Blog onto EmDash, which had to handle millions of pageviews a week and spikes of up to 5,000 requests per second.

In WordPress, the article explains, plugins run inside the same PHP process as the rest of the site, with direct access to its database, filesystem and network, so a contact-form plugin could technically read unpublished posts or send data anywhere. A sandboxed EmDash plugin starts in an isolated runtime with only its own private storage. It gets more, such as reading media or contacting a search service, only when the plugin declares that ability and the site administrator approves it. Each grant is enforced separately by the runtime: access to media does not expose users or unpublished content, and permission to reach one service does not open the rest of the network. Cloudflare compares installing one to installing a mobile app that shows what it wants to do before it runs. The isolation is not tied to Cloudflare's hosting, since on Node.js EmDash runs plugins inside workerd, the open-source Workers runtime, as a separate process.

The new plugin registry applies the same idea to distribution. Cloudflare's argument is that a traditional registry holds the publisher's account, the authoritative package record and the catalog, so one company controls both identity and distribution. EmDash's registry is built on AT Protocol, the decentralized protocol behind Bluesky: publishers sign their package and release records and keep them in their own accounts, while EmDash's catalog indexes them and can hide a listing from view without rewriting or erasing the publication. Before installing, EmDash checks that the release record traces to a signed commit from the publisher's account, then checks the checksum, package name, version, requested access and any required build provenance against the downloaded bundle. The registry handles free plugins only for now; paid plugins are a stated aim.