Go Press

English · 简体中文

> GoPress is a content management framework and CMS engine written in Go for self-hosted websites and content applications that need themes, plugins, APIs, SEO, media handling, and a practical admin experience. > It brings content modeling, admin CRUD, theme rendering, plugin extension points, REST APIs, protocol-neutral Agent capabilities, an optional remote MCP adapter, SEO infrastructure, multi-level caching, responsive media variants, and multi-site configuration into one composable Go codebase. > It is suitable for company websites, editorial sites, product showcases, documentation hubs, and custom systems that want to keep a CMS authoring workflow inside a Go deployment model.

[](https://go.dev) [](LICENSE)

---

What Is GoPress?

GoPress reorganizes the proven building blocks of a traditional CMS — content models, themes, plugins, and admin workflows — around the Go runtime and Go engineering ecosystem. It provides a unified content model, data-driven admin CRUD, a theme template engine, hook/filter extension points, REST APIs, a protocol-neutral Agent execution layer, an optional remote MCP server, SEO primitives, multi-level caching, media variants, and site-level configuration.

GoPress is not a line-by-line rewrite of WordPress, and it is not a statement against PHP. It focuses on a narrower engineering need: keeping the editorial experience and extension model of a CMS while gaining the deployment, concurrency, observability, and long-term maintenance advantages of Go.

Project Status

GoPress is currently in beta. The core content model, admin CMS, theme engine, plugin mechanism, SEO layer, cache path, media pipeline, and bundled example themes are usable, but the project still needs more production validation, benchmark coverage, migration guides, and security review before a stable public release.

If you plan to use GoPress in production, start with internal sites, company websites, documentation sites, or content-driven applications, then validate your traffic profile, editorial workflow, backup strategy, and deployment model.

Why GoPress?

The CMS ecosystem has proven the long-term value of the “content model + theme + plugin + admin” abstraction. GoPress keeps that product shape while using Go’s single-service deployment model, goroutine concurrency, static typing, and standardized toolchain to reduce operational complexity for self-hosted CMS projects.

The comparison below is not meant to rank technology stacks. It describes the design trade-offs GoPress makes:

| Area | WordPress (PHP) | GoPress (Go) | |---|---|---| | Runtime model | PHP-FPM / web server stack, centered on request lifecycle execution | Long-running Go service process, suitable for in-memory registries and workers | | Extension model | Mature theme/plugin ecosystem with flexible runtime loading | Go interfaces and hook registration, emphasizing type safety and maintainability | | Cache strategy | Usually enhanced through plugins, object caches, and reverse proxies | Built-in memory, Redis, and page-cache paths with graceful fallback | | Scheduled work | Commonly handled through WP-Cron or system cron | Process-owned scheduler and worker pool | | Deployment shape | Web server, PHP runtime, database, and optional cache services | Compiled Go service plus database and optional Redis |

Architecture At A Glance

GoPress brings public delivery, admin workflows, REST / OpenAPI, content services, and governance into one compiled Go runtime. Themes contribute presentation and plugins contribute capabilities through the generic core extension contract rather than direct runtime coupling, while PostgreSQL, optional Redis, media assets, workers, and scheduling form the runtime foundation.

Design Principles

1. Content first — a unified Content + Meta model supports posts, contact messages, and theme-declared custom content types.
2. Themes stay separate from the engine — themes render output; the engine owns routing, querying, SEO, media, admin behavior, and shared infrastructure.
3. Plugins extend through interfaces — plugins register capabilities through Go interfaces, hooks, and filters instead of hidden runtime coupling.
4. Cache is a core capability — memory cache, Redis cache, and page cache are part of the core path, with graceful degradation when Redis is unavailable.
5. SEO is built in — URL rewriting, permalinks, canonical tags, sitemap generation, meta output, and redirects are handled at the core layer.
6. API first — registered content types can expose REST endpoints and Swagger / OpenAPI documentation.
7. Instance isolation — table prefixes and site-level configuration allow multiple instances to share infrastructure while keeping data boundaries clear.
8. Agent access is governed, not bypassed — Agent tools reuse Core domain services and require credential scopes, current RBAC, ownership checks, risk policy, idempotency, and audit.

Theme And Admin UI Preview

GoPress ships with a practical admin CMS and a set of production-oriented example themes. The previews below show the direction of the bundled UI: theme-specific visual systems on the public side, and a focused content-management workspace on the admin side.

Admin UI

The first-run installer guides database connection, site bootstrap, and admin account creation before the CMS opens.

| Database Setup | Site Bootstrap | Ready To Use | |---|---|---| | | | |

| Content Workspace | Theme Settings | Media And Editing | |---|---|---| | | | |

Theme Gallery

| Axis Form | FloraFi | |---|---| | | |

| Modern Company (live site) | Civic Estate | |---|---| | | |

More bundled theme previews

| Atelier Slate (live site) | Terra Trail | |---|---| | | |

| GoPress Landing Indigo | GoPress Landing Rose | |---|---| | | |

---

Quick Start

Requirements

• Go 1.25+
• PostgreSQL 14+
• Redis 7+ (optional; GoPress falls back to memory-only cache when Redis is unavailable)
• cwebp (optional; used for WebP variants; missing binaries fall back to JPG/PNG variants)

Install and Run

GoPress ships with a small orchestrator CLI named gopress. It scans themes/ and plugins/ at startup, regenerates the autoload package, and runs the server. You never have to hand-edit imports when adding a theme or plugin — drop the folder in, restart with gopress serve, and it is picked up automatically.

The fastest way to try GoPress is the local build — no global install required.

# Clone the repository
git clone https://github.com/0xmattg/go-press.git
cd go-press

# Download dependencies
go mod download

# Build the gopress CLI into ./build/ (no global install needed)
make gopress

# Start the server. First run opens the web installer.
./build/gopress serve

# Or start with an existing site config (any flag is forwarded to cmd/server)
./build/gopress serve -config sites/localhost/config.toml

# Produce a single production binary (autoload baked in at build time)
./build/gopress build               # -> build/gopress-server
./build/gopress build -o ./myserver # custom output path

make help lists all Make targets. ./build/gopress help lists all CLI subcommands.

Optional: install globally

If you plan to use GoPress regularly, install the CLI onto $PATH so you can drop the ./build/ prefix:

make install      # installs gopress to $GOBIN (or $GOPATH/bin)
gopress serve     # works from any directory after install

> Building on a 1c1g VM? go build parallelizes across all cores and can be OOM-killed on small VPS instances. Prefix with GOFLAGS="-p=1 -v" to force serial compilation, e.g. GOFLAGS="-p=1 -v" make gopress. See [installation guide](docs/guide/en/getting-started/installation.md#building-on-low-memory-machines) for details.

After startup:

| URL | Purpose | |---|---| | http://localhost:8080 | Public site | | http://localhost:8080/admin | Admin CMS | | http://localhost:8080/swagger/index.html | API documentation | | http://localhost:8080/api/v1/content | REST API | | http://localhost:8080/mcp | Remote MCP endpoint, only while the optional gopress-mcp plugin is active |

See the full installation guide: [docs/guide/en/getting-started/installation.md](docs/guide/en/getting-started/installation.md).

---

Documentation

The documentation lives under [docs/guide/](docs/guide/) and is organized as a GitBook-style guide:

| Section | Covers | |---|---| | [Introduction](docs/guide/en/README.md) | Positioning and design principles | | [Getting Started](docs/guide/en/getting-started/installation.md) | Installation, configuration, and the web installer | | [Architecture](docs/guide/en/architecture/overview.md) | Engine boot flow, content model, public authentication, public content submission, authenticated comments, URL/SEO, cache, i18n, content scope, and hooks | | [Admin](docs/guide/en/admin/overview.md) | Admin CMS, standalone pages, extension points, and menu management | | [Themes](docs/guide/en/themes/overview.md) | Creating themes, SEO integration, image pipeline, and media variants | | [Plugins](docs/guide/en/plugins/overview.md) | Creating plugins, hook contracts, bundled plugins, and plugin-specific setup | | [Agent and MCP](docs/guide/en/agent/overview.md) | Core Agent design, layered architecture, Tool execution, authorization, extension development, operations, testing, and the optional [MCP adapter](docs/guide/en/plugins/gopress-mcp.md) | | [Commerce](docs/guide/en/commerce/overview.md) | E-commerce module: core contracts, catalog, cart, checkout, orders, inventory, payments, and shop-theme integration | | [Reference](docs/guide/en/reference/project-structure.md) | Project structure, table prefixes, REST API, tech stack, and roadmap |

OpenAPI files are generated from code annotations:

| File | Description | |---|---| | [docs/swagger.json](docs/swagger.json) | OpenAPI specification in JSON | | [docs/swagger.yaml](docs/swagger.yaml) | OpenAPI specification in YAML | | [docs/docs.go](docs/docs.go) | Generated Swagger Go package imported by the server entry point |

Regenerate docs with:

go run ./cmd/gendoc/

---

Feature Overview

Public Accounts and Identity

Google / Gmail Sign-In · Available Bundled Google OIDC plugin for Gmail and Google Workspace accounts, with Authorization Code Flow, PKCE, verified identity binding, and revocable GoPress sessions.

MetaMask Wallet Sign-In · Available Bundled EIP-4361 SIWE plugin with server-generated one-time challenges, origin and chain binding, EOA signature verification, and policy-controlled account registration.

• Provider-neutral account core — nullable email/password credentials, external identity bindings keyed by (provider, issuer, subject), policy-controlled registration and linking, and database-backed revocable sessions.
• Admin-controlled registration policy — independent switches for public registration, external login, external auto-registration, account linking, and a privilege-limited default role.
• Plugin protocol boundary — identity plugins verify OIDC, wallet signatures, or future protocols, then pass only VerifiedIdentity assertions to core.
• Theme-ready helpers — currentUser, isLoggedIn, loginURL, logoutURL, and loginProviders let themes render account UI without knowing which provider plugin is active.
• Immediate account shutdown — disabling an account rejects existing admin

tokens and public sessions on their next request instead of waiting for token expiry.

See [Public Authentication](docs/guide/en/architecture/public-authentication.md) for the core model, Google and MetaMask setup, plugin contracts, and theme integration.

Public Content Submission

• Declarative policy — theme-defined content types may opt into frontend

authoring with allowed roles, default review status, and owner update/delete controls in theme.toml.

• Core-enforced writes — active-account checks, type-scoped RBAC, ownership,

input limits, global slug uniqueness, sanitization, and per-user rate limits remain in Core while themes own routes and presentation.

• Safe lifecycle — active-theme capabilities are granted by handle and

withdrawn on theme changes without disturbing pre-existing RBAC rules.

See [Public Content Submission](docs/guide/en/architecture/public-content-submission.md) for the policy, service contract, moderation states, and route security checklist.

Authenticated Comments

• Core-owned comment domain — comments remain available across theme switches and can target any registered content type that declares comments support.
• Registered-user participation — active signed-in users with comment.create can post top-level comments and one level of direct replies; anonymous submissions are not accepted.
• Moderated visibility and safety — new comments default to pending, trusted server policy may approve immediately, approved comments are public, authors can see their own pending comments, and core enforces body limits, per-user rate limits, published-target checks, and per-content open/closed status.
• Owner-scoped review — content owners may review replies on their own content only after server-side ownership and update_own checks; global moderation remains protected by comment.moderate.
• Theme-neutral account integration — themes consume safe comment projections, current-user authorization, and own comment activity through core contracts without importing a specific identity plugin.

See [Comments and Moderation](docs/guide/en/architecture/comments.md) for the data model, theme contract, moderation flow, security rules, and extension points.

Agent and MCP (Safe Write Beta)

• Protocol-neutral Core — core/agent owns the Tool Registry, Principal refresh, credential scopes, RBAC and ownership authorization, risk policy, schema validation, bounded execution, idempotency, and mandatory audit without importing MCP.
• Optional official adapter — the disabled-by-default gopress-mcp plugin exposes a stateless Streamable HTTP endpoint at /mcp through the official Go SDK, supporting protocol 2026-07-28 and a 2025-11-25 compatibility path.
• Read-only by default — six read tools cover safe site metadata, content types, content, taxonomy, and media metadata. Tool discovery is filtered per credential and privately cached for 30 seconds.
• Explicit Safe Write — six content/media write tools require safe_write, an individual Tool switch, a matching token scope, current Core RBAC, and ownership where applicable. Every write has an idempotency key; updates use optimistic timestamps; publish and trash require explicit confirmation.
• Short-lived credentials and audit — administrator-issued Bearer tokens are audience-bound, valid for at most 90 days, stored only as digests, displayed once, and immediately revocable. Audit stores metadata and digests rather than tokens or argument values.
• Accurate Beta boundary — OAuth 2.1 browser authorization, Resources, Prompts, Tasks, and MCP Apps are later phases and are not part of the current server.

See the independent [Agent and MCP guide](docs/guide/en/agent/overview.md) for design and implementation details. For endpoint setup, scopes, Tool inputs, curl checks, and troubleshooting, use the [GoPress MCP plugin guide](docs/guide/en/plugins/gopress-mcp.md).

Engine Core

• Unified content model — Content + ContentMeta + ContentType registry; core keeps post, page, and contact_message, while themes declare custom types in theme.toml.
• Pending editorial workflow — the shared content model and admin editor recognize a protected pending review state in addition to draft, published, archived, and trash lifecycle states

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: 0xmattg
• Source: 0xmattg/go-press
• License: MIT
• Homepage: https://gopress.xyz

Install and usage instructions live in the source repository linked above.