Lightcms

LightCMS

[](https://github.com/jonradoff/lightcms/actions/workflows/ci.yml) [](https://codecov.io/gh/jonradoff/lightcms) [](https://goreportcard.com/report/github.com/jonradoff/lightcms) [](https://glama.ai/mcp/servers/jonradoff/lightcms)

LightCMS is a Go-powered content management system built for the AI era. It's simultaneously AI-native (semantic search, built-in Claude-powered chat widget, MCP server for agent control), agentically controllable (Claude Code and any MCP client can read, write, publish, and bulk-import content via 106 MCP tools), and agentically updatable (the codebase is clean, well-structured Go — coding agents can safely extend it). For teams that want a CMS that works with AI rather than around it.

What's New in v6.0

| Feature | Summary | |---------|---------| | Content Approvals | Contributors submit content for approval; editors/admins approve or reject from /cm/approvals. Rejection comments auto-post to the discussion thread. | | Contributor Role | New RBAC role between Viewer and Editor. Can create content + upload assets (pending), post comments, and submit for approval — but cannot publish directly or manage system settings. | | Approval Workflows | Configurable trigger-based workflows (contributor, folder path, template ID, or tag). Sequential or concurrent mode with configurable approver lists. | | Content Discussion | Inline comment thread at the bottom of every edit page. @mention autocomplete, live badge count, admin delete. | | Tabbed Bottom Panel | Discussion, Version History, and Forks organized into tabs on the content edit page. | | Approvals Dashboard | My Queue + Other Pending + Workflow Config at /cm/approvals. Sidebar badge shows pending count. | | Dashboard Sections | Requiring Approvals and Recent Comments appear on the admin dashboard when relevant. | | New Webhook Events | comment.created, content.pending_approval, asset.pending_review. | | 14 new MCP tools | Full comment and approval lifecycle — list/create/delete comments, full workflow CRUD, list/get/submit/approve/reject/cancel approval requests. |

What's New in v5.0

| Feature | Summary | |---------|---------| | Import Pipeline | Three new import types — RSS/Atom feeds, Markdown/ZIP upload, CSV bulk import — with a unified job dashboard at /cm/imports. | | RSS/Atom Import | Configure recurring feed sources with hourly/daily/weekly schedules, template mapping, folder targeting, and auto-publish. | | Markdown Import | Upload .md files or .zip archives with YAML frontmatter. Supports Notion exports, Obsidian vaults, Hugo/Jekyll migrations, and AI-generated content. | | CSV Import | Upload CSV files and map columns to content fields. Specify the title column; all other columns become fields automatically. | | Real-time Job Status | SSE-powered live log stream at /cm/imports/{jobID}. Watch imports happen line-by-line or review full history after the fact. | | 10 new MCP import tools | list_import_sources, create_import_source, update_import_source, delete_import_source, trigger_import_source, import_markdown, import_csv, list_import_jobs, get_import_job, cancel_import_job. | | Agentic bulk content creation | import_markdown is designed for AI agents to generate and import large content batches in a single call. See [MCP.md](MCP.md). | | Deduplication | Imports match by full_path — re-importing the same slug updates rather than duplicates. |

What's New in v4.5

| Feature | Summary | |---------|---------| | Webhooks | HMAC-SHA256 signed events for publish, unpublish, delete, create, update. Admin UI at /cm/webhooks with delivery history and a docs page. | | Scheduled Publishing | Set a future publish_at timestamp on any content item; a background scheduler auto-publishes at the right time. | | Content Locking | Advisory lock when editing (30-min expiry). Warning banner if another user is already editing. Admins can force-unlock. | | Incremental Static Regeneration (ISR) | Template layout changes regenerate affected pages in 20-page batches, preventing server overload on large sites. | | Edge Caching Headers | ETag, Cache-Control, Last-Modified, and Vary headers on all public pages. 304 Not Modified support. | | Cloudflare Integration | Configure Zone ID + API Token to auto-purge Cloudflare cache on publish/unpublish. | | Structured JSON Logging | All server logs emit structured JSON with timestamp, level, message, and context fields. | | Rate Limit Dashboard | New tab on the audit log page showing locked IPs, attempt counts, and a one-click clear button. | | MCP Prompt Resources | Three new MCP resources: lightcms://site/structure, lightcms://content/recent, lightcms://theme/config. |

Why LightCMS?

Lightweight: A clean, focused codebase that's easy to understand, modify, and extend. No bloated frameworks or complex abstractions.

AI-Native: Built from the ground up for the AI era:

• MCP Integration: Full Model Context Protocol server with 106 tools and 3 prompt resources for website management. Supports both local stdio and HTTP streamable transports — connect from Claude Code, Claude Desktop, or any MCP-compatible client.
• OAuth 2.1 for Remote Agents: Sandboxed desktop apps like Claude's Cowork can securely connect over HTTP using OAuth 2.1 with PKCE. No embedded passwords — just authorize once and the agent manages your site.
• Fork-Friendly: Designed to be forked and customized by Claude Code. Ask Claude to add new content types, modify templates, or build custom features — the codebase is structured for AI-assisted development.
• Natural Language Website Management: Skip the admin UI entirely. Create pages, manage assets, customize themes, and publish content through conversation.

Features

Content Management

• Template System: Define reusable content structures with custom fields (text, richtext, image, date, select, markdown)
• Static Page Generation: Fast page loads from pre-rendered HTML — no runtime templating overhead
• Content Versioning: Full version history with diff comparison and one-click revert
• Soft Delete: Recover deleted content with undelete functionality
• Content Tagging: Tag any content item with one or more freeform labels, then query by tag across your site
• Snippets: Named HTML template fragments used as reusable rendering units in dynamic queries
• lc:query Directives: Embed live content queries directly in template layouts — at publish time they expand into rendered lists of matching pages
• Content Collections: Auto-generated paginated listing pages filtered by category
• Folders & URL Organization: Hierarchical content organization with clean URL paths
• Rich Text Editor: TinyMCE integration for visual content editing
• Regex Search & Replace: Site-wide or scoped search-and-replace with RE2 regex support, capture groups, and mandatory preview step
• Bulk Operations: Update or apply field operations across up to 100 pages in a single API call; export/transform/re-import pipelines
• Scheduled Publishing (v4.5+): Set a future publish_at timestamp; a background scheduler auto-publishes at the right time
• Content Locking (v4.5+): Advisory lock while editing (30-min expiry); warning banner if another user holds the lock; admins can force-unlock
• Incremental Static Regeneration (v4.5+): Template layout changes regenerate pages in 20-page batches to prevent server overload on large sites

Import Pipeline (v5.0+)

• RSS/Atom Feed Sources: Configure recurring import sources with configurable schedule (hourly/daily/weekly), template mapping, folder targeting, and auto-publish. Manage sources and run history from /cm/imports.
• Markdown + ZIP Import: Upload .md files or .zip archives of Markdown. YAML frontmatter in each file controls title, slug, folder, template, tags, and scheduled publish time. Supports Notion exports, Obsidian vaults, Hugo/Jekyll site migrations, and AI-generated content.
• CSV Bulk Import: Upload a CSV and specify which column is the title; all other columns are stored as content fields automatically.
• Real-time SSE Job Status: Live log stream at /cm/imports/{jobID} — watch imports happen line-by-line or review full history after the fact.
• MCP-first Design: import_markdown is specifically designed for AI agents to generate and import large content batches in a single call, replacing dozens of create_content calls with one import_markdown + one get_import_job. See [MCP.md](MCP.md) for workflow examples.

Content Forks (v4.0+)

• Fork Workspaces: Create named staging workspaces where sets of page edits can be authored, previewed, and reviewed before going live
• Sparse Model: Only edited pages live in a fork — unmodified pages fall through to live content automatically
• Fork Preview Mode: Activate via a floating bar injected into the live site; a cookie routes all page requests through the fork so you see exactly how the site will look after merge
• Merge with Conflict Detection: Admins merge forks into live content; if a live page was changed after the fork was created, the conflict is recorded (fork wins). New pages created in the fork are inserted into live on merge
• Full MCP Toolset: 8 dedicated fork tools — list_forks, create_fork, get_fork, fork_page, remove_fork_page, merge_fork, archive_fork, delete_fork

Batch & Parallel Operations

Designed for agents that prefer parallelized, high-throughput workflows over sequential single-item calls:

• bulk_update_content: Update up to 100 pages in a single API call. Each item uses merge semantics — only the fields you specify are touched. Supports dry_run validation before committing, and auto_republish to re-publish all previously-published pages in the same call, eliminating a separate publish step
• bulk_field_operation: Apply a single operation (set, clear, prepend, append, wrap) to a field across every matching page in one call. Scope by template, folder, category, or explicit ID list. Ideal for adding disclaimers, updating metadata, or clearing stale fields across a content type
• publish_multiple: Publish a list of IDs — or all drafts at once with publish_all_drafts: true — in a single request instead of looping over publish_content
• export_content: Dump full field data for a scoped set of pages as a structured JSON array. Designed for export → transform → re-import pipelines; pair with bulk_update_content for large-scale content migrations
• Scoped Search & Replace: Both scoped_search_replace_preview and scoped_search_replace_execute accept scope filters (folder, template, category, IDs) so agents can target precise subsets rather than running site-wide operations
• Parallel-Safe Read API: list_content with include_data: true returns full field values in one fetch; agents can fan out reads across multiple list_content / get_content calls concurrently and then batch-write with bulk_update_content

Recommended agent pattern for large updates: list_content → transform in parallel → bulk_update_content (up to 50/call) → publish_multiple.

AI Chat Widget (v4.2+)

• Embeddable Widget: Add a floating AI chat bubble to any page with a single `` tag — self-contained, no build step required
• Two-Phase Pipeline: Each visitor query runs hybrid semantic+fulltext search to retrieve relevant content excerpts, then streams those excerpts through Claude Haiku for a conversational synthesized answer
• SSE Streaming: Haiku's token-by-token output is forwarded live to the browser via Server-Sent Events; falls back to plain JSON for non-SSE clients
• AI-Optional: Without an Anthropic API key, the widget works as a search-in-chat experience returning ranked excerpts — no API cost
• Fully Configurable: Admin "Chat Widget" page controls title, welcome message, placeholder text, primary color, position (bottom-left/right), max results, and editable system/user prompt templates
• Dedicated Rate Limiting: Separate per-IP (5/min) and global (30/min) limiters independent from the search and API limiters
• Source Attribution: Every response includes the content pages whose excerpts were used, with titles and paths

Multi-User Access Control & Approvals (v2.0+, v6.0+)

• Role-Based Access Control (RBAC): Four roles — admin, editor, contributor, viewer — with granular permission enforcement on all admin UI pages and REST API endpoints
• Contributor Role (v6.0+): Create content, upload assets, post comments, and submit for editorial approval — without publish rights
• Approval Workflows (v6.0+): Configurable trigger-based workflows (by role, folder, template, or tag). Sequential or concurrent mode. Default (no workflow): any editor or admin can approve
• Content Approvals Dashboard (v6.0+): My Queue, Other Pending, and Workflow Config at /cm/approvals. Sidebar badge shows pending count
• Content Discussion (v6.0+): Inline threaded comments on every content edit page. @mention autocomplete, admin delete, live count badge
• User Management: Admin panel for creating users, assigning roles, disabling accounts, and resetting passwords
• Audit Log: Persistent, searchable log of all mutations (who did what, when) with 365-day retention
• Rate Limit Dashboard (v4.5+): New tab on the audit log page showing locked IPs, attempt counts, and a clear button
• User-Scoped API Keys: API keys inherit the permissions of their owning user
• Force Password Change: Temporary passwords trigger a mandatory change on first login

Smart End-User Search

• Hybrid Search: Combines full-text exact matching with semantic vector search (Voyage AI embeddings), merged via reciprocal rank fusion
• Configurable Ranking: All ranking weights editable in the admin panel — nav boost, title boost, boosted templates, demoted path prefixes, and penalty scores
• Intelligent Defaults: Nav-linked pages surface first, concept-template pages rank above generic content, video transcripts are deprioritised
• Title Boost: Pages where the query appears in the title always rank above body-only matches
• Typeahead Suggestions: Fast prefix-matching suggestions — pages for direct navigation, keywords for full search — with the same structural ranking
• Works Without Embeddings: Falls back to full-text search if no Voyage API key is configured
• Rate Limiting: Per-IP and global rate limiting for DDoS protection

Developer & Integration

• REST API: Full /api/v1/ JSON API with API key and OAuth token authentication, RBAC-enforced
• MCP Server: 106 tools + 3 prompt resources for agentic website management (stdio + HTTP streamable)
• OAuth 2.1: Authorization code flow with PKCE for remote MCP clients — no embedded passwords
• CLI Tool: Command-line interface for all content management operations
• URL Redirects: 301/302 redirect rules managed from the admin panel
• Webhooks (v4.5+): HMAC-SHA256 signed event delivery for 6 event types (content.create, content.update, content.publish, content.unpublish, content.delete, and more); per-webhook secrets; delivery history with retry visibility; admin UI at /cm/webhooks
• Cloudflare Integration (v4.5+): Auto-purge Cloudflare cache on publish/unpublish via Zone ID + API Token
• Edge Caching Headers (v4.5+): ETag, Cache-Control, Last-Modified, Vary, and 304 Not Modified on all public pages
• Structured JSON Logging (v4.5+): All server logs emit structured JSON with timestamp, level, message, and context fields

Site Customization

• Theme Customization: Colors, fonts, border radius, custom CSS — all editable in the admin panel wi

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: jonradoff
• Source: jonradoff/lightcms
• License: MIT
• Homepage: https://metavert.io/lightcms

Install and usage instructions live in the source repository linked above.