EmDash is a next-generation CMS that Cloudflare released as open source on April 1, 2026. "INA Media," operated by INA&Associates, completed its migration to EmDash at the very moment of that release. Choosing a publishing platform is the foundation of a media strategy, and we were looking for an architecture that could separate, over the long term, "what people should do" from "what should be entrusted to AI." We believe EmDash is the first CMS that can serve as that answer. In this article, I will share why we chose Cloudflare's new CMS on its first day of release, along with the background and criteria behind that decision.
Key points of this article
-
EmDash is an open-source CMS built with TypeScript + Astro 6.0, released by Cloudflare under the MIT license in April 2026
-
Its biggest distinguishing features are "plugin sandboxing" and an architecture that AI agents can operate directly, solving WordPress's structural security challenges
-
INA&Associates adopted EmDash for media.ina-gr.com from day one and has already put it into operation
-
We chose it not because of technical specs, but as a management decision to create an environment where our talent can focus on more essential decision-making
-
What executives should now ask of their publishing platform is not a technology choice, but a resource-allocation question: who should spend time where?
What is EmDash? The reality behind Cloudflare's "spiritual successor to WordPress"
EmDash is a full-stack TypeScript headless CMS released by Cloudflare on April 1, 2026. It is published on GitHub under the MIT license and, as of the time of writing, has earned about 9,700 stars. Cloudflare itself positions EmDash as a "spiritual successor to WordPress."
Why a "spiritual successor"? Since its arrival in 2003, WordPress has embodied the ideal of democratization: enabling anyone to publish a website at low cost. EmDash carries that ideal forward while redesigning it for today's serverless environments and operations built on the assumption of AI agents.
The technology stack consists of Astro 6.0, Cloudflare Workers, SQLite (D1), and R2. Because it can also run on SQLite on Node.js, it is designed not to force lock-in to Cloudflare. That is an important selection point for a corporate media platform intended for long-term operation.
Why is EmDash called "AI-native"?
The biggest reason EmDash is drawing attention in the industry is that it is designed on the assumption that AI agents will operate it. Specifically, the following three elements are built in as standard.
First, an MCP server (Model Context Protocol) is bundled with every instance. This allows AI agents such as Claude and ChatGPT to directly create, update, and search content within an authenticated context.
Second, the EmDash CLI covers content management, media uploads, type generation, and schema operations. It can be fully automated from shell scripts and is intended from the outset to be integrated into CI/CD pipelines.
Third is a mechanism called Agent Skills. Instructions for creating plugins and migrating from WordPress themes are bundled as structured documents that AI agents can understand. At INA Media, our team of writing agents posts content directly through these Agent Skills.
To be frank, the term "AI-native" is often consumed as a temporary buzzword. In EmDash's case, however, its design philosophy is consistently AI-first. Rather than adding a human admin UI afterward, it shows clear signs throughout that the admin UI was rebuilt on the assumption that AI would operate it.
How plugin sandboxing solves an old but still current problem
According to Cloudflare's official announcement, 96% of WordPress site security problems originate from plugins. It also states that in 2025, the number of high-severity vulnerabilities found in the WordPress ecosystem exceeded the combined total of the previous two years.
In the official Cloudflare blog, a plugin isolation mechanism called "Dynamic Workers" is presented as the answer to this structural problem. Each plugin runs inside an independent isolate and cannot execute anything beyond the permissions explicitly declared in its manifest, such as read:content and email:send.
In WordPress, once a plugin is installed, its code can access the site's entire file system, database, and network without restriction. This "full-permission model" has been a breeding ground for vulnerabilities for many years. EmDash's permission declaration model overturns that premise from the ground up.
For a media platform like INA Media, whose readers include affluent owners and investors, site defacement or personal information leaks are not merely technical incidents. They are direct damage to trust itself. Because we see transparency and honesty as the source of long-term trust, the ability to make plugin permissions visible in advance through declarative permissions has major value for us in terms of psychological safety in operations.
Why INA&Associates adopted EmDash on its first day of release
At the surface level, choosing a CMS may look like a technical selection issue. From a management perspective, however, it is a resource-allocation question: where should an organization direct its limited time and attention? We evaluated EmDash from the following three perspectives.
Connection to investment in talent
INA&Associates positions itself as a "human capital investment company." If we are to allocate our greatest resources to people, then the management question becomes how much work that people do not need to do can be handed over to machines. EmDash's MCP, CLI, and Agent Skills provide an environment where writers and editors can be freed from routine CMS operations and focus on essential work such as planning, reporting, and building relationships with readers.
As a concrete example, at INA Media we have built a workflow in which a team of writing agents led by Claude, including researchers, writers, editors, and publishers, generates and posts articles, while editors make only the final publication decision. The fact that agents can write directly to the D1 database is an operational model made possible precisely because EmDash was designed AI-first.
Long-term perspective
If we value sustainable growth over short-term profit, then avoiding lock-in to proprietary SaaS is the better choice. With open source under the MIT license, we do not have to be at the mercy of vendor-driven price increases, feature discontinuations, or service shutdowns.
We ourselves have experienced the burden of content migration caused by the termination of a commercial CMS contract in the past. For that reason, from a long-term perspective, we place the highest priority on a structure in which we can continue to retain ownership of our data and control of our operations.
Fusion of technology and human capability
EmDash's design philosophy is not about handing everything over to AI. Human editors remain responsible for final quality and accountability, while AI is positioned as a tool to improve the speed and accuracy of that decision-making. This aligns with the idea of a "fusion of technology and human capability" that we have discussed repeatedly within the company.
As I also noted in The Frontline of AI Utilization in the Real Estate Industry, I believe AI should be used not to replace judgment, but to broaden the perspective of the person making the judgment. EmDash embodies that philosophy at the foundational CMS layer.
Three questions executives should ask of their publishing platform today
Whether or not to adopt EmDash depends on each company's circumstances. More importantly, I believe executives should use this opportunity to rethink the CMS as infrastructure by revisiting the following three questions.
First, "Are our people spending their time on essential work?" If editors are losing time to CMS operations, plugin updates, and vulnerability responses, that time should really be directed toward building relationships with readers.
Second, "Do we own our data?" SaaS CMS products are convenient, but have you ever estimated the data migration cost when the contract ends? From the standpoint of long-term business continuity, I believe a structure in which you retain operational sovereignty is preferable.
Third, "Is it designed so AI agents can operate it directly?" Over the next three to five years, the center of gravity in content operations will shift from humans to AI agents. A CMS that is not designed to be handled by AI may soon be positioned as a "legacy tool for humans only." I would strongly encourage executives who are considering a review of their talent strategy to work on reviewing their publishing infrastructure in parallel as well.
Conclusion: technology exists to increase the speed of human decision-making
EmDash is technically advanced as a CMS, but that is not the reason INA&Associates adopted it. The reason is that, as a management decision, EmDash was the most coherent choice available at this point in time for creating an environment in which our talent can focus on more essential decision-making while we retain operational sovereignty over the long term.
Technology is not the goal. It is a means of increasing the speed of human decision-making. Whenever a new technology appears, we continue to ask whether it directs our people's time toward what is essential or merely increases administrative clutter. In the case of EmDash, we judged it to be the former. We will continue to share what we learn from operating it through this media platform.
Author: Daisuke Inazawa (Representative Director, INA&Associates Co., Ltd.) Last updated: April 2026
Frequently Asked Questions (FAQ)
Q1. What is the biggest difference between EmDash and WordPress?
A. Their plugin security models are fundamentally different. WordPress uses a full-permission model, while EmDash uses a permission declaration model (sandboxing). According to Cloudflare's statistics, 96% of WordPress site vulnerabilities are plugin-derived, and EmDash is intended to solve this structural issue.
Q2. Is it possible to migrate an existing WordPress site to EmDash?
A. Yes. EmDash supports migration via WordPress WXR export files or through a dedicated Exporter plugin. Media attached to content is also designed to be automatically imported into EmDash's media library.
Q3. What does it mean, specifically, that AI agents can operate it directly?
A. EmDash bundles an MCP server as standard, allowing AI agents such as Claude and ChatGPT to directly create, update, and search content within an authenticated context. At INA Media, this is already built into an operational flow in which our writing team's AI agents post articles directly.
Q4. Is INA Media really running on EmDash?
A. Yes. media.ina-gr.com runs on EmDash on top of Cloudflare D1 + R2 + Workers. This article itself was also inserted directly into EmDash's D1 by the writing team's AI agents and published after final review by an editor.
Read next
Citations and references
-
Official Cloudflare blog, "Introducing EmDash — the spiritual successor to WordPress that solves plugin security" (April 1, 2026): https://blog.cloudflare.com/emdash-wordpress/
-
emdash-cms/emdash GitHub repository (MIT License): https://github.com/emdash-cms/emdash
