A CMS an agent can run — and a human can read.
Lightweight PHP. A measured 100/100 Lighthouse on the starter theme. A read+write API and an MCP control surface built on the same audited services as the admin.
$ git clone https://github.com/NimbusCMS/nimbus && cd nimbus && docker compose upThis page ships zero JavaScript. Turn it off — nothing changes.
Measured, not promised
0third-party runtime deps
Nothing to trust but PHP
Production runs on PHP 8.2 and the pdo/json/mbstring extensions. No third-party packages ship at runtime — there is no vendor tree to audit.
100/100Lighthouse · gated in CI
Performance is a release gate
Every release must clear a Lighthouse and page-weight budget in CI. A regression fails the build, so what ships can’t silently get slower.
~20klines of core PHP
Small enough to read
Read, audit, and fork the whole core in an afternoon — while it still ships a full admin, a JSON API, and an agent surface.
Built in
Everything a content site needs. Nothing it doesn’t.
Collections & fields
Define structured content — posts, menus, products — with plain field types and relations. Your schema, not ours.
Themes in plain PHP
Server-rendered templates handed a data-only view model. No build step, no client runtime.
Headless API /api/v1
Every collection is a scoped JSON endpoint with read/write tokens and optimistic-concurrency writes.
One rule-set, agents included
The admin, the API, and the agent (MCP) surface are three transports over one audited service layer — never a second set of rules.
Per-plugin agent guides
The CMS and each installed plugin ship their own guide, so a connecting agent knows how to drive every capability it touches.
Roles & scoped tokens
Per-collection permissions for people and tokens alike — subset-only, deny-by-default. Give an agent exactly the verbs it needs.