Hatamoto

Stand close. Serve well.

The batteries-included CMS for the agentic era: builder, SEO, caching, forms, redirects, AI analytics and MCP in one Go binary plus Postgres.
Open source, no plugin stack, no PHP, no Node, no telemetry unless you turn it on.

Website · Docs · Get started · Plugins · Themes · Roadmap · Security

The visual page builder: the layers of the home page on the left, the page on a canvas with desktop, tablet and phone sizes, and the selected headline's settings on the right.

Get started

Docker (starts Postgres too):

git clone https://github.com/Zen-Labs-Corp/hatamoto.git && cd hatamoto
docker compose up

Or the binary (Linux or macOS, Intel or ARM), pointed at your own Postgres:

OS=$(uname -s | tr A-Z a-z); ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')
curl -fL "https://github.com/Zen-Labs-Corp/hatamoto/releases/latest/download/hatamoto-$OS-$ARCH.tar.gz" | tar -xz --strip-components=1 "hatamoto-$OS-$ARCH/hatamoto"
DATABASE_URL=postgres://user:pw@localhost:5432/hatamoto?sslmode=disable ./hatamoto serve

The server prints a setup address in its log (docker compose logs hatamoto). Open it to create
your account and site. The admin lives at a private address of its own, which hatamoto admin-url
prints at any time. More: Install with Docker,
Install the binary, First run,
Trust and signing.

Status: v1, plugin SDK v0. It runs hatamoto.dev in production. The plugin SDK
can still change between its minor versions. What stays stable, and for how long: STABILITY.md.

A look around

Every screenshot below is a real Hatamoto server with a seeded demo site, captured by
scripts/homepage-shots (SHOTS_SET=readme), so they are regenerated
when the admin changes.

Write and build pages

Posts get a writing editor with SEO checks, scheduling and suggested internal links. Pages get the visual
builder above: sections and blocks you rearrange on a canvas, previewed at desktop, tablet and phone sizes,
with undo, history and keyboard shortcuts. Page editor,
Builder reference

The post editor: a post with a heading selected and the formatting toolbar, and the publish, schedule, slug and featured image settings in the side panel

See who reads your site, people and AI

The overview shows what changed this week and what needs a look. Analytics are cookieless and count AI
assistants as a channel of their own. The crawler report shows which AI agents fetch which pages, checks that
each one is who it claims to be, and lets you allow or block a whole purpose (training, search, user fetches).
AI and SEO, Crawler analytics

The admin overview: published pages, drafts, new form submissions, AI-referred visits and missing pages, then site health and the pages AI crawlers fetch most.

AI analytics overview: AI fetches, AI-referred visits and AI share of traffic, with both plotted per day.

AI crawlers: fetches by purpose and every agent with its verification status and an Allow or Block switch per purpose

Let agents publish through MCP

Hatamoto is an MCP server. An agent connects with an API key and gets tools for content, the page builder,
media, SEO and analytics, limited to the scopes on its key. This session is real: the agent drafts a post,
publishes it, and the page is live. MCP, Connect an AI agent

A real MCP session: an agent connects with an API key, lists the tools, creates a draft post and publishes it, and the new page answers 200.

Creating an API key: a name, one switch per scope such as read and write entities, media, redirects and SEO, and an expiry.

Move from WordPress without losing a URL

Point the importer at a WordPress export and it reports what it found before anything changes: content,
permalinks and the URL pattern that keeps them, the SEO plugin, page builders and forms it detected, and how
much will come across unchanged. Every old address that moves gets a permanent redirect.
Move your site

The WordPress import scan report: posts, pages, media, terms, authors and menus found, how the old permalinks map to a URL pattern, which plugins and page builders were detected, and the expected fidelity per item.

Redirect rules with from, to, type, hits and an on or off state.

Plugins and updates you can trust

Plugins and themes are signed WebAssembly packages. Before you install one you see who signed it and every
permission it asks for, and the risky ones are off until you switch them on. Updates are signed too: they
install in your maintenance window, and a release that fails its health check rolls back on its own.
Plugins, Updates

Installing the gtm plugin: signed by a key, what it will and will never be able to do, and its JavaScript switched off until you allow it.

Settings, Updates after a failed update: the new version failed its health check, so the site went back to the previous version on its own, with the reason and a Retry button.

More: forms, menus, internal links, URL patterns, caching

_{Forms with a spam filter and CSV export. Forms}	_{Menus, edited and previewed in the admin. Menus}
_{Internal linking rules that turn phrases into links. Settings}	_{Addresses are patterns you set per content type. URL patterns}
_{A page cache and compression built in. Performance}	_{The built-in theme, light and dark. Themes}

Themes

Themes are signed packages too. Install one, then change its colours, fonts and layout parts from the admin
without touching code. Browse themes, Write a theme

Four themes: Hanshi, a journal; Hearth, an advisory firm; Kaizen, a dark journal; and Nagi, a quiet journal

Features

A fast, server-rendered site with a good default theme, a blog and pages.
A proper blog editor and a visual page editor. Admin guide
WordPress import that keeps every old URL working, with a URL audit. Move your site
AI-crawler analytics (which AI read which page, and did it send visitors), llms.txt, JSON-LD and a knowledge graph. AI and SEO
Sandboxed one-click plugins and themes (WebAssembly), nothing to compile. Plugins, Themes
An MCP server, so AI agents can write and publish through the CMS. MCP
Signed releases with automatic updates you control. Updates, docs/UPGRADES.md

How it fits together

One program, hatamoto, and one Postgres database. The site, the admin, the JSON API, the MCP endpoint,
background jobs and the plugin runtime all run in that one process: no Node, no Redis, no search server,
no separate worker. Architecture

flowchart LR
  V[Visitors and crawlers] --> S
  E[Editors] --> S
  A[AI agents over MCP] --> S
  subgraph S[hatamoto, one Go binary]
    direction TB
    R[Site and page cache]
    AD[Admin]
    API[JSON API and MCP]
    J[Background jobs]
    P[Plugins in a WebAssembly sandbox]
  end
  S --> DB[(Postgres: content, settings, plugins, themes)]
  S --> F[(Media folder)]
  U[Signed release channel] -. updates .-> S

Run it in production

Topic	Read
Hardening (HTTPS, HSTS, CSP, secrets, SMTP)	Hardening
Every environment variable	Configuration reference
Every `hatamoto` command	CLI reference
Reverse proxy and TLS	Reverse proxy and TLS
systemd or Docker	Deploy with systemd, Deploy with Docker
Backups and updates	Backups, Updates

No telemetry unless you turn it on. The one optional install count is off until an owner opts in, and HATAMOTO_TELEMETRY=off rules it out. Every connection the server makes, with the switch that turns it off, is listed in
Outbound connections. Updates can stop entirely: set HATAMOTO_UPDATES
to off (no network call at all).

Contribute

Go is the only toolchain: make build, make check, and go test ./... from backend/.
Read CONTRIBUTING.md and the Code of Conduct, and report security
problems privately as described in SECURITY.md. Write a plugin: plugin guide;
write a theme: theme guide.

Licence

Apache-2.0. Copyright Zen Labs Corporation; third-party components in NOTICE.
"Hatamoto" and its logo are trademarks of Zen Labs Corporation: forks must use a different name.
See TRADEMARKS.md.