The open-source, self-hostable website platform for agencies.

Build and run all your client sites from one place — author in code with live in-place editing, a built-in CMS, rich interactive components, and an AI assistant — then publish fast, framework-free static sites. Coding agents can build and edit your sites too, over MCP.

Status: actively developed and self-hostable today (v0.1.0). Pre-1.0 — APIs and on-disk formats may change between minor versions; see CHANGELOG.md.

---

Why Sitewright

Agencies juggle dozens of client sites — each with its own brand, content, forms, languages, and release cadence. Sitewright is one platform for the whole lifecycle, self-hosted in a single container:

• Code-first, but clients can edit. Developers author pages in HTML + Tailwind + DaisyUI; mark any element editable and clients change text, images, and links in place in a live preview — with no access to the code.
• Batteries included. A built-in CMS, forms, multilingual, a rich component + motion library, an image pipeline, SEO, consent/GDPR, and a real deploy pipeline — not a pile of plugins to assemble.
• Agent-native. An in-editor AI assistant builds and edits sites for you, and an MCP endpoint lets external coding agents (Claude Code, ChatGPT, Cursor…) do the same over a scoped key. Your sites are programmable.
• Fast + cheap to host. Output is framework-free static HTML — only the CSS/JS a page actually uses is shipped, so simple pages carry near-zero JavaScript.
• Yours to run. One container, one volume. Hardened by default, versioned releases, automatic pre-upgrade DB snapshots. No SaaS lock-in.

Deploy in one command

docker run -d -p 127.0.0.1:8080:80 -v sw-data:/app/data \
  -e SW_PUBLIC_URL=https://sites.example.com -e TRUST_PROXY=true \
  -e SW_ENCRYPTION_KEY="$(openssl rand -base64 32)" \
  ghcr.io/sitewright-cms/sitewright:latest

Put a TLS reverse proxy in front and you're live. Full guide → docs/deployment.md · every setting → docs/environment.md.

Features

✍️ Authoring

• Code-first pages — each page is HTML + Tailwind + DaisyUI; the code is the page (no lossy block tree).
• Live in-place editing — mark elements with data-sw-* and clients edit text, rich HTML, links, images, and backgrounds directly in a live WYSIWYG preview, safely (no code access).
• Reusable building blocks — components, snippets (a ~25-recipe cookbook to copy and own), full-page templates, data-backed widgets, and site-wide chrome slots (nav / footer / sidebars).
• Dual-mode editor — a full code editor (CodeMirror) or a client-safe content editor, with a searchable Library rail (components, icons, animations, button/parallax/SVG builders, Google-font gallery) and desktop/mobile preview.

🧩 Interactive components & motion

• First-party components — carousel/slider (Embla), tabs, lightbox gallery, native <dialog> modals, dismissible banners, forms, a date/time/range picker, and WebGL shader backgrounds (30 presets). All accessible and degrade to usable HTML without JS.
• Motion & effects — scroll/entrance animations, multi-layer parallax, SVG draw-on + morph animation (with a visual studio), curated nav & button effect libraries, sticky-header modes, scrollspy, a page preloader, click ripples, back-to-top, and opt-in light/dark themes.

🗂️ Built-in CMS

• Typed datasets — collections with 15 field types (incl. nested list/object, references, media), edited in a data panel and click-to-edit in the preview.
• Dynamic pages — a [param] route over a dataset expands into one static detail page per entry at build.
• Safe by design — rename a dataset and the slug cascades across every loop and reference in one transaction.

🌍 Multilingual

• Translate by inheritance — add a language and Sitewright scaffolds translated pages that inherit the master's code; edit the layout once and every language updates.
• Key-first catalog — shared UI strings via {{sw-translate}}, per-locale content, hreflang alternates, and localized datasets.

🖼️ Media, fonts & performance

• Responsive images — AVIF/WebP with srcset, blur-up LQIP, no-CLS intrinsic sizes, on-demand thumbnails, materialized minimally at publish.
• Vectors & icons — SVG kept as sanitized first-class vector; ~1,865 Lucide icons, ~270 brand logos, ~250 country flags — all inlined.
• Fonts — self-hosted uploads and Google Fonts downloaded + self-hosted (never a CDN); a full favicon/PWA icon set generated from one master.
• Lean CSS — publish-time Tailwind v4 emits only the classes you use, brand tokens as first-class utilities, one cacheable stylesheet.

🚀 Publish, deploy & host

• Framework-free static output — only-used-ships CSS/JS, atomic publish, a portable self-contained artifact (runs at a domain root, a subfolder, or locally).
• Deploy anywhere — local hosting, FTP/FTPS, SFTP (with rsync/tar fast paths), and git (HTTPS token or SSH key) — via a wizard, with encrypted secrets, SSRF guards, and live streamed progress.
• Incremental delta deploys — a content-hash manifest uploads only what changed, with a tar-over-SSH fast path, transport compression, and immutable ?v= cache-busting.
• Always-on preview — a whole-site draft preview rebuilt on change, plus revocable share links for stakeholders.
• Self-host client sites — serve them in-container at <slug>.<your-domain> (origin-isolated so author JS runs safely) or via a /sites/<slug>/ path.

🔎 SEO & 🔒 privacy

• SEO built in — per-page Open Graph, Twitter cards, canonical + hreflang, sitemap.xml, robots.txt, and schema.org Organization JSON-LD.
• Insights — an in-editor Lighthouse speed + SEO audit (also an API route and an agent tool).
• Consent Manager — auto-gates third-party iframes and analytics scripts by consent category and derives a tight per-site Content-Security-Policy (never unsafe-inline/*) — GDPR-friendly by construction.

🤖 AI & agents

• On-page AI assistant — a server-side agent loop drives ~45 authoring tools to build and edit the site live (bring the platform key, or a per-project key).
• MCP, everywhere — a remote OAuth MCP endpoint (ChatGPT, Claude.ai) and a local sitewright-mcp stdio bridge (Claude Code, Cursor, Cline, Windsurf, Gemini CLI) let coding agents edit a project over a scoped key.
• Import & clone — crawl or upload an existing site into an editable project (self-hosting its images + fonts, extracting brand identity); AI-assisted nativize with objective fidelity audits.

👥 Agency, accounts & ops

• Multi-tenant — per-project corporate identity/branding; white-label the whole admin panel.
• Client access — invite-only registration and one-time, project-scoped client invites (edit-only, no email infra required).
• Hardened auth — MFA/TOTP, passkeys/WebAuthn, OIDC SSO, and project-scoped API keys.
• Safety net — project-wide version history + restore across pages, datasets, and settings; a 90-day media recycle bin; automatic WAL-safe DB snapshots before every upgrade.
• Self-host ops — one System Settings panel (SMTP, AI, OIDC, branding, HSTS, log level, backups), /health
  • /ready probes, structured logs, and versioned GHCR releases with an in-app update banner.

Monorepo

pnpm + Turborepo. The whole product ships as apps/api's container; the packages are internal (not published to npm).

Package	Purpose
apps/api	Fastify backend — REST API, serves the editor SPA, the render/build/publish pipeline, and the MCP endpoint.
apps/editor	The React visual + code editor (single-page app).
@sitewright/schema	Zod schemas + authoring contracts (pages, datasets, brand tokens, instance settings, the component catalog + agent guides).
@sitewright/core	Pure domain logic — immutable content-tree ops, partial + binding resolution, collection-page expansion, project validation.
@sitewright/blocks	Framework-free renderer + component/effect runtimes — the XSS-safe HTML that the live preview and the published site share.
@sitewright/image-pipeline	Image optimization — AVIF/WebP variants, LQIP, SVG sanitization, favicon/PWA sets (sharp).
@sitewright/tailwind	Publish-time Tailwind v4 compiler — scans rendered HTML, emits a minimal brand-mapped stylesheet.
@sitewright/site-import	Turns a captured external site (crawl or upload) into an editable Sitewright import bundle.
@sitewright/mcp	MCP stdio bridge — exposes a project's authoring tools to local coding agents over a scoped key.
@sitewright/cli	The sitewright CLI — OAuth login + sitewright mcp to run the bridge from stored credentials.

Deeper design docs: architecture · authoring model · project format.

Development

corepack enable      # provides pnpm (Node >= 22, see .nvmrc)
pnpm install
pnpm verify          # typecheck + lint + test + build

Contributions follow a strict quality bar (TDD, full code + security review, E2E) — see CONTRIBUTING.md. To cut a release, see RELEASING.md; to report a vulnerability, see SECURITY.md.

License

Apache-2.0