A modern, lightweight PHP CMS — collections, a themeable admin, and a plugin system you can actually read.
🧹 Try the live demo →
sign in with demo@nimbuscms.dev / explore-nimbus-demo — full admin, resets hourly
· nimbuscms.dev (site + docs)
🚀 Beta —
0.1.0, the first tagged release. It's0.x, so the plugin API may still change between minor releases, and there's no automatic upgrade path yet. Run it, fork it, build on it — just pin your version.
Most PHP CMSes are either enormous or abandoned. Nimbus is a small, modern, readable codebase you can hold in your head: PHP 8.2+, PDO, a clean layered architecture, its own schema via migrations, and a headless-first mindset.
It isn't trying to be WordPress. It's trying to be the CMS you'd be happy to fork.
| nimbus | The CMS core |
| plugin-markdown | Markdown field type — the official reference plugin |
| plugin-seo | SEO structured data (JSON-LD) for public pages |
| plugin-analytics | Privacy-first, first-party analytics |
| plugin-api-advanced | Advanced API features (a security audit log) |
| plugin-inventory | Ledger-based stock, agent-drivable over MCP |
| plugin-commerce | Orders + checkout, reserving stock through Inventory |
| plugin-storefront | The public, themed shop — catalog, cart + checkout over the Inventory/Commerce ports |
| theme-docs | Zero-JS docs + marketing theme |
| theme-cafe | A warm small-business / café theme |
| theme-aurora | A magical-sky storefront theme (powers the Foodmart grocery) |
| nimbuscms-www | The marketing + docs site, running on Nimbus itself |
| demo | The Fern & Kettle demo site (demo.nimbuscms.dev) |
| .github | Community health files and brand assets |
Plugins are ordinary Composer packages:
composer require nimbuscms/markdownDiscovery is Composer's installed.json. There's no upload step and no
in-admin installer, because downloading and executing arbitrary code needs
signing, compatibility and rollback policies designed first.
Disable a plugin and your content is safe: entries using its field type stay in the database untouched, the admin shows them read-only and names the missing provider, and saves are refused until it's back. A CMS that loses content when a plugin is removed isn't one anyone should trust with content.
The plugin surface grows one capability at a time, each added alongside a
plugin that actually needed it — never a batch of extension points designed in
advance. Today a plugin can register field types, contribute to <head> and to a page's
view-data (live data into themed pages, ADR 0027), listen
to and emit events, own its migrations + tables, declare a grantable
wildcard-immune capability, expose MCP tools that gate on it, serve public
routes, publish typed service ports to other plugins, and add
capability-gated admin pages. Access to core tables and controllers is
deliberately still not exposed. See
ADR 0001.
Issues, discussion and pull requests are welcome from anyone. You don't need to be in this organization to write a plugin — plugins live in your own account.
Read CONTRIBUTING first; for anything beyond a small fix, open an issue before writing code. The most common reason a pull request gets turned down is that it adds a good feature the project deliberately doesn't want.
Found a security issue? Report it privately — never in a public issue.
Only officially maintained Nimbus software: core, official plugins and themes, documentation and tooling.
Community plugins and themes stay in their authors' own accounts. They can be listed in the future Nimbus directory without moving here — listed does not mean maintained by Nimbus. A community project joins this organization only when Nimbus deliberately takes on ongoing maintenance, and only with the author's agreement.