The batteries-included CMS for the agentic era
Hatamoto is an open-source, entity-first content management system that ships as a single Go binary alongside Postgres. It bundles a visual page builder, SEO tooling, caching, forms, redirects, and server-side AI crawler analytics, and exposes an MCP server so AI agents can draft and publish content under the same rules as human editors.
Counts AI crawler fetches on the server (since crawlers don't run JavaScript), verifies bots against operators' published IP ranges and reverse DNS to flag spoofed user agents, groups crawlers by purpose (training, search index, user fetch), and reports per-page fetch history, error responses served
Every page starts as a typed record in Postgres; the HTML page, its JSON-LD, sitemap entry, llms.txt summary and knowledge-graph feed are all generated from that one record so outputs can't contradict each other.
Click to select, double-click to type, right-click menus, copy between pages, desktop/tablet/phone views with per-device show/hide, slash menu, autosave, revisions, and server-persisted unsaved work.
Focus keyword, meta, canonicals and checks in the editor; JSON-LD generated from the content type with FAQ, Person and Claim markup; authors become real people with a consistent @id; automatic internal links from rules.
An MCP endpoint at /mcp and a CLI call the same services as the admin, so validation, sanitising, hooks and cache clearing apply to agent work. Scoped keys per agent (read keys can't write), agent-created content starts as drafts, and every call lands in an audit log and version history.
Plugins run in WebAssembly with memory and time limits, their own Postgres schema, and only the permissions the owner grants. A failing plugin is switched off rather than crashing the site. A Go SDK hooks into publishing, JSON-LD, forms and rendering.
Pages render on the server and are served from memory in milliseconds. The cache clears on save and preloads from the sitemap, with no Redis or Varnish required.
Form builder with hidden spam trap, timing and rate limits, optional captcha, email notification, CSV export and signed webhooks. Redirects with wildcards, a 404 log ranked by hits, and an 'Explain a URL' tool showing which rule answers.
You fill in typed fields once (name, slug, area served, hours, pricing, FAQs). The published page, its JSON-LD head markup, sitemap entry and llms.txt listing all derive from that record, so editing the record updates every output on the next request.
The site, admin, API and MCP server are one Go binary on one port next to Postgres 16. It runs its own migrations on boot under a supervisor, deploys on any Linux box or via docker compose, with no PHP, Node, npm or build step.
Scan (read-only) to see what converts, import content/media/menus/authors, audit every old URL for pages or clean 301s, then re-sync the night before cutover with edits preserved.
Free and open source under the Apache-2.0 licence, with source code available on GitHub. No paid plans or pricing tiers are listed.
An open-source, entity-first CMS that runs as a single Go binary next to Postgres. It includes a visual page builder, SEO tooling, caching, forms, redirects, AI crawler analytics and an MCP server in core, with no PHP, Node or plugins to maintain.
Yes. Hatamoto is v1.0, released under the Apache-2.0 licence, with source code available on GitHub (Zen-Labs-Corp/hatamoto).
The functionality usually supplied by plugins (page builder, SEO, caching, redirects, forms, analytics, security, custom fields) is built into core, so there's one binary and one update instead of multiple plugins to keep compatible. Content is stored as typed entities, and all machine-readable outputs (JSON-LD, sitemaps, llms.txt) derive from the same record.
AI crawlers don't execute JavaScript, so scripts like Google Analytics can't see them. Hatamoto counts every fetch on the server, verifies bots against each operator's published IP ranges and reverse DNS so spoofed user agents are flagged and excluded, and groups crawlers into training, search-index and user-fetch categories, tied to the specific page fetched.
Yes. Agents connect through an MCP server at /mcp or a CLI using scoped keys (a read key can't write). Agent work goes through the same validation, sanitising, hooks and cache clearing as the admin, anything an agent creates starts as a draft, and every call — allowed or refused — is recorded in the audit log and version history.
Deploy a single Go binary on any Linux box next to Postgres 16, or run it with docker compose. It runs its own migrations on boot under a supervisor, with no build step, PHP version management or npm required.
Yes. The importer reads your site via the WordPress REST API or a WXR export. It imports posts, pages, categories, tags, menus, media and authors, carries over permalink structure and SEO titles from Yoast, Rank Math, SEOPress or AIOSEO, and audits every old URL for a page or clean 301 before cutover. Re-runs update rather than duplicate. Page-builder layouts, forms, comments and WooCommerce data don't convert — the scan reports this before you start.
Plugins are signed WebAssembly modules running in a sandbox with memory and time limits, their own Postgres schema, and only the permissions the owner explicitly grants. A failing plugin is switched off automatically rather than taking the site down. A Go SDK is provided for hooks into publishing, JSON-LD, forms and rendering.
