Everyone says the same thing about EmDash: learn the admin panel first. Master the dashboard, understand the UI, get comfortable with the block editor. That advice comes from years of WordPress training. It’s also almost useless for this CMS.<\/p>\n
EmDash is not WordPress. The admin panel is deliberately familiar, but the real power lives in places WordPress never had. The CLI. The MCP server. The plugin sandbox manifest. If you only learn the visual interface, you’re using 20% of what this system does.<\/p>\n
Here are eight commands that matter. Some will be obvious. A few will not. That’s the point.<\/p>\n
npm create m-dash@latest<\/code> \u2014 But Not With the Default Template<\/h2>\nThe starter command everyone runs. Type it, pick a template, get a site. What the tutorials skip: the template choice<\/a> locks in your entire schema.<\/p>\nPick “blog” and you get posts, pages, and a comments system. Pick “portfolio” and you get projects with client fields and year metadata. Pick “marketing” and you get landing page sections. There is no “generic” template. Choose carefully from the start, or you’ll spend the next hour deleting content types you don’t need.<\/p>\n
The command itself is straightforward. The decision it forces is not.<\/p>\n
“`<\/p>\n
npm create m-dash@latest<\/p>\n
“`<\/p>\n
2. The MCP Server \u2014 No Command Needed, But You Must Know It Exists<\/h2>\n
Every EmDash instance ships with a built-in MCP server. No plugin. No configuration. It just works.<\/p>\n
Connect Claude, Cursor, or any MCP-compatible agent to http:\/\/localhost:4321\/mcp<\/code>codecodecode (or your deployed URL). The agent can then query content, create posts, update metadata, and even generate plugins. No custom API wrappers. No authentication headaches beyond the passkey you already set up.<\/p>\nThis is the feature WordPress developers miss entirely. They open the admin panel and start clicking. The MCP server means you never have to touch the UI for bulk operations. Ask the agent to “find all posts mentioning ‘legacy’ and add a ‘needs-update’ tag.” Done in one sentence.<\/p>\n
3. m-dash migrate:wordpress<\/code> \u2014 The Import Command That Does More Than You Think<\/h2>\nThe WordPress migration tool is not just a content dumper. Point it at your WXR export file, and it maps Yoast SEO fields to EmDash’s native SEO fields. It reads custom post types. It preserves media associations.<\/p>\n
But here’s what the docs don’t emphasize: it does not<\/strong> migrate plugins, themes, or custom functionality. Your WooCommerce store does not come with you. Your Elementor layouts do not survive. The migration imports the data layer only. Everything else is a rebuild.<\/p>\n“`<\/p>\n
m-dash migrate:wordpress –input=export.xml<\/p>\n
“`<\/p>\n
Plan for that rebuild before you run the command, not after.<\/p>\n
4. The Plugin Sandbox Manifest \u2014 capabilities: [...]<\/code><\/h2>\nThis is not a command. It’s a code pattern that defines everything about plugin security. Every EmDash plugin declares its permissions in a manifest. No manifest, no access.<\/p>\n
“`typescript<\/p>\n
definePlugin({<\/p>\n
id: “my-plugin”,<\/p>\n
version: “1.0.0”,<\/p>\n
capabilities: [“read:content”, “email:send”],<\/p>\n
hooks: {<\/p>\n
“content:published”: async (context) => {<\/p>\n
const email = context.get(“email”);<\/p>\n
await email.send({<\/p>\n
to: “admin@example.com”,<\/p>\n
subject: “New post published”,<\/p>\n
});<\/p>\n
},<\/p>\n
},<\/p>\n
});<\/p>\n
“`<\/p>\n
The plugin can read content and send email. It cannot write to the database. It cannot access the file system. It cannot make external network calls. The runtime enforces this at the V8 isolate level.<\/p>\n
Most developers coming from WordPress write their plugin code first and think about security later. EmDash forces the opposite order. Declare first. Build second.<\/p>\n
5. m-dash content-type:create<\/code> \u2014 Schema as Code, Not Click-Ops<\/h2>\nIn the admin panel, you can create a new content type in under a minute. Name it, add fields, set slugs. Done.<\/p>\n
The problem: that content type lives only in your database. It is not version-controlled. It is not repeatable. If you tear down your local instance and rebuild, that content type is gone.<\/p>\n
The CLI equivalent is better:<\/p>\n
“`<\/p>\n
m-dash content-type:create <\/p>\n
–name=”Project” <\/p>\n
–slug=”project” <\/p>\n
–fields=”title,description,client,year,url”<\/p>\n
“`<\/p>\n
But even that is a stopgap. What you actually want is to define your schema in code, stored in your repository, deployed alongside your theme. EmDash supports this through its configuration file in astro.config.mjs<\/code>codecodecode. Define content types there, and they become infrastructure-as-code.<\/p>\nThe admin panel is convenient. The code-based approach is correct.<\/p>\n
6. m-dash deploy<\/code> \u2014 The Command That Reveals the Lock-In<\/h2>\nDeploy to Cloudflare Workers with one command. It provisions D1 for the database, R2 for media storage, and KV for sessions. It creates the worker routes. It sets up the CDN. The whole process takes about two minutes.<\/p>\n
The catch: this deployment path is the only path that gives you sandboxed plugins. Self-host on a Node.js server, and plugins run in-process without isolation. The security model that justifies EmDash’s existence requires Cloudflare’s paid runtime.<\/p>\n
“`<\/p>\n
m-dash deploy –provider=cloudflare<\/p>\n
“`<\/p>\n
The code is MIT-licensed. The infrastructure is not portable. Know this before you commit to the tool, not after you’ve built your entire site on it.<\/p>\n
7. m-dash agent:skill --add<\/code> \u2014 The Hidden Developer Multiplier<\/h2>\nEmDash ships with “agent skills” files \u2014 structured documentation that tells AI agents<\/a> exactly how to operate the CMS. These are not user-facing docs. They are machine-readable instructions that live in the repository.<\/p>\n