SveltyCMS - Headless CMS with Sveltekit Power

SveltyCMS.com

(Still in Development — your support is appreciated!)

A powerful Enterprise Headless CMS with Sveltekit Power

It's lightning fast, flexible and an easy to use modern content management system to provide a headless backend

This SveltyCMS headless CMS provides a powerful backend based on a modern SvelteKit 2 / Svelte 5 framework. Being designed to be database agnostic, we fully support MongoDB, PostgreSQL, SQLite, and MariaDB/MySQL (via Drizzle ORM).

You can define Content Collections in two ways: in code or via the GUI-based collection builder. Full TypeScript support and a rich widget library make it straightforward to build custom data structures.

All widget fields support localization, validation using Valibot, and access control.

System localization uses Inlang Paraglide JS, a lightweight, type-safe i18n library. English is the default; additional languages are bundled and can be extended.

We use the latest tailwindcss v4, so the CMS can be quickly optimized to your personal needs.

Backend data is available via REST API or GraphQL Yoga for fast, flexible frontends.

⭐ Key Features

🚀 Quick Start

Get up and running fast:

1. Clone and install

git clone https://github.com/SveltyCMS/SveltyCMS.git
cd SveltyCMS
bun install  # or npm/pnpm

1. Start dev server (guided installer auto-launches)

bun run dev  # or npm run dev / pnpm run dev

1. Open the app

2. SvelyCMS: http://localhost:5173/

3. GraphQL: http://localhost:5173/api/graphql

Prefer a full walkthrough? See: ./docs/getting-started.mdx

🛠️ Developer Experience (DXP)

• CLI installer auto-launches for smooth first-run setup
• Typed widgets and schema-driven collection builder
• Fast feedback loop with hot reloads and strong typing

🚀 Setup

Clone the repository

To clone our repository you need to be able to use Git.

git clone https://github.com/SveltyCMS/SveltyCMS.git
cd SveltyCMS

Install all dependencies

[!TIP] Bun is preferred for best results. While SveltyCMS is fully compatible with Node.js (>=24), running the application under the Bun runtime unlocks native Zig-based cryptographic performance (like native Argon2id hashing) and optimized OS-level file watching with zero binding overhead.

Install LATEST STABLE Node.js (>=24) to get started. We recommend using Bun for the best experience (3-4x faster than npm/pnpm). Then choose your preferred package manager:

bun

# Install bun if you haven't already
curl -fsSL https://bun.sh/install | bash

# Install all dependencies
bun install

# Development (CLI installer launches automatically if needed)
bun run dev

# Build for production
bun run build

# Preview production build
bun run preview

⚠️ Windows users: If bun install fails with ParserError or corrupted packages (null bytes in package.json files), use npm install instead. bun run dev and other commands work normally after npm install. This is an upstream bun bug affecting Windows only.

npm

# Install all dependencies
npm install

# Development (CLI installer launches automatically if needed)
npm run dev

# Build for production
npm run build

# Preview production build
npm run preview

pnpm

# Install pnpm if you haven't already
npm install -g pnpm

# Install all dependencies
pnpm install

# Development (CLI installer launches automatically if needed)
pnpm run dev

# Build for production
pnpm run build

# Preview production build
pnpm run preview

Setup Wizard (auto)

When starting the dev server without configuration, the guided installer launches automatically:

• Smart detection via vite.config.ts
• Database configuration: MongoDB, PostgreSQL, SQLite, or MariaDB/MySQL
• Admin account setup, secrets/keys generation
• Optional SMTP and Google OAuth configuration

Start with:

bun run dev  # or npm run dev / pnpm run dev

Development and Production

We use the unified Vite+ Alpha (VoidZero) toolchain for an ultra-fast development experience.

• Development: bun run dev (runs on localhost:5173)
• Production Build: bun run build (Rust-based Rolldown bundler)
• Preview: bun run preview (runs on localhost:4173)
• Linting: bun run lint (oxlint — project-wide checks in <50ms)
• Formatting: bun run format (oxfmt — blazing fast Rust-based formatter)

See our package.json for all available commands.

🔒 Authentication & Security

SveltyCMS implements A++ enterprise-grade security with 4-layer defense-in-depth architecture.

Multi-Layer Protection:

• AI Bot Defense Shield — Proactive detection blocks 28 AI crawler patterns (GPTBot, Claude, Perplexity) and reconnaissance tools (Nmap, SQLMap, Burp Suite). A 45-route honeypot grid with progressive tarpit delays and response poisoning wastes attacker resources.
• 4-Layer Defense-in-Depth — Middleware → Dispatcher → Handler → Page Action; every layer re-validates permissions independently with fail-closed defaults.
• Enterprise SSO — Native SAML 2.0 and SCIM 2.0 support for automated user provisioning (Okta, Azure AD).
• Zero-Bias Cryptography — CSPRNG token generation with rejection sampling, Argon2id password hashing (64MB memory-hard), AES-256-GCM encryption, SHA-256 crypto-chained audit logs.
• Cross-Origin Isolation — COOP, COEP, and CORP headers on all API responses prevent Spectre/Meltdown side-channel attacks.
• Multi-Tenancy — Native tenantId isolation at the database adapter level with TBAC role scoping.
• Granular RBAC — Role-based and field-level access control; OAuth HMAC state integrity; timing-safe cryptographic comparisons; __Host- cookie prefix enforcement (RFC 6265bis).

You can log in with email/password, Google OAuth, or GitHub OAuth. Role- and field-based access control lets you define precisely who can view, edit, or delete content.

📖 Full Security Documentation

🎨 Modern Theming & Design System

SveltyCMS features a native Svelte 5 component library (42+ primitives) built on Tailwind 4 CSS variables with zero third-party UI dependencies.

• Swappable Admin Themes — Centralized app.css using Tailwind 4 @theme blocks. Replace the default color palette to give your CMS a corporate brand identity — from startup purple to enterprise blue in minutes.
• Dark Mode — Native support via media and class selectors.
• Accessibility-First — All components verified for WCAG 2.2 AA compliance in the Kitchen Sink validation lab.
• Zero Runtime Overhead — Components use Svelte 5 Runes ($state, $props) with Svelte use:action patterns instead of heavy state machines.

📖 UI Style Guide

🌍 Great System Localization i18n infrastructure

♿ Accessibility & Inclusivity

SveltyCMS is designed with inclusivity at its core, strictly following WCAG 2.2 AA and ATAG 2.0 standards, and proactively moving towards WCAG 3.0 (Functional Performance).

• Screen Reader Ready: Semantic HTML landmarks, ARIA live regions for status updates, and descriptive labels.
• Keyboard Navigation: Full support for keyboard-only users, including complex widgets like tree views and drag-and-drop interfaces.
• Cognitive Accessibility: Clear input validation, consistent navigation, and focus management.
• For Developers: We provide a comprehensive Accessibility Guide to help you maintain these standards in your custom widgets.

📋 Easily create Data Collections

Great Experience to designing user-friendly and intuitive interfaces for managing content. Full Typescript support to display all available widgets, options to create fully custom data structures.

📧 Flexible Email Templating System

Build and send emails using Svelty Email and TypeScript.

📦 Optimized Bundle Size SveltyCMS is built with modern optimization techniques resulting in a compact bundle compared to traditional CMS platforms: