Total CMS becomes a platform

Total CMS 3.5 is the largest release since Total CMS 3 launched, and the version number skipped from 3.2 to say so.

For ten years Total CMS has done one thing well: put real, editable content into a site somebody else built. You designed the site, dropped in the CMS, and handed the client an admin they couldn’t wreck. That job hasn’t changed and isn’t going anywhere.

What 3.5 adds is everything around it. You can now build the whole site inside Total CMS, extend the system itself, run your own server-side logic, and point a coding agent at any of it. Four new subsystems, each independently useful, none of them required.

Site Builder

Pages, routes and templates now live in the admin. Add a page, set its URL, and it’s live — no build step, no generate command, no deploy pipeline.

Pages are records in a builder-pages collection, matched at request time, so a templated route like /blog/{id} resolves to the matching record automatically. The admin gives you drag-and-drop page ordering, a hierarchical sidebar, live reload while you edit, and a page-inspector overlay that tells you exactly which page record and which template produced the view you’re looking at.

tcms builder:init scaffolds a complete site from a bundled starter — minimal, blog, business or portfolio — with templates, assets, demo content and a styled 404 page. If you want a modern frontend pipeline, tcms builder:frontend drops in a Vite scaffold that compiles to public/assets/. And if you’d rather your templates live in git, put a builder/ folder at your project root: the repo becomes the source of truth and the admin editor goes read-only so nothing drifts.

Worth being clear about what this isn’t. Site Builder is one way to build a Total CMS site, not the way. Hand-coded PHP still works. The Stacks app still works. Anything that outputs HTML on a PHP server still works. Nothing about your existing sites changes.

A real extension architecture

Extensions live in their own folder and integrate through a curated API — they never reach into the internals. You can extend at essentially every layer: Twig functions and filters, CLI commands, routes, admin nav items, dashboard widgets, custom field types, event listeners, settings, schemas, MCP tools.

The part that took the longest is the part you’d never notice working. Every extension runs inside crash containment, so a broken one renders nothing instead of white-screening the site. On production, an extension that fails repeatedly is quarantined automatically with one-click re-enable. Before you turn anything on, a review screen surfaces its sensitive capabilities and scans the source for risky patterns. And an update can’t silently start using a privilege you didn’t grant — it has to ask again. A health panel shows how much time each extension adds to a request.

The bundled set covers passcode-gating content, publishing within a date window, maintenance mode, Pushover notifications, Algolia search and MCP-served documentation. But the more interesting number is on the extensions page: five third-party extensions from Jochen Abitz at Stackswork, built against the beta and released within a week of 3.5 shipping. That’s the real test of an extension API — whether someone outside the project can build against it without asking you questions.

If you want to build one, the Extension Starter repo demonstrates every extension point.

An MCP server, in Standard

This is the one I’d point at first.

Every install ships a Model Context Protocol server, so Claude, ChatGPT, Cursor and anything else that speaks MCP can query collections, fetch objects, and create and update content — with full schema validation and the same event cascade a normal save goes through. There are three access personas: anonymous public access, API-key admin access, and per-user OAuth 2.1 with fine-grained scopes, backed by a full authorization server with PKCE, refresh tokens, a consent screen, token revocation and an audit log.

Every install also serves its own documentation over MCP. An agent working on a site running 3.5 gets that version’s docs — real field names, real Twig signatures, no drift between what the documentation claims and what the install actually does. That’s the difference between an agent reading your system and an agent guessing at it, and it’s the reason this matters more than the tool list suggests. Five guided prompts ship with it, covering research, building a page, explaining a field, writing Twig, and diagnosing a connection.

Access groups govern all of it. The same groups that control your operators now control your agents: read tools, write tools and resources are each gated by group, and a Bearer token gets exactly the checks a signed-in user gets. A new Permission Matrix page shows what every group can reach, including its AI reach, so you can see what a token could do before you hand one out.

And MCP is no longer reserved for the top tier. It comes with Standard now. Letting an agent write still needs Pro, because that’s what API keys and the OAuth server unlock — but reading your content from an agent shouldn’t have been a premium feature, and now it isn’t.

More on how this works, including what it deliberately doesn’t do, on the AI & MCP page.

Automations, and the event system underneath

You can now write server-side automations that run on a schedule, an incoming webhook, or a content event. The handler gets a pre-wired context — object CRUD, querying, the mailer, file and image saving, importers, logging — so a digest email, a webhook fired on publish, or a sync to another system is a PHP file rather than a project. Handlers are hardened the way extensions are: errors are contained and emailed, and one that keeps failing on production disables itself with one-click re-enable. (Pro.)

Underneath sits a centralized event system — 20 core events across object, collection, schema, template and user lifecycle, plus import, bulk-delete, extension, dev-mode and cache events — that both automations and extensions subscribe to.

The rest of it

Internationalization. Localized field types with per-locale storage and site-default fallback, a BCP 47 locale registry with graceful region fall-down, per-user admin language, cms.locale.* Twig helpers, and localized import/export. The admin ships in seven languages.

Write where you like. Total CMS now speaks the WordPress publishing protocol, so MarsEdit, Byword and Ulysses connect and treat your site like any other blog. Scoped to a single blog by API key, and off until you switch it on.

Install anywhere. composer create-project totalcms/totalcms mysite, a guided first-run Setup Wizard, and a full tcms CLI with --json on every command. Runs at your docroot or under a subpath — routing, assets, OAuth and MCP discovery all resolve correctly either way.

Safer by default. A per-site encryption key replaces a constant that used to live in public source. Security headers on every admin, auth and setup page. Error reports explicitly configured never to carry request bodies or personal data, with consent asked rather than assumed. Extensions can no longer register a service that silently replaces core authentication.

A sharper admin. The Permission Matrix. View-as-user for reproducing what an operator sees. Multi-select bulk actions. Data visualizers that map how collections relate and what a single record actually references — worth a look before you delete anything. Singleton collections, a Card field for nested structures, a Secret field for tokens, and {% cache %} fragment caching with automatic invalidation.

There’s more in the full feature list, and considerably more in the release notes.

Upgrading

3.5 is a platform release and a few things moved: API routes are now under /api/, auth routes under /admin/, template includes are namespaced, and session-authenticated API writes need a CSRF token. The upgrade guide has the complete list — read it before you update rather than after.

Existing site: update from the admin, or tcms update:apply. New project: composer create-project totalcms/totalcms mysite. Or start a 45-day trial with full Pro features and no card.

It’s just files. Your agent can read them, and nobody can take them.