Learn Spillway, one task at a time
Install in five minutes, publish a page, then go deeper: the how-to guides each end with a result you can check, and the reference is generated from the code on every release.
Search the docs
53 results · page 4 of 5
Publish a package to the registry
How a module, kit or theme reaches the registry on spillwaycms.com (or any Spillway instance running with REGISTRY_HOST=1), from a terminal or from an agent. The registry contract is in packages/shared/src/index.ts under Registry; the operator's side is in modules.md.
Releases, versioning and support
How a Spillway release is cut, what the version number promises, how long a release is supported, how to upgrade, and how security issues and deprecations are handled. The short version for operators is in install.md; this is the policy behind it.
Roadmap
Spillway is built in phases. Each phase ships as a usable release; nothing in a later phase is required to run the earlier ones. Dates are not promised. Items move between phases as we learn. Phases 1 to 3b and the Phase 4 features are built; what is still ahead is listed under Phase 4 and in…
Roles and permissions reference
<!-- Generated by pnpm docs:build (docs-reference) from ROLE_PERMISSIONS in packages/shared/src/index.ts. Do not edit by hand; edit the source and run the command. -->
Rules for agents
What an AI agent working with Spillway must respect, whether it edits content on a site through MCP, writes code in this repository, or publishes a package to the registry. These rules are also encoded in the server: tokens cannot grow permissions, the AI layer has no publish path, and the…
Schedule a post
Write a blog post now and have it go live at a set time, with the checks still applied at that moment, and optionally come down again later.
Security
How Spillway is built to be run on the open internet, what each role can do, and what to set in production. Vulnerability reports go to the address in SECURITY.md; the findings this page grew out of are in dev/security-review-2026-11-05.md.
Set up SAML with Okta
Let staff sign in to the admin with their Okta account over SAML 2.0, with accounts created on first sign-in and roles taken from Okta groups.
Spillway CMS security review (2026-11-05)
Scope: the committed tree at HEAD of branch phase-2b (764a78a), read with git show, never the working copy. Packages reviewed: core, blocks, admin, fleet, sdk, shared, plus Dockerfile, docker-compose.yml, .github/workflows/ci.yml and pnpm-lock.yaml. SSO, theme/menus and personalization/analytics…
Spillway CMS security review, second pass (2026-11-05): package registry and domain importer
Scope: the working tree of branch phase-4 on the day the two surfaces landed, read file by file. Reviewed: the package registry (packages/core/src/registry/, routes/registry.ts, modules/tar.ts reader and writer, modules/registry-client.ts, kits/registry.ts, sso/github.ts with the GitHub branch of…
The domain importer
Point Spillway at a domain and it brings the site in without a database connection: it crawls the public pages, extracts each one, clusters the pages into content types, converts the bodies into blocks, extracts the theme, keeps every URL and lands the result as drafts with a comparison and a…
The package registry
Spillway can run as the registry that other Spillway instances download modules, themes and kits from. It is the same server with one switch: REGISTRY_HOST=1. spillwaycms.com runs one; so can a company that keeps its own modules private. Without the switch nothing is mounted and GET /registry/v1/*…
Browse by section
Getting started
Install with Docker or from source, run the setup wizard, build a first page and install a kit.
How-to guides
Publish a campaign page, connect HubSpot, set up SAML, translate a page, schedule a post and more.
Reference
Content model, blocks, the HTTP API (OpenAPI), the CLI and the roles and permissions, generated from the code.
Operations
Security, enterprise sign-in with OIDC and SAML, and running a fleet of sites.
Development
Architecture, contributing and the roadmap.
Agent guides
Connect Claude Code, Claude Desktop or any MCP client; build a module, a kit or a theme with an agent; the rules agents work under.
How-to guides
Install a kit
A kit installs a site's structure in one step: content types, vocabularies with their terms, collections, forms, menus and starter pages, with optional sample content. Four kits ship with Spillway (higher education, city, intranet portal, nonprofit), plus the docs kit that holds this documentation…
Publish a campaign page
Build a landing page for a campaign in the page builder, run the pre-publish checks, send it through review and publish it at the URL the campaign will use.
Build a page with AI
Turn a one-paragraph brief into a draft page built from real blocks, then make it yours. The AI never publishes: it drafts, you review, an editor publishes.
Schedule a post
Write a blog post now and have it go live at a set time, with the checks still applied at that moment, and optionally come down again later.
Translate a page
Add a second language to the site and publish a Spanish version of a page at /es/<path>, with hreflang alternates and a per-language sitemap.
Launch a campaign with a workstream
Prepare a landing page, the updates to three existing pages and a new menu entry together, show the whole set to stakeholders on one preview link, and publish everything in one action, now or at a scheduled time.
Connect HubSpot to a form
Send every submission of a Spillway form to a HubSpot form, so leads land in the CRM with the page and UTM context, while Spillway keeps its own copy.
Add a department section
Hand a part of the site to a department: its editors manage everything under one path prefix and one menu, and nothing else.
Set up SAML with Okta
Let staff sign in to the admin with their Okta account over SAML 2.0, with accounts created on first sign-in and roles taken from Okta groups.
Import a design system from Figma
Bring the colors (dark mode included), fonts, sizes, spacing, radius and content width of a Figma design system into the site's theme tokens, so every page and block picks them up once you publish.
Import a website
The importer brings an existing site into Spillway from its public pages alone: no database dump, no credentials. It crawls, proposes content types, converts the pages to blocks, extracts the theme and lands everything as drafts with redirects, so the old URLs keep working when you go live.
For AI agents
Agents are first-class readers and builders here. The whole documentation is available as plain text at /llms.txt (an index) and /llms-full.txt (every page), the HTTP API at /openapi.json, and every registry package offers an agent-readable manifest. The agent guides explain how to connect with an API token and what an agent may and may not do: it drafts, a person publishes.
Connect an agent to Spillway
Spillway treats AI agents as first-class readers and builders. An agent connects to a running site with an API token over the MCP server (POST /mcp) or the plain REST API, reads the content model, drafts content, runs the pre-publish checks and hands its work to a person. Every action is…
Rules for agents
What an AI agent working with Spillway must respect, whether it edits content on a site through MCP, writes code in this repository, or publishes a package to the registry. These rules are also encoded in the server: tokens cannot grow permissions, the AI layer has no publish path, and the…
Build a module with an agent
A recipe for having Claude Code, Cursor or any coding agent write a Spillway module: the prompt to paste, what the agent should produce, and the checks to run before you trust it. Read modules.md once yourself; the agent will read it too.
Build a kit with an agent
A kit is a JSON manifest that installs a site's structure: content types, vocabularies with terms, collections, forms, menus, starter pages and sample content. It is the quickest thing to build with an agent, because the format is declarative and the server validates it. Read kits.md first; the…
Build a theme with an agent
A theme in Spillway is a kit of tokens, blocks (shared blocks and page templates built from the core blocks) and page templates, with screenshots, published to the registry with "kind": "theme". Themes do not ship code: the look comes from the theme tokens the server emits as CSS custom…
Publish a package to the registry
How a module, kit or theme reaches the registry on spillwaycms.com (or any Spillway instance running with REGISTRY_HOST=1), from a terminal or from an agent. The registry contract is in packages/shared/src/index.ts under Registry; the operator's side is in modules.md.
Something missing or wrong?
Every page links to its Markdown source. Fix it in a pull request and the next release carries the change.