What's new in Expanse CMS

It’s been a busy three weeks. Here’s a run-through of the major features that shipped between v3.23 and v3.44.

The CMS is now an MCP server

AI agents can now connect directly to any Expanse site via a JSON-RPC endpoint at /mcp. Out of the box it’s read-only and anonymous — list sections, search content, fetch items as clean Markdown. Version 3.42 added an authenticated write tier: generate API keys scoped to specific permissions, link them to a CMS user, and that user’s existing section permissions become the ceiling. Keys can create drafts, publish, update fields, and delete with a two-step confirmation. Every write is logged to an append-only audit table.

Revision history

Every save in Pages, Blog, Events, Gallery, and News now captures a full snapshot — including custom fields — to a revisions table. Each edit screen has a Revisions panel where you can restore a previous version with one click (the current state is saved first, so the restore itself is undoable) or open a word-level diff comparing any two snapshots.

Snippet refresh in the editor

Snippets inserted via the article editor toolbar are now tagged with the key they came from. When you focus a snippet block, a refresh button appears — one click pulls the latest definition and updates the block in place. Designers can update a snippet and editors can apply the change without re-editing content.

Privacy-first analytics

A cookieless analytics plugin now ships with the CMS. No consent banner required — visitor counting uses a daily-rotating salted hash, IPs are never stored, and the salt rotates on a 48-hour cycle. The admin dashboard covers pageviews, referrers, countries, devices, UTM campaigns, and custom events, with previous-period comparisons and an SVG traffic chart.

SumUp payments

Stripe remains the default, but sites can now switch to SumUp with a single setting. The implementation follows the same hosted-checkout pattern — no card data touches the server. The secret key lives in .env, not the database, so it’s never exposed as a template variable.

Newsletter engine

A full newsletter plugin launched in v3.24: compose and send to named recipient lists, with queued batched sending, a global unsubscribe table, and scheduling support. Since launch, it’s gained per-newsletter Reply-to fields and pre-flight SPF, DKIM, and DMARC checks that hard-block the send queue when DNS isn’t correctly configured.

WebP and Redis

Images are now served as WebP automatically for browsers that support it, with correct Vary: Accept headers for CDN caching. On the backend, the Redis cache helpers moved into core so the full prefs table is cached from the first request (1-hour TTL, per-database scoped), with the connection memoising its health check once per request rather than before every operation.

SEO Manager updates

The SEO Manager plugin gained category and subcategory SEO fields — the same meta title, description, Open Graph, and JSON-LD controls that were previously item-only. The release also fixed five bugs: Open Graph tags bypassing crafted meta copy, auto-descriptions concatenating words across HTML tags, canonical URLs resolving to wrong slugs for items nested under category paths, category pages inheriting homepage metadata, and robots.txt accidentally blocking theme CSS and upload directories from Googlebot.