Outstatic: a GitHub-backed CMS for Markdown and MDX in Next.js

The gap Outstatic fills between a Git repo and a writing team

A Markdown site has an awkward middle. Engineers are comfortable with files in a repository. Writers, marketers and product people are not. The usual answers are to give everyone commit access to the repo, which goes badly, or to bolt on a hosted CMS with its own database, which means a second system to back up, secure and pay for. Outstatic takes a third position: keep the files as the source of truth, and put a dashboard in front of them. The README describes it as a static CMS for Markdown and MDX with content stored in GitHub, and lists the intended audience as teams that want a CMS for a Markdown or MDX site, content in GitHub instead of a database, and a dashboard their team can use without editing files by hand. Blog posts, docs, changelogs, landing pages and resource libraries are named as the kinds of content it suits. That framing is narrower than a general purpose CMS, and it is honest about it. If your content already lives in a Next.js repository as .md or .mdx files, the distance between what you have and what Outstatic offers is small. If your content lives in a relational schema with joins and access rules, this is the wrong shape entirely.

How the dashboard, GitHub and your Next.js app fit together

Outstatic is a Next.js application, not a standalone service. It is built on Next.js, uses TanStack Query for state management and data fetching, GitHub for content storage and authentication, Tiptap for the text editor, and Tailwind CSS for styles. AI completions come through OpenAI and the Vercel AI Gateway via the Vercel AI SDK, with Novel supplying the slash command and completion interface. The data flow follows from that stack. An editor signs in with GitHub, so GitHub is the identity provider as well as the storage layer. The dashboard reads the content directory of a repository and renders each entry in the editor. When the editor saves, the change is written back to the repository as a commit rather than to a database row. Your site then builds from those files the way it always did. The README puts it plainly: content is automatically committed to your GitHub repository and deployed with your website. Custom fields are supported for structured content, which matters if your Markdown files carry frontmatter beyond title and date. The consequence of this design is that the repository history is the audit log. There is no separate revisions table, because the commit graph already is one.

Installing Outstatic in a Next.js project

The README offers two routes. The fastest is the hosted dashboard at outstatic.com, where you create an account with GitHub and manage Markdown in your repositories without installing anything. Self-hosting means adding Outstatic to your own Next.js app, and the README points to the getting started guide at outstatic.com/docs for that. The repository itself is a pnpm and Turborepo monorepo, so the workspace scripts below are for working on Outstatic, not for consuming it. The root package.json enforces pnpm through a preinstall hook and defines the build pipeline.

pnpm i
pnpm dev:outstatic

The first command installs workspace dependencies. The second runs the development task filtered to the outstatic package, which is the one that ships. Running the full development task instead starts the package alongside a dev blog.

pnpm dev

That script filters on outstatic-dev-blog and outstatic together, which is the useful combination if you want to see the dashboard against real content rather than an empty repository. Tests and type checks are separate tasks.

pnpm test
pnpm typecheck

The test task filters to outstatic, and there is a separate end-to-end suite under apps/e2e invoked with pnpm test:e2e. The examples directory holds four reference projects: advanced-blog, basic-blog, docs and outstatic-dashboard. The getting started guide is where the environment variables and the GitHub OAuth setup are documented; the README does not reproduce them, so read that page before you wire anything into a production repository.

The GitHub token is the whole security model, and the README is quiet about it

Because there is no database and no hosted backend, authorization collapses into GitHub permissions. Whoever signs in through the dashboard can commit to the repository. That is elegant until you ask what a compromised editor account can do, and the README does not answer it. It does not document the scope of the token the dashboard requests, whether access can be limited to a single repository, or how a self-hosted deployment should configure its GitHub OAuth application. Those details belong in the getting started guide, and a team evaluating Outstatic for anything with more than a couple of writers should read that page before granting access. The same silence applies to rollback. Since content is committed to Git, the recovery mechanism is presumably a revert commit, but the README does not describe an in-dashboard restore, and no release note in the recent versions mentions one. Treat undelete as a Git operation performed by someone who knows the repository, not as a feature of the product. There is also the build coupling: content changes require a deploy to appear, so the publish button is really a commit button, and the delay between the two depends entirely on your hosting setup.

Outstatic against Keystatic, Decap CMS and TinaCMS

The alternatives people search for alongside Outstatic differ mainly in where the editing interface runs and what it writes to. Keystatic, which appears in the same searches, is a Git-based content tool with a local editing mode, so a writer can run the editor on their own machine and commit from there rather than signing into a deployed dashboard. Decap CMS, formerly Netlify CMS, is a single-page admin app that mounts at a path in your static site and authenticates through a Git gateway or an OAuth provider; it is framework-agnostic in a way Outstatic is not, since Outstatic is explicitly a Next.js package. TinaCMS pairs a Git-backed content layer with a hosted editing service and a paid tier, which is the opposite trade: less infrastructure for you, a recurring cost and a vendor in the loop. Outstatic's distinguishing choice is that the dashboard is part of your own Next.js deployment, so there is no third party between the editor and the repository, and no separate service to keep alive. The cost of that choice is that you own the deployment, the OAuth application and the upgrade path.

Maintenance, releases and what upgrading actually involves

The repository is not archived and the last push was on 2026-08-27, so the project is being worked on. Recent releases run v2.1.12 in June 2026, v2.2.1 in July, and v2.2.4 on 2026-08-20, which is a steady cadence rather than a burst. The monorepo uses Changesets for versioning, with an outstatic:version script that runs changeset version and then syncs the package version, and separate publish scripts for the canary and latest npm tags. The default branch is canary, so the branch you see on GitHub is the integration branch, not necessarily what npm serves under latest. The practical upgrade cost is low if you stay on the package: it is a Next.js dependency, so a version bump is a dependency bump, and the release scripts suggest the maintainers run lint, typecheck, tests and a build before publishing. The larger cost is Next.js itself. Outstatic is built on Next.js and tracks it, so a major Next.js upgrade in your app is the moment to check whether the Outstatic version you have pinned still supports it. On licensing, the repository carries a license.md file but GitHub reports the licence as NOASSERTION, meaning it could not be matched to a standard identifier. Read license.md directly and decide with your own counsel; nothing here should be read as legal advice.

Editorial conclusion

Adopt Outstatic if your site is a Next.js project and you want editors committing Markdown and MDX to GitHub without touching a database. Skip it if you are not on Next.js, or if you need a documented rollback path before you let non-engineers publish. Before wiring it into a production repository, confirm the current release version on npm, the exact environment variable names in the getting started guide, and the scope of the GitHub token the dashboard uses.

Frequently asked questions

Official sources

1. avitorio/outstatic on GitHub
2. Issues
3. Project website
4. README
5. Releases