AnQiCMS: a Go CMS with an SEO toolset and a built-in MCP server

From GoBlog to an enterprise CMS, and what that history explains

AnQiCMS is a content management system written in Go, and its lineage is visible in the release history the README carries all the way back to 2019. The first release was GoBlog v0.1 in November 2019, a Gin version with a separated front end and back end. It was rewritten on the Iris framework as GoBlog v0.5 in December 2020, became a fuller blog with an admin panel and SEO features at v1.0.0 in January 2021, and started turning from a blog engine into a content management system at v2.0.0-alpha in February 2021. It was renamed AnQiCMS in May 2022, and multi-site mode arrived with v3.0.0 in December 2022.

Two claims in the README are worth quoting with attribution rather than as fact. The system claims memory usage roughly 80 percent lower than a PHP based CMS, and a single machine is said to handle about five million page views. These are the maintainer's own figures, published in the README without a methodology, so they are directionally useful and not something to plan capacity around.

The rest of the positioning is narrower and more credible. The stated target users are small and medium business sites, marketing sites, government portals and cross-border e-commerce stores, and the two core advantages claimed are security and enterprise level operation. The topics on the repository, anqicms, blog, go, goblog, iris, seo, seo-friendly and website, match that: this is a site-building product for Chinese-language and cross-border operators rather than a headless content API.

The multi-site support is the feature that makes it an enterprise product rather than a blog. Several independent sites can be managed with different themes and brands, multi-language site configuration and switching are supported including whole-page HTML translation, and v3.6.0 in June 2026 added city sub-sites, which is a Chinese e-commerce pattern where each city gets its own landing page.

Iris, GORM, and an admin interface that lives in another repository

The technical stack is Go with the Iris web framework and GORM as the ORM, and the module path is kandaoni.com/anqicms with a go directive of 1.26.0. The dependency list in go.mod is long, and it describes the feature set more honestly than the feature list does.

The web and data layer is Iris v12 and GORM. Authentication uses golang-jwt/jwt/v5, and the README lists a JWT authentication mechanism as one of the built-in security features. Templates are rendered with pongo2, which is the Django-like template engine, and the template directory is a volume in the container image.

Then the feature-specific dependencies appear. There is a WeChat SDK for the official account integration, the go-pay library and its logging companion for the order and payment modules, qiniu and tencentyun object storage SDKs, an FTP library and an SFTP library for the file transfer tools, a Meilisearch client for search, go-pinyin and a Chinese word segmentation library for the Chinese-language features, a captcha library for form verification, a QR code generator, a browser automation library and an HTML parser for the content collection feature, a Markdown parser, an image processing library, a WebP library for image handling, a cron library for the scheduled publishing and timed tasks, and a process and system information library.

The AI stack is the newest part of that list. The cloudwego/eino framework and its OpenAI model component are there, a Go client for OpenAI, and the official Model Context Protocol Go SDK at version 1.6.1.

One structural detail deserves attention before you clone anything. The admin interface is not in this repository. The README says that if you clone from GitHub and run it yourself, you must first build the admin code, which lives in a separate repository, fesiong/anqicms-admin. Alternatively you can download the latest release of that admin code and extract system.zip into a system folder at the project root. The admin URL is then at http://127.0.0.1:8001/system, and the default administrator account on a non-initialised install is documented as admin with the password 123456.

Running it with Docker, and what the compose file actually builds

The Docker quick experience is two commands:

docker pull anqicms/anqicms:latest
docker run -d --name anqicms -p 8001:8001 anqicms/anqicms:latest

The published image is on Docker Hub as anqicms/anqicms, and the container listens on 8001.

The compose file in the repository is a different thing, and it is worth reading carefully before you use it. The service builds from the local source rather than pulling a published image:

services:
  anqicms:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: anqicms
    restart: unless-stopped
    env_file:
      - .env
    ports:
      - "${ANQICMS_PORT:-8001}:8001"
    volumes:
      - ./config.json:/app/config.json
      - ./data:/app/data
      - ./cache:/app/cache
      - ./template:/app/template
      - ./public/uploads:/app/public/uploads

So the compose route builds the image from the tree you have checked out, and it mounts your local config.json, data, cache, template and uploads directories into the container. The port is overridable through ANQICMS_PORT, and the compose file also sets TZ to Asia/Shanghai, which is a good indication of where the project is developed and used.

The Dockerfile itself is a two-stage build. The builder stage starts from golang:alpine, swaps the Alpine package mirror for the Aliyun one, runs go mod tidy and go mod vendor, and builds with the module path kandaoni.com/anqicms/main, stripping the binary with -trimpath and the flags -w -s. The runtime stage is plain alpine with the binary, the static assets, the templates, the locales, the client files and the dictionary file copied in. Three paths are declared as volumes, /app/template, /app/public and /app/data, and the container exposes 8001 and starts the binary with a port argument.

One detail in the builder is a good sign of care. The system directory is excluded by .gitignore, so the build creates a placeholder file when the directory is missing or empty, in order to satisfy the go:embed directive. Without that, a fresh clone would fail to build until the admin assets were supplied, which is exactly the trap the README warns about.

For hosting outside Docker, the README lists one-click deployments for the BaoTa panel at version 9.2 and later, for the international aaPanel edition, an older BaoTa guide for versions before 9.0, and an LNMP command line deployment.

The SEO toolset, and why it targets Baidu and Bing

The SEO section is the part of AnQiCMS that is most clearly built for a specific market, and reading it tells you what the author of the project actually needed.

The tools are pseudo-static URL rule management, automatic Sitemap generation, link push management that sends new content to search engines with support for Baidu and Bing active push, 301 redirect management, Robots.txt configuration, anchor text management for setting internal keyword links automatically, and a keyword library for centralising SEO keywords.

The Baidu push integration is the tell. A content management system that treats pushing new URLs to a specific search engine as a first-class button, with a management screen, is built for operators who need indexation to happen quickly, which in the Chinese market means Baidu. The 301 and Robots.txt features are the standard Western equivalents, and the anchor text tool, which sets site-internal links for target keywords, is a technique that matters more where the search engine weights internal linking.

The other content-facing features fit the same profile. Custom content models let you define your own content structures rather than being limited to posts and pages, sensitive word filtering and keyword replacement plus content review handle compliance, an anti-scraping interference code is generated to protect content from bulk collection, a document recycle bin recovers deleted documents, backup and restore covers data including static files, and reCAPTCHA is available for forms.

The utility features around them are worth a scan too, since they are the reason a marketing site would keep the system in daily use: global settings, navigation management, single page management for things like a privacy policy or an about page, a site-wide replacement tool for bulk find and replace of keywords or links, email notifications on trigger events, mailing list subscription and mass sending with progress reporting, image watermarking, static page caching, and traffic statistics that also track search engine crawler activity.

It is a broad administrative surface, and breadth like that is where a Go CMS both wins and loses. A compiled binary with a small footprint handles a lot of screens well, but each of those screens is surface area to maintain.

AI Chat, an intent catalog and an MCP server you can plug into Claude

The AI work is the most recent and the most substantial addition, and it is worth separating what is a UI feature from what is an integration point.

The interactive part is an AI chat assistant with more than eighty built-in AI tools covering content, SEO, operations and business domains, which the README says can be called autonomously by an AI agent. Around that sit an AI skills system covering content planning, SEO analysis, batch operations, site health checks, troubleshooting, template development and API development, an AI assisted visual template editor that modifies template code directly, AI writing, automatic tag, image and title-keyword-description generation when a post is created, and an LLMs.txt file generated automatically so language models can read and index the site.

The integration part is the MCP server, and it is the more interesting piece for a developer. The README describes a built-in Model Context Protocol server whose tool surface is consolidated around an intent catalog, with Bearer Token authentication and turn-level operation approval, where write operations are merged into a single confirmation, and which can be connected to external AI clients such as Claude and Cursor.

The turn-level approval model is the detail that makes this usable in production rather than a toy. An agent that can rewrite templates and publish content is a liability if every action needs a separate confirmation, and merging write operations into one confirmation per turn is a workable middle ground. The same release notes for v3.6.5 describe the MCP tool layer being refactored around the intent catalog, with the tool surface consolidated and turn-level operation approval introduced, so this was a deliberate redesign rather than an initial design.

There is a parallel set of automation features that has nothing to do with AI: scheduled publishing, batch import of documents from ZIP archives and Excel spreadsheets, content collection from other sites, automatic image assignment based on the title, JSON-LD structured data output, and WeChat official account integration, order management, a finance module and distribution management for a site that sells.

It is a large surface for one product, and the 3.6.x line has been where the AI features landed and the security fixes followed.

Two security fixes in two days, and what they say about the project

The release notes are unusually candid about security problems, and the two releases from October 2026 are worth reading as a pair.

v3.6.6 on 8 October 2026 is described as a security fix release: a SQL injection in the list sorting parameters, and a problem where switching sites during login treated the password hash as the login key, which was changed to a server issued one-time short-lived ticket. The same entry notes that when a security gate blocks a call, the caller can read the reason and the next step directly.

v3.6.5 on 7 October 2026 is the other one. It introduced the MCP intent catalog refactor and the turn-level approval, added mailing list subscription and mass sending, completed the AI skills system, and fixed several security problems including database password and SMTP authorisation code leaks.

Both are serious classes of bug. SQL injection in a sort parameter is the kind of thing that a CMS should never have, and using a password hash as a login key is a design error in the authentication flow rather than a typo. The one-time short-lived ticket that replaced it is the right fix, since it means the server issues a credential for the specific site switch rather than reusing a secret that is meant to be a password hash.

There is also a v3.6.7 on 20 October 2026, the same day as the last push, which added partial updates to the settings endpoints so that changing one field no longer clears other fields of the same structure, added automatic image alt text completion and site-wide backfill, and fixed a list of defects including a Sitemap that cleared its configuration when generate was clicked once, object storage uploads failing on file names with parentheses or spaces, verification codes being cached and replayed, a template switch still showing the old template, and editor body content carrying meaningless UUIDs.

The honest reading is that the project ships fast and fixes fast. The security gate that produces a readable reason and a next step is a good sign of a process that tries to get bugs fixed. The counterweight is that a project with AI agents able to write content and modify templates, patched for a SQL injection in the same month, is a project where you should run behind a reverse proxy, keep the admin interface off the public internet, and plan on reading the changelog before each upgrade.

One more mechanism predates the AI work and is worth knowing: a system hook extension mechanism added in v3.5.0 in July 2025, which is where the Akismet anti-spam integration sits.

AGPL, a Go 1.26 module and a Makefile that builds for three platforms

The licence is AGPL-3.0, with the text in the License file at the root of the repository and the copyright line reading 2019 to now, AnQiCMS. For a CMS that most people will run unmodified, AGPL is workable. If you intend to modify it and offer the result to others over a network, the obligations are a question for your legal team, and nothing here is legal advice.

The Makefile supports Linux, macOS and FreeBSD, and the build details are ordinary Go practice. The version string comes from git describe with the tags, always and dirty flags, so an untagged working tree gets a -dev suffix, and the linker flags are -w -s, which strip the symbol table and DWARF data. The build target then runs the compiler for the target platform, copies the templates, locales, static assets, the admin system directory, the changelog, the licence and the dictionary into a release directory, copies the cWebP binary for that platform and architecture, and finally strips the binary again. There is a commented-out FreeBSD branch with a noasm build tag, with the comment explaining that FreeBSD needs it to avoid native code in sonic or loader through cloudwego base64x.

The presence of that Go 1.26 requirement and the modern dependency set, eino and the MCP SDK at 1.6.1 among them, mean the project tracks the current toolchain rather than an old one. The trade is that a recent Go release may be required in your build environment, and the Docker route avoids that question entirely because the builder stage uses golang:alpine.

The project also publishes an English README alongside the Chinese one, and the README itself notes that most of the documentation is written in Chinese, so an English user is expected to fall back on the browser's own translation. The official site is anqicms.com with documentation under /help, a live demo at demo.anqicms.com, and interface documentation at /anqiapi.

The version naming is the last practical point. The recent GitHub tags are v3.6.4 from September 2026, v3.6.3 from the start of September, and v3.6.2 from June, while the changelog inside the README documents releases up to v3.6.7 on 20 October 2026. The tag list and the changelog disagree, so a deployment should be pinned by the changelog version rather than by the newest tag you can see.

Editorial conclusion

Adopt AnQiCMS if you run a content site that needs multi-site or multi-language support, an SEO toolset aimed at Baidu and Bing, and you want AI authoring and an MCP server without bolting a separate service onto your stack. Do not adopt it if you need a permissive licence, since it is AGPL-3.0 and any hosted modification carries copyleft obligations, and do not deploy it with the default administrator password, which the README documents as admin and 123456. Verify first that your administrator frontend is present, because it is not in this repository and a fresh clone lacks the system directory, that the container image you pull matches the release you intend to run, since the compose file builds from source by default, and that the October 2026 security fixes, covering SQL injection in list sort parameters and the site switch login, are in the version you deploy.

Frequently asked questions

Official sources

1. fesiong/anqicms on GitHub
2. License: AGPL-3.0
3. Project website
4. README
5. Releases