Weave Code
Cms Laravel Package
totalcms/cms
TotalCMS is a Laravel CMS package for adding content management to your application, helping you manage pages and site content within a familiar Laravel workflow. Use it to build customizable, database-backed CMS features.
Commercial flat-file PHP CMS for web professionals: structured content modeling, no database, content stored as JSON on disk, Twig templating, a REST API, a CLI, and a built-in MCP server so AI agents can work with a live site.
Frequently asked questions about Cms
- How do I install totalcms/cms in a Laravel app?
- Install it as a Composer dependency and follow the package's artisan installation and configuration steps for your Laravel app. TotalCMS fits a normal Laravel deployment with artisan commands, migrations, and an admin surface, but confirm the exact publish and schema setup commands in the version-specific documentation.
- Does TotalCMS store content in a database or as flat JSON files?
- TotalCMS is described as a flat-file CMS: structured content is stored as JSON on disk rather than in a database, and collections and schemas define how that content is modeled. Some package copy also mentions database-backed CMS features, so verify the storage model for your exact version and hosting setup before committing.
- What Laravel and PHP versions does totalcms/cms 3.6.2 support?
- The supplied 3.6.2 notes do not include a supported Laravel and PHP version matrix, so check the package's composer.json and release documentation before upgrading. Use tcms check to validate PHP extensions, but treat its CLI result as complementary to a web-SAPI smoke test rather than a substitute.
- Why did my /feed/rss/{collection} start returning 404 after upgrading TotalCMS?
- RSS is opt-in after the upgrade: only blog and feed collections are auto-enabled, and other collections return 404 from /feed/rss/{collection} until RSS is enabled in their collection settings. Inventory every feed consumer and re-enable the collections that must remain syndicated.
- How do I secure front ends after Public Read was removed from auth and Site Builder schemas?
- The upgrade migration removes Public Read access from auth, playground, mailer, automations, Site Builder pages, and data view schemas, matched by schema name. Anonymous front ends that read those collections need an API key or access group, so audit headless consumers before deploying.
- Does TotalCMS expose a REST API and MCP server for AI agents?
- Yes. TotalCMS exposes REST and MCP surfaces alongside its admin UI, and the MCP server lets AI agents work with a live site. Agents and API clients still need appropriate access, and sensitive values such as password hashes are not serialised.
- How can I use tcms check in a Laravel deployment pipeline?
- Run tcms check with --json in CI or a release step; it exits with code 1 when checks fail, which makes it a deploy-gate primitive without scraping HTML. Because CLI extension and cache checks can differ from the web SAPI, pair it with a post-deploy smoke request through the app server.
- What changed with MCP update_object merge semantics in TotalCMS?
- In the 3.6.2 line, MCP update_object merges changes instead of replacing the full record. That is correct for agent safety because agents never see passwords or binaries, but any script or agent relying on replace semantics must be retested.
- Why are users failing login or password reset after upgrading TotalCMS?
- The upgrade changes email lookup to exact matching, so accounts stored with plus-addressing, casing differences, or whitespace may stop resolving at login and password reset. This was a security fix for a partial-matching account-takeover vector, but you should audit and normalise auth email data before rollout. Login errors are also uniform now, which improves security but can complicate helpdesk triage.
- Is totalcms/cms 3.6.2 safe to upgrade in production, and how should I test it?
- Treat 3.6.2 as behaviourally risky despite the patch version: RSS becomes opt-in, URL field mapping is ignored, Public Read is stripped, and MCP update semantics change. Stage the upgrade, inventory feed URLs and anonymous readers, audit non-normalised email addresses, retest MCP and API writers, and verify tcms check plus a real HTTP smoke test.
Weaver
How can I help you explore Laravel packages today?