Installing Plugins

EmDash plugins can be installed in two ways: from the marketplace via the admin dashboard, or added directly in your Astro configuration. Marketplace plugins run in an isolated sandbox; config-based plugins run in-process.

From the Marketplace

The admin dashboard includes a marketplace browser where you can search, install, and manage plugins.

Prerequisites

To install marketplace plugins, your site needs:

1. Sandbox runner configured — Marketplace plugins run in isolated V8 workers, which requires the sandbox runtime:

   import { emdash } from "emdash/astro";
   
   export default defineConfig({
     integrations: [
       emdash({
         marketplace: "https://marketplace.emdashcms.com",
         sandboxRunner: true,
       }),
     ],
   });

2. Admin access — Only administrators can install or remove plugins.

Browse and Install

The plugin will be downloaded, stored in your site’s R2 bucket, and loaded into the sandbox runner. It’s active immediately.

Capability Consent

Before installation, you’ll see a dialog listing what the plugin needs access to:

Security Audit

Every plugin version in the marketplace has been through an automated security audit. The audit verdict appears on the plugin card:

• Pass — No issues found
• Warn — Minor concerns flagged (review the findings)
• Fail — Significant security issues detected

You can view the full audit report on the plugin’s detail page, including individual findings and their severity.

Updates

When a newer version of an installed plugin is available:

1. Go to Plugins in the admin panel
2. Marketplace plugins show an Update available badge
3. Click Update to see the changelog and any capability changes
4. If the new version requires additional capabilities, you’ll see a diff and need to approve
5. Confirm to update

Uninstalling

1. Go to Plugins in the admin panel
2. Click the marketplace plugin you want to remove
3. Click Uninstall
4. Choose whether to keep or delete the plugin’s stored data
5. Confirm

The plugin’s sandbox code is removed from your R2 bucket and it stops running immediately.

From Configuration

For native plugins (your own code, or packages you install via npm), add them directly to your Astro config:

import { defineConfig } from "astro/config";
import { emdash } from "emdash/astro";
import seoPlugin from "@emdash-cms/plugin-seo";

export default defineConfig({
  integrations: [
    emdash({
      plugins: [
        seoPlugin({ generateSitemap: true }),
      ],
    }),
  ],
});

Native plugins:

• Run in-process (not sandboxed)
• Have full access to Node.js APIs
• Are loaded at build time and on every server start
• Cannot be installed or removed from the admin UI

Marketplace vs. Config: When to Use Which