JED gives you sign-in with two-step login, roles enforced in Postgres, an admin your client can run, and an API with an MCP server. Start each project from the same tested base and spend your time on the parts that are actually new.
Features
Each of these works in the demo and is covered in the docs.
Email and Google sign-in, plus TOTP codes you can require for admins or for everyone.
Permissions live in Postgres, so the database refuses what the app shouldn't allow.
Pages and posts in a BlockNote editor with drafts, so clients can update the site without you.
Public post list, post pages, and an RSS feed, all listed in the sitemap.
Upload and reuse images from the admin, with signed upload tickets on the server.
Postgres full-text search for pages and posts, and Ctrl K to jump through the docs.
Messages are stored in an admin inbox, with optional email delivery through Resend.
Site name, accent colour, logo, and navbar and footer width, changed from settings.
Every migration with a plain-English summary and an applied or not-applied badge.
Read and write endpoints under /api/v1, described in an OpenAPI spec you can generate clients from.
Connect an AI client to /api/mcp. Writes need confirm: true and an idempotency key.
Scoped tokens run as their owner under RLS, and every call is written to the audit log.
CSP and CSRF protection are on by default, and session pages are never cached publicly.
Every pull request runs Biome, typecheck, tests, a build, and npm audit.
About
We design and build gardens for homes across the valley.
Type / for blocks
{
"mcpServers": {
"jed": {
"url": "https://site.example/api/mcp",
"headers": {
"Authorization": "Bearer amn_..."
}
}
}
}Use your email and password, then your authenticator code.
Auth and roles
Sign-in runs on Supabase Auth with cookie sessions checked on the server. New accounts start as members. Admin access comes from a roles table, and row level security checks the same permissions on every query, so a bug in a page can't hand out data the database wouldn't. Turn on TOTP two-step login with one of four policies: off, optional, required for admins, or required for everyone.
How auth and roles workAdmin
Pages and blog posts are written in a BlockNote editor with drafts and previews. Next to them sit the media library, users, redirects, the contact inbox, the audit log, and settings for branding and layout. Each screen checks its own permission, so you can hand out access screen by screen.
Tour the admin panelAPI and MCP
The REST API under /api/v1 and the MCP server at /api/mcp run the same handlers. A personal access token carries the scopes you pick, never more than its owner has, and each call runs as that person under RLS. Every call lands in the audit log. MCP writes need confirm: true and an idempotency key, so a retried call can't apply a change twice.
Read the API docsShipping
CI runs Biome, the TypeScript check, the Vitest suite, a production build, and npm audit on every pull request. CSP headers, CSRF protection on server functions, and private cache headers on session routes are set before you write a line.
Deploying to VercelIn the box
Who it's for
If you build a new marketing site, blog, or small product site every few weeks, you rebuild the same sign-in, admin, and content model each time. JED is that layer, already tested. Clone it for each client, connect a fresh Supabase project, and deploy to Vercel. Each client keeps their own code, database, and deployment.
It's a good fit if you're comfortable with TypeScript, React, and SQL migrations. It's not a hosted CMS or a no-code builder.
Stack
React 19 and Vite, with file routes, loaders, and server functions
Postgres, Auth, Storage, and row level security
Deploys through the Nitro Vercel preset, with a preview for every pull request
Design tokens and accessible components you can restyle per client
Validation at every server boundary and for the API
Lint, format, and tests, run in CI
Getting started
Most setups take a few minutes once your Supabase project exists.
Clone JED into a new folder for the client and run npm ci.
Run npm run setup, then link your Supabase project and push the migrations.
Make your account an admin with one SQL insert, then set the name, colour, and logo in settings.
$ git clone https://github.com/jahzlariosa/jed.git my-site$ cd my-site$ npm ci$ npm run setup
Then follow the setup guide to apply the schema and create your first admin.
The setup guide takes you from an empty repository to a running site with an admin account.