Which Open-Source CMS Should You Choose for an AI Knowledge Base?

Most companies introducing an AI assistant over internal knowledge start with technology: which model, framework, or vector database to use. Those layers can be changed when needed.

A knowledge base and CMS give an AI project a stable foundation: they determine where company knowledge is created, who maintains it, and how it stays current and approved. AI then works with information the company can trust.

A CMS as a knowledge base, not only a website

In an AI project, a CMS has a different role than on a website. It is where knowledge is created, structured, approved, and maintained, and where AI retrieves it. The selection criteria therefore differ:

• structured content: data with defined fields and relationships, rather than pages of text,
• metadata and taxonomy: what area of knowledge an item belongs to and who it is for,
• permissions: who can read, change, and approve what,
• workflow: knowledge reaches AI only after approval,
• versioning and audit trail: which version applies and who approved it,
• a solid API and the ability to react to content changes,
• secure access for AI agents through an API or MCP .

A simple test is whether the approver and approval date of the current document version can be traced. Without that information, there is no reliable basis when AI gives a customer a wrong answer and the company needs to determine why.

How knowledge reaches AI: API, RAG, and MCP

A CMS holds the knowledge. AI works with it through three complementary layers.

API: the CMS’s basic interface for other systems. An AI application or indexer can retrieve content, metadata, and changes through a REST or GraphQL API. A webhook can trigger an update of the RAG index after content changes. The API connects the CMS to the AI layer without giving an agent direct database access.

RAG (Retrieval-Augmented Generation): content from the CMS is indexed automatically and AI searches that index before it answers. RAG is not only vector search: production systems combine semantic search with full text search (BM25) and reranking. Tools such as Qdrant or ChromaDB can provide the search layer.

MCP (Model Context Protocol): an open standard that lets a CMS act as an MCP server. It exposes controlled tools to an agent, which then works directly with live CMS data while the CMS enforces permissions at query time.

The CMS can evaluate permissions for a specific agent as well as for the current user. The assistant can then access and change only the data and tools that match its role or the user’s role in that session.

In practice, they are combined: an API supplies content to the RAG index, and an MCP server exposes a search tool that calls the RAG pipeline alongside tools for working with live content. The important point is that all three are layers above the knowledge base. The knowledge itself has lasting value, which is why the CMS comes before the AI framework.

Which CMS options make sense?

Drupal . Its main strength is knowledge modelling and governance: content types, taxonomy, roles, permissions, approval workflows, revisions, and multilingual content. A company can see who created a piece of knowledge, who approved it, which version applies, and who it is intended for. That matters when AI answers customers or employees. Drupal also has an active AI module ecosystem and an MCP Server module with OAuth 2.1 and tool-level permissions.

Downside: greater complexity and implementation cost; it requires an experienced provider.

Verdict: a choice for knowledge bases where structured knowledge, permissions, and approval matter.

Directus . It is built around the database: it provides an API and an administrative interface over a conventional SQL database. It is ideal when knowledge already exists as structured data such as catalogues, reference data, or internal records. Directus can provide a manageable layer over that data without migrating it into a conventional CMS.

Downside: it is not OSI-approved open source. Its BSL licence has a revenue threshold, so it is effectively a paid product for larger companies.

Verdict: a choice for knowledge held as structured data in SQL.

Strapi . It is a modern headless CMS with structured content types, REST and GraphQL APIs, and a JavaScript/TypeScript ecosystem. It is simpler and cheaper to introduce than Drupal, at the cost of shallower governance capabilities.

Verdict: a compromise between a conventional CMS and rapid delivery where enterprise-level governance is unnecessary.

Payload . It is closely integrated with application code in TypeScript and Next.js . Its knowledge model, API, and logic live in one project. That is useful for AI-native products, where an agent can also work with application configuration.

Downside: it makes sense mainly once a Next.js/TypeScript stack has already been chosen.

Verdict: a choice for AI-native SaaS products built on Next.js and TypeScript.

WordPress . It has a large ecosystem, a REST API , and WP-CLI . When knowledge already lives in WordPress, connecting it to AI is often the fastest route. With dozens of plugins and custom code, however, it becomes less clear where individual pieces of knowledge are stored, making the system less predictable and auditable.

Verdict: a choice for making existing content available; for a new AI knowledge base, I would consider other options.

CMS shortlist

The choice depends on the nature of the knowledge, governance requirements, and existing infrastructure. WordPress makes sense mainly where a company already runs its content and related processes on it.

An AI agent can create new articles, prepare revisions, and generate reports in a knowledge base. The CMS records who created or changed content and when. The human in the loop principle applies to key actions: publishing and changes to approved content require human approval, without which AI cannot carry them out.

A well-chosen CMS is more than content management: knowledge base + API + governance layer. RAG and MCP are replaceable layers above it. Knowledge, its structure, and the processes around it remain, which is why they are the right place to invest first.