Starlight

🩺 Vitals

• 🟢 Last active: 2026-08-04
• 📦 Latest release: @astrojs/starlight@0.41.6 (2026-07-31)
• 🐞 Open issues: 26
• 🌟 Stars: 9k

🏗️ Profile

• Official: starlight.astro.build
• Source: github.com/withastro/starlight
• License: MIT
• Deployment: Language Runtime
• Data Model: Git-versioned Markdown and MDX files (no database)
• Jurisdiction: United States 🇺🇸 (Cloudflare, Inc.)
• Compliance (SaaS): N/A
• Compliance (Self-Hosted): Self-Hosted (User Managed)
• Complexity: Low (1/5) - One npm dependency on top of Astro, with nothing running in production
• Maintenance: Low (2/5) - A pinned dev dependency and a static build, on the most frequent release cadence in this category
• Enterprise Ready: Medium (3/5) - No SSO, RBAC, or audit trail, but self-hosted search ships by default

1. The Executive Summary

What is it? Starlight is a documentation site framework built on Astro. Two things separate it from the rest of this category. The first is search: it ships full-text search out of the box through Pagefind, which builds an index into your static output and runs entirely in the browser. No external service, no API key, no application to be approved for, and it works behind a firewall on internal documentation. Compare that to Docusaurus, which ships no search at all and points you at a hosted service you may not qualify for. The second is that Astro is framework-agnostic: you can drop React, Vue, Svelte, or Solid components into the same site, and Astro ships zero JavaScript to the browser for the parts that do not need it. For a mixed-stack organisation, that removes the usual requirement to standardise your documentation on whatever frontend framework the generator happens to prefer.

The Strategic Verdict:

• 🔴 For teams that need a stable version contract: Caution. Three years in, Starlight is still on a 0.x version line, currently 0.41.4. In practice that means breaking changes arrive in minor releases rather than major ones, so upgrades need reading rather than assuming. It is widely deployed and actively developed, with the most frequent release cadence in this category, but "pre-1.0" is a real answer to give a procurement reviewer and you should be ready to give it.
• 🟢 For internal or air-gapped documentation: Strong Buy. Self-hosted search is the deciding feature. Every other option in this category either ships no search or leans on a hosted index that requires your documentation to be publicly reachable. If your docs sit behind a VPN or inside a regulated network, Starlight is the one that works without a workaround.

2. The "Hidden" Costs (TCO Analysis)

3. The "Day 2" Reality Check

🚀 Deployment & Operations

• Installation: npm create astro@latest -- --template starlight scaffolds a working site in one command. The build writes static files you can serve from your own NGINX box or the Pages feature of a self-hosted forge such as Forgejo or GitLab. Nothing runs in production.
• Search Without a Third Party: Pagefind generates its index at build time and ships it alongside the site, so search is served from the same static host as the pages. The practical consequence is that internal documentation stays internal: there is no crawler to whitelist and no copy of your content sitting in a vendor's index. Algolia DocSearch and a self-hosted Typesense backend are both documented as swaps if you outgrow it.
• Scalability: Astro's islands architecture ships zero JavaScript for static content and hydrates only the interactive components you explicitly mark. The output is smaller than a conventional single-page application build, which matters for documentation read over poor connections and on the accessibility of the rendered result, though the project makes no formal conformance claim.

🛡️ Security & Governance (Risk Assessment)

• Jurisdiction & Concentrated Stewardship: Starlight is MIT-licensed and lives in the Astro organisation, but the team that maintains it now works for Cloudflare, which acquired The Astro Technology Company in January 2026 with a commitment to keep Astro open source. Taken at face value, the direct risk is low: MIT cannot be revoked on code already published, and your content is Markdown in your own repository regardless. The fact worth sitting with is the category-level one. Five months after the Astro deal, Cloudflare also acquired VoidZero, the company behind Vite, which is the foundation under VitePress. Of the JavaScript-based documentation generators a team is likely to shortlist, two now rest on foundations stewarded by the same content delivery vendor. That is not a data exposure, because none of these tools ever see your content. It is concentration in the supply chain beneath your documentation, and the mitigation is the one you already have: keep the content in portable Markdown so a change of direction costs you a theme rather than a migration.
• The Compliance Shift: The build produces static assets, so every control an auditor asks about belongs to whoever serves them. Access logs, TLS, retention, data residency, and authentication in front of internal docs are properties of your web server or CDN, not of Starlight. The tool holds no state, opens no port, and processes no personal data. Self-hosted search changes one thing here that is worth noting explicitly: because the index is built into your own output rather than held by a search vendor, your documentation content never leaves your infrastructure at any point in the pipeline. For internal or regulated documentation that removes a third party from the compliance conversation entirely.
• License Risk (None, but Read the Minor Versions): MIT, with no copyleft, no network clause, and no paid tier to graduate into. The risk is operational rather than legal. On a 0.x line, semantic versioning gives minor releases permission to break things, and Starlight uses it: upgrades between minor versions have carried migrations. Pin the exact version in package.json, read the release notes before bumping, and treat a Starlight upgrade as a small scheduled task rather than a background dependency refresh.

4. Market Landscape

🏢 Proprietary Incumbents

• ReadMe: The established hosted platform for developer and API documentation. Teams leave over a per-admin charge above the included five, SSO gated to paid tiers, and audit logs that only appear at the Enterprise price point.
• GitBook: The general-purpose hosted docs platform, priced as a per-site fee plus a per-editor seat charge, with reader authentication and SAML sitting two tiers above the entry plan.

🤝 Open Source Ecosystem

• VitePress: The closest peer and the direct cross-shop. Similar restraint and a similarly small footprint, but tied to Vue for its theme layer and currently a year without a stable release.
• Docusaurus: The heavier React option. Stronger on versioning, translation, and plugins, at the cost of a much larger dependency tree and no search in the box.