About this plugin
SproutOS exposes your WordPress site to authenticated tools through a clean, versioned REST control API, with your guardrails in place.
Connect a tool or your own backend using a standard WordPress Application Password, and it can inspect and manage the site programmatically: safely, and administrator-only.
A Self-Contained WordPress Control API
Most AI writes WordPress code in a vacuum. SproutOS gives AI direct, structured access to your live WordPress install through a purpose-built REST API at /wp-json/sprout-os/v1/.
It is fully self-contained: no MCP Adapter and no WordPress Abilities API dependency. Every endpoint is written from scratch, administrator-gated, and covered by a safety layer. The API areas in this build are:
- Site: info, aggregated snapshot, server-readiness check, resolved wp-config flags (never secrets), and a live capability manifest
- Inspection: users, database summary, plugin settings, pending updates, installed themes, active-theme docs and templates, and a page-builder probe
- Media: list and upload (URL sideload or base64), with executable-upload blocking
- Content: post meta for any post or post type. Read, write and delete, with a sensitive-key blocklist
- Settings: read the plugin’s settings, and update a whitelisted set of its own toggles
- Create Mode import: the endpoints the dashboard’s import flow drives — fetch a design you built at sproutos.ai, install the plugins and theme it needs, import the pages, and apply the matching settings
Call GET /manifest at any time for a live, self-describing list of every REST endpoint your install exposes. The list is read straight from WordPress’s own route registry, so it can never drift from what is actually registered.
The control API itself is deliberately read-first: of its endpoints, only three accept writes — media upload, post-meta write/delete, and the plugin’s own settings. The Create Mode import endpoints are the exception. ai, and to do it they install plugins and themes and write pages.
Like every other route they run only for a logged-in administrator, but treat them as the powerful part of the surface.
Built For Control And Safety
Giving AI access to a live site should never be a leap of faith. SproutOS ships the guardrails first:
- Administrator-only access: every route checks manage_options, and unauthenticated calls are rejected with 401
- Authentication with WordPress Application Passwords over HTTPS
- Read-first control API: outside the Create Mode import flow, only three endpoints accept writes
- Secret redaction: settings and wp-config responses never leak values whose keys look like secrets, tokens, keys, salts or passwords
- Sensitive-key blocklist on post meta: credentials stored in custom fields can neither be read nor written through the API
- Executable-upload block: media uploads reject.php and similar executable types
- Privacy and GDPR controls: IP anonymization, configurable data retention, CSV export, and a live summary of exactly what is collected
Our advice: start on a staging site, and move to production once you are happy with the flow. SproutOS is built to be used on live and client sites too.
Set Up In Three Steps
- Install and activate SproutOS.
- Open SproutOS in the admin, use the button to open WordPress’s Application Passwords settings, and create a password there.
- Copy the API base URL and point your authenticated tool or backend at the API.
Create Sites With AI (Create Mode)
SproutOS also builds new WordPress sites from a prompt, the agency way. ai you turn a client brief into a Scope, a Sitemap, and an on-brand Design, then export production-ready WordPress to Elementor, Gutenberg, or Figma. Use this plugin to import those sites into WordPress.
Who It Is For
WordPress agencies, freelancers, and developers who want authenticated tools to inspect and update selected parts of their sites safely.
External Services
The control API runs on your own site using a WordPress Application Password over HTTPS. ai; site details and the content you choose to act on are sent there to perform the requested work. tab=terms.
tab=privacy.
Development
SproutOS is open source (GPLv2 or later) and nothing in it is obfuscated. com/posimyth/sproutos/tree/sproutos-source
txt file in the plugin root.