WordPress MCP Plugin
SproutOS WordPress MCP Plugin connects AI agents directly to your site via the Model Context Protocol. 175+ abilities across 10 categories. Works with Claude, Cursor, Windsurf, and any MCP-compatible client. Free forever, GPL licensed.
The SproutOS WordPress MCP Plugin connects AI agents directly to your WordPress site. Your AI reads files, edits themes, creates pages, runs PHP, and manages your database - all from inside the chat window.
175+ abilities. 10 categories. Free forever.
The Copy-Paste Loop Is Over
Without SproutOS, working with AI on WordPress means constantly switching tabs and pasting code. The AI has no idea what your actual site looks like.
Ask AI for help
You describe what you want in Claude, ChatGPT, or another AI tool.
AI generates code - blindly
The AI writes code without seeing your theme, your plugins, or your database. It is guessing.
You copy, paste, and hope
You switch to WordPress, paste the code in, and test it manually.
Something breaks
You go back to the AI, explain the error, and repeat the whole loop.
Open your AI client
Claude Desktop, Cursor, or any MCP-compatible client.
Ask in plain language
"Change the hero heading color to blue" - no code, no commands needed.
AI reads your site and acts
Your AI reads your actual theme, makes the change, and confirms it is done.
You review
No copying. No pasting. No switching windows.
How It Works
SproutOS uses two open standards to connect your AI directly to WordPress.
MCP (Model Context Protocol) is an open protocol that every major AI client - Claude, Cursor, Windsurf, and others - already speaks. It lets AI tools call actions on external systems, like your WordPress site.
WordPress Abilities API is a built-in WordPress feature (WP 6.9+) that lets plugins register callable tools with defined input and output schemas. SproutOS registers 175+ tools this way.
The four steps that happen on every task:
| Step | What Happens |
|---|---|
| Discover | AI reads what it needs - plugin source, theme structure, database tables. Only the relevant parts, before writing a single line |
| Prototype | Tests code against your actual running WordPress. Iterates, catches errors, adjusts |
| Save | Working code becomes a sandbox file - loaded on every request, crash-guarded, manageable from the admin dashboard |
| Expand | Bridge tools let your AI call any of the 175+ abilities on demand, regardless of your Capability Profile |
SproutOS connects over HTTPS using your WordPress Application Password. Any MCP-compatible AI client can connect to any site - staging, production, or agency client sites.
175+ Abilities - What Your AI Can Do
SproutOS registers abilities across 10 categories. Your AI picks the right ones automatically - you never need to know tool names.
WordPress Core
Posts, pages, users, media, menus, options, settings, CPTs, taxonomies, comments.
File Operations
Read, write, edit, delete files. Directory listing. All constrained to ABSPATH. Sensitive files blocked.
Theme Management
List theme files, read theme files, update theme files, update stylesheet. Child and parent theme support.
PHP Execution & Sandbox
Execute PHP with full WordPress API access. Batch execute. Sandbox enable/disable. GitHub version only.
Elementor
Page editing, widgets, global styles, templates, dynamic tags, custom CSS/JS. Registers only when Elementor is active.
The Plus Addons (TPAE)
40+ widget abilities - accordions, carousels, pricing tables, forms, dark mode, and more. Loads when TPAE is active.
Builder / Cross-Builder
Add, move, remove, duplicate, and reorder elements across page builders. Detect builder, build pages, convert HTML.
WooCommerce
Products, orders, categories, tags, reports. Registers only when WooCommerce is active.
Bricks Builder
Full Bricks support. Registers only when Bricks is active. Added in v0.0.2.
Bridge Tools
Always available in every profile. Discover all tools, dispatch any ability, inspect any tool schema.
AI Abilities
Every tool documented with parameters, return values, and notes.
Capability Profiles - Control Your Token Budget
Four profiles control how many abilities are sent to your AI client at the start of a session.
Token budget refers to how much of your AI's context window is used upfront. A smaller starting catalogue means more room for your actual conversation and task.
| Profile | What's Included | Best For |
|---|---|---|
| Ultra-Minimal | Bridge tools only - AI discovers everything on demand | Token-sensitive sessions |
| Minimal (default) | ~6 KB / ~1,500 tokens upfront - core abilities included | Most everyday workflows |
| Standard | Larger upfront catalogue | Moderate-token sessions, builder work |
| Full | Complete ability catalogue with all schemas | Maximum depth, complex multi-step tasks |
Capability Profiles - Full Guide
When to use each profile, how bridge dispatch works, and how to switch profiles.
Safety Built In
SproutOS is powerful by design and safe by default. Every safety layer is independent.
Admin-Only Access
Only users with Administrator role (manage_options) can connect or use any tool. No exceptions.
Safe Mode
One toggle makes every ability read-only instantly. AI can see everything but write nothing.
Sandbox Isolation
All AI-written PHP goes into a dedicated folder (wp-content/sproutos-mcp-sandbox/). Core files, plugins, and themes are never touched directly.
Protected Files & Dirs
.env, wp-config.php, .htaccess, and core WordPress directories are fully blocked from any read, write, or delete.
Crash Guard
If a sandbox file causes a fatal error, SproutOS disables that file automatically and activates Safe Mode. One bad file does not affect the rest.
Additional controls: Domain Lock, Rate Limiter, Meta Snapshots, full Audit Log, per-tool Ability Manager, and configurable approval before every call.
Security & Best Practices
Full security model - authentication, sandbox, filesystem restrictions, crash recovery, and recommended setup.
Admin Dashboard
The plugin adds a SproutOS menu in your WordPress admin with five tabs.
| Tab | What It's For |
|---|---|
| MCP Connect | Generate and manage Application Passwords. Copy connection config snippets. |
| AI Abilities | Toggle individual tools on/off. Choose Capability Profile. Enable Safe Mode. |
| Sandbox | View and manage AI-generated PHP files. Enable or disable files individually. Only shown when sandbox is enabled. |
| Analytics | Six stat cards, session-grouped activity feed, CSV export. Every tool call logged with risk level and execution time. |
| Settings | Server instructions, analytics data collection, email notifications, webhook notifications, privacy controls. |
The admin bar always shows Sprout MCP: ON or Sprout MCP: OFF so you always know when AI abilities are active.
Real-World Use Cases
These are real prompts you type directly into your AI client - Claude Desktop, Cursor, or any MCP-compatible tool. After connecting SproutOS, your AI figures out which tools to call automatically. Just describe what you need.
Site Maintenance
"Check for plugin updates each morning, take a full UpdraftPlus backup first, then apply updates one by one and verify the site after each one"
Performance
"Run a full Lighthouse audit and trace the exact cause of the slow score"
WooCommerce
"List products with stock below 5 units and export as CSV"
Code & Automation
"Create and deploy a custom PHP snippet that adds a banner to all product pages"
Security
"Scan our theme files for any hardcoded credentials"
Use Cases - All Prompt Examples
20+ real-world prompts across site maintenance, performance, security, content, WooCommerce, and automation.
Analytics & Monitoring
Every tool call is logged automatically. No setup required.
Six stat cards: Total Calls, Calls Today, Failed Calls, Unique Sessions, Unique Users, Most Used Ability.
Activity feed: Session-grouped entries with risk level (readonly / additive / destructive / unknown), execution time, and error badges.
Notifications: Email alerts (per session or daily digest) and webhook notifications to Slack, Discord, or any custom endpoint with HMAC signing.
Privacy controls: IP anonymization, configurable data retention, full CSV export, and a live data summary showing exactly what gets collected and where it goes.
Analytics & Monitoring - Full Guide
Stat cards, activity feed, email and webhook notifications, data retention, and privacy controls.
Compatible AI Clients
SproutOS works with any MCP-compatible client. Connect over HTTPS to any WordPress site - staging, production, or agency client sites.
- Claude Desktop - Anthropic's desktop AI application
- Claude Code - Anthropic's CLI tool for developers
- Cursor - AI-powered code editor
- Windsurf - AI coding assistant
- Any MCP-compatible client - the protocol is open; any tool that adopts it works automatically
Who Is This For
- WordPress agencies managing multiple client sites who want AI with direct site access
- WordPress developers who want to stop copy-pasting and let AI read, edit, and test directly
- Theme and plugin developers who want AI to work with real file structures and APIs
- Technical admins comfortable with PHP and WordPress internals
System Requirements
| Requirement | Minimum |
|---|---|
| WordPress | 6.9+ |
| PHP | 8.0+ |
| Node.js | 18+ (on the machine running your AI client) |
| HTTPS | Required for HTTP transport |
| AI Client | Any MCP-compatible client |
Frequently Asked Questions
Any MCP-compatible client. This includes Claude Desktop, Claude Code, Cursor, Windsurf, and any tool that supports the Model Context Protocol.
Yes - many agencies do. SproutOS's sandbox keeps all AI-written PHP isolated, Safe Mode lets the AI read but not touch anything, and Crash Guard automatically disables any file that causes an error. The recommended approach is to start on staging to get familiar with the workflows, then move to live once you are confident. Keep a backup before any major session.
No. Node.js is only needed on the machine running your AI client - your local machine. Nothing extra is required on the WordPress server itself.
PHP execution (sprout/execute-php) is available in the GitHub version only. It is disabled in the WordPress.org build to comply with directory guidelines. All other abilities work in both versions.
A preset that controls how many of the 175+ abilities are sent to your AI client at the start of a session. Fewer abilities upfront means fewer tokens consumed. Bridge tools are always available in every profile - your AI can still discover and call any ability on demand.