SproutOS – Create Creative Sites with AIbyPOSIMYTH

SproutOS is the AI Operating System for modern WordPress agencies, from the team behind plugins running on 500,000+ WordPress sites. It exposes your site to AI assistants and automation tools through a clean, versioned REST control API, with your guardrails in place.

Connect an AI client, a no-code tool (n8n, Zapier), or your own SaaS backend using a standard WordPress Application Password, and it can read and manage the site programmatically: safely, and administrator-only.

A Self-Contained WordPress Control API

Most AI writes WordPress code in a vacuum. SproutOS gives AI direct, structured access to your live WordPress stack (content, media, plugins, themes and Elementor layouts) through a purpose-built REST API at /wp-json/sprout-os/v1/.

It is fully self-contained: no MCP Adapter, no WordPress Abilities API, and no bundled third-party libraries. Every endpoint is written from scratch, administrator-gated, and covered by a safety layer. API areas include:

• Site: info, snapshot, server-readiness, resolved wp-config flags (never secrets), and a live capability manifest
• Content: posts, pages and any post type. Create, read, update, delete, plus post-meta
• Media: list and upload (URL sideload or base64), with executable-upload blocking
• Plugins: list, activate / deactivate, upgrade, and install from wordpress.org
• Themes: list, read / edit theme files, install and upgrade
• Inspection: users, database summary, settings, pending updates, theme docs, and a builder probe
• Elementor: whole-page read / write plus granular element get, edit, clone, move, delete and insert with widget-type validation

Call GET /manifest at any time for a live, self-describing list of everything your install exposes.

Two Editions: Choose The Right One

SproutOS comes in two editions built from one identical codebase. They differ in exactly one folder, the developer tools folder, so everything else works the same way in both.

SproutOS (this plugin, on WordPress.org). The safe, live-site edition. It exposes only the secure, purpose-built REST control API. Every route is administrator-gated and file access is deliberately limited, so this is the edition to run on production and client sites. This is the version you are reading about now.

SproutOS Developer Edition (on GitHub). Everything in this plugin, plus a native Model Context Protocol (MCP) server at /wp-json/mcp/sproutos, so AI clients such as Claude, Claude Code and Cursor connect to your site directly, and an administrator-only PHP execution tool (sprout/eval). The eval tool runs arbitrary PHP as an administrator: it can read, write and delete any WordPress file or folder, run any database query, and change anything on the site that PHP can reach. That is complete freedom, and complete responsibility for your entire WordPress setup. Run it on local, staging, or developer environments, keep good backups, and choose wisely.

Because it ships arbitrary code execution, the Developer Edition is not distributed on WordPress.org. It is the most powerful build and is recommended only when you have backups and a staging workflow in place. Get it from GitHub: https://github.com/posimyth/sproutos

The Developer Edition is a drop-in: when it is active, this build stands down automatically so there is never a duplicate registration.

Built For Control And Safety

Giving AI access to a live site should never be a leap of faith. SproutOS ships the guardrails first:

• Administrator-only access: every route checks manage_options
• Authentication with WordPress Application Passwords over HTTPS
• Domain lock: calls are rejected if the site URL drifts (anti-clone)
• Rate limiter: a per-user / IP token bucket
• Protected posts: pinned post IDs cannot be modified or deleted through the API
• Secret redaction: option and setting responses never leak keys that look like secrets, tokens or passwords
• Executable-upload block: media uploads reject .php and similar executable types
• Audit logging: every call, and every rejection, is recorded with the action, user, risk level, and timestamp
• Privacy and GDPR controls: IP anonymization, configurable data retention, CSV export, and a live summary of exactly what is collected

Our advice: start on a staging site, and move to production once your guardrails are set. SproutOS is built to be used on live and client sites too.

Set Up In Three Steps

1. Install and activate SproutOS.
2. Open SproutOS in the admin, create a WordPress Application Password, and copy the API base URL.
3. Point your AI client, automation, or SaaS backend at the API and start giving it plain-English instructions.

Manage A Fleet Of Sites (Coming Soon)

This plugin connects one site. The SproutOS platform is being built to run your whole agency in one place:

• Connect many WordPress sites
• Agents: audits, maintenance, security, SEO, and client reports, on a schedule or on demand
• Connectors: each tool’s actions in a clear Read, AI Draft, Approval Gate, Write, Verify flow
• Roles and permissions for your whole team
• Branded client reports

Create a SproutOS account at https://sproutos.ai to get early access as these ship.

Create Sites With AI (Create Mode)

SproutOS also builds new WordPress sites from a prompt, the agency way. In Create Mode at https://sproutos.ai you turn a client brief into a Scope, a Sitemap, and an on-brand Design, then export production-ready WordPress to Elementor, Gutenberg, or Figma. Use this plugin to import those sites into WordPress.

Who It Is For

WordPress agencies, freelancers, and developers who already use Claude, ChatGPT, or Cursor and want AI to do real work on their sites, safely, without hand-coding every task.

External Services

The control API runs on your own site using a WordPress Application Password over HTTPS. The SproutOS account features (fleet management and Create Mode) connect to the SproutOS service at https://sproutos.ai; site details and the content you choose to act on are sent there to perform the requested work. Terms: https://sproutos.ai/privacy-policy?tab=terms . Privacy: https://sproutos.ai/privacy-policy?tab=privacy .

Development

SproutOS is open source (GPLv2 or later) and nothing in it is obfuscated. The complete, human-readable source for the compiled dashboards is maintained publicly at https://github.com/posimyth/sproutos/tree/sproutos-source

For the full compiled-file-to-source map and build steps, see the Source-Readme.txt file in the plugin root.

Looking for the native MCP server and the PHP execution tool? Those live in the SproutOS Developer Edition on GitHub: https://github.com/posimyth/sproutos