內容簡介
SproutOS 是一款專為 WordPress 設計的外掛，透過安全的 REST 控制 API，讓 AI 工具能夠安全地檢查和管理您的網站，提升創意網站的開發效率。
【主要功能】
• 提供安全的 REST API 介面
• 支援 AI 直接訪問 WordPress 安裝
• 實時檢查網站狀態與能力
• 管理用戶、資料庫與外掛設定
• 媒體上傳與內容管理功能
• Create Mode 匯入設計與設定
外掛標籤
開發者團隊
② 後台搜尋「SproutOS – Create Creative Sites with AI」→ 直接安裝（推薦）
原文外掛簡介
SproutOS exposes your WordPress site to authenticated tools through a clean, versioned REST control API, with your guardrails in place.
Connect a tool or your own backend using a standard WordPress Application Password, and it can inspect and manage the site programmatically: safely, and administrator-only.
A Self-Contained WordPress Control API
Most AI writes WordPress code in a vacuum. SproutOS gives AI direct, structured access to your live WordPress install through a purpose-built REST API at /wp-json/sprout-os/v1/.
It is fully self-contained: no MCP Adapter and no WordPress Abilities API dependency. Every endpoint is written from scratch, administrator-gated, and covered by a safety layer. The API areas in this build are:
Site: info, aggregated snapshot, server-readiness check, resolved wp-config flags (never secrets), and a live capability manifest
Inspection: users, database summary, plugin settings, pending updates, installed themes, active-theme docs and templates, and a page-builder probe
Media: list and upload (URL sideload or base64), with executable-upload blocking
Content: post meta for any post or post type. Read, write and delete, with a sensitive-key blocklist
Settings: read the plugin’s settings, and update a whitelisted set of its own toggles
Create Mode import: the endpoints the dashboard’s import flow drives — fetch a design you built at sproutos.ai, install the plugins and theme it needs, import the pages, and apply the matching settings
Call GET /manifest at any time for a live, self-describing list of every REST endpoint your install exposes. The list is read straight from WordPress’s own route registry, so it can never drift from what is actually registered.
The control API itself is deliberately read-first: of its endpoints, only three accept writes — media upload, post-meta write/delete, and the plugin’s own settings. The Create Mode import endpoints are the exception. They exist to do one job, build out a site you designed at sproutos.ai, and to do it they install plugins and themes and write pages. Like every other route they run only for a logged-in administrator, but treat them as the powerful part of the surface.
Built For Control And Safety
Giving AI access to a live site should never be a leap of faith. SproutOS ships the guardrails first:
Administrator-only access: every route checks manage_options, and unauthenticated calls are rejected with 401
Authentication with WordPress Application Passwords over HTTPS
Read-first control API: outside the Create Mode import flow, only three endpoints accept writes
Secret redaction: settings and wp-config responses never leak values whose keys look like secrets, tokens, keys, salts or passwords
Sensitive-key blocklist on post meta: credentials stored in custom fields can neither be read nor written through the API
Executable-upload block: media uploads reject .php and similar executable types
Privacy and GDPR controls: IP anonymization, configurable data retention, CSV export, and a live summary of exactly what is collected
Our advice: start on a staging site, and move to production once you are happy with the flow. SproutOS is built to be used on live and client sites too.
Set Up In Three Steps
Install and activate SproutOS.
Open SproutOS in the admin, use the button to open WordPress’s Application Passwords settings, and create a password there.
Copy the API base URL and point your authenticated tool or backend at the API.
Create Sites With AI (Create Mode)
SproutOS also builds new WordPress sites from a prompt, the agency way. In Create Mode at https://sproutos.ai you turn a client brief into a Scope, a Sitemap, and an on-brand Design, then export production-ready WordPress to Elementor, Gutenberg, or Figma. Use this plugin to import those sites into WordPress.
Who It Is For
WordPress agencies, freelancers, and developers who want authenticated tools to inspect and update selected parts of their sites safely.
External Services
The control API runs on your own site using a WordPress Application Password over HTTPS. Create Mode connects to the SproutOS service at https://sproutos.ai; site details and the content you choose to act on are sent there to perform the requested work. Terms: https://sproutos.ai/privacy-policy?tab=terms . Privacy: https://sproutos.ai/privacy-policy?tab=privacy .
Development
SproutOS is open source (GPLv2 or later) and nothing in it is obfuscated. The complete, human-readable source for the compiled dashboards is maintained publicly at https://github.com/posimyth/sproutos/tree/sproutos-source
For the full compiled-file-to-source map and build steps, see the Source-Readme.txt file in the plugin root.
