SproutOS

SproutOS is a modern WordPress plugin designed to help site owners, agencies, and developers work faster with AI-powered tools, flexible admin controls, and workflow-focused features.

It helps streamline website management, improve automation, and organize advanced site operations from a dedicated admin experience inside WordPress.

With SproutOS, you can configure smart site tools, manage feature access, monitor activity, set up notifications, and keep better control over how advanced functionality is used on your website.

The plugin does not require any external service to run its core admin experience. External requests are only made when an administrator explicitly uses an optional feature: webhook notifications (to a user-configured URL), stock image search (Openverse API), the Map widget (which embeds Google Maps), or importing media from a user-supplied URL. Each of these is documented in the External Services section below.

Why Use SproutOS?

• Improve WordPress workflows with AI-powered tools and automation support.
• Control which advanced features are available in your site setup.
• Manage site activity with analytics and logging controls.
• Receive webhook and email notifications for selected events.
• Add safety-focused controls for advanced operations.

Main Features

• AI-powered workflow support for advanced WordPress use cases.
• Admin dashboard for connection settings, feature controls, analytics, and privacy options.
• Enable or disable feature groups based on your workflow.
• Support for custom advanced tools and controlled admin operations.
• Runtime protection for safer handling of advanced features.
• Activity tracking for usage, sessions, and related events.
• Webhook notifications for external monitoring and automation.
• Data-sharing controls for environment details sent to AI clients.

External Services

This plugin connects to the following external services:

SproutOS Platform (Create Mode)

SproutOS includes an optional “Create Mode” feature that connects your WordPress site to the SproutOS cloud platform so you can browse, generate, and import AI-designed pages, sections, and design concepts from the SproutOS web app directly into Elementor or Gutenberg.

What data is sent: To connect a site, the plugin sends the site URL and a PKCE code challenge to register the site, then exchanges an authorization code for an OAuth2 access/refresh token (public client, no client secret stored). Once connected, authenticated requests may include: exported project/page/design data retrieved from the administrator’s SproutOS account, page content being converted to Elementor/Gutenberg markup, feedback the administrator chooses to submit (a satisfaction rating and optional comments), and best-effort error reports (an internal error code, message, stack trace, and plugin/WordPress version) used to diagnose Create Mode issues. No passwords or payment data are transmitted.

When it is sent: Only after an administrator explicitly connects a SproutOS account from the SproutOS admin screen, and only while using Create Mode features (browsing/importing a project, submitting feedback, or when a Create Mode error occurs). It is never triggered by front-end visitor traffic or by the plugin’s core MCP/admin features.

Service provider: SproutOS.

• Service URL: https://sproutos.ai/
• API endpoint: https://api.sproutos.ai/

1. Openverse (stock image search) When an administrator uses the stock image search feature, this plugin sends a search query to the Openverse API to retrieve publicly licensed images. * Service: Openverse, operated by the WordPress Foundation. * Data sent: Search keywords and pagination parameters (e.g. search query, page number, results per page). No personal user data is transmitted. * When: Only when an administrator explicitly triggers a stock image search from the WordPress admin area. * API endpoint: https://api.openverse.engineering/v1/images/ * Terms of Service: https://docs.openverse.org/terms_of_service.html * Privacy Policy: https://wordpress.org/about/privacy/

2. Webhook notifications (optional, user-configured) If an administrator enables webhook notifications and configures a webhook URL, this plugin sends event data to that URL. The destination is entirely controlled by the site administrator — SproutOS does not operate or own any fixed endpoint. * Service: Any HTTP endpoint configured by the site administrator (e.g. Zapier, Slack, a custom server). SproutOS does not provide or control this endpoint. * Data sent: A JSON payload containing: event type (ability_executed), ability name, execution status, session ID, WordPress username of the executing user, timestamp, site URL, and site name. * When: Only when an MCP ability is executed AND webhook notifications are enabled AND a webhook URL has been configured by the administrator. Disabled by default. * The administrator is solely responsible for reviewing the privacy policy and terms of service of the third-party endpoint they configure. * No data is sent to any SproutOS-operated server via this feature.

3. Google Maps (Map widget embed) When an administrator adds a Map widget to a page, the plugin embeds a Google Maps frame so the rendered page displays the requested location. The map is loaded by the visitor’s browser from Google. * Service: Google Maps, operated by Google LLC. * Data sent: The address or latitude/longitude entered by the administrator, plus the visitor’s browser request data (e.g. IP address) sent directly to Google when the embedded map loads. * When: Only when a Map widget has been added to a page, and only on the front-end pages where that widget appears. * Terms of Service: https://cloud.google.com/maps-platform/terms * Privacy Policy: https://policies.google.com/privacy

4. Remote media import (administrator-supplied URLs) The stock-image sideload and SVG-import features fetch a file from a URL that the administrator explicitly provides, then store it in the Media Library. No fixed third-party service is involved — the destination is whatever URL the administrator enters. * Data sent: A standard HTTP GET request to the administrator-supplied URL. No personal user data is transmitted. * When: Only when an administrator explicitly triggers an image sideload or SVG import with a URL.

Privacy

• Analytics and logging settings are configurable by the site administrator.
• No personal data is sent to any external service by default.
• Webhook delivery is optional and disabled by default.

Development

SproutOS is open source (GPLv2 or later). The complete, human-readable source code for the compiled dashboard — the React source (src/) and the build configuration (webpack.config.js, package.json) — is maintained publicly at:

https://github.com/posimyth/sproutos/tree/sproutos-source

To review, study, rebuild, or modify the compiled dashboard, clone the repository above; it contains the full un-minified source. See Source-Readme.txt in the plugin root for a map of each compiled file to its source.

• Admin dashboard (React) source: in the repository, the un-minified JavaScript/JSX lives in src/ (entry point src/index.js). The compiled bundle shipped in build/ is generated from these files.
• Build tool: the compiled files are built with @wordpress/scripts using the webpack.config.js and package.json in the repository.

• Build steps: from the repository root run:

  npm install npm run build

• PHP: all PHP is plain, un-obfuscated source under the plugin root, sprout-core/, and sprout-ui/ — no build step is required for it.

Third-party libraries bundled in the compiled JavaScript (build/index.js):

• react-router-dom 6.30.4 — MIT license — client-side routing between the dashboard tabs (includes react-router 6.30.4 and @remix-run/router 1.23.3, both MIT).

• axios 1.17.0 — MIT license — HTTP client used for admin-ajax.php requests.

  react, react-dom, and react/jsx-runtime are not bundled; they are provided by WordPress core and loaded as script dependencies (see build/index.asset.php).