KnowDevPro

KnowDevPro is a WordPress-to-WordPress sync and AI connector plugin for teams that maintain local, staging, and production environments.

It is designed for this operating model:

1. Build and edit on local/dev.
2. Push to staging.
3. Let an AI connector inspect staging.
4. Ask the user before production changes.
5. Push from staging to production only after explicit approval.
6. Pull production changes back into staging/dev when needed.

Current sync support includes:

• Posts.
• Pages.
• Enabled custom post types.
• Post meta, with filtered exclusions.
• Public or UI-visible taxonomies.
• Featured images copied by source URL.
• In-content images copied to the receiving site with src and wp-image class repointing.
• Multi-site connection records with one-click connection tests.
• Site manifests and content hashes.
• Compare, pull, prepare-push, and execute-push jobs.
• Manual compare/pull/push from the WP Admin Sync tab.
• Local-to-remote object ID mapping records.
• Production approval phrase for guarded pushes.
• Audit logging with configurable retention.
• Daily cleanup of expired OTP challenges, tokens, and old jobs.

• Namespaced OAuth authorization endpoint.
• Dynamic Client Registration for compatible MCP clients.
• Static OAuth clients for Custom GPT Actions.
• Email allowlist.
• Guest OTP verification.
• Logged-in admin approval without OTP.
• Logged-in allowlisted user approval without OTP.
• 1-hour access tokens.
• 14-day refresh-token connection window by default.
• Namespaced MCP JSON-RPC endpoint.
• Custom GPT OpenAPI schema endpoint.
• Dynamic Custom GPT name, description, instructions, conversation starters, and action setup fields.
• OpenAPI schema in JSON and YAML.

Install KnowDevPro on every WordPress site that participates in sync.

Recommended production-safe topology:

` Dev -> Staging -> Production Production -> Staging -> Dev `

Recommended AI connector topology:

` Claude / Custom GPT -> Staging KnowDevPro MCP/GPT endpoint Staging KnowDevPro -> Production WordPress site `

Do not expose a local-only WordPress URL directly to hosted AI clients. Hosted clients need a reachable HTTPS URL. Use staging as the AI-facing control point.

Example staging-to-production setup:

1. Install KnowDevPro on production.
2. In production, set environment to `production`.
3. In production, rotate a Site API Key and copy it.
4. Install KnowDevPro on staging.
5. In staging, set environment to `staging`.
6. In staging, add production as a connected site.
7. Paste the production URL and production Site API Key.

Open `KnowDevPro -> AI Connectors`.

First enter the GPT name, for example:

` Halim GPT `

KnowDevPro then generates copy-ready GPT Builder fields using that name:

• Name
• Description
• Instructions
• Conversation starters
• OAuth authorization URL
• OAuth token URL
• OAuth scope string
• Token exchange method
• OpenAPI JSON URL
• OpenAPI YAML URL
• Privacy policy URL
• OAuth Client ID guidance
• OAuth Client Secret / Key guidance

KnowDevPro does not require an allowed AI user to have a WordPress account.

Configure users in `KnowDevPro -> Access Control`.

Allowed list format (only the email is required):

` email | scopes | push environments | expires | notes `

Examples:

` james@example.com sara@example.com | kdp_sync:read kdp_sync:compare kdp_sync:pull lee@example.com | kdp_sync:read kdp_sync:push_staging | staging | 2026-12-31 | contractor `

Push environments restrict which environments the identity may push to (dev, staging, production; comma-separated; empty means all). Expires is a YYYY-MM-DD date after which the identity can no longer authorize or use connectors.

OAuth behavior:

• If the visitor is not logged in, KnowDevPro asks for email.
• If the email is not on the allowlist, authorization is rejected.
• If the email is allowed, KnowDevPro sends a one-time password.
• The visitor enters the OTP.
• KnowDevPro shows an Allow / No consent screen.
• If approved, OAuth completes.
• Access tokens last 1 hour by default.
• Refresh tokens keep the connection alive for 14 days by default.

• Logged-in admins may skip OTP if admin bypass is enabled.
• Logged-in users whose account email is allowlisted may skip OTP.
• Logged-in users whose email is not allowlisted are rejected unless they are admins and admin bypass is enabled.

Find these in `KnowDevPro -> AI Connectors`.

Claude / MCP Server URL:

` https://staging.example.com/wp-json/knowdevpro/v1/mcp `

Custom GPT OpenAPI Schema URL:

` https://staging.example.com/wp-json/knowdevpro/v1/gpt/openapi.json `

Custom GPT OpenAPI YAML Schema URL:

` https://staging.example.com/wp-json/knowdevpro/v1/gpt/openapi.yaml `

OAuth Authorization URL:

` https://staging.example.com/knowdevpro/oauth/authorize `

OAuth Token URL:

` https://staging.example.com/wp-json/knowdevpro/v1/oauth/token `

Dynamic Client Registration URL:

` https://staging.example.com/wp-json/knowdevpro/v1/oauth/register `

1. Use a publicly reachable HTTPS staging site.
2. Open Claude connector settings.
3. Add a custom connector.
4. Paste the KnowDevPro MCP Server URL from staging.
5. Complete OAuth.
6. Enable only the tools needed for the current workflow.

The GPT Builder only shows its OAuth callback URL after you save a Client ID and Secret, so create the KnowDevPro client first and add the callback URL afterwards:

1. In `KnowDevPro -> AI Connectors`, create a static OAuth client. Only the client name is required; leave the redirect URIs empty for now.
2. Copy the Client ID and Client Secret shown once after creation.
3. Create or edit a Custom GPT with Actions.
4. In the GPT Builder, paste the generated Name, Description, Instructions, and Conversation Starters from `KnowDevPro -> AI Connectors`.
5. Create a new Action.
6. Import the OpenAPI JSON URL or OpenAPI YAML URL shown in KnowDevPro.
7. Select OAuth authentication and paste the Client ID and Client Secret.
8. Use the Authorization URL and Token URL shown in KnowDevPro.
9. Paste the Scope string shown in KnowDevPro.
10. Use the default POST token exchange method.
11. Save the GPT action, then copy the callback URL the GPT editor now displays.
12. Back in KnowDevPro, paste that callback URL into the client's Redirect URIs field in the OAuth Clients table and click Update URIs.
13. Keep production-push tools approval-gated.

Recommended Custom GPT instruction:

` You are connected only to the staging KnowDevPro site. Always compare staging and production before suggesting a production push. Never execute a production push until the user explicitly says it is ready and approves the exact prepared job. `

KnowDevPro exposes namespaced MCP tools:

• `kdp_sync_list_sites`
• `kdp_sync_compare`
• `kdp_sync_prepare_push`
• `kdp_sync_execute_push`
• `kdp_sync_pull`
• `kdp_sync_list_jobs`
• `kdp_sync_connector_config`

1. `kdp_sync_prepare_push`
2. `kdp_sync_execute_push`

Push scopes are enforced per target environment:

• Pushes to dev or staging targets require `kdp_sync:push_staging`.
• Preparing a production push requires `kdp_sync:push_production_pending_approval`.
• Executing a production push requires `kdp_sync:push_production`.

All plugin endpoints are namespaced under `knowdevpro/v1`.

Site-to-site API:

• `GET /wp-json/knowdevpro/v1/site/ping`
• `GET /wp-json/knowdevpro/v1/site/manifest`
• `POST /wp-json/knowdevpro/v1/site/content/export`
• `POST /wp-json/knowdevpro/v1/site/content/apply`

• `GET /wp-json/knowdevpro/v1/gpt/openapi.json`
• `GET /wp-json/knowdevpro/v1/gpt/openapi.yaml`
• `GET /wp-json/knowdevpro/v1/gpt/sites`
• `POST /wp-json/knowdevpro/v1/gpt/compare`
• `POST /wp-json/knowdevpro/v1/gpt/push/prepare`
• `POST /wp-json/knowdevpro/v1/gpt/push/execute`
• `POST /wp-json/knowdevpro/v1/gpt/pull`
• `GET /wp-json/knowdevpro/v1/gpt/jobs`

• `GET /knowdevpro/oauth/authorize`
• `POST /wp-json/knowdevpro/v1/oauth/token`
• `POST /wp-json/knowdevpro/v1/oauth/register`
• `POST /wp-json/knowdevpro/v1/oauth/revoke`
• `GET /wp-json/knowdevpro/v1/oauth/authorization-server`
• `GET /wp-json/knowdevpro/v1/oauth/protected-resource`

Always active (KnowDevPro-specific, cannot collide with other plugins):

• `/.well-known/oauth-authorization-server/knowdevpro/oauth`
• `/.well-known/openid-configuration/knowdevpro/oauth`
• `/knowdevpro/oauth/.well-known/oauth-authorization-server`
• `/knowdevpro/oauth/.well-known/openid-configuration`
• `/.well-known/oauth-protected-resource/wp-json/knowdevpro/v1/mcp`

• `/.well-known/oauth-authorization-server`
• `/.well-known/openid-configuration`
• `/.well-known/oauth-protected-resource`

` add_filter('knowdevpro_register_well_known_oauth_routes', '__return_false'); `

KnowDevPro is designed for addons.

Content and sync filters:

` apply_filters('knowdevpro_sync_supported_post_types', $post_types); apply_filters('knowdevpro_sync_excluded_meta_keys', $meta_keys, $post_id); apply_filters('knowdevpro_sync_preserve_meta_keys', $preserved_keys, $post_id); apply_filters('knowdevpro_sync_query_args', $query_args, $args); apply_filters('knowdevpro_sync_prepare_payload', $payload, $post, $target_site); apply_filters('knowdevpro_sync_apply_remote_payload', $result, $payload, $source_site); apply_filters('knowdevpro_sync_environment_policy_allowed', $allowed, $local_environment, $target_environment, $direction, $connection); `

Content and sync actions:

` do_action('knowdevpro_sync_before_apply_item', $item, $source_site); do_action('knowdevpro_sync_after_apply_item', $result, $item, $source_site); `

Well-known OAuth route filter:

` apply_filters('knowdevpro_register_well_known_oauth_routes', true); `

Suggested future addon hook names:

` do_action('knowdevpro_sync_before_push', $job, $source, $target); do_action('knowdevpro_sync_after_push', $result, $job); do_action('knowdevpro_sync_before_pull', $job, $source, $target); do_action('knowdevpro_sync_after_pull', $result, $job); apply_filters('knowdevpro_sync_payload_for_acf', $payload, $post_id); apply_filters('knowdevpro_sync_payload_for_woocommerce', $payload, $object_id); `

KnowDevPro is powerful. Treat it like deployment infrastructure.

Recommended:

• Expose AI connectors from staging, not production.
• Use HTTPS.
• Keep Site API Keys private.
• Rotate keys when a developer leaves.
• Keep OAuth scopes narrow.
• Keep production approval enabled.
• Keep direct dev-to-production disabled.
• Review audit logs after each production sync.
• Back up production before major pushes.

This first version focuses on safe content-object sync. It is not a full database migration tool.

Not included by default:

• Full database cloning.
• Theme/plugin file deployment.
• WooCommerce order synchronization.
• User account synchronization.
• Form entry synchronization.
• Bidirectional automatic conflict merging.

Media notes:

• Images are copied by having the receiving site download them from the source site's URL, so the source site must be reachable over HTTP from the receiver. A push from staging to production means production downloads images from staging; local-only dev URLs cannot be fetched by remote sites.
• If an image download fails, the content is still synced and the image keeps its original source URL as a fallback.
• Copied images are deduplicated by source URL, so re-syncing does not create duplicate attachments.
• Image URLs and wp-image classes inside content are repointed to the receiving site. Block attribute IDs inside block JSON (for example a gallery's "ids" list) are not rewritten.
• Both sites should run the same KnowDevPro version, since content hashes are normalized the same way on each side.

Does an allowed connector user need a WordPress account?

Can admins skip OTP?

Why is the access token only 1 hour if I asked for 14 days?

Can Claude connect by URL?

Can a Custom GPT connect?

Can I add ACF support later?