WordPress as a deploy target for Claude Code, Cursor, and Codex.

How to think about it

WordPress as a runtime, like Chrome runs extensions or Figma runs plugins.

DesignSetGo Apps is one WordPress plugin. The apps you ship through it are not plugins. They are sandboxed static bundles (HTML, JS, CSS, WASM) plus a dsgo-app.json manifest. The runtime loads them, sandboxes them, and feeds them WordPress data through a typed bridge. The app never sees a REST token.

The shift in one line: anything you used to ship as a WordPress plugin with full trust (a calculator, a portal, a dashboard, an AI tool) becomes a sandboxed bundle with declared permissions instead. The category survives. The security model flips.

The loop

From init to live in three commands.

The CLI scaffolds a minimal starter by default, or an Astro starter with --astro for multi-page apps. Any static bundle works. It authenticates with a WordPress Application Password and pushes the bundle; each subsequent deploy is an atomic update at the same app id.

The bridge client

No REST plumbing. No auth boilerplate.

The @designsetgo/app-client package gives you typed access to your WordPress site. Same surface in inline mode (same window) and iframe mode (cross-frame); the transport is auto-selected.

// Read posts, pages, the current user, and per-app storage.
// The bridge handles auth + REST behind the scenes.

import { dsgo } from "@designsetgo/app-client";
await dsgo.ready;

// Site context
const site = await dsgo.site.info();

// Real posts, filtered by what the current user can see
const { posts } = await dsgo.posts.list({
    type: "recipe",
    orderby: "date",
    order: "desc",
    per_page: 10,
});

// Logged-in user, and what they're allowed to do
const me = await dsgo.user.current();
if (await dsgo.user.can("edit_posts")) {
    // show the editor-only UI
}

// Per-app, per-user persistent storage; survives reloads
await dsgo.storage.user.set("favourites", [42, 88]);

What your AI agent sees

An AGENTS.md and a CLAUDE.md in every starter.

The starter ships a full extension manual at the project root. AGENTS.md is the vendor-neutral canonical file; Codex, Cursor, Aider, and any tool that follows the agents.md convention read it directly. CLAUDE.md is a one-line @-import of AGENTS.md so Claude Code picks up the same content without duplication or drift.

Agent skills pack

Teach the agent the bridge before the project exists.

AGENTS.md answers the agent once it is inside a DSGo project. The DSGo skills pack answers it on the way in: installed at the user level, so the agent already knows the manifest schema, every dsgo.* method, and the CLI loop before apps init runs.

npx skills add DesignSetGo/skills

• building-dsgo-apps Scaffolding, the inline-vs-iframe choice, project layout.
• dsgo-manifest Every field of dsgo-app.json: routes, permissions, secrets, scheduled jobs, webhooks.
• dsgo-bridge-api Every dsgo.* method, its permission gate, its error code shape.
• deploying-dsgo-apps The @designsetgo/cli loop, preview deploys, CI with env-var auth.
• dsgo-abilities Publishing abilities back to the site, consuming abilities, dsgo.ai.prompt tool calling.

Isolation modes

Inline for crawlable pages. Iframe for drop-in artifacts.

Same bundle format, same bridge, different rendering. Apps declare which they want in the manifest. See How it works for the deeper trade-off.