Skip to main content
The Library keeps the plugins and themes you reach for again and again, such as premium plugins and themes you buy as ZIPs (Gravity Forms, Divi, Bricks) or your own private ones on GitHub. Once something is in the library, you or your AI agent can install it on any ready sandbox by its name, without hunting for the file. The library belongs to your workspace. Members who can deploy plugins can install from it; changing it needs the same permission as Templates and Blueprints.

​
Add a plugin or theme

Open Library in the SandyWP app and select Add to library.
  • Upload ZIP. Choose the plugin or theme ZIP (up to 50 MB). The name defaults to the file name. Uploading again under the same name replaces the stored ZIP, so updating a premium plugin is one upload.
  • GitHub release. Pick a repository that SandyWP’s GitHub App can read. Every install checks the repository’s latest published release and uses its .zip asset, so sandboxes always get the newest version.
For GitHub, attach the built plugin ZIP to each release. SandyWP uses the only .zip asset, or the one named <repository>.zip when a release has several. GitHub’s automatic “Source code” archives are never used: their folder name changes with every tag, which WordPress would treat as a new plugin.
To give the GitHub App access to a repository, open Account → GitHub. See GitHub.

​
Plugins and themes

SandyWP reads each ZIP the way WordPress does to tell the two apart: a plugin has a PHP file declaring Plugin Name:, a theme has a style.css declaring Theme Name:. The library shows which one each entry is, and a ZIP that is neither is refused when you add it. Installing a theme activates it, so it becomes the sandbox’s theme. A child theme needs its parent theme installed first.

​
Install from the library

From the dashboard, select Install next to an entry and choose a ready sandbox. The plugin or theme is installed and activated. From an AI agent connected to the SandyWP MCP server, just ask, for example “install gravityforms on my-shop”. The agent calls sandywp_list_plugin_library to find the name and sandywp_deploy_plugin with libraryPlugin to install it. The agent never needs the ZIP file. From the CLI:
From the API, send { "libraryPlugin": "gravityforms" } to POST /api/app/sites/{id}/deploy-plugin.

​
License keys

Premium plugins usually need a license key before they update or unlock features. Save the key next to the plugin once, and your AI agent can fetch it and activate the license on the sandbox after installing the plugin. SandyWP itself does nothing with the key: it only keeps it safe until an agent asks for it. To add a key, open the entry’s actions menu on Library and choose Set license key (or Replace license key), or paste it into the optional License key field while adding the plugin. The same menu removes it. From the CLI:
Pass the key from an environment variable or a secret manager, as above, so it does not end up in your shell history. When you ask an agent to “install gravityforms on my-shop and activate the license”, it installs the plugin with sandywp_deploy_plugin, reads the key with sandywp_get_plugin_license, and activates it the way that plugin expects, for example with the plugin’s WP-CLI command or its settings screen. Only add keys for plugins you are licensed to use in your workspace, and check that the license allows activation on test or staging sites.

​
Security

  • Encrypted at rest. Keys are encrypted with AES-256-GCM before they are stored. They are never stored in plain text.
  • Write-only everywhere you manage them. The dashboard, the API, and the CLI never show a saved key. They show only whether a key is stored and its last four characters, for example ••••ABCD (keys shorter than 12 characters show no characters at all).
  • A separate permission for agents. Reading a key needs the licenses:read permission, which you approve when you connect an agent. An agent that can install library plugins cannot read their keys without it. Agents connected before this permission existed must reconnect to get it.
  • Every read is recorded. Each time an agent reads a key, SandyWP records who read it, with which connection, when, and for which plugin in your workspace audit log. The Library page shows when an agent last read each key.
Once an agent reads a key, it is in that agent’s chat transcript, and once the plugin is activated, it is stored in the sandbox’s WordPress database. Anyone who can open that sandbox or its wp-admin can read it there. Do not share sandboxes with activated licenses through public template launch links, and delete them when you are done.