Settings
Go to Settings → Windcodex Forge Pro. There are five tabs.
| Tab | Purpose |
|---|---|
| Connection | Connector URL, OAuth discovery, connected apps, static client |
| Tools | Turn tool groups on or off; enable the live-site override |
| General | Connector status, safety acknowledgements, limits, data cleanup |
| Activity | Tool-call log, sandbox draft browser with diff viewer, snapshots |
| License | Activate a key for automatic updates |
Connection
See Connecting an AI Platform.
Tools
One toggle per group with a risk badge, plus the environment status. See the Tools Reference. If the site is detected as production, the tab explains that power tools are blocked and offers the hostname-typed override. See Live-Site Block.
General
Connector
| Option | Default | Description |
|---|---|---|
| Connector status | On | Turn off to immediately stop every connected AI platform from reaching the site |
| Read-only mode | Off | Strips every tool that is not marked read-only |
| Acting user | Current admin | Used only for calls not tied to an OAuth user. Power tools still require an Administrator at call time |
| Max results per list call | 50 | Cap on rows returned by list and query tools |
| Requests per minute | 120 | Per-user cap (10-600). The highest-risk tools also have a separate 10 per minute cap |
| OAuth auto-registration | On | Let platforms register themselves |
Safety
| Option | Default | Description |
|---|---|---|
| I have a backup in place | Off | Required before wp_execute_php and wp_create_admin_access_link will run |
| Allow direct live writes | Off | Exposes wp_write_file. Drafts remain available without it |
| Live-site override | Off | Lets power tools run on a production-detected site, locked to the current domain. Turn it off here; turn it on from the Tools tab |
Data & Privacy
| Option | Default | Description |
|---|---|---|
| Delete all data on uninstall | Off | On: settings, OAuth data, logs, snapshots, jobs, memories, and tables are removed on deletion. Off: everything stays for a later reinstall |
Activity
The log records tool calls, including the full PHP code or command run. It also hosts the draft browser for the sandbox (with diff, promote, and discard) and the list of snapshots.
License
See License.
⚠️
The audit log stores full PHP code and commands so you can see exactly what happened. If a command contains a secret, the secret is in the log. Avoid putting credentials in commands.