WP HoloDev Documentation

Getting Started

WP HoloDev runs locally on Windows and keeps each codebase in its own project workspace.

1. Open WP HoloDev

Extract the Windows package and launch WP HoloDev. The interface opens in your normal browser while the application itself runs locally on your computer.

You do not need Python, PostgreSQL, Redis or Docker simply to run the main application.

2. Complete the Initial Setup

The first-run setup takes you through the main application settings and provider connections.

You can connect one or more supported providers and, where needed, keep multiple accounts for the same provider separate.

3. Create a Project

Create a project for the codebase you want to work on. You can point WP HoloDev at an existing folder or create a new project workspace.

A project can be a WordPress plugin, theme, website or another software project.

4. Choose the Project Settings

Choose the Working Mode, Model Assignment and Agent Level you want to use.

These settings are separate from one another, so changing the model policy does not change the Working Mode or Agent Level.

5. Start Working

Open a conversation and describe what you want done. WP HoloDev can inspect the project, select appropriate skills and tools, make the required changes and run relevant checks.

Core Concepts

These are the main terms used throughout WP HoloDev.

Project

A project is the workspace for one codebase. It keeps its conversations, jobs, settings, memory, validation information and other project-specific records together.

Job

A job is a piece of work being carried out inside a project.

Jobs have their own progress, TODOs, validation results and execution state. This means unfinished work is not dependent on a single chat response remaining in memory.

Working Mode

The Working Mode tells WP HoloDev what type of work is being carried out.

The available modes are Coding, WordPress Coding, Design, WordPress Design and Cyber Security.

Model Assignment

Model Assignment controls which provider connections and models may be used for model-backed work.

The available settings are Full Auto, Semi-Auto and Manual.

Agent Level

Agent Level controls whether additional specialist agents may be created for a job.

The available settings are Full, Low and None.

Tool

A tool performs an operation against the real project or development environment, such as reading files, searching code, writing files, running project commands or checking a page in the browser.

Skill

A skill provides a specialist working method for a particular type of task, such as debugging, implementation, testing, WordPress work or code review.

Validator

A validator checks the actual project and provides evidence about the result. Examples include syntax checks, tests, static analysis and browser validation.

Projects

Projects keep codebases and their settings separate.

One Project Per Codebase

Create a separate project for each plugin, theme, website or software codebase you want to work with.

Each project can keep its own settings, conversations, memory, rules, validation history and deployment information.

Existing Codebases

WP HoloDev can work with existing source code. You do not need to recreate a project from scratch before using it.

The existing structure can be inspected before changes are made so the current architecture and conventions can be followed.

Project Isolation

Project-specific state stays with the project it belongs to.

This prevents one project's rules, memory, WordPress settings or provider choices from being silently applied to another project.

Working Modes

Working Modes change how WP HoloDev approaches a task and which skills, tools and validators are most relevant.

Coding

Use Coding for general software development, debugging, implementation, maintenance and testing.

WordPress Coding

Use WordPress Coding for plugin, theme and WordPress site work where WordPress APIs, security patterns, coding standards and specialist validation matter.

Design

Use Design for frontend work, interfaces, layouts, responsive behaviour, usability and accessibility.

WordPress Design

Use WordPress Design where visual and frontend work also needs to follow WordPress architecture and implementation requirements.

Cyber Security

Use Cyber Security for defensive review of project code, dependencies, endpoints, permissions, secrets and other security-sensitive areas.

The Working Mode does not change project permissions or model selection by itself. Model Assignment and Agent Level remain separate settings.

Cyber Security Mode

Cyber Security Mode is a separate working mode for defensive security work inside the current project.

It is intended for examining source code, project configuration, dependencies, endpoints and other project-owned development assets. It is not a general-purpose penetration-testing mode for unrelated systems.

Security Review

You can use Cyber Security Mode to review a project for vulnerabilities, unsafe assumptions and weak security boundaries.

Typical areas include authentication, authorisation, capability checks, request validation, output escaping, SQL handling, REST permissions, AJAX handlers, redirects, file operations and secrets.

Read-Only Review

If you ask for a review only, the mode can investigate and report findings without changing the project.

This is useful when you want to establish the problems first and decide separately which ones should be fixed.

Security Remediation

If you ask for confirmed problems to be corrected, Cyber Security Mode can move from review into remediation using the normal project editing and validation tools.

Changes remain subject to the same project boundaries and permissions as other Working Modes.

Automatic Security Tools

Cyber Security Mode can make relevant security tools and validators available automatically.

This can include repository inspection, endpoint tracing, dependency checks, secret scanning, deterministic security validation and project-specific test commands.

Security Skills

Relevant security-oriented skills can be selected automatically where they apply to the task.

Skills guide the work but do not grant additional filesystem, command, network or external-service access.

Independent Security Review

Where Agent Level permits it, a separate security reviewer can be used to inspect findings or completed changes independently.

The reviewer remains subject to the selected Model Assignment and its assigned permissions.

Model Assignment Still Applies

Cyber Security Mode does not choose a model policy for you.

You can use Full Auto, Semi-Auto or Manual exactly as you can in the other Working Modes.

Agent Level Still Applies

Cyber Security Mode also respects Agent Level.

With Agent Level None, all security work stays with the main agent while native tools and validators remain available.

Example Requests

Review this project for security problems. Do not modify anything. Report only confirmed findings with evidence.

Trace every REST endpoint and check its permissions, argument validation and data exposure.

Scan the project for secrets, unsafe command execution and filesystem boundary problems.

Fix the confirmed security findings only. Do not change unrelated code and run the relevant regression tests afterwards.

Providers & Models

WP HoloDev can use models from several providers and can keep separate connections for different accounts.

Supported Providers

Provider support includes OpenAI, Anthropic, OpenRouter, OpenCode, LM Studio, WP HoloDev AI and compatible custom endpoints.

The available model list depends on the connections configured in your installation.

Multiple Accounts

You can connect more than one account to the same provider.

WP HoloDev keeps the provider, connection and model together as one exact route. The same model name on two different accounts is therefore treated as two separate routes.

Local Models

LM Studio can be connected for compatible models running locally on your computer.

Local and cloud models can be used through the same project workflow.

Live Model Discovery

Where supported, WP HoloDev can retrieve the models available through a provider connection rather than relying on a fixed list built into the application.

Model Assignment

Model Assignment controls how model routes are chosen for a project.

Full Auto

Full Auto allows WP HoloDev to choose the lowest-cost available route that is suitable for the work.

Selection can take account of capability, context requirements, tool requirements, availability and cost.

If a route becomes genuinely unavailable, another suitable route can be used.

Semi-Auto

Semi-Auto lets you create an allowlist of exact provider connections and models.

WP HoloDev can choose between those routes but cannot move outside the allowlist.

Manual

Manual locks all model-backed work for the job to the exact provider connection and model you selected.

This includes the main agent, permitted specialist agents, continuation and review work.

Manual does not silently fall back to another provider connection or model.

Model Assignment Does Not Control Tools

Native tools, skills and validators remain available regardless of whether Model Assignment is Full Auto, Semi-Auto or Manual.

Agent Levels

Agent Level controls how much work may be delegated to additional specialist agents.

Full

Full allows specialist agents to be created when there is a useful reason to divide the work.

There is no fixed four-agent limit in Full mode.

Low

Low allows a maximum of four logical specialist agents across the whole job.

Retries or provider fallback for the same logical agent do not count as new specialist agents.

None

None keeps all model-backed work with the main agent.

Native tools, skills, validators, continuation and recovery still work normally.

Agent Level and Model Assignment

Agent Level does not decide which models are used.

You can, for example, use Manual with Full Agent Level or Full Auto with Agent Level None.

Development Workflow

Jobs are tracked as ongoing pieces of work rather than one-off responses.

Understand the Request

The first step is to establish what needs to change, what should remain unchanged and what evidence is expected before completion.

Inspect the Project

Relevant files, symbols, references and project structure can be inspected before changes are made.

Carry Out the Work

Files can be edited and authorised project commands can be run through the tool system.

Validate

Relevant tests, validators and browser checks can be run after changes are made.

Correct Failures

If a check fails, the failure can remain part of the active job while the cause is investigated and corrected.

Review

The completed changes can be reviewed before the job is considered finished.

Completion

Structured TODOs and required validation remain part of the job state.

If actionable work is still outstanding, a final-sounding response does not automatically complete the job.

Automatic Tool Use

WP HoloDev normally chooses the native tools required for a task automatically.

You Usually Do Not Need to Pick Tools

Describe the result you want rather than listing every internal operation.

For example:

Find the cause of this bug, fix it properly and run the relevant tests.

The job can use code search, file reading, editing and testing tools without you naming each one.

Tools Can Be Added During a Job

The full tool set does not have to be decided before work starts.

If the investigation shows that another authorised capability is needed, WP HoloDev can make it available later in the same job.

Working Mode Influences Tool Selection

The active Working Mode helps determine which tools and validators are most relevant.

WordPress Coding can favour WordPress-specific checks. Design can make browser verification more relevant. Cyber Security can favour defensive security analysis and validation.

Automatic Tool Use Does Not Bypass Security

Every native tool call still passes through the normal tool registry, argument validation, project boundaries and permission controls.

Agent Level Does Not Disable Tools

Agent Level only controls specialist agents.

With Agent Level None, the main agent can still read files, search code, edit the project, run authorised commands and use validators.

Manual Model Assignment Does Not Disable Tools

Manual controls the model route, not the tool system.

The selected model still has access to authorised native tools and validators.

External Software Must Actually Be Available

Some checks depend on software installed on the computer or provided by the project.

If Composer, PHPStan, WP-CLI, Docker or another required runtime is not available, WP HoloDev reports that rather than treating the check as successful.

Manual Tool Commands

Use /tools to see available native tools.

Use /tool <name> [JSON] when you want to invoke an authorised native tool directly.

Skills

Skills provide specialist working methods for different types of development work.

Automatic Skill Selection

WP HoloDev can select relevant skills automatically from the project, request and Working Mode.

You do not normally need to choose a skill before starting a job.

General Engineering Skills

Bundled skills cover areas such as controlled implementation, root-cause debugging, test-first development, architecture and independent review.

WordPress Skills

WordPress skills cover repository analysis, plugin development, REST APIs, WP-CLI, performance, static analysis, directory compliance and other WordPress-specific work.

Project and User Skills

Additional approved skills can be discovered from user and project sources.

The source and trust level of a skill remain separate from whether it is relevant to the current task.

Explicit Skill Selection

Use /skills to see available skills.

Use /skill <id> [task] when you want to force a particular skill for a request.

Skills Do Not Grant Permissions

A skill can change the method used to approach a task, but it cannot grant additional filesystem, command, network or MCP permissions.

Chat Interface

The main conversation is where you describe the work and receive progress information, questions and results.

Describe the Outcome

You generally do not need to specify which files, tools or skills should be used.

Tell WP HoloDev what you want done, what should not be changed and any checks you expect before completion.

Multiple Conversations

A project can contain separate conversations for different pieces of work while keeping the same project context.

Operational Detail

Tool calls and other execution details can be inspected separately so they do not need to fill the main conversation.

Execution Trace

The execution trace shows what happened during a job.

Model Routes

You can inspect which provider connection and model handled model-backed work.

Specialist Agents

When subagents are used, their role, parent job and route information can be recorded.

Tool Activity

Automatic and explicit tool calls can be inspected separately from the main conversation.

Validation

Test and validator activity can be reviewed as part of the job history.

Lifecycle Information

Continuation, cancellation and completion decisions can also be recorded.

Browser Testing

Browser testing is useful when source-level checks cannot prove that an interface behaves correctly.

Playwright

WP HoloDev uses Playwright for bounded browser operations.

Common Uses

Browser checks can cover forms, settings screens, navigation, JavaScript behaviour, responsive layouts and other interface work.

Screenshots

Screenshots can be captured during testing and used as evidence when investigating visual problems.

Automatic Browser Use

Browser testing can be selected automatically when it is relevant to the current task and the browser capability is available.

Permissions & Approvals

Project access and tool execution remain subject to WP HoloDev's permission system.

Project Boundaries

File operations are restricted to authorised project locations.

Command Controls

Project commands are checked before execution.

Unknown or higher-risk operations can require additional authority or be refused.

Network Access

Network and browser capabilities are controlled separately from ordinary file access.

MCP

MCP tools remain subject to the external-action and network controls that apply to the configured server.

Permissions Cannot Be Self-Granted

A skill, model or specialist agent cannot grant itself broader permissions.

Project Memory

Project memory allows useful project-specific information to remain available between sessions.

Project Facts

Stable information about the project can be retained for later work.

Decisions

Important implementation and architecture decisions can remain associated with the project.

Project Rules

Development requirements and project-specific rules can be reused on later jobs.

Task History

Previous work can provide useful context when returning to a related area of the codebase.

Validation History

Earlier checks can help distinguish existing problems from new regressions.

Inspectable Memory

Memory remains reviewable rather than becoming a hidden source of project instructions.

Specialist Agents

Some jobs can use additional agents for focused work or independent review.

Typical Roles

Roles can include code review, security review, testing, frontend review, accessibility review, architecture review and WordPress review.

Full Agent Level

Full allows purposeful delegation where it helps the job.

Low Agent Level

Low limits the job to four logical specialist agents.

Agent Level None

None prevents model-backed subagents while leaving native tools, skills and validators available to the main agent.

Model Assignment Still Applies

Specialist agents remain inside the project's Model Assignment policy.

In Manual mode they use the same exact model route selected for the job.

Validation & Testing

Relevant project checks can be selected automatically after work is carried out.

PHP Syntax

PHP source can be checked for syntax errors where a suitable PHP runtime is available.

WordPress Coding Standards

PHPCS and WordPress Coding Standards can be used where the project provides the required tooling.

Static Analysis

PHPStan and other supported static-analysis tools can be used to find type and contract problems.

Automated Tests

Existing project test suites can be run when their required runtime and dependencies are available.

Plugin Check

WordPress Plugin Check can be used during plugin validation where appropriate.

Security Checks

Deterministic security validation can be used to find common application and WordPress security problems.

Browser Validation

Playwright can be used where behaviour needs to be verified in a browser.

Regression Comparison

Existing findings can be recorded before changes are made so later results can distinguish pre-existing problems from new regressions.

Unavailable Validators

If a validator depends on software that is not available, that check is reported as unavailable rather than passed.

WordPress Development

WP HoloDev includes dedicated WordPress Coding and WordPress Design modes alongside specialist WordPress skills and validation.

Plugins

Existing plugin projects can be inspected, changed, tested and reviewed while retaining their existing structure.

Themes

Theme work can include PHP templates, CSS, JavaScript, blocks, hooks and other WordPress-specific behaviour.

Hooks and Filters

Repository analysis can identify WordPress actions and filters and help trace where they are registered and used.

REST and AJAX

REST routes, AJAX handlers and admin-post actions can be inspected for registration, permissions, validation and callers.

Database Access

Options, metadata, custom tables and direct database queries can be included in code and security review.

WP-CLI

WP-CLI can be used where it is installed and the required WordPress environment is available.

Isolated WordPress Testing

Docker Desktop can be used for isolated WordPress environments when runtime testing is needed.

Docker is optional and is not required for normal WP HoloDev use.

Release Packaging

WordPress projects can be prepared for distribution after the required development and validation work is complete.

Final Validation

Relevant release checks can be run against the final source before packaging.

Source-Bound Evidence

Validation evidence can be tied to the exact source that passed the checks.

If the source changes afterwards, the previous final validation no longer represents the modified project.

ZIP Packaging

Plugins can be packaged as installable ZIP files when you choose to run the release workflow.

Integrity Information

Release packages can be fingerprinted so the resulting file can be matched to the source used to create it.

WordPress Bridge & Deployment

The WordPress Bridge provides a controlled connection between a project and an authorised WordPress installation.

Pairing

The WordPress installation is paired with the correct project before deployment is allowed.

Deployment

A validated release can be deployed through the bridge without giving ordinary FTP or hosting credentials to the model handling the project.

Post-Deployment Verification

The resulting installation can be checked after deployment.

Rollback

Where a previous verified release is available, rollback can restore that package if a deployment needs to be reversed.

Usage & Cost

WP HoloDev records model usage and can enforce explicit limits when you want them.

Unlimited Cumulative Usage by Default

Jobs do not have a built-in cumulative token ceiling by default.

This allows long-running jobs to continue without being stopped simply because they crossed an arbitrary total-token value.

Explicit Token Budgets

You can apply a finite token budget when a project or job needs one.

Explicit Cost Budgets

Cost limits can also be applied where supported.

Usage Tracking

Token usage and estimated cost can be recorded against development jobs.

Agent Limits

Specialist-agent limits are controlled through Agent Level rather than model routing.

Security

Security controls are enforced by WP HoloDev itself rather than relying on project instructions to behave safely.

Filesystem Boundaries

Project file operations are restricted to authorised locations using path checks designed to prevent traversal and filesystem-link escapes.

Controlled Tool Execution

Native tool calls use the same central tool and permission system whether they were selected automatically or invoked explicitly.

Command Controls

Project commands are checked before execution and higher-risk operations can be refused or require additional authority.

Credential Protection

Provider credentials are kept separate from normal project instructions and are protected against unnecessary exposure through logs and stored metadata.

Untrusted Project Content

Source files, comments, documentation and other repository contents are treated as project data rather than application-level instructions.

Archive Safety

ZIP and archive handling includes checks for unsafe paths, links, suspicious extraction behaviour and other common archive attacks.

Network Protection

Browser and network access includes safeguards around unsafe destinations, credential-bearing URLs and other network risks.

Local Application Protection

The local interface uses host, origin, session and application controls rather than trusting any request simply because it reaches localhost.

Project Isolation

Project state and project-specific WordPress information remain scoped to the correct project.

Audit Information

Important security decisions and tool activity can be retained for later inspection.

Recovery & Cancellation

Long-running work is kept as persistent job state.

Persistent Jobs

Requirements, TODOs, progress, validation results and other job information can be stored while work continues.

Continuation

If actionable work remains, WP HoloDev can continue the same job rather than accepting an early final response as completion.

Context Compaction

Older conversational detail can be reduced from the active model context during long jobs while important structured job state is retained.

Resume After Restart

Stored state can be used to recover interrupted work after WP HoloDev is restarted.

Cancellation

Cancelling a job prevents new work from being started for that job and prevents stale asynchronous results from silently restarting it.

Commands

Slash commands provide direct access to common WP HoloDev functions.

/status

Show the current project or job status.

/models

Show model information available to the current project.

/skills

Show available skills.

/skill <id> [task]

Use a particular skill for the supplied task.

/tools

Show native tools available to the current project.

/tool <name> [JSON]

Invoke an authorised native tool directly.

/memory

Show project memory information.

/check

Run the Holographic Plugin Check workflow where applicable.

/test

Run the relevant project testing workflow.

/review

Run a review workflow for the current project or changes.

/build

Run the configured project build workflow where appropriate.

/deploy

Start the deployment workflow for an eligible WordPress release.

/rollback

Start the rollback workflow where a suitable previous deployment is available.

/cancel

Cancel the active job.

/help

Show the commands available in the installed version of WP HoloDev.

Troubleshooting

When something does not behave as expected, start with the information already recorded for the job.

Check the Execution Trace

Look for failed tool calls, provider errors, validation failures, permission denials or unavailable development software.

Check Model Assignment

If the expected model was not used, check the project's Model Assignment setting.

Manual uses one exact route. Semi-Auto can only use routes in the project's allowlist. Full Auto can choose between suitable available routes.

Check Agent Level

If specialist agents were not created, check whether Agent Level is set to None or whether the Low limit has already been reached.

Check Runtime Availability

A check may be unavailable because the required program or project runtime is not present.

Use the runtime inventory when you need to confirm which tools and development software are actually available.

Check Permissions

A tool may have been blocked because the requested operation was outside the project boundary or required additional authority.

Check Validation Results

If a job remains incomplete, inspect the failing requirement or validator before assuming that the completion system itself is stuck.

Check Browser Evidence

For frontend or interface problems, inspect browser results and screenshots as well as the source code.

Check Cyber Security Scope

If Cyber Security Mode refuses an operation, check that the request is defensive work against the current project rather than an unrelated external target.