Canvasly Pro does not call an AI model to build pages. WordPress stores a provider API key and acts as a read-only Model Context Protocol (MCP) server. An outside agent, such as Cursor or Claude, reads layouts through MCP, then writes them back through a separate WordPress address. Canvasly itself never loads this. It exists only while Canvasly Pro is active.
Open Canvasly → AI Connection. Only a site administrator can open it. Two stored settings are used:
Both are removed if you uninstall Canvasly Pro. The editor never receives the API key. A status check reports only whether a key is stored.
Only a provider on this list can be saved. An arbitrary web address is rejected, so this screen cannot be pointed at a private server. Every host must be HTTPS on port 443, with no username or password in the address. Localhost, addresses ending in .local or .internal, raw IP addresses, and lookalike hosts are rejected.
| Provider | Host used for the test | How the test sends the key |
|---|---|---|
| OpenAI | api.openai.com/v1 | Bearer token |
| Anthropic | api.anthropic.com/v1 | x-api-key |
| Gemini | generativelanguage.googleapis.com/v1beta | x-goog-api-key |
| Azure | Your own host under openai.azure.com, cognitiveservices.azure.com, or services.ai.azure.com | api-key |
| Perplexity | api.perplexity.ai | Bearer token |
| Cursor | api.cursor.com/v1 | Bearer token, and the test calls /me |
| Groq | api.groq.com/openai/v1 | Bearer token |
| Mistral | api.mistral.ai/v1 | Bearer token |
| DeepSeek | api.deepseek.com | Bearer token |
An Azure host must be a single name in front of one of those three endings. Add-ons may add providers, and those hosts still have to pass the same HTTPS checks.
The key is encrypted before it is stored. A key must be 20 to 256 characters, with no spaces and no web address scheme such as https://. Leave the password field blank when you save if you want to keep the key already stored.
Test connection is the only time WordPress calls the provider. It checks the provider’s model list. Cursor is checked at /me. Azure is checked at /openai/models?api-version=2024-10-21. A successful response means the key was accepted. There is no chat, no completion, and no request that generates a layout. The model name you save is not sent to the provider.
WordPress is the MCP server. It does not forward those requests to OpenAI, Anthropic, or any other provider. The agent connects to your site:
POST /wp-json/canvasly-lite/v1/mcp
The protocol version reported to the client is 2024-11-05. The server name is canvasly-lite. This address is hidden from the public REST index.
The address stays closed until both of these are true: Enable MCP is checked, and a token exists. If MCP is on and there is no token, the screen warns you, and the address keeps answering with “forbidden” (HTTP 403).
A token starts with lbai_ and then 48 hexadecimal characters. WordPress stores only a hash of it, a short hint of the first 8 characters, the administrator who created it, and the time. The full token is shown once, for two minutes. Generate a new one to replace it. Revoke deletes it. The person who owns the token must still be an administrator.
Send it on every MCP request in one of these ways:
Authorization: Bearer lbai_...
X-Canvasly-Lite-MCP-Token: lbai_...
A person who is already logged in to WordPress and can edit theme options can also call this address without the token. Each accepted call acts as the token’s owner, and that person must be allowed to edit layouts. After 60 calls in a minute, further calls are refused until the minute passes.
MCP can list and read layouts. It cannot create, update, or delete them.
| Request | What comes back |
|---|---|
| initialize | Protocol version, server info, and a note that the tools are read-only. |
| ping | An empty result. |
| tools/list and tools/call | The three tools below. |
| resources/list | One entry for each Canvasly page this person can edit. |
| resources/read | The layout for an address like canvasly-lite://document/123. |
| prompts/list | Always empty. No prompts are registered. |
| Tool | What it returns |
|---|---|
| list_layout_documents | Up to 50 posts or pages that store a Canvasly layout and that this person can edit. An optional title search narrows the list. |
| get_layout_document | One page: its number, title, type, status, and layout. |
| get_layout_schema | The catalog of units and shared settings, plus the page layout when a page number is set. Compact results are the default. Empty and default settings are left out so the tree stays small. Saving fills those defaults back in. |
Writes do not go through MCP. They use the layout routes below. The MCP token proves who is calling MCP. It does not, by itself, allow the save. The agent also needs a WordPress login, or another WordPress credential, that can edit layouts.
| Address | What it does |
|---|---|
| GET /wp-json/canvasly-lite/v1/layout-schema | The catalog of units. Requires permission to edit theme options. |
| GET /wp-json/canvasly-lite/v1/layout-schema/{id} | The catalog plus the layout of that page. |
| POST /wp-json/canvasly-lite/v1/layout-schema/{id} | Checks the layout and saves it. Add render=1 to also receive the HTML. |
| POST /wp-json/canvasly-lite/v1/layout-schema/render | Checks the layout and returns HTML without saving. |
The catalog id is canvasly-lite.layout.v1. A layout is a version, page settings, and a list of units. Each unit has an id, a type, settings, children, and an optional slot. The agent is told to:
global_class, using names that already exist, separated by spaces.component and its component id.n_. The save step assigns an id if one is missing.A save can be the full catalog response, an object that contains a document, or an object that has a root list.
/wp-json/canvasly-lite/v1/mcp with the bearer token./wp-json/canvasly-lite/v1/layout-schema/{page number} with WordPress credentials that can edit the page. Canvasly checks it, saves it, and the public page is drawn from that layout.The provider key stored in WordPress is not part of that loop. Pro does not send the layout, the prompt, or the model id to OpenAI, Anthropic, Cursor, or the other listed hosts, except for the model-list check used by Test connection.