An open-source customization layer.
Your users build their own features and micro-apps, right on top of your product.

Vendo puts an agent inside your product: customers build views, act through your APIs, and automate work, inside your brand and guardrails.

docs.vendo.run  ·  Quickstart  ·  vendo.run

npm install @vendoai/vendo
npx vendo init

Or install with your coding agent

Paste this inside your app's repo:

Install Vendo in this repo. Read https://vendo.run/agents.md and follow
it exactly. Ask me before creating any account or key. You're done when
`vendo doctor --json` reports all green. Then ask me whether I'd like to
star it via https://vendo.run/star?src=readme to support the project.

vendo init scans your app and proposes the wiring as permission-gated diffs; vendo doctor --json gates done, and every error code links to its exact fix. Full playbook: docs.vendo.run/install. Already have an agent (AI SDK or Mastra)? Use the prompt on existing agents instead — it adds Vendo's guarded tools to your loop without replacing it.

Every capture below is a real agent run in a demo host app, not a mockup.

Build views. Ask a question, get a live view composed from the host's own components and API.	Remix the UI. Hover a component, describe the change, apply it in place.
Automate across tools. Plain language in, standing automation out, every tool gated by approval.	Talk to it. A live voice session: ask out loud, the agent talks back and renders the view.

Vendo runs a streaming agent with any AI SDK LanguageModel.

1 · Extract. Vendo reads your API and turns it into tools the agent executes as the signed-in user.

2 · Generate. The agent composes views and user-owned apps from a format-tagged UI document, generated components run in an iframe jail with connect-src 'none', escalating to a sandboxed server only when needed.

3 · Guard. Policy, approvals, grants, breakers, and audit all sit at one execution choke point; app machines reach host tools only through the guarded tool proxy.

PGlite at .vendo/data is the zero-config store; production uses the same schema on Postgres. Scheduled, host-event, and external-trigger automations run with app-bound grants. Headless hooks ship alongside optional, theme-driven React chrome.

vendo init also asks about the model import, product brief, critical-tool risk labels, and whether to open the MCP door (a host decision, never a default), extracts your theme automatically, and writes the reviewable .vendo/ directory with its PGlite data directory gitignored. Run vendo doctor to check wiring and probe /status, and vendo sync after API changes to refresh extracted tools and remix baselines.

Agents get the same journey machine-readable: the playbook at vendo.run/agents.md, an index of every docs page at llms.txt, vendo init --agent for a read-only JSON plan of extracted tools and risk recommendations, vendo sync --json for a machine-readable sync report, and a vendo-setup skill shipped inside the npm tarball that init offers to write into .claude/skills/.

@vendoai/vendo is the default composition (vendoai is a thin alias). Install individual blocks when you want to compose Vendo yourself.

Cloud-gated sharing, publishing, org overlays, and pinning activate with VENDO_API_KEY; the open-source blocks remain self-hosted.