runvendo/vendo
Embedded agents your customers use to automate work, build views, and connect their tools. - runvendo/vendo
57 stars · 1 forks · TypeScript Topics: react, automation, typescript, sdk, ai, nextjs, devtools, agents, ai-agents, embedded-ai, llm, generative-ui
README
Vendo puts an agent inside your product. Customers can build views, act through your APIs, and automate work inside your brand and guardrails.
Website · Docs · Quickstart
npm install @vendoai/vendo npx vendo init @vendoai/vendo is the default composition. The vendoai package is a thin alias. Install individual blocks when you want to compose Vendo yourself. See it in action Every capture below is a real agent run in a demo host app, not a mockup.
Build views. Ask a question, get a live view composed from the host's own components and API. Remix the UI. Hover a component, describe the change, apply it in place. Automate across tools. Plain language in, standing automation out, every tool gated by approval. Talk to it. A live voice session: ask out loud, the agent talks back and renders the view.
What Vendo does
Runs a streaming agent with any AI SDK LanguageModel. Extracts your API as tools and executes present calls with the signed-in user's session. Builds user-owned apps from a format-tagged UI document, escalating to a sandboxed server only when needed. Applies policy, approvals, grants, breakers, and audit at one execution choke point. Runs scheduled, host-event, and external-trigger automations with app-bound grants. Ships headless hooks plus optional, theme-driven React chrome.
PGlite at .vendo/data is the zero-config store. Production uses the same schema on Postgres. Generated components run in an iframe jail with connect-src 'none'. App machines reach host tools only through the guarded tool proxy. Packages
Package One job
@vendoai/core Shared types, schemas, formats, validators, and seams
@vendoai/store Postgres persistence, with PGlite as the default
@vendoai/agent Conversation loop, streaming, tools, and thread context
@vendoai/actions Host API and connector tools executed as the signed-in user
@vendoai/guard Policy, approvals, grants, audit, breakers, and safety
@vendoai/apps App generation, editing, execution, interchange, and sandbox adapters
@vendoai/automations Trigger ingestion, schedules, away runs, and run history
@vendoai/ui Headless React hooks, optional chrome, tree rendering, and voice surfaces
@vendoai/telemetry Anonymous, opt-out build and development telemetry
@vendoai/vendo Default composition, public wire, React entry, and vendo bin
Install flow vendo init scans the host app, then asks about the model import, product brief, critical-tool risk labels, and whether to open the MCP door. It proposes the handler route and <VendoRoot> wiring while extracting the theme automatically. Every code change is permission-gated and shown as a diff. It writes the reviewable .vendo/ directory and leaves the PGlite data directory ignored. Run vendo doctor to check wiring and probe /status. Run vendo sync in build and development flows to refresh extracted tools and remix baselines. Read the quickstart for the complete composition and first-turn setup. License Apache-2.0. Cloud-gated sharing, publishing, org overlays, and pinning activate with VENDO_API_KEY; the open-source blocks remain self-hosted.