From outside agents

vendo init turns your app into an MCP server. Your own agent connects to it and acts as the user who is signed in — same guard, same approvals, same audit trail as the rest of your product. Claude, ChatGPT and Cursor connect to the same door.

Run init

The MCP door mints its own principals through an OAuth adapter, so it needs an identity to open. Init asks How do your users sign in? on every run, and every answer but None yet carries that adapter: authJs(), clerk(), supabase(), auth0() and jwt() all do, and Write my own scaffolds a working one for you. Answer None yet on this path and init writes nothing at all and exits 1, naming what to answer instead — so the next run is the whole fix. Auth.

npm install @vendoai/vendo
npx vendo init

pnpm add @vendoai/vendo
pnpm exec vendo init

Answer the first question with From outside agents over MCP and give init the origin your dev server prints. Init writes the door — mcp: true — into lib/vendo.ts, adds the discovery route beside your wire route, and fills .vendo/ with your tool catalog, policy and brand.

Wire your agent

vendo.agentTools opens the door for one conversation. Pass the incoming request and the agent acts as whoever is signed in. This route drives Anthropic directly, so it needs its own ANTHROPIC_API_KEY in .env.local — a Vendo Cloud key covers Vendo’s own inference, not your loop.

app/api/agent/route.ts

import Anthropic from "@anthropic-ai/sdk";
import { vendo } from "@/lib/vendo";

const anthropic = new Anthropic();

export async function POST(request: Request) {
  const { task } = await request.json();
  const door = await vendo.agentTools(request);
  const messages: Anthropic.MessageParam[] = [{ role: "user", content: task }];

  while (true) {
    const reply = await anthropic.messages.create({
      model: "claude-sonnet-4-6",
      max_tokens: 4096,
      tools: door.tools,
      messages,
    });
    messages.push({ role: "assistant", content: reply.content });

    const results = await door.results(reply);
    if (results.length === 0) return Response.json({ reply, embeds: door.embeds });
    messages.push({ role: "user", content: results });
  }
}

An empty results is how the loop knows the model is done. What the agent may call, and what a call meets on the way to your API, is in How the door works.Ship door.embeds to the page and render each one:

app/chat.tsx

import { VendoToolResult } from "@vendoai/vendo/react";

// wherever you render the assistant's turn:
embeds.map((embed, index) => <VendoToolResult key={index} output={embed} />)

Nothing to wrap: the embed finds the wire at /api/vendo and rides your host session cookie.

Approvals

Ask your agent to pay someone and the call parks — a tool nobody has graded needs a person. The approval card is one of the embeds, so it renders in your chat: approve it there, ask again, and the call runs.Grade the catalog with vendo sync --ai and only the destructive tools keep asking.

When you deploy

Two variables on your platform, and the same code:

VENDO_BASE_URL=https://app.example.com
VENDO_API_KEY=vnd_…

VENDO_BASE_URL is the public https origin your app answers on — every discovery URL derives from it. VENDO_API_KEY is the key init already put in .env.local, and it is the whole setup for your token broker — Service keys & broker is that half.

Claude, ChatGPT and Cursor

Your users’ setup page ships with the door. Open it in a browser, at the dev origin you gave init:

<your dev origin>/api/vendo/mcp/connect

It carries the copy-paste config for each client, and they sign in with your app’s own login. Claude Code takes two lines:

/plugin marketplace add runvendo/vendo
/plugin install vendo@vendo

Make it yours

The setup was the same for everyone. These, in order, make it yours.

Wire auth

Swap the demo principal for your real sign-in.

Add tools

Point Vendo at your API — the agent gets hands.

Approve actions

Decide what runs and what asks first.

Generate screens

Ask for a view, pin it into your grid.

Theme it

Your fonts, colors, and radii on every surface.

Set instructions

The brief your agent reads before every turn.

Get started

Vendo's Full-Stack Agent

In your existing agent