MCP server

Connect your Vendu e-commerce store to any AI assistant that supports the Model Context Protocol.

Quick Start

Option A: OAuth (Claude Desktop, Cursor)

Your MCP client will handle authentication automatically:

{
  "mcpServers": {
    "vendu": {
      "url": "https://vendu.space/api/mcp"
    }
  }
}

When you first connect, you'll be redirected to Vendu to authorize access.

Option B: API Key

Go to Settings → Integrations → API Keys in your Vendu dashboard
Create a key with the scopes you need (read, write)
Add to your MCP client config:

{
  "mcpServers": {
    "vendu": {
      "url": "https://vendu.space/api/mcp",
      "headers": {
        "Authorization": "Bearer vndu_your_key_here"
      }
    }
  }
}

Available Tools

Read Tools (scope: `read`)

Tool	Description
`get_orders`	Get recent orders. Filter by status, date, customer.
`get_conversations`	Get customer conversations. Filter by platform, AI status.
`get_products`	Search your product catalog by name, category, stock.
`get_contacts`	Get customer contacts with conversation summary.
`get_analytics`	Store analytics: orders, revenue, AI performance (today/7d/30d).
`get_ai_config`	View your AI assistant config: tone, language, knowledge base.
`get_messages`	Read messages from a specific conversation.

Write Tools (scope: `write`)

Tool	Description
`update_ai_persona`	Update AI tone, language, custom instructions.
`pause_ai_for_contact`	Pause/resume AI auto-replies for a conversation.

Authentication

The server supports two authentication methods:

API Key: Authorization: Bearer vndu_xxxxx — create in Settings → Integrations, scoped per key. This is a different key from the REST API key (vk_live_…, Settings → Developers) used for /api/v1/*; neither works on the other surface.
OAuth 2.1: Full PKCE flow with dynamic client registration — used by Claude Desktop, Cursor, etc.

OAuth Endpoints

Endpoint	URL
Authorization Server Metadata	`GET /.well-known/oauth-authorization-server`
Dynamic Client Registration	`POST /api/oauth/register`
Authorization	`GET /oauth/authorize`
Token Exchange	`POST /api/oauth/token`
MCP Endpoint	`POST /api/mcp`

Protocol

Transport: Streamable HTTP (stateless)
Protocol: JSON-RPC 2.0 (single & batch)
MCP Version: 2025-03-26

Examples

Ask about orders

"Show me all pending orders from the last 7 days"

The AI calls get_orders with { "status": "pending", "since": "2026-03-16T00:00:00Z" }.

Check analytics

"How is my store performing this week?"

The AI calls get_analytics with { "period": "7d" } and summarizes revenue, order count, and AI performance.

Adjust AI behavior

"Make the AI more formal and respond in English"

The AI calls update_ai_persona with { "tone": "formal", "language": "en" }.

Support

Dashboard: vendu.space
Documentation: vendu.space/docs/developers/mcp
Email: support@vendu.space

What the assistant can change

Read tools are available with the read scope. The following require write, and each one is deliberately narrow:

Tool	What it does
`reply_to_conversation`	Sends a message to the customer on their channel, records it in the conversation, and pauses AI auto-replies — a human has taken over. An identical message within a minute is refused, because a retried tool call would otherwise reach the customer twice.
`update_order_status`	Moves an order through its lifecycle. A transition the lifecycle forbids is rejected with the list of valid targets; the change carries the same lock, audit row and event as a change made in the dashboard.
`tag_contact`	Adds a tag to a contact, for segmentation and automation triggers.
`update_ai_persona`	Tone, language, custom instructions, auto-reply on/off.
`pause_ai_for_contact`	Pauses or resumes AI replies for one conversation.

Nothing here can create an order or take a payment. Those are money-path actions and stay with the agent and the dashboard, where the Supervisor and the order saga apply.

What the server will never do

Installing apps, changing scopes, setting credentials, touching billing or managing the team are not available over MCP, and will not be.

The line is not read-versus-write — replying to a customer is a write and it is fine. It is whether the effect outlives the conversation and then acts on its own. A reply is one message a person can see and correct; an installed app is a standing grant that keeps calling an external endpoint long after the conversation ended.

This matters because the same assistant reads customer messages, and a customer's message is text an attacker controls. Every tool above has a bounded worst case. "Install an app" would not.

Configuration belongs in the dashboard, in front of someone who can see what they are approving.

Connect your Vendu e-commerce store to any AI assistant that supports the Model Context Protocol.

Quick Start

Option A: OAuth (Claude Desktop, Cursor)

Your MCP client will handle authentication automatically:

{
  "mcpServers": {
    "vendu": {
      "url": "https://vendu.space/api/mcp"
    }
  }
}

When you first connect, you'll be redirected to Vendu to authorize access.

Option B: API Key

Go to Settings → Integrations → API Keys in your Vendu dashboard
Create a key with the scopes you need (read, write)
Add to your MCP client config:

{
  "mcpServers": {
    "vendu": {
      "url": "https://vendu.space/api/mcp",
      "headers": {
        "Authorization": "Bearer vndu_your_key_here"
      }
    }
  }
}

Available Tools

Read Tools (scope: `read`)

Tool	Description
`get_orders`	Get recent orders. Filter by status, date, customer.
`get_conversations`	Get customer conversations. Filter by platform, AI status.
`get_products`	Search your product catalog by name, category, stock.
`get_contacts`	Get customer contacts with conversation summary.
`get_analytics`	Store analytics: orders, revenue, AI performance (today/7d/30d).
`get_ai_config`	View your AI assistant config: tone, language, knowledge base.
`get_messages`	Read messages from a specific conversation.

Write Tools (scope: `write`)

Tool	Description
`update_ai_persona`	Update AI tone, language, custom instructions.
`pause_ai_for_contact`	Pause/resume AI auto-replies for a conversation.

Authentication

The server supports two authentication methods:

API Key: Authorization: Bearer vndu_xxxxx — create in Settings → Integrations, scoped per key. This is a different key from the REST API key (vk_live_…, Settings → Developers) used for /api/v1/*; neither works on the other surface.
OAuth 2.1: Full PKCE flow with dynamic client registration — used by Claude Desktop, Cursor, etc.

OAuth Endpoints

Endpoint	URL
Authorization Server Metadata	`GET /.well-known/oauth-authorization-server`
Dynamic Client Registration	`POST /api/oauth/register`
Authorization	`GET /oauth/authorize`
Token Exchange	`POST /api/oauth/token`
MCP Endpoint	`POST /api/mcp`

Protocol

Transport: Streamable HTTP (stateless)
Protocol: JSON-RPC 2.0 (single & batch)
MCP Version: 2025-03-26

Examples

Ask about orders

"Show me all pending orders from the last 7 days"

The AI calls get_orders with { "status": "pending", "since": "2026-03-16T00:00:00Z" }.

Check analytics

"How is my store performing this week?"

The AI calls get_analytics with { "period": "7d" } and summarizes revenue, order count, and AI performance.

Adjust AI behavior

"Make the AI more formal and respond in English"

The AI calls update_ai_persona with { "tone": "formal", "language": "en" }.

Support

Dashboard: vendu.space
Documentation: vendu.space/docs/developers/mcp
Email: support@vendu.space

What the assistant can change

Read tools are available with the read scope. The following require write, and each one is deliberately narrow:

Tool	What it does
`reply_to_conversation`	Sends a message to the customer on their channel, records it in the conversation, and pauses AI auto-replies — a human has taken over. An identical message within a minute is refused, because a retried tool call would otherwise reach the customer twice.
`update_order_status`	Moves an order through its lifecycle. A transition the lifecycle forbids is rejected with the list of valid targets; the change carries the same lock, audit row and event as a change made in the dashboard.
`tag_contact`	Adds a tag to a contact, for segmentation and automation triggers.
`update_ai_persona`	Tone, language, custom instructions, auto-reply on/off.
`pause_ai_for_contact`	Pauses or resumes AI replies for one conversation.

Nothing here can create an order or take a payment. Those are money-path actions and stay with the agent and the dashboard, where the Supervisor and the order saga apply.

What the server will never do

Installing apps, changing scopes, setting credentials, touching billing or managing the team are not available over MCP, and will not be.

This matters because the same assistant reads customer messages, and a customer's message is text an attacker controls. Every tool above has a bounded worst case. "Install an app" would not.

Configuration belongs in the dashboard, in front of someone who can see what they are approving.

Quick Start

Option A: OAuth (Claude Desktop, Cursor)

Option B: API Key

Available Tools

Read Tools (scope: read)

Write Tools (scope: write)

Authentication

OAuth Endpoints

Protocol

Examples

Ask about orders

Check analytics

Adjust AI behavior

Support

What the assistant can change

What the server will never do

Quick Start

Option A: OAuth (Claude Desktop, Cursor)

Option B: API Key

Available Tools

Read Tools (scope: read)

Write Tools (scope: write)

Authentication

OAuth Endpoints

Protocol

Examples

Ask about orders

Check analytics

Adjust AI behavior

Support

What the assistant can change

What the server will never do

Read Tools (scope: `read`)

Write Tools (scope: `write`)

Read Tools (scope: `read`)

Write Tools (scope: `write`)