Vendo

Every SaaS team has a feature backlog full of requests that are individually reasonable and collectively impossible. Vendo's bet is that a lot of them do not need to be built at all: the customer wants a view, a report or a recurring automation, and an agent with access to your existing APIs can assemble it on demand.

How it works

npx vendo init scans your repository and extracts what the generated apps have to look and behave like — your components, colours, API surface and permission rules. After that, a customer describes what they want in words and Vendo produces a real micro-app: views and dashboards, standing automations ("every Monday at 7"), actions with persistent state, and integrations with tools they already use such as Gmail, Slack and GitHub.

The security model is the interesting part. Generated apps run inside the requesting user's permissions and cannot exceed the API boundaries your product already enforces, so a customer cannot prompt their way into data they could not otherwise reach. Vendo's own doctor check verifies correctness before anything deploys.

Where it shows up

Embedded as an overlay, a chat sidebar or a panel inside your product — two commands to install — and also reachable from outside it, with generated apps surfacing in ChatGPT and Claude, or running on a schedule.

Pricing

The core is open source (Apache-2.0, runvendo/vendo). The Free tier costs nothing and includes $5 of monthly usage, roughly 100 agent turns, with hard caps. Pro at $49/month adds multiplayer, publishing to an org registry and a basic console, with $49 of usage included. Teams at $499/month adds org governance, session replay and tenant support. Enterprise is custom and covers SOC 2 Type II, self-hosting and air-gapped deployment, custom roles and dedicated support. Paid tiers activate by setting a single VENDO_API_KEY.

Worth knowing

Vendo is built by Aisle Technologies, Inc., backed by Y Combinator and Founders, Inc. The project is tested nightly against sixteen real open-source applications — cal.com, dub, formbricks and twenty among them — which is a more honest maturity signal than most launch pages offer, and a good place to look before deciding whether your own codebase resembles the ones it has been proven against.