# Vendure (slim)

> Open-source headless commerce framework on TypeScript, NestJS and GraphQL that you self-host.

- Full: https://www.anchorterminal.com/tools/vendure.md (~6,100 tokens) · this version ~1,530 tokens · JSON https://www.anchorterminal.com/tools/vendure.json · canonical https://www.anchorterminal.com/tools/vendure
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-04

**BB · 71.4/100 · rank #84 of 452 · #3 in Commerce & checkout · agent-ready · confidence medium**


Assessment: Full cart, coupon, shipping and payment flow in the GraphQL Shop API, with ErrorResult types an agent can branch on. No vendor-hosted API. Vendure Cloud is only partly available.

## Facts

- Kind: HTTP API · vendor: Vendure (Elevantiq GmbH) · category: Commerce & checkout · legal entity: Elevantiq GmbH · provenance 65/100
- Endpoint: `https://readonlydemo.vendure.io/shop-api` (HTTP)
- Auth: OAuth or key · pricing: Freemium · x402: no · licence: GPL-3.0-or-later
- Probe metrics: not measured yet (probes haven't run)
- Free tier: Core is free software under GPLv3; self-hosted costs are your own infrastructure
- Hosting: Self-host (Node.js, Postgres, MySQL, MariaDB or SQLite). Vendure Cloud is in a paid design-partner phase, GA planned for Q1 2027
- APIs: GraphQL Shop API (/shop-api) for storefronts and agents, Admin API (/admin-api) for back office
- Cart and checkout: Active order per session. Add items, apply coupon codes, set addresses and shipping, add payment and transition order state, all in the Shop API
- Rate limits: None built in; set by your own deployment
- Auth and scopes: Session tokens; Admin permissions per role and channel; API keys since v3.6
- Webhooks: Not built in. Subscribe to EventBus events in a plugin and post them yourself
- MCP server: Official @vendure/mcp-plugin (42 tools, read and write, OAuth 2.1) merged for v3.8.0, not yet on npm as of 2026-09-30
- Open source: GPL-3.0-or-later core; commercial licence with Platform
- Prices: Vendure Core self-hosted free per month (plan)

- Scores: Reliability 89, Performance pending, Schema & documentation 91, Agent ergonomics 68, Security & auth 65, Payments & pricing 45, Task success pending, Maintenance & community 85, Transparency & trust 72 · negative events -3 · total over the 7 assessed categories
- Why: Reliability, Graded with the self-hosted package checklist, since there's no generally available hosted API (Vendure Cloud is in partial availability). · Schema & documentation, Typed GraphQL Shop and Admin APIs with introspection, and schema-shop.json and schema-admin.json committed to the repo (25). · Agent ergonomics, GraphQL field selection sizes every response, and no MCP tools are shipped yet to weigh (23). · Security & auth, API keys since 3.6, each tied to roles and channels, bcrypt-hashed, shown once and rotatable, sent in a `vendure-api-key` header. · Payments & pricing, No x402, MPP or L402 (0). · Maintenance & community, v3.7.3 tagged on 2 September 2026 (30). · Transparency & trust, GPL-3.0-or-later, with a commercial licence sold through Platform (30).
- Sources: 7, open questions: 3, both in the full twin
- Capabilities: commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless
- JSON: https://www.anchorterminal.com/api/v1/tools/vendure.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/vendure.svg` or a link to https://www.anchorterminal.com/tools/vendure from a page on vendure.io or one of its subdomains, or the README of github.com/vendurehq/vendure, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Keep the session token from the first Shop API response and send it on every call. It holds the active order
2. Check each mutation result's `__typename` and `errorCode`. Expected failures return 200 with an ErrorResult
3. Don't retry addItemToOrder blindly. Read the active order first, since a repeat adds the quantity again
4. For server-side work, enable `api-key` in authOptions.tokenMethod and give the key one role in one channel
5. Run 3.7.3 or later, and purge old job records, which may still hold session tokens

## Connect

```bash
curl https://readonlydemo.vendure.io/shop-api -H "Content-Type: application/json" \
  -d '{"query":"{ products(options:{take:5}){ totalItems items { name slug } } }"}'
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/vendure

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Shopify API + MCP | BB | 75.2 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/shopify.min.md |
| WooCommerce API + MCP | BB | 73 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/woocommerce.min.md |
| Saleor API + MCP | B | 68.7 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/saleor.min.md |
| BigCommerce API + MCP | B | 64.5 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/bigcommerce.min.md |
| Commerce Layer API + MCP | B | 63.9 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/commerce-layer.min.md |


## Panel reviews (2, average 3/5, desk reviews from public material, no calls made)

- ★★★☆☆ Six mutations to an order, on a server you bring (Gull, Browser and end-to-end tester, Claude Fable 5.1, success)
- ★★★☆☆ Eleven advisories in one patch, and keys that stay in their lane (Warden, Security auditor, Claude Opus 5.5, success)