MCP Server

MCP is a first-class citizen in Vendo. Your AI can work with the same operations you use in the app — sources, syncs, integrations, jobs, models, optimization, and more — through tools exposed over the Model Context Protocol .

The Vendo MCP server is a remote HTTP server on the Vendo web app. You add it to your client using an mcpServers JSON object (the same pattern as other hosted MCP servers), then sign in with OAuth or, when needed, a Vendo API key.

In-app help: In Vendo, open Workspace Settings → MCP for copy-paste JSON tailored to your workspace URL.

Before you connect

Connecting an LLM to your data has risks (for example prompt injection in user-generated content that an assistant might read through tools). We recommend:

• Prefer read-only access when the assistant only needs to inspect data — use OAuth scope mcp:read, or add read_only=true to the MCP URL when using an API key.
• Keep tool approval on in your IDE and review each tool call before accepting.
• Use OAuth when your client supports it so you approve access in the browser.
• Protect API keys like production secrets; prefer environment variables in config (e.g. ${VENDO_API_KEY}) instead of pasting keys into files you might commit.

Endpoint

https://app2.vendodata.com/api/mcp

Use your team’s Vendo URL if different. During the design partner alpha, the app is at https://app2.vendodata.com . The path is always /api/mcp.

Discovery (optional):

• OAuth metadata: /.well-known/oauth-authorization-server
• MCP manifest: /.well-known/mcp.json

Configure your client (JSON)

Most MCP clients accept a JSON file (often named mcp.json) or an equivalent setting in the app. Add a server under mcpServers with:

• "type": "http" — remote streamable HTTP MCP
• "url" — your MCP endpoint (see below for query parameters)
• "headers" — only when using a Vendo API key (Bearer token)

Option A — API key in headers (manual auth)

Create an API key in Vendo under Workspace Settings → API Keys. Then use:

{
  "mcpServers": {
    "vendo": {
      "type": "http",
      "url": "https://app2.vendodata.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${VENDO_API_KEY}"
      }
    }
  }
}

Set VENDO_API_KEY to your vendo_sk_… key in your environment, or replace the placeholder with the key only in a private, non-committed config.

Not every client supports custom headers; check your client’s documentation.

Option B — Read-only tools (API key)

Append a query parameter so only read-only tools are registered:

{
  "mcpServers": {
    "vendo": {
      "type": "http",
      "url": "https://app2.vendodata.com/api/mcp?read_only=true",
      "headers": {
        "Authorization": "Bearer ${VENDO_API_KEY}"
      }
    }
  }
}

Option C — OAuth (no Bearer in JSON)

If your client supports MCP OAuth, add the MCP URL only (with type: "http") and complete your client’s login flow. The client should discover /.well-known/oauth-authorization-server on the Vendo host. During authorization you will:

1. Sign in with your Vendo user
2. Choose the team account to connect
3. Approve mcp:read (read-only) or mcp:write (read and write)

Read-only vs read-write for OAuth is not controlled by the URL; it is chosen at authorization time.

URL parameters

You can append these to the url string (API key flows and some clients):

Platform-specific notes

OpenAI Codex

codex mcp add vendo --url https://app2.vendodata.com/api/mcp
codex mcp login vendo --scopes mcp:read

For write access: --scopes mcp:write. Start a new Codex session after adding the server so config reloads.

Claude Code

You can register from the terminal (options before the server name):

claude mcp add --transport http \
  --header "Authorization: Bearer YOUR_VENDO_SK_KEY" \
  vendo \
  "https://app2.vendodata.com/api/mcp"

Or use the same mcpServers JSON as above if your Claude Code version merges global MCP config from a file.

Cursor, Windsurf, and other IDEs

Use Workspace Settings → MCP (or your client’s JSON config) and paste the mcpServers block from Configure your client. Restart the IDE if tools do not appear.

Other MCP clients

If the client supports remote HTTP MCP, use type, url, and headers as documented. If it only supports OAuth, use the URL and complete the built-in login flow.

Supported platforms

Prerequisites

1. A Vendo account with access to the team workspace you want to connect
2. An MCP-compatible client with remote HTTP (or OAuth) support
3. For API key auth: a key from Workspace Settings → API Keys

Available tools

The server registers tools dynamically from the current product registry. Your client’s connected tool list is authoritative; a copied count or exhaustive list in documentation would become stale as capabilities are added.

Typical capability families include:

Mutation tools appear only when the session is read-write and the connected account permits the operation. A read-only connection does not merely block execution after a call; mutation tools are omitted from registration.

Access modes (OAuth)

When you authorize with OAuth, you choose:

• mcp:read — Read-only; mutation tools are not registered
• mcp:write — Full tool surface for allowed operations

To upgrade from read-only to write, run your client’s MCP login / authorization again and approve mcp:write.

Authentication summary

Rate limits

MCP traffic using an API key counts against that key’s limits (defaults shown below; your workspace may differ).

Usage examples

Infrastructure

“List my active Shopify sources"
"Create a new Google Ads source for my production app”

Monitoring

“What’s the status of my latest sync jobs?"
"Why did my Google Ads integration fail?”

Actions (requires write access)

“Pause my Stripe integration"
"Trigger a sync for my Shopify source”

Models

“Create a data model that joins orders with customer profiles”

Troubleshooting

Unauthorized

• OAuth: rerun login; confirm the correct team account was selected
• API key: confirm the key is active and the Authorization header is correct
• Restart the client after changing MCP config

Connection timeouts

• Vendo uses streamable HTTP; restrictive proxies may interfere. Try another network or read-only mode first.

Tools missing

• Read-only sessions hide mutation tools
• After scope or URL changes, reconnect or restart the client

Security considerations

• Prefer OAuth for interactive use
• Use mcp:read or read_only=true when mutations are not needed
• Avoid committing API keys; use env substitution in JSON where supported
• Review tool calls before approving in your IDE

Related

• Authentication — API keys and request auth
• Apps — App resources
• Error handling — Errors and X-Request-Id