TECH Signal 508
Vendo launches open-source embedded agent letting B2B SaaS users build custom features without touching source code
Vendo is an open-source embedded agent that reads a product's API and lets end users generate their own views, micro-apps, and automations in a sandboxed UI surface, acting as the signed-in user without modifying the host's source code.
B2B SaaS teams facing constant bespoke feature requests get a mechanism to offload that work onto an AI agent that operates within existing user permissions. The security model centralizes policy, approvals, and audit at one execution choke point, but the material is thin on how this holds up against complex permission scopes or API surface changes. Only one feed carries this, and it is a self-reported launch post, so there is no independent corroboration.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Vendo reads your product's API and turns it into tools the agent executes as the signed-in user, generating UI in a sandboxed iframe with connect-src 'none'.
Installation is a single npm package with zero-config PGlite storage by default, switching to Postgres for production on the same schema.
Cloud-gated features like sharing, publishing, and org overlays require a VENDO_API_KEY, while the core open-source blocks remain self-hostable.
THE CLUSTER