VibeCart

io.github.runjohnray2-lgtmPublished by GitHub account runjohnray2-lgtmv0.3.0Updated Oct 24, 2026

Agent-native commerce with trusted catalog, durable carts, and Stripe Checkout via MCP and UCP.

VerifiedStreamable HTTPWeb executableFinanceBusiness & Commerce

Overview

AI-generated overview

VibeCart is a remote commerce MCP server that lets an assistant browse a merchant's trusted product catalog and create Stripe hosted checkout links.

What you can do
  • List and look up products with server-resolved prices from the configured merchant catalog
  • Create a hosted Stripe Checkout URL for one or more catalog items, with prices resolved server-side
  • Retrieve concise Next.js App Router integration guidance for installing VibeCart
  • Support durable carts and UCP-aware catalog/cart capabilities on separate endpoints
When to use it
Use it when an AI-built app or agent needs to show a merchant's products and hand a customer off to Stripe Checkout without building its own commerce layer. It suits merchants who keep their own Stripe account and catalog feed.
Requirements
A remote streamable HTTP endpoint; no package install. The merchant side needs a configured HTTPS JSON catalog feed (VIBECART_CATALOG_URL, optionally VIBECART_CATALOG_BEARER_TOKEN) and a Stripe secret key for live payments; without them the server uses demo data and demo-mode checkout.
Before you install
create_checkout contacts Stripe and creates real checkout sessions when live keys are configured, though it never charges by itself; the customer must complete payment. Without a configured catalog the server serves fictional demo products and prices, so verify the catalog before treating listings as real. UCP endpoints require capability negotiation and should not be used by ordinary MCP clients.

Installation

In SourceWeft

  1. Open VibeCart in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.runjohnray2-lgtm%2Fvibecart/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "vibecart": {
      "type": "http",
      "url": "https://vibecart.vercel.app/mcp"
    }
  }
}

README

VibeCart

Commerce infrastructure for AI-built apps and AI agents.

VibeCart lets a merchant keep their existing app and Stripe account while adding a small, inspectable commerce layer that AI agents can discover and use. Payments settle directly to the merchant's Stripe account; VibeCart does not need to become merchant of record.

The architecture is protocol-first: one trusted commerce backend, then thin MCP/UCP/client adapters around it.

Live production surface

Generic MCP

Endpoint: https://vibecart.vercel.app/mcp

Tools:

  • vibecart.list_products
  • vibecart.get_product
  • vibecart.get_integration_instructions
  • vibecart.create_checkout

vibecart.create_checkout supports both the legacy single-product input and a trusted multi-item items[] input. Product prices are resolved on the server; callers do not supply real transaction prices.

Generic MCP clients should use /mcp.

Durable cart

VibeCart's Neon-backed cart is live in production:

  • POST /api/cart
  • GET /api/cart/:id
  • PATCH /api/cart/:id
  • DELETE /api/cart/:id
  • POST /api/cart/:id/checkout

The cart uses trusted server-side repricing, idempotent creation, optimistic version checks, expiration, multi-item state, and cart-to-Stripe Checkout handoff.

UCP

  • Discovery: https://vibecart.vercel.app/.well-known/ucp
  • UCP-aware MCP transport: https://vibecart.vercel.app/ucp/mcp
  • Released protocol target: UCP 2026-04-08

Production advertises released catalog and cart capabilities. Current cart tools are:

  • create_cart
  • get_cart
  • update_cart
  • cancel_cart

UCP calls require meta.ucp-agent.profile and capability negotiation. Do not point an ordinary MCP client at /ucp/mcp.

The order pipeline and released-schema get_order adapter also exist, but get_order remains hidden until its VibeCart Cloud lookup and real merchant permalink dependencies are configured. VibeCart does not advertise optional capabilities before their runtime dependencies are ready.

Stripe checkout and orders

  • Trusted multi-line Stripe Checkout creation is supported.
  • Stripe webhook signatures are verified before paid events enter the post-payment pipeline.
  • Delayed-payment completion is handled separately so orders are not created prematurely.
  • Paid Checkout line items are normalized into durable order records when VibeCart Cloud forwarding is configured.
  • Trusted merchant product IDs survive Checkout through Stripe Product metadata.

He Said Nothing physical-store pilot

/he-said-nothing is the controlled physical-product pilot for the $39, $59, and $89 mystery gift boxes. The storefront can remain public while ordering fails closed. When the full launch gate is configured it:

  • saves the relationship quiz, sizing clues, packaging choice, gift message, and fulfillment note in a durable cart
  • opens a cart-bound, idempotent Stripe Checkout Session
  • collects email, phone, shipping address, a separately disclosed shipping charge, and optional Stripe automatic tax
  • stores the verified paid order, line items, delivery details, gift clues, and event history in Neon
  • exposes paid orders only through the HMAC-signed merchant session at /he-said-nothing/admin
  • supports the fulfillment states New, Packing, Shipped, Cancelled, and Refunded-in-Stripe

The checkout gate requires every dependency in .env.example; HSN_CHECKOUT_ENABLED=true alone is insufficient. Test and live Stripe keys must match HSN_CHECKOUT_MODE, and live mode additionally requires customer-support, return-policy, and processing-time text.

Merchant catalog source

The built-in lib/products.ts catalog is demo/reference data only. A real merchant can keep SKUs and prices outside VibeCart and point Core at a merchant-controlled HTTPS JSON feed:

bash
VIBECART_CATALOG_URL=https://merchant.example/vibecart/catalog.jsonVIBECART_MERCHANT_NAME="Example Merchant"# Optional when the feed is private:VIBECART_CATALOG_BEARER_TOKEN=server-side-secret

Accepted response shape:

json
{  "products": [    {      "id": "sku-123",      "name": "Example product",      "description": "Merchant-controlled product data",      "priceCents": 4900,      "image": "https://merchant.example/products/sku-123.jpg",      "variant": "Optional variant"    }  ]}

An array of products at the document root is also accepted. id, name, and a non-negative integer priceCents are required; image URLs, when present, must use HTTPS.

The configured source is shared by generic MCP catalog/checkout, UCP catalog, and durable cart repricing. VibeCart validates the document, rejects duplicate IDs, caps response/product counts, blocks redirects/private-network targets, applies a short timeout, and caches healthy catalog data for 30 seconds. If VIBECART_CATALOG_URL is configured and the source is unhealthy or invalid, commerce operations fail closed; VibeCart does not silently fall back to demo products.

Normal SKU and price changes therefore do not require editing VibeCart TypeScript or redeploying Core.

Agent-client distribution

VibeCart does not build a different commerce engine for every model. OpenAI/Codex/ChatGPT, Claude, Gemini, VS Code, Cursor, and other MCP clients connect to the same backend.

See:

Provider adapters are CI-checked to keep Stripe/database/catalog secrets and duplicated commerce logic out of client configuration.

VibeCart Cloud

VibeCart Core is free to self-host. VibeCart Cloud is the optional $29/month managed layer for merchants that want VibeCart to operate the recurring plumbing.

Current Cloud capabilities include:

  • durable verified commerce events
  • durable normalized paid-order records and order history
  • server-to-server order lookup
  • signed merchant fulfillment webhooks
  • delivery history and bounded retries
  • monitoring/alerts and support workflows

Cloud workspace: https://vibecart-cloud-uupzkh.v2.appdeploy.ai/

Merchant checkout revenue still settles directly to the merchant's Stripe account. VibeCart takes no percentage of merchant sales.

Quick start

bash
npm installnpm run dev

Without VIBECART_CATALOG_URL, Core uses the fictional reference catalog for development. Configure a merchant catalog URL before treating products/prices as a real store catalog.

Without a Stripe secret, Checkout runs in clearly labeled demo mode. For live payments, configure STRIPE_SECRET_KEY in the hosting provider's secret/environment settings. Never commit secret values.

Useful public endpoints:

  • /start — merchant/client quickstart
  • /mcp — generic MCP transport/discovery
  • /api/cart — durable cart creation
  • /.well-known/ucp — UCP business discovery
  • /ucp/mcp — UCP-aware MCP transport
  • /mcp-clients.json — machine-readable client compatibility manifest
  • /llms.txt — concise machine-readable integration notes
  • /agents.md — agent-facing guide
  • /api/health — boolean readiness state without secret values
  • /cloud — managed Cloud offer

Security model

  • Merchant owns the Stripe account and receives merchant funds directly.
  • Trusted prices come from the configured server-side merchant catalog provider.
  • A configured remote merchant catalog fails closed rather than falling back to demo prices.
  • Client-supplied pricing is disabled by default and is prototype-only when explicitly enabled server-side.
  • Stripe webhook signatures are verified before post-payment processing.
  • Cart state is durable and versioned rather than trusted from the browser/agent.
  • Catalog, Stripe, database, and Cloud integration credentials remain server-side.
  • Public health/discovery endpoints expose readiness booleans/capabilities, not credential values.
  • Optional UCP capabilities are advertised only when their runtime dependencies are valid.

Protocol conformance

CI pins the released UCP v2026-04-08 source and executes VibeCart's real mappers through the official ucp-schema validator. Cart success/error payloads, catalog responses, discovery, and the private order mapper have release-pinned conformance gates.

Current reference limits

  • The remote catalog connector is intentionally a simple trusted JSON-provider contract, not yet a multi-merchant catalog control plane with merchant UI, inventory sync, or per-merchant credentials stored by VibeCart Cloud.
  • Inventory, automated tax calculation, shipping-rate calculation, returns/refunds, and a complete fulfillment lifecycle are not finished platform services.
  • Public UCP order lookup remains activation-gated until its Cloud/permalink runtime dependencies are configured.
  • Next.js App Router is the reference implementation; other frameworks should use adapters around the same Core protocol surface rather than fork commerce logic.

North star

VibeCart: commerce infrastructure for every AI agent. Build once. Sell everywhere AI can act.

License

MIT — free to use, modify, distribute, sublicense, and sell under the license terms.

Source: README.md at commit a17dfc4

Tools

4

vibecart.list_products

List trusted catalog products

Lists products from the configured trusted merchant catalog. Use the returned stable IDs for product lookup or checkout.

Takes no parameters.

vibecart.get_product

Get one trusted catalog product

Looks up one product and its trusted USD-cent price from the configured merchant catalog. Does not access Stripe or create a checkout.

ParametersproductIdrequired

vibecart.get_integration_instructions

Get secure integration instructions

Returns concise Next.js App Router guidance for installing VibeCart with trusted catalog pricing, multi-item checkout, and the shared MCP endpoint.

Takes no parameters.

vibecart.create_checkout

Create a hosted Stripe Checkout session

Creates a hosted checkout URL for one or more trusted merchant-catalog products. Legacy productId + quantity input remains supported; new integrations should use items[]. VibeCart resolves all prices server-side. This can contact Stripe but never charges by itself; the customer must complete Stripe Checkout.

ParametersitemsquantityproductId

Version history

1
  1. v0.3.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts