Vendo: A New Tool That Lets You Build Custom Apps Inside Software You Already Use
Vendo, part of Y Combinator's Summer 2026 batch, publicly launched on August 20, 2026, via a Hacker News post. Founded by Yousef and Nour, the project is an open-source tool for business software. It lets people build their own features and mini-apps on top of the software they already use, without changing the original product's code. The codebase lives at github.com/runvendo/vendo, is licensed under Apache-2.0, and is available as an npm package called @vendoai/vendo.
When you set up Vendo, it reads the product's design, data connections, and page structure so that the apps it creates look like they belong there. Those apps can pull in data and perform actions through the product's own interface. Vendo uses an AI agent — a program powered by a large language model — to generate these apps, and the setup process is designed to be run by AI coding assistants such as Claude Code, Cursor, GitHub Copilot, OpenAI Codex, and Windsurf.
What makes Vendo different from typical "AI in your app" integrations is how it runs the code it generates. Vendo acts as an embedded agent that works through a product's own interface as the signed-in user. It renders the apps it creates in a sandbox — a sealed-off environment where the generated code cannot touch the browser, the internet, or the system clock. Every app is compiled, checked for errors, tested against real data, and rendered before the user sees anything. User clicks are passed through Vendo's own safety layer, which controls what the app is allowed to do. This is not a throwaway code snippet in a chat window. Vendo creates apps that users keep, pin to their dashboard, and run automatically on a schedule.
The project also works through MCP (Model Context Protocol), a standard that lets AI tools like Claude, ChatGPT, Cursor, and Claude Code interact with the SaaS product as the signed-in user. This means someone can use their preferred AI chatbot to work with a SaaS product, and Vendo manages the session with the same safety rules it uses for its in-product agent.
Vendo's customers use it for a range of tasks: creating custom dashboards and reports, building automated workflows that connect to external services like Slack, adding business logic such as extra form fields or permission rules, and creating, sharing, and reusing custom apps across a company. The project has published a benchmark and write-up on generating product UI at vendo.run/blog/generating-product-ui-measured. Documentation is hosted at docs.vendo.run, and the GitHub organization "runvendo" currently lists 22 repositories.
The project is not without rough edges. GitHub issue #478, filed on July 21, 2026, reports that AI SDK v7 breaks Vendo's internal agent loop, indicating that the rapidly changing AI software ecosystem can cause things to break.
The broader context here is that making business software customizable has been a hard problem for years. Platforms have tried plugin marketplaces, drag-and-drop builders, and scripting tools for non-developers, each with trade-offs around security, upkeep, and how much you can actually build. Vendo's bet is that an AI agent can close the gap between "I need a custom view" and "I have a working app pinned to my dashboard." The sandbox is the critical design choice: by giving the generated code no access to the browser, network, or clock, Vendo limits the damage that whatever the AI produces can cause. The host product controls every action and data request through its own safety layer. That is a meaningfully different approach from tools that let an AI write and run code with fewer restrictions.
In this author's view, the durability aspect is what sets Vendo apart from the current wave of AI-generated interface experiments. Most AI-generated interfaces disappear when you close the chat. Vendo's apps persist, can be pinned, triggered, and shared across teams. If the approach holds up under real-world load and the safety model proves robust, the pattern of an AI generating a durable, sealed-off mini-app inside a host product could become a standard way to extend business software. The unresolved question is whether the quality of generated apps scales from dashboards and form extensions to genuinely complex multi-step workflows, and whether the sandbox holds when generated code is running automatically across a large organization. The project is early, the AI SDK v7 breakage is a reminder of how quickly the foundation beneath these systems can shift, and the benchmark write-up suggests the team is aware that UI generation quality is something to measure rather than simply claim.
