VibeCart MCP server

VibeCart

Commerce infrastructure for AI-built apps and AI agents.

VibeCart lets a merchant keep their existing app and Stripe account while adding a small, inspectable commerce layer that AI agents can discover and use. Payments settle directly to the merchant's Stripe account; VibeCart does not need to become merchant of record.

The architecture is protocol-first: one trusted commerce backend, then thin MCP/UCP/client adapters around it.

Live production surface

Generic MCP

Endpoint: https://vibecart.vercel.app/mcp

Tools:

• vibecart.list_products
• vibecart.get_product
• vibecart.getintegrationinstructions
• vibecart.create_checkout

vibecart.create_checkout supports both the legacy single-product input and a trusted multi-item items[] input. Product prices are resolved on the server; callers do not supply real transaction prices.

Generic MCP clients should use /mcp.

Durable cart

VibeCart's Neon-backed cart is live in production:

• POST /api/cart
• GET /api/cart/:id
• PATCH /api/cart/:id
• DELETE /api/cart/:id
• POST /api/cart/:id/checkout

The cart uses trusted server-side repricing, idempotent creation, optimistic version checks, expiration, multi-item state, and cart-to-Stripe Checkout handoff.

UCP

• Discovery: https://vibecart.vercel.app/.well-known/ucp
• UCP-aware MCP transport: https://vibecart.vercel.app/ucp/mcp
• Released protocol target: UCP 2026-04-08

Production advertises released catalog and cart capabilities. Current cart tools are:

• create_cart
• get_cart
• update_cart
• cancel_cart

UCP calls require meta.ucp-agent.profile and capability negotiation. Do not point an ordinary MCP client at /ucp/mcp.

The order pipeline and released-schema getorder adapter also exist, but getorder remains hidden until its VibeCart Cloud lookup and real merchant permalink dependencies are configured. VibeCart does not advertise optional capabilities before their runtime dependencies are ready.

Stripe checkout and orders

• Trusted multi-line Stripe Checkout creation is supported.
• Stripe webhook signatures are verified before paid events enter the post-payment pipeline.
• Delayed-payment completion is handled separately so orders are not created prematurely.
• Paid Checkout line items are normalized into durable order records when VibeCart Cloud forwarding is configured.
• Trusted merchant product IDs survive Checkout through Stripe Product metadata.

He Said Nothing physical-store pilot

/he-said-nothing is the controlled physical-product pilot for the $39, $59, and $89 mystery gift boxes. The storefront can remain public while ordering fails closed. When the full launch gate is configured it:

• saves the relationship quiz, sizing clues, packaging choice, gift message, and fulfillment note in a durable cart
• opens a cart-bound, idempotent Stripe Checkout Session
• collects email, phone, shipping address, a separately disclosed shipping charge, and optional Stripe automatic tax
• stores the verified paid order, line items, delivery details, gift clues, and event history in Neon
• exposes paid orders only through the HMAC-signed merchant session at /he-said-nothing/admin
• supports the fulfillment states New, Packing, Shipped, Cancelled, and Refunded-in-Stripe

The checkout gate requires every dependency in .env.example; HSNCHECKOUTENABLED=true alone is insufficient. Test and live Stripe keys must match HSNCHECKOUTMODE, and live mode additionally requires customer-support, return-policy, and processing-time text.

Merchant catalog source

The built-in lib/products.ts catalog is demo/reference data only. A real merchant can keep SKUs and prices outside VibeCart and point Core at a merchant-controlled HTTPS JSON feed:

VIBECART_CATALOG_URL=https://merchant.example/vibecart/catalog.json
VIBECART_MERCHANT_NAME="Example Merchant"

Shortened. The full README is on GitHub.