Sarvex Is Now Open Source
Sarvex, the gateway that makes WooCommerce and Magento stores transactable by AI shopping agents, is now open source under Apache-2.0. Here is what that means and why we did it.
Sarvex is now open source. The code is public under the Apache License 2.0, and you can read it, run it, and send changes back.
This post is short on purpose. It says what is in the repository, why we chose to open it, and how to get started.
What Sarvex is
Sarvex is a gateway that makes a WooCommerce or Magento store transactable by AI shopping agents, using the Universal Commerce Protocol (UCP).
A merchant installs a thin plugin. Sarvex then hosts the store's UCP profile and checkout endpoints, keeps the catalog agent-ready, and monitors the integration. The merchant does not have to learn the protocol.
Why open source
I wrote before that the hard part of agentic commerce is not the AI. It is money and trust. A gateway that sits near checkout asks a merchant to trust it with a lot.
Open code is the honest answer to that. Do not take our word that Sarvex never sees a raw payment credential. The checkout schema has no field that could hold one. You can read it and check.
The same goes for tenant isolation, request signing, and how orders get recorded. These are the parts a merchant or an agency should be able to inspect.
There is a second reason. The protocol is still moving, and the commerce world is bigger than one small team can cover. Spec versions, platforms, and agent surfaces each plug in behind a registry, so other people can add them without editing the core.
What is in the repository
- One Go binary, three isolated planes. Serving (agent-facing), sync (catalog and connector), and control (the console API). They talk through an event bus, not by importing each other.
- WooCommerce and Magento 2 support, with thin PHP plugins that hold no business logic.
- Two UCP spec generations, served side by side.
- A Vue console for merchants and operators.
- Docs and decisions in the open: architecture, cross-plane sequences, how-to guides for adding a spec version, a platform, or an agent surface, architecture decision records, and a security policy.
How to run it
Sarvex is self-hosted. Production is Kubernetes. Local development runs the same services with docker-compose, so what you test is what you ship.
The developer docs walk through local setup, the repository map, and the architecture. If you only want to call the APIs, the API reference is generated straight from the contract files.
Where it stands
It is pre-1.0. Interfaces and wire formats can still change, and we call out breaking changes in the changelog. Shopify, BigCommerce, and Commercetools connectors exist but are frozen: they are kept compiling, not extended.
How to help
Read the contributing guide first. Two rules are enforced strictly in review: planes must not import each other, and tenant isolation is checked at the query level. After that, open an issue or a pull request. Found a vulnerability? Please report it privately, using the security policy in the repository.
If you would rather have help setting it up, get in touch. We are happy to talk.