Vendo releases open-source layer for customer-built features in B2B SaaS

Why it matters

Vendo turns bespoke feature requests into customer-built software, shifting a SaaS vendor's bottleneck from roadmap capacity to permissions, security and governance.

Nour Zahzah and Yousef Helal released Vendo, an open-source customization layer that lets customers generate features, automations and small applications inside the B2B software they already use, according to Vendo's verified Launch YC announcement.

The founders are targeting a familiar source of friction in SaaS: specialized customer requests that remain in the feature backlog because they do not justify a place on the shared roadmap. With Vendo, a customer can describe a dashboard, workflow or integration in plain English and have an embedded agent assemble it from the host product's APIs and interface components.

Zahzah and Helal have known each other since kindergarten and previously built Aisle, an in-store AI shopping assistant for retailers. Zahzah, Vendo's CEO, studied mechanical engineering at the University of California, Berkeley and spent seven years in the San Jose Earthquakes' academy. Helal finished his Berkeley electrical engineering and computer science degree at 19, earned a master's degree from Stanford, and worked on FPGA infrastructure and processor technology at Apple and AMD, according to Y Combinator's Vendo profile and Helal's resume.

Vendo did not begin with this exact pitch. Zahzah wrote when announcing Vendo's YC acceptance that the founders had previously built Vendo as "one-click deploy and customization for any open-source software." They subsequently turned toward an embedded agentic layer for commercial SaaS products.

Turning the feature backlog into a product surface

Vendo targets the requests that product managers understand but cannot justify placing on a shared roadmap. One enterprise customer wants a custom approval flow. Another needs a dashboard that combines three obscure fields. A third needs an integration that may never matter to anyone else.

SaaS vendors may leave those requests in a backlog or handle them as paid services work. Vendo gives the customer an agent that operates through the vendor's existing API as the signed-in user. The generated interface appears inside the original product and uses its theme and components, according to Vendo's documentation.

Vendo's public repository says generated interfaces render in a sandboxed, brand-native surface without modifying the host application's source code. The repository documents sandboxing, approvals, grants, policy controls, audit records and circuit breakers. These are company-documented controls and do not amount to an independent security audit. The repository also describes an iframe environment with network access disabled by default and a sandboxed server for heavier execution.

According to Y Combinator's Vendo profile, customers can create automations, connect with external tools and let the agent take actions inside the host product. The repository separately lists schedules, host API actions and connector tools. Each capability gives generated software more utility while increasing the amount of authentication, authorization and review the host vendor must manage.

Vendo's approach is to inherit the signed-in user's permissions and route actions through the host product's API. Vendo describes generated software as running in secure sandboxes within the host product's security guardrails, according to its YC profile. The architecture keeps the host API and permission model in charge instead of granting the agent a separate path into customer systems.

The Apache-2.0 release also serves Vendo's distribution strategy. Vendo advertises a free cloud plan, a Pro plan at $49 per month and a Teams plan at $499 per month. Its pricing page also lists custom Enterprise pricing.

Two commands, then the hard part

The advertised installation flow is deliberately short:

npm install @vendoai/vendo
npx vendo init

The Vendo repository says the initializer reads the host repository, identifies its theme, components and API surface, and proposes permission-gated changes. SaaS teams can connect an agent they already operate or use Vendo's packaged agent, which includes chat, actions, generated interfaces and a knowledge base, according to YC's company profile.

Vendo can also expose host tools to Claude, ChatGPT, Cursor and Claude Code through the Model Context Protocol. That gives developers another route into the same APIs and permissions, although it expands the set of agent clients whose behavior the vendor must supervise.

The Vendo repository showed 472 stars, 73 forks and 3,855 commits on August 20th. The count is time-sensitive.

The initializer is the commercially important part of the pitch. An embedded agent has limited value if every SaaS company must manually map its design system, tools and authorization rules before a customer can build anything. Vendo is betting that enough of that setup can be inferred from a repository to make adoption practical while still putting permission-sensitive actions behind controls.

The roadmap becomes a governance problem

Vendo is entering a category that is forming quickly. Rough, an embedded AI feature builder, also runs generated features in a sandbox inside host products and emphasizes tracking who created each feature and what it touches. CustomAdapt, an embedded AI builder for B2B SaaS, includes an app-sharing marketplace.

Retool, a low-code application platform, lets developers build customer-facing portals and embedded applications. Prismatic, an embedded integration platform, gives SaaS customers a white-labeled workflow builder for integrations. Those products generally begin with developers or predefined workflow surfaces. Vendo pushes creation toward the end user by asking the agent to compose interfaces, take actions and preserve applications that can run again.

That wider scope creates an operational tradeoff. SaaS vendors could satisfy narrow customer requirements without adding each one to the permanent core product. They would then have to review and support a growing body of customer-generated software whose behavior depends on evolving APIs, permission models and external services.

Adjacent launches show how broadly software companies are testing natural-language application creation. Jotform introduced an AI App Builder in June 2026, while app-generation startup Emergent raised $23 million from Lightspeed in September 2025. Those products address different users and deployment models, but they add pressure on established SaaS vendors to offer creation tools inside products that once shipped with fixed interfaces.

Zahzah and Helal are framing the permissions, execution and review burden as infrastructure Vendo can absorb for many software vendors. Customers increasingly expect AI systems to act inside products, while product teams are discovering that a chat window does little to reduce the engineering work behind permissions, integrations and persistent workflows.

A two-person YC company in San Francisco

Y Combinator lists Vendo as an active Summer 2026 company in San Francisco, with categories including AI, B2B, customer success and open source. YC and Founders, Inc. each list a two-person team. Founders, Inc. includes Vendo in its portfolio, though the available material does not disclose an investment amount.

Acceptance into YC carries the accelerator's standard $500,000 investment commitment, consisting of $125,000 for 7% equity and $375,000 through an uncapped most-favored-nation SAFE. The public record does not establish additional financing or a valuation.

The founders now have to prove that customers want to build inside their SaaS tools and that vendors are willing to hand over this part of the interface. The public record does not establish customer references, paid usage, revenue or production deployment counts. Keeping generated features useful after the demo will depend on the less photogenic work: permissions, approvals, API maintenance and support.