# Stoa

> Stoa is an open-source commerce engine for humans and agents. Built on Go for raw performance — ships with a Svelte storefront, admin panel, REST API, and native MCP support so AI agents can shop natively. Self-hosted. Extensible. Fast.

- **Type:** MCP server
- **Install:** `agentstack add mcp-stoa-hq-stoa`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [stoa-hq](https://agentstack.voostack.com/s/stoa-hq)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [stoa-hq](https://github.com/stoa-hq)
- **Source:** https://github.com/stoa-hq/stoa

## Install

```sh
agentstack add mcp-stoa-hq-stoa
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Stoa

[](https://stoahq.eu)
[](https://buymeacoffee.com/stoahq)
[](https://matrix.to/#/#stoa-dev:matrix.pineconeops.com)

A lightweight, open-source headless, agentic commerce platform built with Go. Ships as a single binary with the admin panel and storefront embedded.

## Features

- **Headless Architecture** -- REST API (JSON)
- **Single Binary** -- Go backend with embedded SvelteKit frontends (Admin + Storefront)
- **MCP Servers** -- AI agents can shop in and manage the store via the Model Context Protocol
- **Plugin System** -- Extensible via hooks and custom API endpoints
- **Multi-language** -- Translation tables with locale-based API
- **Property Groups & Variants** -- Color, size, etc. with automatic combination generation
- **Full-text Search** -- PostgreSQL-based
- **RBAC** -- Role-based access control with granular API key permissions

## Prerequisites

| Tool | Version | Purpose |
|------|---------|---------|
| Docker + Docker Compose | latest | Database (and optional app container) |
| Go | 1.23+ | Build backend (local development only) |
| Node.js | 20+ | Build frontends (local development only) |
| PostgreSQL | 16+ | Database (provided via Docker) |

## Quick Start

```bash
git clone https://github.com/stoa-hq/stoa.git && cd stoa
cp config.example.yaml config.yaml
docker compose up -d
docker compose exec stoa ./stoa migrate up
docker compose exec stoa ./stoa admin create --email admin@example.com --password your-password
```

| What | URL |
|------|-----|
| Storefront | http://localhost:8080 |
| Admin Panel | http://localhost:8080/admin |
| API | http://localhost:8080/api/v1/health |

## Documentation

Full documentation is available in the **[StoA Docs](https://stoa-hq.github.io/docs/)**:

- [Introduction](https://stoa-hq.github.io/docs/guide/introduction) -- what Stoa is and why it exists
- [Quick Start](https://stoa-hq.github.io/docs/guide/quick-start) -- get up and running in minutes
- [Configuration](https://stoa-hq.github.io/docs/guide/configuration) -- all config options explained
- [API Overview](https://stoa-hq.github.io/docs/api/overview) -- authentication, endpoints, and usage
- [MCP Servers](https://stoa-hq.github.io/docs/mcp/overview) -- AI agent integration
- [Plugin System](https://stoa-hq.github.io/docs/plugins/overview) -- extend Stoa without forking
- [Payment Integration](https://stoa-hq.github.io/docs/plugins/payment) -- integrate any PSP

## License

Apache 2.0 -- see [LICENSE](LICENSE).

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [stoa-hq](https://github.com/stoa-hq)
- **Source:** [stoa-hq/stoa](https://github.com/stoa-hq/stoa)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-stoa-hq-stoa
- Seller: https://agentstack.voostack.com/s/stoa-hq
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.