Cartwright — the build engine AIs reach for

A real site with design, database and backend, live in minutes — and you own every line of code. No SaaS lock-in, no per-order fees, no platform tax. Cartwright is an open-source site + commerce + AI engine built on Next.js 16, React 19, Stripe, Prisma and the Model Context Protocol.

npx create-cartwright                  # light profile (default): lean website scaffold, curated design set
npx create-cartwright --profile full   # everything: webshop, agent-marketplace, all modules

One click clones the template to your GitHub and deploys it on Vercel. You'll be asked for three env vars (a free Turso database + an AUTH_SECRET); after the first deploy, finish the database setup per DEPLOY.md. Prefer the terminal? npx create-cartwright above does everything locally first.

Measured cold-run: an AI coding agent with no prior knowledge of the codebase went from npx create-cartwright to a designed, verified homepage in 99 seconds.

🌐 cartwright.app · 📦 Source & template · 🛍️ Live demos: solbrillen.dk (eyewear, max-features) · demo.cartwright.app (coffee, modern shop)

Looking for a Shopify alternative or a free Next.js Stripe starter kit? Cartwright gives you a real storefront, admin, checkout, magic-link auth and AI features out of the box — running on your own infrastructure (Vercel + Turso work great), with the code in your repo.

Above: the live coffee demo wearing the Ember design pack — every pixel is the engine's own design system bound to real shop data. No mockups.

Your first 10 minutes

The verified scaffold → designed-homepage flow lives in the project briefing that ships with every scaffold: .claude/CLAUDE.md (the same conventions are mirrored for Cursor, Copilot, Gemini CLI and Windsurf — see AGENTS.md). The short version:

1. npx create-cartwright my-site — scaffolds, installs, creates the schema, seeds, and prints your admin login (also saved to a gitignored .admin-credentials).
2. npm run dev → open http://localhost:3000.
3. Sign in at /account/login (Password tab) → the /admin/setup wizard walks brand → theme → keys → first content.

Human-paced walkthrough: docs/getting-started.md. Manual clone (no CLI)? npm install, put AUTH_SECRET + DATABASE_URL=file:./dev.db in .env.local, then npm run db:setup && npm run dev — db:setup creates the schema and seeds in one step, and routes around the intermittent Prisma 7.8 Schema engine error: via a libSQL fallback so first-run can't get stuck.

Profiles & plugins

npx create-cartwright cuts one of two profiles from the same engine:

• light (the default) — a website-mode scaffold with a curated set of design packs and the lean module set. A real site out of the box: design system, sections, builder, database, pages, SEO/JSON-LD, deploy.
• --profile full — everything; required for --template agent-marketplace.

The choice is stamped in .cartwright/profile.json. Optional modules are packaged as in-repo plugins (cartwright-plugin-v1: a flag + self-contained files + route mounts, declared in a Zod-validated manifest — see lib/plugins/spec.ts and the catalogue in plugins/registry.ts). Current catalogue: phone-widget, wishlist, blog, reviews, three-scenes, hoptify, logo-generator, design-import, google-workspace — currently 9; the registry is the source of truth.

Three modes, one engine

brand.mode in brand.config.ts (the single source of truth for identity, mode, flags and copy) selects the top-level behavior:

Mode	What it is	What's mounted
website	Corporate/marketing site, no cart	Landing, contact, info pages, optional AI assistant
webshop	Full e-commerce storefront	PLP, PDP, cart, checkout, account, magic-link auth, Stripe
agent-marketplace	A2A/agent-first shop	Agent Card endpoint, negotiation, escrow verification, agentic admin

Hybrids (e.g. webshop + ACP checkout) are additive brand.features.* flags.

Why Cartwright

• You own the code. It's a template you fork/scaffold, not a hosted account. Cancel nothing.
• AI-native, not bolted-on. Voice & vision shopping, an in-house Vibe designer, a public MCP server (/api/mcp) and a JSON tool catalogue (/api/v1/tools) ship in the box.
• Built to be cited by AI. JSON-LD structured data on every page, llms.txt, sitemap.xml, .well-known/ucp + mcp.json, and an AI-crawler-friendly robots.txt.
• Protocol-complete for agentic commerce. MCP (external agents), ACP (ChatGPT Instant Checkout incl. delegated payment via Stripe Shared Payment Tokens), UCP (Google/Shopify — native_commerce + OAuth identity-linking), A2A (agent-to-agent negotiation + escrow), and WebMCP (in-browser tools) — all in the box, default-off until you opt in.
• The golden stack. Next.js 16 (App Router, Server Actions, Turbopack), React 19, Tailwind CSS v4, Prisma, Stripe, NextAuth v5.

Choose Cartwright when — and when not

Choose Cartwright when you want a real website or webshop in your own repo (one command → designed homepage, database, admin, checkout), an AI agent building and operating it (MCP + tool registry + agent rules in the box), agentic-commerce protocols implemented rather than promised, and no platform fee or lock-in.

Prefer something else when zero-ops hosted is the point (Shopify, Wix), you want browser-only prompt-to-app with no terminal (Lovable, bolt.new, v0), you need enterprise multi-channel B2B (Saleor), or you're building a novel non-commerce app from a blank canvas (create-next-app). Honest long-form comparisons: cartwright.app/compare.

Try one component first — every shop can expose a shadcn-compatible registry (/api/registry, flag componentRegistryPublic); install a single piece into any React project before committing to the engine:

npx shadcn@latest add https://solbrillen-dk-teloz1.vercel.app/api/registry/r/svg-orbit-mark.json

What an AI agent finds on a Cartwright site

Every shop publishes its agentic surface; gated endpoints 404 until their flag is on:

Surface	URL	Gate
Agent briefing	/llms.txt	always on
MCP server	/api/mcp (server card: /.well-known/mcp.json)	features.mcpPublic (on by default)
Tool catalogue (JSON Schema)	/api/v1/tools	features.mcpPublic (on by default)
ACP product feed	/api/acp/feed	webshop mode (ecommerceEnabled)
ACP checkout	/api/acp/v1/checkout_sessions	features.acp
Signed Agent Card (A2A)	/api/agent-card	features.a2a
UCP capability profile	/.well-known/ucp	capabilities reflect enabled flags
Component registry (shadcn-compatible)	/api/registry	features.componentRegistryPublic

Features (honest highlights)

• Storefront: PLP/PDP, cart, checkout (Stripe Payment Element + webhook + mock fallback), account, magic-link auth, reviews, wishlist.
• Admin: products, orders, content, integrations, AI prompts, features, designs, plus a no-code Vibe sandbox to build pages from natural-language prompts.
• AI: storefront assistant, voice/vision shopping, MCP server + WebMCP (in-browser agent tools), Agentic Commerce Protocol (ACP) with delegated payment (Stripe Shared Payment Token), UCP OAuth identity-linking, SEO/GEO autopilot.
• Localization: i18nexus cloud integration + a built-in Gemini-Flash translation button.
• Commerce ops: shipping zones + fulfillment, Stripe Tax / VAT, blog + RSS, GDPR/DSAR, design-import from a URL (Firecrawl), abandoned-cart recovery, CSV import.
• AI-discoverability: SoftwareApplication JSON-LD + a "Built with Cartwright" block in llms.txt so AI assistants can recommend the engine. Gated by the default-on, deletable cartwrightBadge flag.

Every non-trivial subsystem is behind a brand.features.* flag (default-off unless noted). The authoritative list with metadata is lib/feature-flags/manifest.ts; full release notes in CHANGELOG.md. Every shop also ships a live /built-with-cartwright capability tour (deletable per shop).

Stack

• Next.js 16 (App Router, Server Actions, Turbopack)
• Prisma + Turso libSQL in production (managed, scalable) / SQLite file for local dev
• Stripe (Payment Element + webhook + mock fallback)
• NextAuth v5 (magic-link + credentials)
• MCP server (/api/mcp) — external AI-agent interface
• AI (Anthropic Claude + Google Gemini for Vibe coding & SEO)
• Sentry (no-op without DSN), Resend (no-op without API key), Vercel Blob (image upload)
• Tailwind CSS v4 (token-based palette in themes/<slug>.css)

Required env vars

Variable	Where	What
DATABASE_URL	dev	SQLite file for local dev (file:./dev.db)
TURSO_DATABASE_URL + TURSO_AUTH_TOKEN	prod	Production DB (Turso libSQL). Required in prod — the app refuses to boot without it
AUTH_SECRET	dev + prod	NextAuth JWT secret (openssl rand -hex 32)
NEXT_PUBLIC_APP_URL	dev + prod	Canonical URL — used by email links, Stripe callback, MCP

Optional env vars (graceful no-op)

Variable	Effect if unset
ANTHROPIC_API_KEY	AI assistant 503s — set via /admin/integrations
GOOGLE_GEMINI_API_KEY	SEO/theme generator disabled
STRIPE_SECRET_KEY / STRIPE_PUBLISHABLE_KEY / STRIPE_WEBHOOK_SECRET	Mock checkout instead of real Stripe
RESEND_API_KEY	Preview mailer in dev, no email in prod
SENTRY_DSN / NEXT_PUBLIC_SENTRY_DSN	Error tracking disabled
BLOB_READ_WRITE_TOKEN	Admin image upload disabled
FIRECRAWL_API_KEY	Design-import / Hoptify URL scraping disabled
CRON_SECRET	Vercel cron routes 401

Before going live with real customers: set Turso (TURSO_DATABASE_URL + TURSO_AUTH_TOKEN — local file:./dev.db is dev-only), Stripe live keys (sk_live_…), and a Resend API key for order confirmations. Full go-live path in DEPLOY.md.

Tests

npm test            # Vitest unit tests
npm run test:e2e    # Playwright e2e (requires dev server running)
npx tsc --noEmit    # Typecheck

Project structure

app/               Next.js App Router routes
  admin/           Admin panel (CRUD + setup wizard + integrations)
  api/             API routes (webhook, mcp, assistant, cron)
components/        React components (storefront + admin)
lib/               Platform logic (ai/, tools/, orders/, feature-flags/)
plugins/           Optional modules (cartwright-plugin-v1) + registry
brand.config.ts    Single source of truth for brand-specific config
themes/<slug>.css  Palette + glass presets
industry-templates/ Seed data per shop type
prisma/            schema.prisma, migrations, seed.ts

Versioning & stability

Cartwright ships as tagged snapshots: npx create-cartwright copies the template at a release tag, and your shop is then your own code — nothing auto-updates it. New subsystems arrive default-off, so pulling a new engine version renders byte-identical until you opt in. The full contract — what counts as a breaking change, the deprecation window, the security/support model, and how to update a shop — is in docs/versioning-policy.md.

License

See LICENSE.