Features · Development
One binary, one database, one dependency
GoCommerce is a Go program with its admin compiled in, talking to one PostgreSQL. Everything else — payments, carriers, search, an AI agent — is a module you import, and the whole API is written down in OpenAPI.
- 342 documented REST operations
- 1 production dependency (pgx)
- 44 modules, compiled in only when imported
The shape of it
-
One binary and PostgreSQL
The API and the 61-screen Svelte admin compile into one binary with go:embed. No Node.js at runtime, no cgo; it cross-compiles for Linux, Windows and macOS, and a distroless Docker image is provided.
admin/embed.go · Dockerfile -
One production dependency
go.mod requires only the pgx PostgreSQL driver, and modules add no third-party dependencies — CI enforces it.
go.mod · AGENTS.md -
Headless REST, documented
342 operations — 238 in the core, the rest from modules — in OpenAPI 3.0.3, served at /doc and printed by gocommerce spec. The admin is itself a client of the same API.
core/openapi.json -
MIT, all of it
The licence covers the whole repository. There is no closed edition and no paid tier.
LICENSE
Extending it
-
Modules, compiled inPartial
44 modules plug into a small set of ports; import one and it is in your binary. Narrower than a plugin store: modules are Go, compiled in, not installed at runtime.
core/ports.go · ext/ -
Signed webhooks
The webhooks module posts signed events to any URL, with retries and a delivery log. Go code can also subscribe in-process.
ext/webhooks · core/events.go -
Custom data
Fifteen core tables — products, variants, orders, carts, discounts, vendors and more — carry a free-form metadata object. Product attributes follow Shopify’s taxonomy, embedded in the binary, and can be filtered.
core/types.go · Metadata -
Admin screens from modulesPartial
A module adds an admin screen by describing a list and a form, gated by rights. Missing: shipping your own front-end code into the admin.
core/screens.go -
Any language
Anything that speaks JSON over HTTP can drive the API, and non-Go services receive events through signed webhooks.
core/openapi.json
Running it
-
gocommerce doctor
Fifteen health checks — the stock ledger, refunds, returns, event backlog, discounts, the API contract — from the command line (non-zero exit on failure), the admin or the API.
core/doctor.go -
Several instances, no coordination
Run more copies behind a load balancer: background work is claimed with FOR UPDATE SKIP LOCKED and migrations run under an advisory lock. Uploads live on local disk, so instances share a volume for them.
core/outbox.go · core/migrate.go -
Events that are never lost
Each event is written in the same transaction as the change it describes, delivered at least once with backoff, and parked after 12 failures on an Events screen where it can be retried.
core/outbox.go -
No API rate limits
Only operator sign-in and password reset are throttled. Your server and database set the ceiling.
core/superusers.go -
A command-line toolPartial
serve, migrate, superuser, doctor, spec, taxonomy, attributes and version. Missing: environments, data branching and scaffolding.
cmd/gocommerce/main.go
Working with AI agents
-
An MCP server
19 tools that call the same domain services as the API — never the database — each checked against the caller’s rights. Read-only mode withholds every tool that changes anything, and changes are logged. Over HTTP or stdio.
ext/mcp -
Guides for coding agents
AGENTS.md sets 14 architectural rules and four notes for AI agents; skills/ holds 15 task guides and an index, so an agent reads the part of the domain it is about to change.
AGENTS.md · skills/ -
A test kit for module authors
gctest gives each test its own isolated database schema, and over a thousand tests catch a wrong edit.
gctest/gctest.go
Not in GoCommerce yet
There is no GoCommerce cloud, so none of the hosted-platform conveniences exist. Self-hosting gives you standard PostgreSQL backups and point-in-time recovery instead. Also absent today:
- Sandboxes and data branchingNo hosted environments; copy a store with pg_dump and pg_restore.
- Managed backups and auto-scalingBackups and scaling are yours, on your own infrastructure.
- GraphQLThe API is REST and JSON.
- Custom webhook payloadsEach event has a fixed body; you can filter events, not reshape them.
- An app storeThe Plugins screen configures modules already compiled in.
- A generated clientGenerate your own from the OpenAPI spec.
- Data anonymisationNo tooling to mask production data.
FAQ
Questions about development
What do I need to run GoCommerce?
One PostgreSQL database and somewhere to run one binary — a server, a container or your laptop. No Node.js, Redis or message broker is required.
Can I scale it horizontally?
Yes. Several instances can run behind a load balancer with no coordination between them; background work is claimed with row locks. Give them a shared volume for uploaded media, and size your PostgreSQL connection pooling.
Is there a GraphQL API?
No. The API is REST and JSON, documented in OpenAPI 3.0.3, so any language can generate a client from the spec.
How do I add a feature the core does not have?
Write a module: a Go package under ext/ that plugs into the core’s ports and is compiled in when imported. Or keep it outside GoCommerce entirely and listen to its signed webhooks.
Can an AI agent run the store?
Through the MCP module: 19 tools that go through the same services and rights checks as the API. Read-only mode lets an agent look without changing anything.
Read the code behind every tile
Each file named on this page is in the GoCommerce repository, MIT licensed. Run it and check.