Read the code

Own the code. Own the data. Keep what you build.

git clone https://github.com/mercurjs/mercur
cd mercur
pnpm install
pnpm dev

Runs on the stack your team knows

• API-first — A REST API across admin, vendor, and storefront scopes.
• Event-driven — Workflows with compensation and rollback.
• Headless and modular — Mercur installs over Medusa v2 as a plugin.
• Open — The code is on GitHub.

What runs in Core

• Split carts and per-vendor orders
• Rule-based commissions
• Vendor payouts through Stripe Connect
• Offers, pricing, and per-vendor catalogs
• Returns and RMA
• Multi-vendor data isolation
• Pluggable search (Algolia, Meilisearch)

Add to the engine through a typed API across three scopes, registry blocks you copy into your own repo, a dashboard SDK, events, and custom fields.

MIT-licensed, and the core stays MIT. Fork it, ship it, keep it. No relicense, no rug-pull.

Security in the open

Secret scanning, dependency updates, and a disclosure policy live in the same public repository, alongside automated scanning and static analysis.

• Report privately to security@mercurjs.com.
• Safe harbor for good-faith research.
• Coordinated disclosure – no public report before a fix ships.

Where to get help

• Found a bug? Open an issue.
• Have a question? Start a discussion.
• Want to talk live? Join the Discord.

Core runs the marketplace. Enterprise runs it in production.

Running one at scale, under audit, across regions adds a layer – settlement, enforced access, integrations, and support. That layer is Enterprise.

• Settlement ledger, statements, exports
• SSO, enforced roles, audit trail
• On-prem delivery and reference architecture
• SLAs and direct access