Most “AI sales assistants” are a scripted widget in the corner of a page. They can answer, sometimes; they cannot sell, because they cannot touch the order. There is a sharper version: an LLM sales manager that knows your live catalogue, answers like someone who has read every product page, and can actually place, change, and add to the order — because it acts through MCP against the same invoice your checkout writes to. The salesperson is an agent with write access, not decoration.

It sells from a real catalogue

The idea is laid out in an analysis on VBWD, a self-hosted, source-available full-stack SaaS SDK. The shop plugin owns products, variants, stock, and orders; the cms plugin owns the surrounding guides and FAQs; and bot_meinchat_llm runs retrieval over exactly that content inside the meinchat chat surface. So when a shopper asks which item is fine for sensitive skin and in stock in medium, the agent is not hallucinating from training data — it is reading your live shop and CMS, and the answer reflects this moment’s stock.

The part everyone else skips: it can act

Answering is table stakes. The non-trivial move is letting the agent do things, safely, through the mcp capability server. Adding a product, applying a confirmed size, attaching a warranty, removing something the shopper changed their mind on — each is a capability call that lands on the one invoice. As the original analysis puts it:

This is the sentence that changes the economics of a store: the conversation and the transaction are the same object.

There is no “the bot suggested it, now click over to the cart” seam where you lose half your shoppers. The agent that persuaded is the agent that transacts, and it does so through the identical invoice interface as your human checkout — not a bespoke, brittle “add to cart” integration.

Guardrails are the whole game

Write access is powerful, which is exactly why the boundaries matter. The core is RBAC-aware and event-driven with native signed webhooks, so you scope what the agent may invoke and audit everything it does:

You decide which capabilities the agent may invoke and which it may not — it can add a line item but you can withhold, say, the capability to issue a refund or override a price floor.

Every action is an event, so it is observable rather than a black box. And because plugins toggle on and off without a restart, you can pilot the agent on one product category, watch the invoices and events it generates, and expand only when you trust it — no redeploy, no downtime to dial it back.

The honest boundary

An LLM sales manager is only as good as the content you feed it and the safety model you impose. VBWD gives you the retrieval plumbing, the MCP write path, the RBAC scoping, and the audit trail — it does not hand you a trustworthy agent for free. You own the prompt design, the escalation-to-human rules, the refusal behaviour, and the monitoring for the day the model says something you would never sign off on. As the source is blunt about it:

Retrieval grounds the model, but grounding is a reduction of risk, not its elimination; you still test, still watch the events, still keep a human in the loop for the high-stakes actions.

The platform removes the integration burden; it does not remove your responsibility for what the agent says and does to customers. If an agent that can genuinely close the sale is the store you want to build, read the full analysis on VBWD, and the public code is on GitHub. The write path already exists.

Written for Red Robot with AI assistance and human editing. Adapted from an original analysis published on VBWD.