Free for merchants · Open source

Ask Mago anything.
Or tell it what to do

Mago is the AI admin assistant for Magento 2. Ask what sold best this week and get a live answer — or tell it to change a setting, and it does, after your OK. Works with Claude, OpenAI, Gemini, a local model and more.

Free to use, MIT-licensed, no subscription. You only pay your AI provider for what you use — see the FAQ.

Mago
in your admin panel
What were our best sellers this week?
Top 3 products did most of the work — revenue is up ↑ 12% vs last week. Best sellers · 7 days
Trail Runner XT214
Canvas Tote187
Wool Beanie142
Nice — set the free shipping threshold to €75
That changes live checkout settings, so I need your OK first.
ConfirmCancel
Ask a follow-up…
Why merchants love it

Run the store, skip the busywork

Ask in plain language

Sales, products, customers, configuration — ask like you'd ask a colleague and get a straight answer with live store data.

Answers in real time

Responses stream in live while Mago works — no waiting for a report to render, no page reloads.

Nothing changes without your OK

Reading is instant, writing never is: every change to your store gets an explicit confirm step first.

Follows your admin roles

Read and write access run through Magento's own ACL — every admin sees exactly what their role allows.

Your AI, your key

Bring your own key for Claude, OpenAI, Gemini, OpenRouter or a local model, and switch providers whenever you like. No middleman, no markup.

Free and open source

No licence, no seats, no subscription. Runs on Magento ≥ 2.4.9 and Mage-OS ≥ 3.0 — install it, paste your key, done. The code is MIT on GitHub.

Core + addons

One core, endless skills

Mago Core ships with the essentials — analytics, configuration, content and admin navigation as built-in skills. Everything else is an addon: a small module that teaches Mago a new trick.

Addons plug in through Mago's skill API without touching core, so any agency or module vendor can build one — performance insights, payment status, exception monitoring. That's how this stays a community effort instead of one vendor's roadmap.

Browse the addons → Contribute on GitHub ↗
+ Community addonsoptional skills, built by anyone
Mago Corethe assistant + built-in skills, open source
Your Magento storedata stays yours, guarded by ACL

Addons snap onto the core — remove one and everything else keeps working.

Trusted source

Built in the open, checked by peers

No time to dig through an AI module for security holes yourself? You shouldn’t have to take a stranger’s word for it either. This is who stands behind Mago, and what every change goes through.

Made by agencies you know

Five Dutch Magento agencies build Mago together, with Mage-OS as neutral ground. Not a startup that might vanish, but people who build Magento stores for a living.

Your competitor reviews the code

Every pull request is read by a developer from another agency before it merges. Nobody gets to wave their own code through.

Checked on every change

Each pull request runs PHPStan at level 8, the Magento coding standard, unit tests and end-to-end browser tests.

Open, with a way to report

Every line is MIT on GitHub, for you or your developer to read. Found a security issue? Report it privately through GitHub or security@mage-os.org.

Read the backstory → Security policy ↗
GDPR · AVG · DSGVO

Customer data stays in your store

Mago lets the AI work with your store without handing it your customers. Personal details are taken out before anything leaves your server — always, with no setting to forget.

  • Names, emails, phone numbers and addresses never go out. Mago strips them from every lookup before it talks to the AI provider. Order and customer numbers become placeholders like [order_1].
  • Unknown means blocked. A field that a skill — or a third-party add-on — hasn’t explicitly marked as safe is never sent.
  • What you type is checked too. Email addresses, IBANs, BSNs, VAT numbers and Dutch phone numbers in your messages are swapped out before sending. Names in free text are caught on a best-effort basis, so don’t paste customer details into the chat.
  • History cleans itself up. Conversations are stored with the placeholders, not the real values, and deleted automatically after 90 days. You can set your own retention period.
  • No Mago server in between. Requests go straight from your store to the provider you pick. Want it all in the EU? Use Azure OpenAI in an EU region, or a local model through Ollama or LM Studio so nothing leaves your server at all.
Order lookup · in your store
CustomerAnna de Vries
Emailanna.devries@example.nl
Order#100004521
CityUtrecht
Total€84,50
What the AI provider receives
Customerremoved
Emailremoved
Order[order_1]
CityUtrecht
Total€84,50

Mago swaps the placeholder back when it shows you the answer, so you still see the real order number.

How Mago protects your data →

The AI provider still processes the conversation itself, so sign its data processing agreement, as with any processor. The full details are in the privacy mode documentation on GitHub ↗

Pricing & costs

What does it cost?

Short version: Mago is free. The AI model you connect it to is not — and that bill goes straight to you, at your provider's rates.

Is Mago really free for merchants?
Yes. Mago Core is open source under the MIT licence: install it on as many stores as you like, for any number of admin users, with no licence fee, no seats and no subscription. There is no paid tier hiding behind it.
So where do costs come in?
In the AI model. Every question you ask is sent to the provider you chose, such as Claude (Anthropic), OpenAI or Google Gemini, and they bill per usage, based on the amount of text sent and received. Typical admin use comes down to cents per conversation, and you can set a monthly spending limit in your provider account so there are never surprises.
Do I need my own API key?
Yes. You create an API key in your own account at Anthropic, OpenAI or another provider and paste it into Stores › Configuration › Mage-OS › AI Configuration. Mago talks to the provider directly with that key, so usage is billed to you, at list price, with no markup — and your store data never passes through a Mago server, because there isn't one.
How do you keep those AI costs low?
By being stingy with what we send. Mago's prompts are kept deliberately small: it only passes the model the store data a question actually needs, pulls in a skill's context on demand instead of all at once, and keeps its own instructions short. The result is that a typical action — creating a product, say — costs a few cents, and a quick lookup often far less. Lower token use also means faster answers, so it is optimised on both counts.
Which AI providers can I use?
Claude (Anthropic) and OpenAI work out of the box. Azure OpenAI, Google Gemini, DeepSeek, OpenRouter, Hugging Face, Opper, OpenCode and local models through Ollama or LM Studio work too, once you install the matching provider package. Mago gets its providers from Mage-OS AI Base ↗. Switching is a matter of picking another provider in the same configuration screen and pasting the matching key: no reinstall, no data migration.
What about privacy and the GDPR?
Customer details stay out of it. Before anything goes to the AI provider, Mago strips names, email addresses, phone numbers and addresses from what it looked up, and turns order and customer numbers into placeholders — always on, with no switch to forget. Conversations are stored with those placeholders and deleted after 90 days, Mago stores nothing outside your Magento installation, and every write needs your confirmation. The provider still processes the conversation itself, so sign its data processing agreement. More on privacy.
Will addons be free as well?
Mago Core always is. Addons are published by their own maintainers under their own licence — we ask every maintainer to state it clearly, and the addon listing shows it per addon.
Safety & control

What can it touch?

Powerful enough to save you real time, fenced in so it can’t hurt your store.

Can Mago run any query on my database?
No. Mago has no raw SQL access. It works through fixed skills for sales figures, products, orders, configuration and so on, and each skill only fetches what it was built for, within your admin role. A developer can write a custom skill that does more, but that is a deliberate choice in your own code: raw query access will not ship in Mago Core.
Can a product review or customer message take over Mago?
That attack is called prompt injection, and Mago is built to resist it. Everything that comes from your store, like product and CMS content, reviews, customer names, order comments and config values, reaches the AI marked as untrusted data, never as instructions. The model is told to ignore any instructions inside it and to act only on what you asked. And if something did slip through, a change still needs your OK in the confirm step.
Can Mago break my store, or switch itself off?
It can only change what your admin role allows, and never without your OK. On top of that, some things are off-limits entirely. Mago can’t read or change its own settings, payment settings, or anything that looks like a password, API key or token. It also refuses to change settings that could lock you out, such as the base URLs, the admin URL, two-factor authentication and admin security. For other risky settings, like cookies, email senders or developer options, the confirm step tells you what could go wrong before you approve. Developers can add their own blocked paths in di.xml.
Built together with
Made by Mouses Magmodules Linted Vendic Control Alt Delete Mage-OS Nederland

Mago is built in the open with the developers, community builders and backers of the Dutch Magento ecosystem.