Vercel plugin
The Vercel plugin lets a Vaubaan Gateway mission use Vercel without handing the agent a credential. Runtime hosting plane — projects, deployments, logs, env vars, custom domains, firewall, preview comments.
- Version:
3.0.0(package@vaubaan/plugin-vercel) - Status: stable
- Health: not enough reports yet — what this means
- Source: plugins/vercel, catalog risk-catalog.yaml version 3 of 2026-10-14
- How to connect an account: Connect Vercel
- How it is modelled: handbook
One account is one Vercel access token pinned to a team; one resource is one project of that team. The environment is not a label you set: Vercel's own production, preview and development environments are read from each call, so the same project can run freely on preview and ask first on production.
Permissions
Each permission is a named risk of the plugin's catalog: a mission holds an explicit list of them, never "all". The severity is computed from the permission's six axes (undo, blast radius, data, cost, visible to, lasts); nothing is decided from it.
| Permission | What it allows | Severity | Why it is a risk |
|---|---|---|---|
vercel.read-account | Read account / team / project metadata | low | Inventory of teams, projects, deployments, build/runtime logs, env-var keys (encrypted), domains, toolbar threads. Surface of attack is negligible : metadata only, no plaintext secret leaks. This permission is the always-on baseline that every other read assumes. |
vercel.read-deployment | Read deployments + build/runtime logs | low | Runtime logs can carry app data (PII if the app logs by accident, OWASP LLM01 surface via tokens injected into logs). Standard posture for a coding agent in debug mode but still distinct from pure metadata read. |
vercel.read-env-var | Read env vars (encrypted values only) | low | Listing of env-var keys with values returned encrypted by Vercel. No direct secret exfiltration possible. Discriminates from the plaintext variant which is the higher-severity write. |
vercel.read-env-var-plaintext | Read env vars in plaintext (`decrypt=true`) | medium | `list_env_vars` with `decrypt=true` returns Stripe keys, DB URLs, JWT signing secrets etc. in the clear. Equivalent to a full credentials compromise on the project. Distinct risk class from the encrypted read. |
vercel.fetch-deployment-url | HTTP fetch to a Vercel deployment URL | low | `web_fetch_vercel_url` makes an outbound HTTP request against a deployment URL. Logs an access on the target side, may consume bandwidth. Not a major security risk but worth a dedicated permission for audit-log granularity. |
vercel.mint-bypass-token | Mint a deployment-protection bypass token | low | Credential creation. The token bypasses SSO / Password Gate on a single deployment URL with a short TTL. Exposing the URL out-of-band bypasses the project deployment-protection. |
vercel.deploy | Trigger a deployment | medium (high on prod; only for preview, development, prod) | Preview / development builds have no prod impact and are reversible. Production deploys are public and costly to roll back (prod alias re-pointed, CDN cache invalidated). The vector_overrides for prod reflect the higher blast and visibility. |
vercel.toolbar-write | Write / edit / react on toolbar threads | low | UI comment surface on deployment previews. Visible to the team only, reversible via delete/edit, zero effect on build / runtime / routing. Semantically a mutate but the risk is minimal. |
vercel.env-var-write | Write / update / delete env vars | medium (high on prod; only for preview, development, prod) | Affects future builds on the targeted env. The stored value is a secret on the Vercel side. On prod a bad value breaks the service at the next deploy ; an attacker-injected value exfiltrates traffic or takes over the app. The vector_overrides for prod reflect the costly reversibility. |
vercel.env-var-fan-out | Write env var on every env in one call (prod included) | high | `upsert_env_var target=['production','preview','development']` (or target omitted = all 3 by Vercel default), and `delete_env_var` (whose upstream API removes the var from every env it lives in regardless of the Vaubaan hint), touch all 3 envs in a single tool call. Treated as its own permission so the agent who only holds `env-var-write` on preview does NOT silently escalate to prod. |
vercel.project-settings-write | Update project settings (framework, build cmd, node version, root dir) | medium | Modifies the build pipeline for *every* future deployment of all 3 envs. A bad install / build command breaks preview AND prod at the next push. Posture-shift on the CI chain. |
vercel.firewall-read | Read firewall / WAF configuration | low | Exposes the full WAF posture of a project : custom rules, IP blocking entries, managed rulesets, OWASP CRS settings, and the firewallEnabled toggle. Metadata-only (no mutations), but reveals the security policy surface — an attacker who sees the rules can craft bypasses. |
vercel.firewall-write | Toggle the project firewall on/off | medium | Flipping the WAF off exposes the project to all unfiltered traffic. Flipping it on may block legitimate visitors if rules are misconfigured. Posture-shift affecting production traffic immediately. |
vercel.firewall-rule-write | Create / update / remove a custom firewall rule | medium | A bad rule can silently expose production to attacks (too permissive) or block legitimate traffic (too restrictive). Each rule is project-scoped and applies to all deployments. Posture-shift with public-facing impact on every request. |
vercel.ip-rule-write | Add / remove an IP blocking rule | medium | IP rules directly control which source IPs can reach the project. A wrong deny blocks paying customers ; a wrong bypass lets an attacker in. Immediate public-facing posture-shift. |
vercel.domain-write | Attach / verify / detach a custom domain | high | External DNS coupling. Attach → public routing (can hijack traffic from a domain the org controls). Detach → breaks the public service if the domain is prod. Verify is idempotent but folded into the same risk for UX simplicity. |
vercel.uncategorized-write | Uncategorized Vercel write | medium (the catch-all: touched only by a call no other permission covers) | Catch-all for writes that have not been explicitly categorised. If observed in production, signals that a tool was added without a matching catalog entry — the mission creator must opt in explicitly (no implicit accept). |
Presets
A preset pre-fills the permissions of a mission for one account, with a limit per period, a rate and whether each permission runs freely or asks the mission creator first. The person creating the mission adjusts it; the mission stores the explicit list.
Read-only
read-only — Inspect projects, deployments, logs, env-var keys and the firewall; no write.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
vercel.read-account | Read account / team / project metadata | 2000 | 120 per minute | runs freely |
vercel.read-deployment | Read deployments + build/runtime logs | 2000 | 120 per minute | runs freely |
vercel.read-env-var | Read env vars (encrypted values only) | 500 | 30 per minute | runs freely |
vercel.fetch-deployment-url | HTTP fetch to a Vercel deployment URL | 300 | 30 per minute | runs freely |
vercel.firewall-read | Read firewall / WAF configuration | 200 | 30 per minute | runs freely |
Developer
developer — One mission per code project — preview and development deploys, logs, preview env vars, toolbar comments; nothing that touches production configuration.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
vercel.read-account | Read account / team / project metadata | 5000 | 120 per minute | runs freely |
vercel.read-deployment | Read deployments + build/runtime logs | 5000 | 120 per minute | runs freely |
vercel.read-env-var | Read env vars (encrypted values only) | 1000 | 60 per minute | runs freely |
vercel.fetch-deployment-url | HTTP fetch to a Vercel deployment URL | 1000 | 60 per minute | runs freely |
vercel[preview].deploy | 200 | 10 per minute | runs freely | |
vercel[development].deploy | 200 | 10 per minute | runs freely | |
vercel[preview].env-var-write | 200 | 20 per minute | runs freely | |
vercel[development].env-var-write | 200 | 20 per minute | runs freely | |
vercel.toolbar-write | Write / edit / react on toolbar threads | 500 | 30 per minute | runs freely |
vercel.mint-bypass-token | Mint a deployment-protection bypass token | 50 | 5 per minute | runs freely |
Operator
operator — Everything a developer can do, plus production deploys, production env vars, project settings, domains and firewall — production-affecting changes asking first.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
vercel.read-account | Read account / team / project metadata | 5000 | 120 per minute | runs freely |
vercel.read-deployment | Read deployments + build/runtime logs | 5000 | 120 per minute | runs freely |
vercel.read-env-var | Read env vars (encrypted values only) | 1000 | 60 per minute | runs freely |
vercel.read-env-var-plaintext | Read env vars in plaintext (`decrypt=true`) | 20 | 5 per minute | ask me first |
vercel.fetch-deployment-url | HTTP fetch to a Vercel deployment URL | 1000 | 60 per minute | runs freely |
vercel[preview].deploy | 200 | 10 per minute | runs freely | |
vercel[development].deploy | 200 | 10 per minute | runs freely | |
vercel[prod].deploy | 50 | 5 per minute | ask me first | |
vercel[preview].env-var-write | 200 | 20 per minute | runs freely | |
vercel[development].env-var-write | 200 | 20 per minute | runs freely | |
vercel[prod].env-var-write | 50 | 5 per minute | ask me first | |
vercel.env-var-fan-out | Write env var on every env in one call (prod included) | 50 | 5 per minute | ask me first |
vercel.project-settings-write | Update project settings (framework, build cmd, node version, root dir) | 50 | 5 per minute | ask me first |
vercel.domain-write | Attach / verify / detach a custom domain | 20 | 5 per minute | ask me first |
vercel.firewall-read | Read firewall / WAF configuration | 500 | 30 per minute | runs freely |
vercel.firewall-write | Toggle the project firewall on/off | 20 | 5 per minute | ask me first |
vercel.firewall-rule-write | Create / update / remove a custom firewall rule | 50 | 10 per minute | ask me first |
vercel.ip-rule-write | Add / remove an IP blocking rule | 100 | 20 per minute | ask me first |
vercel.toolbar-write | Write / edit / react on toolbar threads | 500 | 30 per minute | runs freely |
vercel.mint-bypass-token | Mint a deployment-protection bypass token | 100 | 10 per minute | runs freely |
Tools
| Tool | What it does |
|---|---|
vercel__search_vercel_documentation | Search the Vercel documentation |
vercel__deploy_to_vercel | Deploy the project |
vercel__list_projects | List projects |
vercel__get_project | Read a project |
vercel__list_deployments | List deployments |
vercel__get_deployment | Read a deployment |
vercel__get_deployment_build_logs | Read the build logs of a deployment |
vercel__get_runtime_logs | Read runtime logs |
vercel__get_access_to_vercel_url | Create a link that bypasses deployment protection |
vercel__web_fetch_vercel_url | Fetch a deployment URL |
vercel__list_teams | List teams |
vercel__check_domain_availability_and_price | Check the availability and price of a domain |
vercel__list_toolbar_threads | List toolbar comment threads |
vercel__get_toolbar_thread | Read a toolbar comment thread |
vercel__change_toolbar_thread_resolve_status | Resolve or reopen a toolbar thread |
vercel__reply_to_toolbar_thread | Reply to a toolbar thread |
vercel__edit_toolbar_message | Edit a toolbar message |
vercel__add_toolbar_reaction | React to a toolbar message |
vercel__update_project_settings | Change the settings of a project |
vercel__upsert_env_var | Set an environment variable |
vercel__list_env_vars | List environment variables |
vercel__delete_env_var | Delete an environment variable |
vercel__list_project_domains | List the domains of a project |
vercel__add_project_domain | Attach a domain to a project |
vercel__verify_project_domain | Re-check a domain of a project |
vercel__remove_project_domain | Detach a domain from a project |
vercel__get_firewall_config | Read the firewall configuration |
vercel__toggle_firewall | Turn the firewall on or off |
vercel__upsert_firewall_rule | Set a firewall rule |
vercel__remove_firewall_rule | Remove a firewall rule |
vercel__manage_ip_blocking | Change an IP blocking rule |
Health
Health: not enough reports yet. A plugin version is deemed validated by the community with at least 200 reports and 90 % of them successful, over the last 90 days, as reported by the instances whose operators turned community telemetry on. It is a community signal, not a security guarantee.