Vercel MCP

Unclaimed listing

This is a third-party listing. Vercel has not published an ownership proof naming this registry's editor, so the registry's editors maintain it. Everything below is either the vendor's own words on the vendor's pages, cited, or a measurement the researcher ran and dated.

What it is

The subject is Vercel MCP, which the vendor calls "Vercel's official MCP server. It's a remote MCP with OAuth that gives AI tools secure access to your Vercel projects", served at https://mcp.vercel.com. The vendor says it enables an assistant to "Search and navigate Vercel documentation", "Manage projects and deployments", "Analyze deployment logs", and "Query visitors, page views, and custom events".

The page says the tools split into "public tools (available without authentication) and authenticated tools (requiring Vercel authentication)". Its security guidance says "Connecting to Vercel MCP grants the AI system you're using the same access as your Vercel user account", warns about prompt injection, and recommends human confirmation for changes. Its Markdown rendering omits the HTML's clause "your use is subject to Vercel's AI Product Terms" (2026-10-11, appendix (W3)).

The server's OAuth protected-resource metadata (/.well-known/oauth-protected-resource) names the resource Vercel MCP, the authorization server https://vercel.com, and the scope openid.

Can an agent use it without an account? (measured)

No, as of 2026-09-26 at 12:06Z. Yes for one day, 2026-09-25, from two containers. No before that: for initialize on 2026-09-12 and 2026-09-17, and for tools/list and the same tools/call on 2026-09-21.

What the cell means. noAccountNeeded states the most recent measurement of the claimed job's own request; agentAccess.notes carries the dated series, including the readings that disagree with the cell. A day of 200 between two runs of 401 is a window, and the registry has no value for "sometimes": the honest cell is the latest reading with the series beside it.

On 2026-09-26 at 12:06Z, with no credentials, no cookie and no session, from a cloud IP, the researcher sent the same four request shapes to https://mcp.vercel.com/ and every one answered HTTP/2 401 with the www-authenticate: Bearer error="invalid_token" challenge and the 73-byte JSON error body (transcript): initialize twice, 22 seconds apart, a sessionless tools/list, and the tools/call of search_vercel_documentation, topic routing, filed as p-20260926-vercel-mcp-doc-tool-anonymous. The protected-resource metadata still answers 200, unchanged. The registry's merger read the same 401 on the same shapes from its own container at 10:13Z and reopened issue #162. So the claimed job did not run for a caller with no account today.

The day it answered. On 2026-09-25 at 18:03Z, same conditions, the researcher sent the four shapes and every one answered HTTP/2 200 with no www-authenticate header (transcript): initialize twice; a sessionless tools/list returning 46 tools, search_vercel_documentation first, then the project, deployment, log, analytics, domain and buy_* tools; and the tools/call of the documentation tool, which returned text beginning "### Move Route After Another Route", filed as p-20260925-vercel-mcp-doc-tool-anonymous. That is why version 3 set noAccountNeeded to true.

The merger measured the same four shapes as 200 from its container at 10:11Z, 16:08Z and 22:04Z that day (issue #162), so the window was neither one client's nonce nor one client's policy. No vendor page or changelog entry read on either day mentions it.

On 09-25 the server said which tools are public, and the vendor's pages still do not. That day's initialize result carried an instructions string opening: "Documentation, CLI guidance, and domain search, availability, and pricing are public. Account tools and purchases require sign-in. Complete OAuth when challenged and retry the same tool on this connection." It is the only place the split has been stated tool by tool. The MCP page still promises "two main categories: public tools (available without authentication) and authenticated tools" and links the tools reference. auth stays oauth, how the vendor documents the credentialed half.

The earlier readings, still standing as dated measurements: on 2026-09-12 and 2026-09-17 (p-20260917-vercel-mcp-unauthenticated) a keyless initialize answered 401 with the same challenge; on 2026-09-21 a bare tools/list (p-20260921-vercel-mcp-tools-list-anonymous) and the documentation call (p-20260921-vercel-mcp-doc-tool-anonymous) each answered 401.

Not measured, by choice: no account, purchase or domain tool was called, so where the keyless surface ends is the server's claim, not a measurement. A keyless GET https://api.vercel.com/v2/user answered 403 with {"error":{"code":"forbidden","message":"The request is missing an authentication token","missingToken":true}} on 2026-09-17 (p-20260917-vercel-mcp-unauthenticated).

Agent-facing surfaces beyond the MCP server (the vendor's, read 2026-09-21)

Vercel publishes an experimental machine-readable catalog of its agent surfaces at /.well-known/ai-catalog.json, specVersion 1.0, four entries with urn:air:vercel.com: identifiers: the MCP OAuth metadata, the REST API's OpenAPI description, the agent-resources documentation in Markdown and a documentation graph. llms.txt links it; only the OAuth metadata and the OpenAPI document's status were fetched.

Every documentation page is also served as Markdown at a .md path. The vendor also ships Vercel Skills and a plugin for coding agents. No skill was installed or run.

Purchases the server makes on a team's behalf (the vendor's, read 2026-09-22, re-read 2026-10-11)

A correction first, the researcher's omission. The 2026-09-21 head named six of the tools page's eleven groups and not Purchase; the changelog entry "Vercel MCP now supports purchases" is dated July 21, 2026, before the read. The reviewer found it.

What the page says, in the vendor's words. On 2026-10-11 the tools reference is an index of groups, and the Purchase tools live on its Billing and Purchases page, which opens: "You can purchase credits and domains, add supported add-ons, or upgrade a team to Pro." Withdrawn, on no vendor page read that day: the September sentences "make purchases on behalf of a team. Charges go to the team's payment method immediately and are non-refundable" and "are being rolled out gradually" (in the researcher's 2026-09-26 archive; the search is appendix (W5) of the record's artifact). Every purchase runs the same quote-then-confirm flow: get_purchase_quote "is read-only and nothing is charged", "Charges are immediate and non-refundable", and returns the cost where Vercel can quote one, the applicable spend limit, and an idempotencyKey that "is a signed token of the quoted terms"; the matching buy_* tool is then called with confirm: true, the same parameters and that key. Quotes "expire after 5 minutes". The vendor states four guarantees: the same key twice "does not create a second charge"; a confirmation whose parameters do not match the quote is rejected; if no payment method is on file "nothing is charged" and the response carries a billingUrl to add one; a successful confirmation returns a billingUrl and a proofUrl.

The four buy_* tools, and what each commits a team to. buy_pro "starts recurring Pro billing immediately at the standard Pro price", and because "Vercel's API doesn't return the Pro subscription price" the quote carries a link to the pricing page instead of a number. buy_credits buys prepaid credits for v0, AI Gateway or Vercel Agent, "in whole US dollars (1–1000)", with plan prerequisites the vendor names (Agent credits need Pro, v0 credits need a paid v0 plan, AI Gateway credits need neither). buy_addon buys units of siem: "Only siem is available today". buy_domain registers one domain: the quote returns a live purchasePrice, the confirm step "must echo that price back as expectedPrice", "the order is rejected if the live price no longer matches", the registration term is priced in the quote and required at confirm, and the "full registrant (contact) details" are supplied on every confirm (the September reason is gone from the page). get_domain_order reads the asynchronous order's status.

One place the vendor disagrees with itself. The Billing page says the SIEM add-on requires that "the team must be on the Flex plan"; the changelog announcing the same tool says it "requires an Enterprise plan". Recorded as the vendor's inconsistency, not resolved here: no account was held and neither claim was tested.

Nothing in this section was exercised. No OAuth flow was completed, no quote was requested, no buy_* tool was called and nothing was bought. Every sentence above is the vendor's claim about its own product; the only requests measured on this endpoint are the keyless ones in the access section, none of them a purchase tool.

Pricing and terms

Freemium. The plans page names three: Hobby, free; Pro, "a flexible credit-based system that provides transparent, usage-based billing"; and Enterprise. The pricing page prices by usage: "Pro teams get a monthly usage credit instead, then move to on-demand pricing", team seats at "$20 / month per additional paid seat", and unit tables. Read as Markdown, which is what this registry's gate and the agent strings measured on 2026-10-11 receive (Vercel's recognition rule is unpublished), the page lacks the build machine table a browser is shown and states the bulk-redirect and Global Config prices differently from the HTML (p-20261011-vercel-docs-pricing-markdown-lacks-builds-table, 2026-10-11). The MCP server carries no separate price on any page read; a tool call is billed as the underlying Vercel product.

The vendor is Vercel Inc., from its AI Product Terms. Prices and terms are the vendor's, read 2026-09-21.

How payment works

Nothing an agent can pay for. No surface read here prices an agent call and no request here drew a 402. The keyless documentation request answered 200 on 2026-09-25 and 401 Bearer on 2026-09-26; the account tools are gated by OAuth per the server. Neither is a price, so machinePayable is false with an empty protocol list.

The money this tool moves goes the other way, and that is why the enum stays false. The Purchase tools let an authenticated agent spend, against a card a human already put on the team, with no price ever quoted to the machine for the call itself. machinePayable records whether a machine can pay this tool for access, not whether this tool can spend a human's money on a machine's say-so; on that second question the vendor's documentation says yes. methods is empty for the same reason: no method here is one a machine presents.

For a human, the vendor is unusually direct, and the two paid tiers differ. The Pro billing FAQ answers its own question "What payment methods are available?" with "Credit/Debit card only". Asked "Can I pay by invoice?", the same page answers "Yes. If you have a card on file, Vercel will charge it automatically", which is a receipt against a card rather than an invoice to remit. The Enterprise billing FAQ lists two methods, "Credit card" and "ACH/Wire", and says a card payment is taken "When the invoice is finalized in Stripe". So humanBilling is card-on-file, exactly true of the self-serve tier and the default of the other; ACH and wire exist only on Enterprise and are recorded here, not in the enum.

Jobs

Two claimed as the vendor's claim; the first is also measured, with the keyless result differing by day, the second is not.

eng.retrieve-reference-context, on the Vercel MCP page: the server lets an assistant "Search and navigate Vercel documentation". The vendor's words cover retrieval of Vercel's own documentation into an assistant's context, and nothing wider. Measured both ways: a keyless tools/call of search_vercel_documentation returned documentation sections with source URLs on 2026-09-25 (p-20260925-vercel-mcp-doc-tool-anonymous) and answered 401 on 2026-09-21 and 2026-09-26 (p-20260926-vercel-mcp-doc-tool-anonymous). One topic, one request per day; whether the search is current or complete is not measured.

proc.purchase-on-behalf, on the Billing and Purchases page: "You can purchase credits and domains, add supported add-ons, or upgrade a team to Pro", "Charges are immediate and non-refundable", and the tools reach a completed, charged order (buy_credits and buy_pro charge on confirmation; buy_domain returns an orderId whose status get_domain_order reads). The job's definition claims it for a vendor that "says the agent path reaches checkout completion or a confirmed-order handoff" and records prerequisites (an account, a token, a granted purchase permission) in agentAccess and the profile rather than as a reason to withhold the claim, so the OAuth gate and the vendor's "team role with billing access" sit there. The vendor's claim; nothing was bought, and the catalogue is Vercel's own product list.

Not claimed: the project, deployment, log, analytics, Access, Design import, Toolbar, CLI, Domain and Agent Runs Observability tool groups have no job in the current taxonomy whose whole outcome the vendor's words cover; the profile records the capability and the empty cell.

Empty cells kept empty

No proof: unclaimed. source is null: the hosted server's code is not published on a page read. Not measured: any authenticated tool, the account, deployment, log, analytics, domain and toolbar tools, rate limits, the skills and plugin, and every Purchase tool, including the read-only get_purchase_quote. Not established: when between 09-21 and 09-25 the keyless surface opened, when between 22:04Z on 09-25 and 10:13Z on 09-26 it closed, and whether either was deliberate (no vendor page or changelog entry read says); whether the SIEM add-on wants the Flex plan or Enterprise; the default spend limit; why the MCP page promises a public category its tools reference does not mark; and the vendor's own view of this listing.

Revisions: version 6 (2026-10-12) links the plans page the Pro sentence quotes; version 5 (2026-10-11) re-bases the Purchase quotations on the Billing and Purchases page, withdraws three September sentences the vendor no longer publishes, re-sources the purchase job, and records the pricing page's Markdown gaps; version 4 (2026-09-26) sets noAccountNeeded back to false on the researcher's own 12:06Z readings after the merger reopened issue #162, keeping 09-25 as a dated exception; version 3 (2026-09-25) had set it true on that day's measurement (issue #162); version 2 (2026-09-22) added the Purchase tools and payments block; version 1 (2026-09-12) filed it.