Summary: A demo agent comes together easily: pick a model, attach a few tools, wrap it in a chat box. Multi-model teams thus get a routing layer that is no cost center in itself — the only remaining risk is choosing the wrong expensive model. On June 17, Vercel answered with the Agent Stack, arranged into three core capabilities: connect to models, execute complex workflows, and connect to data and tools.
A demo agent comes together easily: pick a model, attach a few tools, wrap it in a chat box. The list balloons the moment production enters the picture — a provider can vanish mid-run, a task an hour in can collapse at step nine, code you cannot trust has to be walled off somewhere to execute, and Slack, GitHub, and the company’s data systems all have to sit within the agent’s reach.
On June 17, Vercel answered with the Agent Stack, arranged into three core capabilities: connect to models, execute complex workflows, and connect to data and tools. The pitch is plain — here are the building blocks for creating and shipping production-grade agents — no lock-in to one vendor, and no abstraction layer you have to hand-roll yourself.
Six products across three layers, each in its place
| Layer | Products | What it solves |
|---|---|---|
| Connect to models | AI SDK, AI Gateway | Any model callable through one interface; hundreds of models routed via one endpoint |
| Execute workflows | Workflow SDK, Vercel Sandbox | Long tasks built to survive failure; an isolated VM for every agent |
| Connect to data and tools | Vercel Connect, Chat SDK | Short-lived, scoped entry into internal systems; agents shipped into the apps users already use |
That two-products-per-layer symmetry carries a point — every layer couples an interface to a platform. AI Gateway is the platform beneath the interface of the AI SDK; the execution is what Workflow SDK defines, the compute what Sandbox supplies; delivery is Chat SDK’s to handle, permissions are Connect’s.
Layer one — Connect to models: AI SDK with AI Gateway
Any model becomes callable through the single interface the AI SDK hands the agent; distributing traffic over hundreds of models falls to AI Gateway, all from one endpoint. Vercel’s nickname for the Gateway is a “CDN for tokens”: the service sits on a global network Vercel has kept running for over a decade, every call travels through one and the same endpoint, a broken provider triggers failover on its own, and cost and usage are followed across every provider.
Pricing merits a second look: the provider’s rate passes through with zero markup, and your own keys work too. Multi-model teams thus get a routing layer that is no cost center in itself — the only remaining risk is choosing the wrong expensive model.
One showcase grounds it: SERHANT, a property-technology company, keeps three models running on one key — Claude draws market analysis, GPT the marketing copy, and Gemini the image generation. This is where abstracting the model layer pays off: routing by task no longer has to shape itself around any single vendor’s account layout.
Still, a unified interface is not itself a routing strategy. Classification gets by on a cheap model; high-stakes decisions may not. Connectivity and switching are the Gateway’s territory — the quality bar stays with the team.
Layer two — Execute workflows: Workflow SDK plus Vercel Sandbox
Workflow SDK lends agent runs durability: every step of every job is checkpointed, state is kept, failures are retried; a run can pause for a human approval, a slow API, or a webhook, then resume from the last step that succeeded rather than starting over. When a task runs for hours, this is what decides whether model costs and external side effects are paid for twice.
The numbers case is FLORA: its creative agent sits on the Workflow SDK; from one creative session the work can fan out to over fifty image models, with persistence at every step and a retry whenever one fails.
Vercel Sandbox covers the other half: every agent receives a microVM of its own — a full Linux computer with its own filesystem and kernel, Docker support included, sealed away from the host and from each sibling sandbox. The security model turns on credentials: injection happens only when the agent’s code actually invokes a service, so the service is usable while a raw token never shows itself. Vercel points out that its billion preview deployments and its six million daily builds rest on this same primitive — the isolation layer is infrastructure already in service, not a coined marketing term.
Idempotency remains the standing question: wherever payments or emails go out as side effects, the workflow persists state but leaves deduplication to you; any retry still requires operation keys spelled out and an audit trail to match.
Layer three — Connect to data and tools: Vercel Connect alongside Chat SDK
The newest arrival here is Vercel Connect, a public beta: wire each system in once, and from then on the agent issues a short-lived token per task, scoped to no more than the permissions explicitly granted — an intentional departure from the long-lived, wide-permission tokens of old. Slack, GitHub, Snowflake, Salesforce, Notion, and Linear are supported natively; other services arrive via OAuth or an API.
Delivery belongs to Chat SDK: from one codebase, the agent is carried into apps its users already occupy. NanoClaw is the case — one agent present on more than 12 channels, conversations moving out of Slack and into GitHub or Linear with context unbroken.
Permissions gain a time dimension on this layer — that is the thread tying it together: tokens that expire quickly, scopes spelled out precisely, so an audit log can trace every sensitive action. Each added connection raises the weight of this line.
eve: all three layers inside one directory
For teams unwilling to wire the layers by hand, Vercel hands over eve — opinionated, open source, a framework that pulls the whole Agent Stack into a single directory.
agent/
agent.ts # the model it runs on
instructions.md # who it is
tools/ # what it can do
skills/ # what it knows
subagents/ # who it delegates to
channels/ # where it lives
schedules/ # when it acts on its ownDurability, sandbox, approvals, and delivery come connected underneath; what is left for the team to write is the agent alone — instructions authored in markdown, tools in TypeScript. eve, too, sits in public beta right now.
The trade-offs, and a builder’s checklist
Six pieces on one platform spare teams that already run on Vercel a pile of wiring; the price: observability, state, and deployment settings all sink deeper roots into one environment. Where vendor risk weighs heavily, eve’s open source is the counterweight — the interface spanning all three layers keeps a reference implementation that travels.
And if none of the products gets adopted, the Agent Stack still functions as a checklist:
- Model layer: does swapping a model take just one line? Does a dead provider trigger failover?
- Execution layer: if a long task stops at step N, can the run pick up at step N? And where is untrusted code supposed to execute?
- Connection layer: are the tokens given to external systems short-lived, or long-lived and wide? Do sensitive actions leave an audit entry apiece?
Six questions spread over three layers — whichever box you cannot answer marks the gap where your next investment belongs.