Vercel Ship 26: Agents Get Logins, Event Triggers, and Budgets

Deployments triggered by agents on Vercel increased 28-fold over the past year, CEO Guillermo Rauch said at Vercel Ship 26 in San Francisco on October 16.

Most of the announcements focused on what happens after an agent starts running. It needs permission to act for a user, a way to react to changes, storage for files and learned information, and limits on what it can spend.

Here's what Vercel announced, who can use each feature, what it costs where pricing is available, and what I'd try first.

What shipped and who can use it

The short version: the pieces that let agents log in and get notified are ready today, the background workers are still in beta, and two of the pricing details matter more than they look.

Vercel Connect gives agents a login

Say you build an agent that reads a Linear issue and posts a summary in Slack. The prompt takes an afternoon. Then you hit the boring part: the agent needs an OAuth token for Linear and another for Slack, someone has to store them, they expire, and the agent should only get the permissions it actually needs.

What a lot of projects do instead is paste a long-lived token into an environment variable and move on. Now the agent's process can read a credential that works for months, which is the last thing you want sitting next to something that takes instructions from text it found on the internet.

Vercel Connect takes that job off your hands. Your app asks Connect for a token with the scopes it needs, and Connect does the OAuth exchange, keeps the token, caches it and renews it. Vercel opened it as a public preview at Ship London. It's now generally available, with more than 1,000 connectors across OAuth, MCP and API-key services, and the catalog flags which ones are still experimental.

Read next: The Race to Make Personal AI Work

Recommended

Recommended

The Race to Make Personal AI Work

I tried using the Instacart app in ChatGPT today. It didn’t really work. After spending more time on it than I wanted to, I gave up and did the shopping myself. I wanted it to work. Ordering groceries is exactly the kind…

Read next

Enterprise-Managed Authorization removes consent prompts

Inside a company, the token problem has a second layer.

Picture an internal agent that works across Slack, GitHub and Notion. Normally every employee clicks through three separate "Allow access" screens, and when someone leaves, IT has to hunt down each of those grants to revoke them.

Enterprise-Managed Authorization, in public beta, moves that decision to the identity provider the company already uses for sign-in, such as Okta. Employees sign into the app with their work account. Admins grant or pull access to supported services in one place. The app still asks for specific scopes, and whatever token comes back can't do more than those scopes allow, or more than that employee could already do in the service.

Think of it as a building badge. Instead of signing a visitor log at every office door, you badge in once and the doors you're allowed through open. Technically, it's built on Cross-App Access, an IETF draft standard where the identity provider vouches for the user to the other service, so that service can issue a token without asking the user again.

In Vercel's example, an app gets a token for Slack's MCP server using whoever is signed in:

import 'server-only';

import { getToken } from '@vercel/connect';
import { requireIdentity } from '@vercel/passport';

export async function getResourceToken(scopes: string[]) {
  const identity = await requireIdentity();
  return getToken('oauth/resource', { subject: identity, scopes });
}

The identity comes from Vercel Passport, which tells you who this is for: companies building internal tools, not someone wiring up a side project on a Saturday.

Connect also picked up Secure Compute routing, which solves a very specific headache. Salesforce and Snowflake customers often lock their accounts to a short list of approved IP addresses, and Connect's shared IPs aren't on it. With routing turned on, Connect sends its token requests out through your Secure Compute network's static IPs instead.

The detail I like is what happens when that network is down. Connect doesn't fall back to its shared addresses. The request just fails. That's annoying for about a minute, and it's the right call: the whole point of an allowlist is that traffic never comes from somewhere your security team didn't approve.

MCP Events let agents react instead of polling

Most agents find out about changes the way a kid in the back seat finds out about the trip: "Are we there yet?" Any new issues? Any new messages? Anything since five minutes ago? Most of the time the answer is no, so you're paying for requests that return nothing. And when something does happen, the agent only notices on its next check.

MCP Events, in public beta through Connect, lets the agent stop asking. It subscribes to an event on an MCP server that supports them, say "an issue was created," and Connect calls your app's webhook when it happens.

Connect also handles the parts that usually go wrong with webhooks. It registers the subscription with the server, renews it before it lapses, checks that incoming webhooks really came from that server, and forwards each event to you with authenticated delivery. Here's a subscription to new issues that lasts 24 hours:

import { experimental_subscribe } from '@vercel/connect/mcp';

export async function subscribeToIssues(idempotencyKey: string) {
  return experimental_subscribe('oauth/issues', {
    tokenParams: { subject: { type: 'app' } },
    name: 'issue.created',
    arguments: { project_id: 'ABC' },
    destination: { path: '/hooks' },
    ttlMs: 24 * 60 * 60 * 1000,
    idempotencyKey,
  });
}

On the receiving end, call experimental_verifyMcpEvent before acting on anything, so a forged request can't trigger your agent. And take the experimental_ prefix at its word: Vercel is telling you the API can still change.

The same subscriptions show up as tools in the AI SDK and in eve, Vercel's open-source agent framework, so an agent can look at what events a server offers and subscribe on its own. Vercel isn't the only one betting on this, either. Cloudflare's MCP server started pushing Workers errors to subscribed agents as MCP Events this month.

Drives and eve memory store different kinds of state

Two announcements addressed persistent state, but they solve different problems.

Drives are for files. A Drive is a directory mounted inside a Vercel Sandbox, and its contents stay put after the sandbox stops. The next run, or a different sandbox, can mount the same Drive and pick up where the last one left off, so an agent doesn't re-clone the repo and reinstall dependencies every time it wakes up.

eve memory is for what an agent learns. Memories live in named slots defined by files under agent/memory/. Each slot has a provider, which stores and retrieves the memory, and a scope, which decides who shares it, such as one set of memories per signed-in user.

Before each turn, eve pulls the relevant memories into the model's context. Depending on the provider, memories get updated automatically after a turn, through tools the agent calls, or both. Deployed on Vercel, the built-in file provider keeps memories in a private Vercel Blob store, so they survive restarts and deploys. Supermemory, Upstash AgentKit and Kybernesis Arcana are supported too, and you can write your own provider.

eve also gained extensions for installing tools and skills, plus a way to create and deploy agents from the Vercel dashboard.

Daemons and Python run the work behind an agent

Not all agent work starts with an HTTP request. A worker pulls a job off a queue, finishes it and asks for the next one. Until now, that kind of always-on process usually had to live somewhere other than Vercel.

Vercel Daemons, in public beta, runs those workers. You deploy code or a container image, pick how many instances to keep in each region, and Vercel restarts any that exit or crash. The first release supports pull-based workloads like queue consumers, database job pollers, Celery and Dramatiq workers, and Temporal workers. CPU and memory metrics require Observability Plus.

I couldn't find Daemons pricing on the changelog or the product page. That's the number I'd want before moving an existing worker fleet.

Python is also generally available. FastAPI, Flask and Django run on standard CPython with PyPI dependencies, uv and pyproject.toml, and Vercel says 150,000 teams already run Python backends there. If your agent's tools or MCP servers are written in Python, they can now live in the same Vercel project as the frontend.

AI Gateway budgets are soft caps

AI Gateway now supports spending budgets for a team, project, API key or individual team member. Once a budget is exceeded, the gateway rejects new requests that use Vercel's system credentials.

Two details matter if you're counting on a budget to stop a runaway agent. Vercel calls them soft caps, so requests already in flight can push spending past the limit. And spend through your own provider keys is metered separately and doesn't count at all. If an agent calls Anthropic or OpenAI through the gateway with your own key, the budget won't stop it.

AI Gateway also added US-only inference, which keeps model processing in the United States, alongside its existing Zero Data Retention setting.

Token Pass is a separate prepaid plan in early access. Pro teams pay $30 a month for $80 in GLM 5.3 and Kimi K3 credit, and unlike the budgets, it stops when the credit runs out.

Shopify's engineers call themselves verification engineers

Shopify CEO Tobi Lütke described how his engineers work during the closing conversation with Rauch.

"We now think of ourselves as verification engineers," he said, "building harnesses and acceptance tests that make changes verifiable."

Shopify is rewriting its storefront renderer from Ruby to Rust and comparing the output byte for byte before switching over. At a company hackathon, its internal Slack agent, River, topped the code-deletion leaderboard.

That ties the rest of the announcements together. Connect, events, Drives and budgets all let agents do more without someone watching. None of them tell you whether the agent's work was right. That still has to come from somewhere, and Shopify's answer is to write the tests first.

What to try first

None of these need a migration, and each one tells you something within a day.

Kill one polling loop. Find the agent that checks GitHub, Linear or Slack every few minutes. Swap that loop for an MCP Events subscription with a 24-hour TTL, run both side by side for a day, and look at two numbers: how many requests the old loop made for nothing, and how much sooner the new one reacted.

Give one sandboxed agent a Drive. Pick the one that clones a repo and installs its dependencies every time it starts, which is probably the slowest part of its day. Time a cold start, mount a Drive, and time it again.

Put a budget on every key you've handed an agent, then check which calls it doesn't see. Set the budget first. Then look for any calls that go through your own Anthropic or OpenAI keys, because those skip the budget entirely, and that's the spend that will surprise you on a bad night.

Sources

• Vercel Ship 2026 recap, Vercel
• Vercel Connect, Vercel
• Vercel Connect adds Enterprise-Managed Authorization, Vercel
• Vercel Connect now supports Secure Compute, Vercel
• MCP Events support in Vercel Connect is now in public beta, Vercel
• Vercel Drives is now generally available, Vercel
• Persistent memory for eve agents, Vercel
• Backends on Vercel: Python, containers, and Daemons, Vercel
• Vercel Daemons is now in public beta, Vercel
• Vercel AI Gateway documentation, Vercel
• Introducing Token Pass, Vercel
• Bring Your Own Cloud on AWS is now generally available, Vercel
• Identity Assertion Authorization Grant (Cross-App Access), IETF draft
• Cloudflare AI changelog, Cloudflare