Vercel MCP Server: Install, Tools and Safety

Vercel MCP is Vercel's official remote MCP server, at https://mcp.vercel.com. You sign in with OAuth, and your AI tool can search Vercel docs, manage projects and deployments, read logs and query Web Analytics. There is nothing to run locally. Vercel only supports MCP clients it has reviewed and approved. We checked it on 31 October 2026.

Quick facts

A warning about names. A search for "vercel mcp" returns community repositories, such as Quegenx/vercel-mcp-server, that are not Vercel's. This page is about the official hosted server.

What it does

The server turns the Vercel dashboard and much of its API into tools. A typical question is "why did my last deployment fail?" The agent lists your teams and projects, lists deployments, reads the failed one, pulls the build or runtime logs, and tells you the error. You never leave the editor.

Vercel's own summary is four jobs: search and navigate documentation, manage projects and deployments, analyse deployment logs, and query visitors, page views and custom events.

The docs also say the server can deploy code and now supports purchases, according to changelog posts linked from the page. Read those two as signs of how much power the connection has: it is not read-only by nature. The tools reference lists a Billing and Purchases category of 5 tools and says each tool still needs the relevant OAuth grant and Vercel permissions. Neither page says how individual deploy or purchase calls are confirmed, so turn on human confirmation in your client, as Vercel advises.

The tool categories

The tools reference lists 25 categories. We show the biggest ones.

The reference says it covers 217 catalog tools and 31 workflow or widget tools, and that availability depends on server configuration, client support, and your team or project scope. A listed tool still needs the right OAuth grant and your normal Vercel permissions.

The tools to start with

Vercel's own "frequently used" list is the place to begin:

What it will not do

The catalog excludes endpoints that need unsupported credentials. It does not create AI Gateway API keys, exchange SSO tokens, import KMS private keys, or sign KMS messages or tokens. Use the dashboard or the CLI for those. Also, MCP and the CLI use separate authentication, so a working CLI does not prove your MCP grant has the same access.

Install it

The one-line route configures every detected client:

npx -y add-mcp https://mcp.vercel.com -g

Without -g it installs for the current project. Add -y to skip the confirmation prompt. You can also pick a client, for example npx add-mcp https://mcp.vercel.com -a opencode.

Adding the server does not complete authorisation. The client must walk you through a browser sign-in, and you then choose which teams it may work with. Afterwards, ask the assistant to list your teams and projects to confirm access.

Install it in each agent

Vercel documents all five of ours except Antigravity. Lines below come from Vercel's docs unless we say otherwise.

Claude Code

claude mcp add --transport http vercel https://mcp.vercel.com

Then start claude and type /mcp to authenticate the server.

Codex

codex mcp add vercel --url https://mcp.vercel.com

Codex detects OAuth support and opens your browser to authorise.

Cursor

In .cursor/mcp.json, project or global:

{
  "mcpServers": {
    "vercel": {
      "url": "https://mcp.vercel.com"
    }
  }
}

Cursor shows a "Needs login" prompt. Click it to authorise.

OpenCode

npx add-mcp https://mcp.vercel.com -a opencode

or in opencode.json:

{
  "mcp": {
    "vercel": {
      "type": "remote",
      "url": "https://mcp.vercel.com"
    }
  }
}

OpenCode starts the OAuth flow when it needs to. You can also run opencode mcp auth vercel.

Antigravity

Antigravity is not on Vercel's supported client list as we read it. Vercel states that it only supports clients it has reviewed and approved, and lists Claude Code, Claude.ai and desktop, ChatGPT, Codex CLI, Cursor, VS Code with Copilot, Devin, Raycast, Goose, Windsurf, Gemini Code Assist, Gemini CLI, OpenCode and Pi. The add-mcp command also configures other HTTP clients, including Cline, Grok Build, Kimi Code, Kilo Code and Zed.

Our adaptation, which may not be accepted by Vercel's allow list: Antigravity takes serverUrl for Streamable HTTP in ~/.gemini/config/mcp_config.json:

{
  "mcpServers": {
    "vercel": {
      "serverUrl": "https://mcp.vercel.com"
    }
  }
}

Vercel only supports clients it has reviewed and approved, and Antigravity is not on its supported list as of its 15 September 2026 update, so the Antigravity config above may be refused. Gemini CLI is now for Code Assist enterprise customers only, though Vercel still documents it with npx mcp-remote https://mcp.vercel.com in ~/.gemini/settings.json.

Other clients Vercel documents

VS Code with Copilot (one-click or MCP: Add Server, HTTP), Claude.ai and desktop (Settings, Connectors, Add custom connector, on Pro, Max, Team and Enterprise plans), ChatGPT (add a custom MCP server in Plugins), Devin (MCP Marketplace), Raycast, Goose, Windsurf (serverUrl in mcp_config.json) and Pi (through pi-mcp-adapter).

A diagnosis walkthrough

This is our suggested flow, built from the "frequently used" tools. We did not run it. Your last production deploy failed, and you want to know why.

1. Find the project. The agent calls list_teams, then list_projects for the team you granted. This also proves the grant works.
2. List recent deployments. list_deployments shows state and timing. Look for the first failed one, not just the latest.
3. Open the failing deployment. get_deployment returns its status and details.
4. Read the evidence. For a build failure, the deployment's details and logs show the error. For a runtime failure, get_runtime_errors groups errors by route, and get_runtime_logs lets you filter to the time window.
5. Check the live URL. web_fetch_vercel_url fetches a deployment URL, including a protected preview you can access, so the agent can see what a visitor sees.
6. Fix in code, not in the dashboard. The change belongs in your repository. Ask the agent for a patch and let your normal pull request flow trigger a new preview.

Every step is a read. The sensitive tools, such as environment variables, domains and rolling releases, stay unused, and a client that asks before every write will never reach them without you seeing it. That is the pattern we would copy for a team: read freely, write by confirmation, change code through git.

Why the approved-client rule exists

Vercel says it supports only reviewed clients "to ensure secure access". That is unusual among MCP servers, and it has a practical effect: a client you build yourself will not connect until Vercel approves it. The page links a client review form for builders.

The reason ties to OAuth. Vercel says its server blocks confused deputy attacks by requiring explicit user consent for each client connection. That stops an attacker from reusing a consent cookie to get access through a malicious authorisation request. An allow list adds a second layer: only clients Vercel has looked at get to ask.

Security notes

Vercel's own list is clear and worth repeating.

1. Connecting grants your account's access. Vercel says the connection gives the AI system the same access as your Vercel user account. Treat the grant like handing over a session.
2. Check the endpoint. The only official one is https://mcp.vercel.com. Double-check the URL when a marketplace offers one-click installs.
3. Keep human confirmation on. Vercel says to always enable it so you approve each step before it runs. Domains, environment variables, firewall rules, rolling releases and purchases are not things to auto-approve.
4. Grant only the teams you need. The OAuth step lets you choose teams. Your assistant needs access to a team before it can see that team's projects and logs, and your normal Vercel permissions still apply.
5. Prompt injection is the real threat. Vercel's example: a hostile instruction in a log or page says to copy private deployment logs to an outside address. If the agent also has a tool that can send data out, that could work. Vercel notes its MCP only operates inside your Vercel account, but any external tools you connect might share data elsewhere.
6. Logs hold secrets. Runtime logs and environment variables can contain tokens. Do not combine this server with a tool that can post to the web in the same agent.
7. Purchases exist. A changelog item says Vercel MCP now supports purchases. Keep billing tools behind confirmation.
8. Use a role. Where you can, use a Vercel team role with limited rights for the connected account.

Limits and known issues

• Approved clients only. If your client is not listed, you cannot use the server.
• Tool availability varies. It depends on server configuration, client support and team or project scope. Tools in one client may be missing in another.
• A huge catalog. 217 plus 31 tools is a lot of context for a client that loads all of them. Vercel's tools reference does not say how clients load them, and notes that some connections expose a smaller workflow tool list.
• No self-hosting. The docs describe the hosted server only.
• Separate auth from the CLI. Keep the same team and project when you switch, and inspect a resource after an uncertain write before you retry.
• Docs move. The tools reference is dated 15 September 2026. Your connection's tool list is the truth.

Alternatives

See MCP clients for how each agent handles remote OAuth servers.

Our take

We did not run this server for this page. This comes from Vercel's documentation as of 31 October 2026.

It is a well-run hosted server. OAuth with per-client consent, a reviewed client list and a security section written in plain words all point to a vendor that has thought about this. The catalog is the other side of that: 248 documented tools, including domains, environment variables, firewall rules and purchases, is a large surface to hand to an agent.

For most developers, the value is diagnosis: "why did this deploy fail?" and "what errors are users hitting?" Those need read tools only. We would use the server for that and keep every write behind a confirmation prompt. If you use Antigravity, check with Vercel's list first, because the docs name approved clients and ours is not on it.

A short setup checklist

1. Run npx -y add-mcp https://mcp.vercel.com -g, or use the line for your agent.
2. Sign in and grant one team, not all of them.
3. Ask the assistant to list your teams and projects.
4. Try a read: the last deployment's status and runtime errors.
5. Make sure confirmation is on for writes.
6. Do not pair it with a tool that can post data to the web.

Related pages

• Claude Code, one of the clients Vercel's setup covers
• Cursor, another client with a documented setup
• All add-ons, the full directory

Frequently asked questions

What is the Vercel MCP server?

It is Vercel's official remote MCP server at https://mcp.vercel.com. After an OAuth sign-in, an AI tool can search docs, manage projects and deployments, read logs and query Web Analytics.

Is it free?

Vercel says Vercel MCP is available on all plans, subject to its AI Product Terms. Actions that cost money, such as purchases, follow your account's billing.

Can I use it from any MCP client?

No. Vercel only supports clients it has reviewed and approved, and lists them. Builders can submit a client review form.

Is there a local version to install?

The documented server is the hosted one. The quick setup uses npx add-mcp to configure your clients to point at it.

How do I keep it safe?

Confirm the endpoint is mcp.vercel.com, grant access only to the teams you need, and keep human confirmation on for every write.