🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP
Sign In

@mastra/vercel

Package Overview
Dependencies
Maintainers
7
Versions
175
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install
This package has malicious versions linked to the ongoing "Mastra AI framework compromise" supply chain attack.

Affected versions:

1.0.1
View campaign page

@mastra/vercel

Vercel serverless sandbox provider for Mastra workspaces

latest
Source
npmnpm
Version
1.2.0
Version published
Weekly downloads
3K
27.99%
Maintainers
7
Weekly downloads
 
Created
Source

@mastra/vercel

Vercel workspace sandbox providers for Mastra.

This package exposes two Vercel-backed sandbox implementations:

  • VercelSandbox runs commands in a Vercel Sandbox (MicroVM).
  • VercelServerlessSandbox runs commands as stateless Vercel Functions.

Use VercelSandbox when you need a Linux environment with a filesystem, exposed ports, or background processes. Use VercelServerlessSandbox when you need short-lived, stateless command execution backed by Vercel Functions.

Installation

npm install @mastra/vercel

VercelSandbox

VercelSandbox executes commands inside Vercel Sandbox, an ephemeral Firecracker MicroVM running Amazon Linux 2023.

Use it when your agent or workflow needs:

  • a Linux filesystem for the sandbox session
  • sudo access
  • exposed ports for preview servers
  • background processes
  • command execution with streamed output
import { Workspace } from '@mastra/core/workspace';
import { VercelSandbox } from '@mastra/vercel';

const workspace = new Workspace({
  sandbox: new VercelSandbox({
    runtime: 'node24',
    timeout: 600_000,
  }),
});

const result = await workspace.sandbox.executeCommand('node', ['--version']);
console.log(result.stdout);

Authentication

When Vercel OIDC is available, VercelSandbox can authenticate automatically. Outside an OIDC environment, provide Vercel credentials directly or through environment variables:

export VERCEL_TOKEN="..."
export VERCEL_TEAM_ID="team_..."
export VERCEL_PROJECT_ID="prj_..."
const sandbox = new VercelSandbox({
  token: process.env.VERCEL_TOKEN,
  teamId: process.env.VERCEL_TEAM_ID,
  projectId: process.env.VERCEL_PROJECT_ID,
});

Resources and exposed ports

Use resources.vcpus to request CPU capacity and ports to expose services from the sandbox.

const sandbox = new VercelSandbox({
  resources: { vcpus: 4 },
  ports: [3000],
});

await sandbox.start();
await sandbox.executeCommand('npm', ['run', 'dev'], { background: true });

const info = await sandbox.getInfo();
console.log(info.metadata.domains);

Vercel supports up to 8 vCPUs and up to 4 exposed ports per sandbox. Memory is allocated at 2048 MB per vCPU.

Streaming command output

const result = await sandbox.executeCommand('npm', ['test'], {
  onStdout: chunk => process.stdout.write(chunk),
  onStderr: chunk => process.stderr.write(chunk),
});

console.log(result.exitCode);

Background processes

VercelSandbox includes VercelSandboxProcessManager, so you can start and manage background processes.

const process = await sandbox.processes.spawn('npm run dev');

console.log(process.pid);

await process.kill();

Options

OptionTypeDefaultDescription
idstringgeneratedUnique identifier for this sandbox instance.
sandboxNamestringgenerated by VercelOptional sandbox name passed to the Vercel API.
tokenstringVERCEL_TOKENVercel API token. Omit when OIDC authentication is available.
teamIdstringVERCEL_TEAM_IDVercel team ID.
projectIdstringVERCEL_PROJECT_IDVercel project ID.
runtime'node24' | 'node22' | 'node26' | 'python3.13''node24'Sandbox runtime.
timeoutnumber300_000Timeout in milliseconds before the sandbox auto-terminates.
resources{ vcpus?: number }undefinedResources to allocate.
portsnumber[]undefinedPorts to expose from the sandbox.
envRecord<string, string>{}Default environment variables inherited by all commands.
metadataRecord<string, unknown>{}Custom metadata surfaced by getInfo().
instructionsstring | (opts) => stringdefault instructionsCustom instructions returned by getInstructions().

VercelServerlessSandbox

VercelServerlessSandbox executes commands as Vercel serverless Functions. It deploys an executor function and invokes it over HTTP.

Use it when you want short-lived command execution without managing infrastructure.

import { Workspace } from '@mastra/core/workspace';
import { VercelServerlessSandbox } from '@mastra/vercel';

const workspace = new Workspace({
  sandbox: new VercelServerlessSandbox({
    token: process.env.VERCEL_TOKEN,
    teamId: process.env.VERCEL_TEAM_ID,
    regions: ['iad1'],
    maxDuration: 60,
    memory: 1024,
  }),
});

const result = await workspace.sandbox.executeCommand('node', ['--version']);
console.log(result.stdout);

Authentication

VercelServerlessSandbox requires a Vercel API token. Pass token or set VERCEL_TOKEN.

export VERCEL_TOKEN="..."
const sandbox = new VercelServerlessSandbox({
  token: process.env.VERCEL_TOKEN,
  teamId: process.env.VERCEL_TEAM_ID,
});

Options

OptionTypeDefaultDescription
tokenstringVERCEL_TOKENVercel API token.
teamIdstringundefinedVercel team ID for team-scoped deployments.
projectNamestringgeneratedExisting Vercel project name. Auto-generated if omitted.
regionsstring[]['iad1']Deployment regions.
maxDurationnumber60Function max duration in seconds.
memorynumber1024Function memory in MB.
envRecord<string, string>{}Environment variables baked into the deployed function.
commandTimeoutnumber55_000Per-invocation command timeout in milliseconds.
instructionsstring | (opts) => stringdefault instructionsCustom instructions returned by getInstructions().

Limitations

VercelServerlessSandbox is stateless. It doesn't provide:

  • a persistent filesystem
  • an interactive shell
  • long-running background processes
  • mounted directories

Only /tmp is writable during a function invocation.

Editor provider descriptors

Use the provider descriptors when registering Vercel sandboxes with the Mastra editor.

import { MastraEditor } from '@mastra/core/editor';
import { vercelSandboxProvider, vercelServerlessSandboxProvider } from '@mastra/vercel';

const editor = new MastraEditor({
  sandboxes: [vercelSandboxProvider, vercelServerlessSandboxProvider],
});
ProviderIDCreates
vercelSandboxProvidervercel-sandboxVercelSandbox
vercelServerlessSandboxProvidervercel-serverlessVercelServerlessSandbox

FAQs

Package last updated on 01 Jul 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts