The agent demo formula is simple: one model, a few tools, a chat box. Production stretches that list fast — model providers go down, hour-long tasks die at step nine, untrusted code needs somewhere isolated to run, and the agent still has to reach Slack, GitHub, and the company’s data systems.
The Agent Stack Vercel announced on June 17 turns that list into three core capabilities: connect to models, execute complex workflows, and connect to data and tools. The positioning is direct — it hands you the building blocks to create and ship production-grade agents, without locking into a single vendor or hand-rolling your own abstraction layer.
The three layers: six products, each in its slot
| Layer | Products | Problem solved |
|---|---|---|
| Connect to models | AI SDK, AI Gateway | One interface to call any model; one endpoint routing hundreds of them |
| Execute workflows | Workflow SDK, Vercel Sandbox | Durable long-running tasks; an isolated VM per agent |
| Connect to data and tools | Vercel Connect, Chat SDK | Short-lived scoped access to systems; agents delivered into users’ apps |
Two products per layer is not decoration — each layer pairs an interface with a platform. The AI SDK is the interface and AI Gateway the platform; Workflow SDK defines the execution and Sandbox supplies the compute; Connect governs permissions and Chat SDK governs delivery.
Layer one — Connect to models: AI SDK and AI Gateway
The AI SDK gives an agent one interface to call any model, and AI Gateway routes across hundreds of them from a single endpoint. Vercel calls the Gateway a “CDN for tokens”: it runs on the global network Vercel has operated for over a decade, sends every call through the same endpoint, fails over when a provider goes down, and tracks cost and usage across all providers.
The pricing structure deserves attention: you pay the provider’s price with no markup, and you can use your own keys. For multi-model teams, the routing layer itself is not a cost center — the only risk left is picking the wrong expensive model.
The showcase makes it concrete: SERHANT, a real-estate technology company, runs three models from a single key — market analysis to Claude, marketing copy to GPT, image generation to Gemini. That is the practical dividend of abstracting the model layer: task-oriented routing no longer has to conform to any one vendor’s account structure.
A unified interface still is not a routing strategy. A cheap model may be fine for classification and wrong for high-stakes decisions; the Gateway solves connectivity and failover, not your quality bar.
Layer two — Execute workflows: Workflow SDK and Vercel Sandbox
Workflow SDK makes agent runs durable: it checkpoints every step of every job, keeps state, retries what fails, pauses for human approvals, slow APIs, or webhooks, and resumes from the last successful step instead of restarting from zero. For tasks that run for hours, that alone decides whether you pay for model calls and side effects twice.
FLORA is the numbers case: its creative agent is built on the Workflow SDK, and a single creative session fans out across more than fifty image models, each step persisted and retried on failure.
Vercel Sandbox handles the other half: each agent gets its own microVM — a full Linux computer with a filesystem, Docker support, and its own kernel, isolated from the host and every other sandbox. The security design centers on credentials: they are injected only when the agent’s code calls a service, so the agent can use a service while never seeing a raw token. Vercel also notes this is the same primitive behind its billion preview deployments and six million daily builds — the isolation layer is reused infrastructure, not a marketing coinage.
The old question that remains is idempotency: for side effects like payments and emails, a workflow persists state but does not deduplicate for you; retries still need explicit operation keys and an audit trail.
Layer three — Connect to data and tools: Vercel Connect and Chat SDK
Vercel Connect is the newest block of the stack, in public beta: integrate each system once, and the agent then mints a short-lived token for each task, scoped only to the permissions you explicitly grant — a deliberate contrast with long-lived, broad-permission tokens. It ships with support for Slack, GitHub, Snowflake, Salesforce, Notion, and Linear, and reaches any other service through OAuth or an API.
Chat SDK solves delivery: one agent, one codebase, into the apps where users already are. The case is NanoClaw — a single agent across more than a dozen channels, with conversations carrying context from Slack into GitHub or Linear without breaking.
The shared theme of this layer is the time dimension of permissions: short-lived tokens with explicit scopes are what make sensitive actions traceable in an audit log. The more you connect, the more this line matters.
eve: the three layers in a single directory
Teams who would rather not wire the layers themselves get eve: an opinionated, open-source framework that folds the whole Agent Stack into one directory.
agent/
agent.ts # the model it runs on
instructions.md # who it is
tools/ # what it can do
skills/ # what it knows
subagents/ # who it delegates to
channels/ # where it lives
schedules/ # when it acts on its ownDurability, sandboxing, approvals, and delivery are wired in underneath; the team writes only the agent itself — instructions in markdown, tools in TypeScript. eve is in public beta as well.
Trade-offs and a builder’s checklist
Bundling all six blocks on one platform saves significant wiring for teams already on Vercel; the cost is that observability, state, and deployment configuration tie deeper into a single environment. For teams wary of vendor risk, eve being open-source is a hedge: the three-layer interface at least has a portable reference implementation.
Even if you adopt none of the products, the Agent Stack works as a checklist:
- Model layer: is switching models a one-line change? Is there failover when a provider dies?
- Execution layer: when a long task dies at step N, can it resume from step N? Where does untrusted code run?
- Connection layer: are external-system tokens short-lived or long-lived and broad? Can sensitive actions be audited one by one?
Three layers, six questions. Whichever cell you cannot answer is the next gap worth investing in.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.