vercel / sandbox

The one skill covers creating a sandbox from a git source or a blank Amazon Linux 2023 image, choosing a runtime (node22, node24, node26, or python3.13) and vCPU count, running commands with streamed stdout/stderr, exposing ports back out through sandbox.domain(), and installing missing system packages as root with sudo dnf install. It documents both auth paths side by side: a Vercel OIDC token, pulled locally with vercel env pull and refreshed automatically in production, or a long-lived access token paired with a team ID and project ID for environments where OIDC isn't available.

This is for a team already deploying through Vercel that wants an agent able to spin up a disposable Linux environment for untrusted or AI-generated code, a throwaway dev server, or a bug repro, instead of running that on the developer's own machine. Without a Vercel account and project already linked, the skill has nothing to act on.

READ THE FULL ANALYSIS＋

The resource ceiling depends on the plan, not just the request. A sandbox tops out at 45 minutes and 8 vCPUs on Hobby; Pro and Enterprise extend the runtime to 24 hours, and Enterprise alone allows up to 32 vCPUs, each carrying 2048MB of memory regardless of tier. An agent planning a long task needs to know which ceiling it's actually working under before it starts.

It also survives a Workflow DevKit step boundary. The skill notes that Sandbox and CommandFinished instances serialize across Workflow steps and rehydrate afterward, recreating their API client from OIDC or environment credentials rather than staying open in memory — worth knowing if the agent's task spans more than one Workflow step.