Sign InOpen Brain
VercelEngineering PostOfficial Source

Introducing Run SDK: secure eval for your agents

Run SDK executes agent-generated JavaScript or TypeScript behind narrow host functions, with resumable approval and auth boundaries instead of application-level eval access.

Vercel · Aug 25, 2026
Open Source Open MarkdownOpen JSON
Source Summary

Vercel’s **Run SDK** executes JavaScript or type-stripped TypeScript in a fresh QuickJS context, isolated from Node.js and the network. Calls reach trusted application code only through declared host functions.

Practical Implication

Use narrow, action-specific functions for agent tools, then interrupt sensitive calls for approval or authentication. A **signed resume token** restores the run while reusing results from host calls that already completed.

Agent-Ready Context
Vercel’s **Run SDK** executes JavaScript or type-stripped TypeScript in a fresh QuickJS context, isolated from Node.js and the network. Calls reach trusted application code only through declared host functions.

Use narrow, action-specific functions for agent tools, then interrupt sensitive calls for approval or authentication. A **signed resume token** restores the run while reusing results from host calls that already completed.

This is an application-level JavaScript sandbox, not an operating-system sandbox. Host functions remain trusted code and still require authorization checks; package installs and process isolation belong in Vercel Sandbox. Runtime support starts at **Node.js 22.13+** and Bun.
Connected Context · Feed7 Judgment

Run SDK introduces a narrow application-level boundary for executing agent-generated JavaScript and pausing sensitive host calls without repeating completed work. It confirms that useful agent evaluation can be separated from trusted application access, while sharply limiting the claim: host authorization, credential scope, network or process isolation, and broader policy enforcement remain external responsibilities.

IT Admin for the AI Workforce — Sarthak Aggarwal, DecaworkThe external identity and policy model explains what Run’s trusted host functions still need: deterministic authorization, scoped capabilities, auditability, and revocation outside agent-generated code.Unlock Agent Autonomy: The Runtime for AI-Native Systems — Tushar Jain, DockerDocker’s task containment and external capability judgment cover a broader runtime boundary, while Run explicitly provides only application-level JavaScript isolation and delegates process isolation elsewhere.Project-scoped TokensProject-scoped tokens complement Run by limiting the credentials available to trusted host code; code isolation alone does not constrain the authority those functions exercise.Cline is now available in the AI SDK harness layerBoth records distinguish an agent or host runtime from isolated tools: the Cline adapter keeps the agent in the host, while Run confines generated code and exposes only declared host functions.
Context Map
infracodingsecurity#sandboxing#tool-use#agent-sdks
Uncertainty
This is an application-level JavaScript sandbox, not an operating-system sandbox. Host functions remain trusted code and still require authorization checks; package installs and process isolation belong in Vercel Sandbox. Runtime support starts at **Node.js 22.13+** and Bun.