Vercel MCP server, with a policy gate.
Manage Vercel deployments from any MCP client without pasting an access token into each one. Gentkey holds the token server-side, injects it at call time, and gates writes behind an explicit grant.
https://app.gentkey.com/mcpclaude.ai (web & mobile) · Claude Code · Cursor · any MCP clientWhat’s free, what needs a grant.
Reads: Vercel's tools ship write-gated until a curated read set lands; vendor self-labeling isn't trusted.
Writes: Grant mcp-vercel.write and the connector opens. It connects with a Vercel access token (Vercel's OAuth currently serves allow-listed clients only) — the token is encrypted at rest and never enters any agent's context.
Gentkey proxies the official Vercel MCP server (https://mcp.vercel.com/) — you get the vendor’s own tools, with custody, gating, and audit added in front.
| Grant | What it governs |
|---|---|
mcp-vercel.write | Every tool the official Vercel server exposes — deployments, projects, logs, and reads too, until a curated read set lands |
Connect once, use everywhere.
Sign in at gentkey.com, add Vercel (api key), then point each client at your endpoint. Every client completes a standard OAuth flow and lands in your Gentkey — your connections, nobody else’s.
claude.ai (web & mobile)
- Settings → Connectors
- Add custom connector
- Paste
https://app.gentkey.com/mcpand finish the OAuth prompt
Claude Code
claude mcp add --transport http \
gentkey https://app.gentkey.com/mcpCursor
// .cursor/mcp.json
{
"mcpServers": {
"gentkey": { "url": "https://app.gentkey.com/mcp" }
}
}Things agents do with Vercel here.
- Did the last production deploy succeed?
- Show me the build logs for the failing preview deployment.
- List all projects in the team and their latest deploy times.
- Roll back production to the previous deployment.
Custody, gating, and audit — built in.
The model never sees a credential
Your Vercel key is encrypted at rest and injected server-side at call time. Your stored credential never enters a context window.
Writes need a grant
Anything that changes state needs a capability you granted explicitly — revoke it and the next call is denied.
A trail you can act on
Every decision is attributed to the agent that made it — allowed, denied, or denied by constraint.
Fair questions.
Why does Vercel connect with a token instead of OAuth?
Vercel's authorization server currently serves only allow-listed clients, so a hosted gateway can't complete the OAuth dance. Gentkey stores your scoped access token encrypted (AES-256-GCM) and injects it server-side — the token never appears in any agent's config or context window.
What happens when an agent calls a Vercel write tool it hasn't been granted?
The call is denied at the gateway — nothing reaches Vercel — and the denial is recorded in the audit log along with the grant that would have authorized it, so you can decide deliberately instead of finding out later.
Where are my credentials stored?
Encrypted at rest (AES-256-GCM) on Gentkey's server and injected server-side at call time. No credential you store with Gentkey ever enters a model's context window or an agent's config file.
Can I use this from claude.ai's free plan?
Yes — and it's the strongest case for a gateway: free claude.ai accounts currently get a single custom connector, so pointing that one slot at Gentkey puts every connector you've linked behind it.
How do I revoke an agent's access?
Revoke the grant (the next write is denied) or revoke the agent's tokens entirely in one click. Other agents and their grants are untouched — no shared key to rotate.
Is Gentkey affiliated with Vercel?
No. Gentkey is an independent MCP gateway. Trademarks belong to their owners; where an official Vercel MCP server exists, Gentkey proxies it and adds custody, gating, and audit on top.
Often connected together.
Cut Vercel a smaller key.
Sign in, connect Vercel, and grant your first scoped capability in under a minute.