DocsPricingSecurity
GitHub
LoginGet Started

Vercel

CLIvercel

An agent with vercel on its PATH can deploy to production. Memnox wraps the binary, reads the command before it runs, and matches it against the table below. Nothing here is a list of what we support: it is what the runtime already classifies, and the strings are the ones a rule matches on.

What it reads to authenticate

Discovery records that these exist and hashes them. It never reads a value, so a scan can say three agents reach this file and never what is inside it.

! ~/.vercel/auth.json! VERCEL_TOKEN

What it cannot undo

3

Every one of these carries the alternative a refusal names, which is why an agent takes the alternative and finishes the task instead of stopping.

vercel env rm **secretsvercel.env-rm
vercel domains rm **vercel.domains-rm
vercel project rm **vercel.project-rm

What it changes

4

Allowed by default, and the obvious first thing to put behind ask.

vercel deploy --prodproductionvercel.deploy-prod
production deploy
vercel --prodproductionvercel.prod
production deploy
vercel env add **secretsvercel.env-add
vercel deployvercel.deploy
preview deploy

What it only reads

5

Matched so a rule can say read is fine, rather than leaving it unspoken.

vercel whoamivercel.whoami
vercel lsvercel.ls
vercel listvercel.list
vercel inspect **vercel.inspect
vercel logs **vercel.logs

The rule this writes

[[rules]]
name = "vercel-destructive-asks-first"
match.actions = ["vercel.env-rm"]
decision.effect = "ask"
decision.reason = "This cannot be undone."

memnox protect --for vercel writes this into memnox.policies.toml from the table above. You can edit it, and the file is yours.

Run npx memnox to find out whether Vercel is actually reachable from your machine. It reads your own disk and needs no account.