Introducing Run SDK: secure eval for your agents
Vercel's Run SDK gives agents a sandbox to write code without touching your secrets. Host functions replace direct access—and the approval gates are built in.
Why it matters
Agent-generated code execution is becoming standard. Run SDK solves the security problem practitioners face right now: letting agents write TypeScript that coordinates tools without exposing app credentials or requiring full context dumps. Human-in-the-loop approval and resumable execution are native.
The key facts
10 to knowRun SDK executes untrusted JavaScript/TypeScript in isolated QuickJS context (worker thread, no direct Node.js/network access)
Host functions expose only selected operations—database client credentials remain in application
Calls cross sandbox boundary via serialization; promises supported for existing service clients
Human-in-the-loop: interrupts at sensitive operations, returns signed token for approval workflow, resumes without replaying completed work
Per-run and global limits on heap, values crossing boundary, execution time
Powers Vercel AI SDK's 'code mode' tool execution; agent response includes both calls and logic
Two concurrent requests; filtering stays local to program; only useful result returns to app
Node.js 22.13+, Bun; extracted from internal just-bash js-exec module
Intended for JavaScript computation; Vercel Sandbox recommended for OS-level isolation workloads
Published August 26, 2026
Go to the source
Vercel Blogvercel.com
Publisher excerpt: Agents increasingly write TypeScript programs to coordinate tools and process their results. Once those programs touch real applications, some steps require authentication, while others need human approval. Executing that code with gives it the same access as the application around it, including…