ToolsAugust 26, 2026via Vercel Blog
Introducing Run SDK: secure eval for your agents
Why it matters
Agent-generated code execution is becoming standard. Run SDK solves the security problem practitioners face right now: letting agents write TypeScript that coordinates tools without exposing app credentials or requiring full context dumps. Human-in-the-loop approval and resumable execution are native.
Key signals
- Run SDK executes untrusted JavaScript/TypeScript in isolated QuickJS context (worker thread, no direct Node.js/network access)
- Host functions expose only selected operations—database client credentials remain in application
- Calls cross sandbox boundary via serialization; promises supported for existing service clients
- Human-in-the-loop: interrupts at sensitive operations, returns signed token for approval workflow, resumes without replaying completed work
- Per-run and global limits on heap, values crossing boundary, execution time
- Powers Vercel AI SDK's 'code mode' tool execution; agent response includes both calls and logic
- Two concurrent requests; filtering stays local to program; only useful result returns to app
- Node.js 22.13+, Bun; extracted from internal just-bash js-exec module
- Intended for JavaScript computation; Vercel Sandbox recommended for OS-level isolation workloads
- Published August 26, 2026
The hook
Vercel's Run SDK gives agents a sandbox to write code without touching your secrets. Host functions replace direct access—and the approval gates are built in.
Agents increasingly write TypeScript programs to coordinate tools and process their results. Once those programs touch real applications, some steps require authentication, while others need human approval.
Executing that code with gives it the same access as the application around it, including it…