From fc216020e68093134baf71c16b17ba6b3886f905 Mon Sep 17 00:00:00 2001 From: dprevoznik <58714078+dprevoznik@users.noreply.github.com> Date: Tue, 21 Jul 2026 01:13:26 +0000 Subject: [PATCH 1/6] Add Vercel Eve extension integration doc Co-Authored-By: Claude Opus 4.8 --- docs.json | 1 + integrations/vercel/eve-extension.mdx | 206 ++++++++++++++++++++++++++ integrations/vercel/overview.mdx | 17 ++- 3 files changed, 222 insertions(+), 2 deletions(-) create mode 100644 integrations/vercel/eve-extension.mdx diff --git a/docs.json b/docs.json index d27efcb6..d04309b4 100644 --- a/docs.json +++ b/docs.json @@ -229,6 +229,7 @@ "pages": [ "integrations/vercel/overview", "integrations/vercel/ai-sdk", + "integrations/vercel/eve-extension", "integrations/vercel/marketplace" ] }, diff --git a/integrations/vercel/eve-extension.mdx b/integrations/vercel/eve-extension.mdx new file mode 100644 index 00000000..9d53712e --- /dev/null +++ b/integrations/vercel/eve-extension.mdx @@ -0,0 +1,206 @@ +--- +title: "Eve Extension" +description: "Give your Vercel Eve agent a Kernel cloud browser with a one-line mount" +--- + +## Overview + +The [`@onkernel/eve-extension`](https://www.npmjs.com/package/@onkernel/eve-extension) package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser. Mount it and Kernel's browser toolset — session management, Playwright execution, human-like computer controls — plus a `browse` skill show up under your mount automatically. There's no browser tool code to write or maintain. + +The tools aren't reimplemented in the extension. It packages a single MCP connection to [Kernel's hosted MCP server](https://github.com/onkernel/kernel-mcp-server), and Eve discovers the tools at runtime under your mount namespace (e.g. `kernel__browser__manage_browsers`). + +You can authenticate through [Vercel Connect](https://vercel.com/connect) — the recommended setup, where no API key touches your app and each user authenticates as themselves — or with a static Kernel API key. Either way it's a one-line mount; you pick the auth model in the mount config. + +## Prerequisites + +- **Node 24+** +- An Eve agent project running **Eve `>= 0.25`** — extensions need it. Older Eve silently ignores `agent/extensions/` and nothing mounts. If you don't have a project yet: + ```bash + npx eve@latest init my-agent && cd my-agent + ``` +- A [Kernel account](https://dashboard.onkernel.com) — either a Vercel Connect Kernel connector (recommended path below) or a Kernel API key + +## Setup with Vercel Connect (recommended) + +With Vercel Connect, no key touches your app, environment, or the model, and each user authenticates as themselves with a one-time consent that's cached afterward. This is a good fit for Kernel's per-user managed auth. + +**1. Install** the extension: + +```bash +pnpm add @onkernel/eve-extension +``` + +**2. Create and attach the Kernel connector** in Vercel Connect. Name it `eve-extension` so the mount snippet works unedited: + +```bash +vercel connect create mcp.onkernel.com --name eve-extension +vercel connect attach mcp.onkernel.com/eve-extension +``` + +You can also add it from the Vercel dashboard under **Connectors → Browse all → Kernel**. Confirm the UID with `vercel connect list`. + +**3. Mount the extension** — one line, passing the connector UID: + +```typescript +// agent/extensions/kernel.ts +import kernel from "@onkernel/eve-extension"; + +export default kernel({ connect: "mcp.onkernel.com/eve-extension" }); +``` + +**4. Run it:** + +```bash +npx eve dev # or: npx eve deploy +``` + +Leave `KERNEL_API_KEY` unset. The first time a user drives the browser, Eve surfaces a Connect consent prompt; they approve once and it's cached from then on, persisting across threads and sessions. + +## What you get + +Once mounted, the agent has the following tools, namespaced under your mount (e.g. `kernel__browser__*` — discover the exact names via `connection_search`): + +- **`manage_browsers`** — create, list, get, and delete browser sessions. Returns a `session_id` and a `live_view_url` you can watch or take over. +- **`execute_playwright_code`** — run Playwright against the live page to read, navigate, click, or type. +- **`computer_action`** — human-like mouse, keyboard, and screenshot controls for the same session. +- **`manage_auth_connections`** — Kernel's [managed auth](/auth/overview), so the agent logs into sites through a stored connection or a hosted login flow instead of typing credentials into the page. +- **`manage_profiles`** — create and reuse browser [profiles](/auth/profiles) (persistent cookies, logins, storage). +- **`manage_proxies`** — create and attach [proxies](/proxies/overview) (datacenter, ISP, residential, mobile) with geo-targeting. +- the **`browse` skill** — the loop the model follows to drive the browser end to end. It runs autonomously but is human-in-the-loop friendly: it surfaces the live-view URL for take-over, hands off for sign-ins, ambiguous choices, and sensitive actions, and defaults to Kernel managed auth for authenticated sites. + +A few heavier tools are off by default to keep an autonomous agent's blast radius small on a shared API key. You can add any of them via a [connection override](#overriding-the-connection): `browser_curl` (raw HTTP through the session), `manage_credentials` (create, read, and delete stored credentials — the managed-auth flow above works without it), `exec_command` (shell exec in the VM), and `manage_browser_pools`. + + + The default mount has no approval gate, and its toolset includes `execute_playwright_code` (arbitrary JS in the browser VM) and `manage_auth_connections` (reuse of logged-in sessions). On a shared `KERNEL_API_KEY`, every agent user effectively acts as your whole org. That's fine for a **personal or single-tenant** agent. For **team or multi-tenant** deployments, add an approval gate via a [connection override](#overriding-the-connection) — `approval: once()` (per session) or `approval: always()` (every controlled action). + + +## Auth models + +Both models are one-line mounts — no connection override needed: + +| Model | Mount | Consent behavior | +| --- | --- | --- | +| **Per-user via Vercel Connect** (recommended; each person authenticates as themselves) | `kernel({ connect: "mcp.onkernel.com/" })` | Each user consents once, ever; the grant persists across threads and sessions. No key in your app or environment. | +| **Shared API key** | `kernel({ apiKey })` or set `KERNEL_API_KEY` | One key for everyone, no prompts, no connector setup. | + +## Authenticate with an API key instead + +One shared credential, no connector setup. A good fit for a single-tenant or personal agent. + +**1. Install** the extension: + +```bash +pnpm add @onkernel/eve-extension +``` + +**2. Get a Kernel API key** at [dashboard.onkernel.com/api-keys](https://dashboard.onkernel.com/api-keys) and set it in the agent's environment: + +```bash +# local dev — in the agent's .env.local +KERNEL_API_KEY=sk_... + +# deploying to Vercel +npx vercel env add KERNEL_API_KEY +``` + +**3. Mount the extension** — a single file that reads `KERNEL_API_KEY` from the environment: + +```typescript +// agent/extensions/kernel.ts +export { default } from "@onkernel/eve-extension"; +``` + +**4. Run:** `npx eve dev` or `npx eve deploy`. + +To pass the key explicitly instead of via the environment: + +```typescript +// agent/extensions/kernel.ts +import kernel from "@onkernel/eve-extension"; + +export default kernel({ apiKey: process.env.KERNEL_API_KEY }); +``` + +### Configuration + +`kernel({ ... })` accepts: + +| Option | Default | Purpose | +| --------- | -------------------------- | ------------------------------------------------------------------------------------------ | +| `connect` | — | Vercel Connect connector UID — brokers a per-user token, so no API key is used. | +| `apiKey` | `KERNEL_API_KEY` env var | Kernel API key bearer token. Used when `connect` is not set; read lazily at request time. | + +When `connect` is set it takes precedence. Otherwise the key is read from `apiKey`, and failing that from `KERNEL_API_KEY`. + +## Overriding the connection + +You only need this for advanced customization — widening the tool allowlist or adding an approval gate before irreversible actions. Auth is handled by the mount config above, so you don't override for that. + +Mount the extension as a directory and name the connection file `browser.ts` to shadow the extension's built-in `browser` connection: + +``` +agent/extensions/kernel/ + extension.ts # export default kernel({ connect: "mcp.onkernel.com/eve-extension" }) + connections/browser.ts # shadows the extension's "browser" connection +``` + +```typescript +// agent/extensions/kernel/connections/browser.ts +import { defineMcpClientConnection } from "eve/connections"; +import { connect } from "@vercel/connect/eve"; +import { always } from "eve/tools/approval"; + +export default defineMcpClientConnection({ + url: "https://mcp.onkernel.com/mcp", + description: "Kernel cloud browser.", + auth: connect("mcp.onkernel.com/eve-extension"), // or { getToken: async () => ({ token: process.env.KERNEL_API_KEY! }) } + tools: { + allow: [ + "manage_browsers", + "execute_playwright_code", + "computer_action", + "browser_curl", // high blast radius — raw HTTP through the session + "manage_auth_connections", + "manage_credentials", // high blast radius — create/read/delete stored credentials + "manage_profiles", + "manage_proxies", + "manage_browser_pools", // heavier tools, off by default — add as needed + "exec_command", // high blast radius — shell exec in the VM + ], + }, + approval: always(), // re-check every controlled action; once() would auto-allow the rest of the session +}); +``` + +## Additional resources + + + + Vercel's agent framework + + + The hosted MCP server the extension connects to + + + Log agents into sites without handling credentials + + + +## Related + +- [Vercel Marketplace Integration](/integrations/vercel/marketplace) +- [AI SDK Tool](/integrations/vercel/ai-sdk) +- [Browser Creation](/introduction/create) +- [Live View](/browsers/live-view) diff --git a/integrations/vercel/overview.mdx b/integrations/vercel/overview.mdx index 3b775d8a..34bdd8c0 100644 --- a/integrations/vercel/overview.mdx +++ b/integrations/vercel/overview.mdx @@ -5,7 +5,7 @@ description: "Integrate Kernel with Vercel for seamless browser automation in yo ## Vercel + Kernel -Kernel and Vercel have partnered to provide seamless browser automation capabilities for your Vercel applications. Our integration offers two powerful ways to add browser automation to your projects: +Kernel and Vercel have partnered to provide seamless browser automation capabilities for your Vercel applications. Our integration offers several ways to add browser automation to your projects: ### AI SDK Tool for Browser Automation @@ -18,6 +18,12 @@ With this tool, you can build AI-powered applications that browse the web, extra [Learn more about the AI SDK tool →](/integrations/vercel/ai-sdk) +### Eve Extension + +The `@onkernel/eve-extension` package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser with a one-line mount. Kernel's full browser toolset — session management, Playwright execution, human-like computer controls, managed auth, profiles, and proxies — plus a `browse` skill show up under your agent automatically. Authenticate per-user through Vercel Connect or with a shared Kernel API key. + +[Learn more about the Eve extension →](/integrations/vercel/eve-extension) + ### Vercel Marketplace Integration The [Vercel Marketplace integration](/integrations/vercel/marketplace) allows you to install and configure Kernel directly from the Vercel dashboard. This integration: @@ -38,7 +44,7 @@ The [Vercel Marketplace integration](/integrations/vercel/marketplace) allows yo ## Next Steps - + Build Agents with browser automation tools + + Mount a Kernel browser in your Eve agent + Date: Tue, 21 Jul 2026 01:21:35 +0000 Subject: [PATCH 2/6] Break dense feature enumerations into bullet lists Co-Authored-By: Claude Opus 4.8 --- integrations/vercel/eve-extension.mdx | 2 +- integrations/vercel/overview.mdx | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/integrations/vercel/eve-extension.mdx b/integrations/vercel/eve-extension.mdx index 9d53712e..da526d9e 100644 --- a/integrations/vercel/eve-extension.mdx +++ b/integrations/vercel/eve-extension.mdx @@ -5,7 +5,7 @@ description: "Give your Vercel Eve agent a Kernel cloud browser with a one-line ## Overview -The [`@onkernel/eve-extension`](https://www.npmjs.com/package/@onkernel/eve-extension) package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser. Mount it and Kernel's browser toolset — session management, Playwright execution, human-like computer controls — plus a `browse` skill show up under your mount automatically. There's no browser tool code to write or maintain. +The [`@onkernel/eve-extension`](https://www.npmjs.com/package/@onkernel/eve-extension) package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser. Mount it and Kernel's browser toolset plus a `browse` skill show up under your mount automatically — no browser tool code to write or maintain. See [what you get](#what-you-get) for the full toolset. The tools aren't reimplemented in the extension. It packages a single MCP connection to [Kernel's hosted MCP server](https://github.com/onkernel/kernel-mcp-server), and Eve discovers the tools at runtime under your mount namespace (e.g. `kernel__browser__manage_browsers`). diff --git a/integrations/vercel/overview.mdx b/integrations/vercel/overview.mdx index 34bdd8c0..8c4ace54 100644 --- a/integrations/vercel/overview.mdx +++ b/integrations/vercel/overview.mdx @@ -20,7 +20,13 @@ With this tool, you can build AI-powered applications that browse the web, extra ### Eve Extension -The `@onkernel/eve-extension` package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser with a one-line mount. Kernel's full browser toolset — session management, Playwright execution, human-like computer controls, managed auth, profiles, and proxies — plus a `browse` skill show up under your agent automatically. Authenticate per-user through Vercel Connect or with a shared Kernel API key. +The `@onkernel/eve-extension` package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser with a one-line mount. Once mounted, Kernel's browser toolset plus a `browse` skill show up under your agent automatically: + +- Session management, Playwright execution, and human-like computer controls +- Managed auth, browser profiles, and proxies +- The `browse` skill — the loop the model follows to drive the browser end to end + +Authenticate per-user through Vercel Connect or with a shared Kernel API key. [Learn more about the Eve extension →](/integrations/vercel/eve-extension) From 7c4b5935e96d4e9bbe736e7c510c8722e672980c Mon Sep 17 00:00:00 2001 From: dprevoznik <58714078+dprevoznik@users.noreply.github.com> Date: Tue, 21 Jul 2026 01:26:22 +0000 Subject: [PATCH 3/6] Break dense prose into bullets and formalize section heading Co-Authored-By: Claude Opus 4.8 --- integrations/vercel/eve-extension.mdx | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/integrations/vercel/eve-extension.mdx b/integrations/vercel/eve-extension.mdx index da526d9e..41036915 100644 --- a/integrations/vercel/eve-extension.mdx +++ b/integrations/vercel/eve-extension.mdx @@ -5,7 +5,7 @@ description: "Give your Vercel Eve agent a Kernel cloud browser with a one-line ## Overview -The [`@onkernel/eve-extension`](https://www.npmjs.com/package/@onkernel/eve-extension) package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser. Mount it and Kernel's browser toolset plus a `browse` skill show up under your mount automatically — no browser tool code to write or maintain. See [what you get](#what-you-get) for the full toolset. +The [`@onkernel/eve-extension`](https://www.npmjs.com/package/@onkernel/eve-extension) package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser. Mount it and Kernel's browser toolset plus a `browse` skill show up under your mount automatically — no browser tool code to write or maintain. See [included tools and skills](#included-tools-and-skills) for the full toolset. The tools aren't reimplemented in the extension. It packages a single MCP connection to [Kernel's hosted MCP server](https://github.com/onkernel/kernel-mcp-server), and Eve discovers the tools at runtime under your mount namespace (e.g. `kernel__browser__manage_browsers`). @@ -22,7 +22,11 @@ You can authenticate through [Vercel Connect](https://vercel.com/connect) — th ## Setup with Vercel Connect (recommended) -With Vercel Connect, no key touches your app, environment, or the model, and each user authenticates as themselves with a one-time consent that's cached afterward. This is a good fit for Kernel's per-user managed auth. +Vercel Connect is the recommended path because: + +- No key touches your app, environment, or the model. +- Each user authenticates as themselves with a one-time consent that's cached afterward. +- Per-user identity is a good fit for Kernel's [managed auth](/auth/overview). **1. Install** the extension: @@ -56,7 +60,7 @@ npx eve dev # or: npx eve deploy Leave `KERNEL_API_KEY` unset. The first time a user drives the browser, Eve surfaces a Connect consent prompt; they approve once and it's cached from then on, persisting across threads and sessions. -## What you get +## Included tools and skills Once mounted, the agent has the following tools, namespaced under your mount (e.g. `kernel__browser__*` — discover the exact names via `connection_search`): @@ -66,9 +70,20 @@ Once mounted, the agent has the following tools, namespaced under your mount (e. - **`manage_auth_connections`** — Kernel's [managed auth](/auth/overview), so the agent logs into sites through a stored connection or a hosted login flow instead of typing credentials into the page. - **`manage_profiles`** — create and reuse browser [profiles](/auth/profiles) (persistent cookies, logins, storage). - **`manage_proxies`** — create and attach [proxies](/proxies/overview) (datacenter, ISP, residential, mobile) with geo-targeting. -- the **`browse` skill** — the loop the model follows to drive the browser end to end. It runs autonomously but is human-in-the-loop friendly: it surfaces the live-view URL for take-over, hands off for sign-ins, ambiguous choices, and sensitive actions, and defaults to Kernel managed auth for authenticated sites. +- the **`browse` skill** — the loop the model follows to drive the browser end to end. + +The `browse` skill runs autonomously but is human-in-the-loop friendly: + +- It surfaces the live-view URL so you can take over. +- It hands off for sign-ins, ambiguous choices, and sensitive actions. +- It defaults to Kernel managed auth for authenticated sites. + +A few heavier tools are off by default to keep an autonomous agent's blast radius small on a shared API key. Add any of them via a [connection override](#overriding-the-connection): -A few heavier tools are off by default to keep an autonomous agent's blast radius small on a shared API key. You can add any of them via a [connection override](#overriding-the-connection): `browser_curl` (raw HTTP through the session), `manage_credentials` (create, read, and delete stored credentials — the managed-auth flow above works without it), `exec_command` (shell exec in the VM), and `manage_browser_pools`. +- `browser_curl` — raw HTTP through the session. +- `manage_credentials` — create, read, and delete stored credentials (the managed-auth flow above works without it). +- `exec_command` — shell exec in the VM. +- `manage_browser_pools` — manage pools of pre-warmed browsers. The default mount has no approval gate, and its toolset includes `execute_playwright_code` (arbitrary JS in the browser VM) and `manage_auth_connections` (reuse of logged-in sessions). On a shared `KERNEL_API_KEY`, every agent user effectively acts as your whole org. That's fine for a **personal or single-tenant** agent. For **team or multi-tenant** deployments, add an approval gate via a [connection override](#overriding-the-connection) — `approval: once()` (per session) or `approval: always()` (every controlled action). From 24a7cefff0fa03eefa4fee6325a97dc0db273042 Mon Sep 17 00:00:00 2001 From: dprevoznik <58714078+dprevoznik@users.noreply.github.com> Date: Tue, 21 Jul 2026 01:31:43 +0000 Subject: [PATCH 4/6] Deslop: drop em-dashes, tighten prose, remove redundant auth-models table Co-Authored-By: Claude Opus 4.8 --- integrations/vercel/eve-extension.mdx | 61 ++++++++++++--------------- integrations/vercel/overview.mdx | 2 +- 2 files changed, 27 insertions(+), 36 deletions(-) diff --git a/integrations/vercel/eve-extension.mdx b/integrations/vercel/eve-extension.mdx index 41036915..57f94dbd 100644 --- a/integrations/vercel/eve-extension.mdx +++ b/integrations/vercel/eve-extension.mdx @@ -5,20 +5,20 @@ description: "Give your Vercel Eve agent a Kernel cloud browser with a one-line ## Overview -The [`@onkernel/eve-extension`](https://www.npmjs.com/package/@onkernel/eve-extension) package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser. Mount it and Kernel's browser toolset plus a `browse` skill show up under your mount automatically — no browser tool code to write or maintain. See [included tools and skills](#included-tools-and-skills) for the full toolset. +The [`@onkernel/eve-extension`](https://www.npmjs.com/package/@onkernel/eve-extension) package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser. Mount it and Kernel's browser toolset plus a `browse` skill show up under your mount automatically, so there's no browser tool code to write or maintain. See [included tools and skills](#included-tools-and-skills) for the full toolset. The tools aren't reimplemented in the extension. It packages a single MCP connection to [Kernel's hosted MCP server](https://github.com/onkernel/kernel-mcp-server), and Eve discovers the tools at runtime under your mount namespace (e.g. `kernel__browser__manage_browsers`). -You can authenticate through [Vercel Connect](https://vercel.com/connect) — the recommended setup, where no API key touches your app and each user authenticates as themselves — or with a static Kernel API key. Either way it's a one-line mount; you pick the auth model in the mount config. +You can authenticate through [Vercel Connect](https://vercel.com/connect) or with a static Kernel API key. Connect is the recommended setup: no API key touches your app, and each user authenticates as themselves. Either way it's a one-line mount, and you pick the auth model in the mount config. ## Prerequisites - **Node 24+** -- An Eve agent project running **Eve `>= 0.25`** — extensions need it. Older Eve silently ignores `agent/extensions/` and nothing mounts. If you don't have a project yet: +- An Eve agent project running **Eve `>= 0.25`**, which extensions require. Older Eve silently ignores `agent/extensions/` and nothing mounts. If you don't have a project yet: ```bash npx eve@latest init my-agent && cd my-agent ``` -- A [Kernel account](https://dashboard.onkernel.com) — either a Vercel Connect Kernel connector (recommended path below) or a Kernel API key +- A [Kernel account](https://dashboard.onkernel.com), with either a Vercel Connect Kernel connector (recommended path below) or a Kernel API key ## Setup with Vercel Connect (recommended) @@ -43,7 +43,7 @@ vercel connect attach mcp.onkernel.com/eve-extension You can also add it from the Vercel dashboard under **Connectors → Browse all → Kernel**. Confirm the UID with `vercel connect list`. -**3. Mount the extension** — one line, passing the connector UID: +**3. Mount the extension** in one line, passing the connector UID: ```typescript // agent/extensions/kernel.ts @@ -62,15 +62,15 @@ Leave `KERNEL_API_KEY` unset. The first time a user drives the browser, Eve surf ## Included tools and skills -Once mounted, the agent has the following tools, namespaced under your mount (e.g. `kernel__browser__*` — discover the exact names via `connection_search`): +Once mounted, the agent has the following tools, namespaced under your mount (e.g. `kernel__browser__*`; discover the exact names via `connection_search`): -- **`manage_browsers`** — create, list, get, and delete browser sessions. Returns a `session_id` and a `live_view_url` you can watch or take over. -- **`execute_playwright_code`** — run Playwright against the live page to read, navigate, click, or type. -- **`computer_action`** — human-like mouse, keyboard, and screenshot controls for the same session. -- **`manage_auth_connections`** — Kernel's [managed auth](/auth/overview), so the agent logs into sites through a stored connection or a hosted login flow instead of typing credentials into the page. -- **`manage_profiles`** — create and reuse browser [profiles](/auth/profiles) (persistent cookies, logins, storage). -- **`manage_proxies`** — create and attach [proxies](/proxies/overview) (datacenter, ISP, residential, mobile) with geo-targeting. -- the **`browse` skill** — the loop the model follows to drive the browser end to end. +- **`manage_browsers`**: create, list, get, and delete browser sessions. Returns a `session_id` and a `live_view_url` you can watch or take over. +- **`execute_playwright_code`**: run Playwright against the live page to read, navigate, click, or type. +- **`computer_action`**: human-like mouse, keyboard, and screenshot controls for the same session. +- **`manage_auth_connections`**: Kernel's [managed auth](/auth/overview), so the agent logs into sites through a stored connection or a hosted login flow instead of typing credentials into the page. +- **`manage_profiles`**: create and reuse browser [profiles](/auth/profiles) (persistent cookies, logins, storage). +- **`manage_proxies`**: create and attach [proxies](/proxies/overview) (datacenter, ISP, residential, mobile) with geo-targeting. +- the **`browse` skill**: the loop the model follows to drive the browser end to end. The `browse` skill runs autonomously but is human-in-the-loop friendly: @@ -80,24 +80,15 @@ The `browse` skill runs autonomously but is human-in-the-loop friendly: A few heavier tools are off by default to keep an autonomous agent's blast radius small on a shared API key. Add any of them via a [connection override](#overriding-the-connection): -- `browser_curl` — raw HTTP through the session. -- `manage_credentials` — create, read, and delete stored credentials (the managed-auth flow above works without it). -- `exec_command` — shell exec in the VM. -- `manage_browser_pools` — manage pools of pre-warmed browsers. +- `browser_curl`: raw HTTP through the session. +- `manage_credentials`: create, read, and delete stored credentials (the managed-auth flow above works without it). +- `exec_command`: shell exec in the VM. +- `manage_browser_pools`: manage pools of pre-warmed browsers. - The default mount has no approval gate, and its toolset includes `execute_playwright_code` (arbitrary JS in the browser VM) and `manage_auth_connections` (reuse of logged-in sessions). On a shared `KERNEL_API_KEY`, every agent user effectively acts as your whole org. That's fine for a **personal or single-tenant** agent. For **team or multi-tenant** deployments, add an approval gate via a [connection override](#overriding-the-connection) — `approval: once()` (per session) or `approval: always()` (every controlled action). + The default mount has no approval gate, and its toolset includes `execute_playwright_code` (arbitrary JS in the browser VM) and `manage_auth_connections` (reuse of logged-in sessions). On a shared `KERNEL_API_KEY`, every agent user effectively acts as your whole org. That's fine for a **personal or single-tenant** agent. For **team or multi-tenant** deployments, add an approval gate via a [connection override](#overriding-the-connection): `approval: once()` (per session) or `approval: always()` (every controlled action). -## Auth models - -Both models are one-line mounts — no connection override needed: - -| Model | Mount | Consent behavior | -| --- | --- | --- | -| **Per-user via Vercel Connect** (recommended; each person authenticates as themselves) | `kernel({ connect: "mcp.onkernel.com/" })` | Each user consents once, ever; the grant persists across threads and sessions. No key in your app or environment. | -| **Shared API key** | `kernel({ apiKey })` or set `KERNEL_API_KEY` | One key for everyone, no prompts, no connector setup. | - ## Authenticate with an API key instead One shared credential, no connector setup. A good fit for a single-tenant or personal agent. @@ -111,14 +102,14 @@ pnpm add @onkernel/eve-extension **2. Get a Kernel API key** at [dashboard.onkernel.com/api-keys](https://dashboard.onkernel.com/api-keys) and set it in the agent's environment: ```bash -# local dev — in the agent's .env.local +# local dev: in the agent's .env.local KERNEL_API_KEY=sk_... # deploying to Vercel npx vercel env add KERNEL_API_KEY ``` -**3. Mount the extension** — a single file that reads `KERNEL_API_KEY` from the environment: +**3. Mount the extension** in a single file that reads `KERNEL_API_KEY` from the environment: ```typescript // agent/extensions/kernel.ts @@ -142,14 +133,14 @@ export default kernel({ apiKey: process.env.KERNEL_API_KEY }); | Option | Default | Purpose | | --------- | -------------------------- | ------------------------------------------------------------------------------------------ | -| `connect` | — | Vercel Connect connector UID — brokers a per-user token, so no API key is used. | +| `connect` | None | Vercel Connect connector UID that brokers a per-user token, so no API key is used. | | `apiKey` | `KERNEL_API_KEY` env var | Kernel API key bearer token. Used when `connect` is not set; read lazily at request time. | When `connect` is set it takes precedence. Otherwise the key is read from `apiKey`, and failing that from `KERNEL_API_KEY`. ## Overriding the connection -You only need this for advanced customization — widening the tool allowlist or adding an approval gate before irreversible actions. Auth is handled by the mount config above, so you don't override for that. +You only need this for advanced customization: widening the tool allowlist or adding an approval gate before irreversible actions. Auth is handled by the mount config above, so you don't override for that. Mount the extension as a directory and name the connection file `browser.ts` to shadow the extension's built-in `browser` connection: @@ -174,13 +165,13 @@ export default defineMcpClientConnection({ "manage_browsers", "execute_playwright_code", "computer_action", - "browser_curl", // high blast radius — raw HTTP through the session + "browser_curl", // high blast radius: raw HTTP through the session "manage_auth_connections", - "manage_credentials", // high blast radius — create/read/delete stored credentials + "manage_credentials", // high blast radius: create/read/delete stored credentials "manage_profiles", "manage_proxies", - "manage_browser_pools", // heavier tools, off by default — add as needed - "exec_command", // high blast radius — shell exec in the VM + "manage_browser_pools", // heavier tools, off by default + "exec_command", // high blast radius: shell exec in the VM ], }, approval: always(), // re-check every controlled action; once() would auto-allow the rest of the session diff --git a/integrations/vercel/overview.mdx b/integrations/vercel/overview.mdx index 8c4ace54..eeda8a41 100644 --- a/integrations/vercel/overview.mdx +++ b/integrations/vercel/overview.mdx @@ -24,7 +24,7 @@ The `@onkernel/eve-extension` package is a [Vercel Eve](https://vercel.com/eve) - Session management, Playwright execution, and human-like computer controls - Managed auth, browser profiles, and proxies -- The `browse` skill — the loop the model follows to drive the browser end to end +- The `browse` skill, the loop the model follows to drive the browser end to end Authenticate per-user through Vercel Connect or with a shared Kernel API key. From a9f1e323149fc74968b2ef2a7b1dcc76b64b90bd Mon Sep 17 00:00:00 2001 From: dprevoznik <58714078+dprevoznik@users.noreply.github.com> Date: Tue, 21 Jul 2026 01:41:07 +0000 Subject: [PATCH 5/6] Break dense security warning into bullets Co-Authored-By: Claude Opus 4.8 --- integrations/vercel/eve-extension.mdx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/integrations/vercel/eve-extension.mdx b/integrations/vercel/eve-extension.mdx index 57f94dbd..c769b233 100644 --- a/integrations/vercel/eve-extension.mdx +++ b/integrations/vercel/eve-extension.mdx @@ -86,7 +86,10 @@ A few heavier tools are off by default to keep an autonomous agent's blast radiu - `manage_browser_pools`: manage pools of pre-warmed browsers. - The default mount has no approval gate, and its toolset includes `execute_playwright_code` (arbitrary JS in the browser VM) and `manage_auth_connections` (reuse of logged-in sessions). On a shared `KERNEL_API_KEY`, every agent user effectively acts as your whole org. That's fine for a **personal or single-tenant** agent. For **team or multi-tenant** deployments, add an approval gate via a [connection override](#overriding-the-connection): `approval: once()` (per session) or `approval: always()` (every controlled action). + The default mount has no approval gate, and its toolset can run arbitrary JS in the browser VM (`execute_playwright_code`) and reuse logged-in sessions (`manage_auth_connections`). On a shared `KERNEL_API_KEY`, every agent user effectively acts as your whole org. + + - For a **personal or single-tenant** agent, the default is fine. + - For **team or multi-tenant** deployments, add an approval gate via a [connection override](#overriding-the-connection): `approval: once()` (per session) or `approval: always()` (every controlled action). ## Authenticate with an API key instead From c5c3d2425d0a656460de4d541b713f6414ccde2b Mon Sep 17 00:00:00 2001 From: dprevoznik <58714078+dprevoznik@users.noreply.github.com> Date: Tue, 21 Jul 2026 02:07:37 +0000 Subject: [PATCH 6/6] Reword one-line mount to 1 loc Co-Authored-By: Claude Opus 4.8 --- integrations/vercel/eve-extension.mdx | 4 ++-- integrations/vercel/overview.mdx | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/integrations/vercel/eve-extension.mdx b/integrations/vercel/eve-extension.mdx index c769b233..2d472b9c 100644 --- a/integrations/vercel/eve-extension.mdx +++ b/integrations/vercel/eve-extension.mdx @@ -1,6 +1,6 @@ --- title: "Eve Extension" -description: "Give your Vercel Eve agent a Kernel cloud browser with a one-line mount" +description: "Give your Vercel Eve agent a Kernel cloud browser in 1 loc" --- ## Overview @@ -9,7 +9,7 @@ The [`@onkernel/eve-extension`](https://www.npmjs.com/package/@onkernel/eve-exte The tools aren't reimplemented in the extension. It packages a single MCP connection to [Kernel's hosted MCP server](https://github.com/onkernel/kernel-mcp-server), and Eve discovers the tools at runtime under your mount namespace (e.g. `kernel__browser__manage_browsers`). -You can authenticate through [Vercel Connect](https://vercel.com/connect) or with a static Kernel API key. Connect is the recommended setup: no API key touches your app, and each user authenticates as themselves. Either way it's a one-line mount, and you pick the auth model in the mount config. +You can authenticate through [Vercel Connect](https://vercel.com/connect) or with a static Kernel API key. Connect is the recommended setup: no API key touches your app, and each user authenticates as themselves. Either way it's 1 loc, and you pick the auth model in the mount config. ## Prerequisites diff --git a/integrations/vercel/overview.mdx b/integrations/vercel/overview.mdx index eeda8a41..2119cbab 100644 --- a/integrations/vercel/overview.mdx +++ b/integrations/vercel/overview.mdx @@ -20,7 +20,7 @@ With this tool, you can build AI-powered applications that browse the web, extra ### Eve Extension -The `@onkernel/eve-extension` package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser with a one-line mount. Once mounted, Kernel's browser toolset plus a `browse` skill show up under your agent automatically: +The `@onkernel/eve-extension` package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser in 1 loc. Once mounted, Kernel's browser toolset plus a `browse` skill show up under your agent automatically: - Session management, Playwright execution, and human-like computer controls - Managed auth, browser profiles, and proxies