Vercel

Vendor key: vercel_ai. For how source fields and scan configs fit together, see Agent Discovery Integrations.

Lists the projects in one Vercel team and reports each project that looks like it calls an LLM or runs an AI agent. To cover more teams, add one source for each.

Vercel has no agent resource, so Arthur flags a project when any of these signals fires for it:

An environment variable, or a team-shared variable linked to the project, is named exactly as an LLM provider key, such as OPENAI_API_KEY or ANTHROPIC_API_KEY. Arthur reads variable names only and never their values.
An AI integration from the Vercel Marketplace has access to the project.
Vercel lists the project among the team's projects with production Agent Runs. Vercel hasn't documented this endpoint, so it may change.
With Observability Plus, the project sends AI Gateway requests or calls a known LLM provider's API.
With read_deployment_sources on, the project's latest production deployment depends on an AI library in its package.json.

A single LLM call is flagged the same way as an agent with tools. The scan log names every signal that fired for each project.

Before you start

In Vercel, create an access token from a dedicated team member (Account Settings → Tokens). Scope it to the one team and give it an expiration.

Source fields

Field	Required	Sensitive	Default	Description
`team_id`	Yes	No		The team's ID from Team Settings → General → Team ID, for example `team_1a2b3c4d5e6f7g8h9i0j1k2l`. Not the team slug.
`access_token`	Yes	Yes		A Vercel access token scoped to the team.
`include_projects`	No	No	All projects	Comma-separated project names or IDs to limit the scan to, for example `support-bot,prj_abc123`.
`read_deployment_sources`	No	No	`false`	`true` or `false`. When `true`, Arthur reads `package.json` from each project's latest production deployment that wasn't built from Git (v0, CLI or API deployments) to detect AI libraries.

read_deployment_sources reads deployed source files, so it's off unless you turn it on. Arthur keeps only the dependency names.

Scan config

Setting	Value
`query`	`""`
`query_language`	`none`
`lookback_window_seconds`	The project list ignores it: every scan reports every flagged project. Agent Runs and Observability Plus signals are read over this window, up to 30 days. `0` reads the last 30 days.

Required permissions

Vercel tokens have no read-only scope. A token carries the permissions of the user who created it, within the team it's scoped to. The role you need depends on your plan:

Enterprise: a member with the Enterprise Viewer role.
Pro: a Pro Viewer reads projects and deployments. Observability Plus signals need a Member or Owner token.

If the project list can't be read, the scan fails. A 404 means the team_id doesn't exist. A 403 means the token is invalid, expired or revoked, or can't see the team: Vercel answers a bad token with 403, not 401. A 401 on a project's variables, or an error other than 403 when listing integrations, also fails the scan. If a project's variables answer 403, 404 or a server error, that project is skipped with a warning unless another signal flagged it. If one of the other signals can't be read, the scan logs a warning and goes on without it. Without Observability Plus, the scan logs that once.