← Back to search

ai

vercel Scanned 18d ago

AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.

npm ↗
D
40 / 100

Versions

No versions found.

PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 19

showDiceGame
annotations: none low

Show or play a MCP App dice game.

roll boolean score number
getWeather
annotations: none low

Get the current weather for a city.

city string
calculateSum
annotations: none low

Returns the sum of N numbers

showDashboard
annotations: none low

Show an interactive MCP App dashboard for a topic.

refreshDashboardData
annotations: none low

Refresh the rendered dashboard data. This tool is intended for the MCP App, not the model.

reason string
lookup-order
annotations: none low

Look up the status of a customer order.

orderId string
ping
annotations: none low

A simple ping tool

create_event
annotations: none low

Create a calendar event by collecting event details

register_user
annotations: none low

Register a new user account by collecting their information

Alice
annotations: none low

message string
read
annotations: none low

Read file contents.

write
annotations: none low

Write content to a file.

edit
annotations: none low

Edit a file by exact-string replacement.

bash
annotations: none low

Execute a shell command.

grep
annotations: none low

Search file contents with regex.

find
annotations: none low

Find files matching a glob pattern.

ls
annotations: none low

List directory entries.

harness-tools
annotations: none low

contextual
annotations: none low

User is Ada

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs.promises, fs/promises, os, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 72

info
Transport: streamable-http manifest_parser · 80%
low
Tool 'create_event' has no annotations annotation_checker · 100%
low
Tool 'register_user' has no annotations annotation_checker · 100%
low
Tool 'showDiceGame' has no annotations annotation_checker · 100%
low
Tool 'getWeather' has no annotations annotation_checker · 100%
low
Tool 'Alice' has no annotations annotation_checker · 100%
low
Tool 'refreshDashboardData' has no annotations annotation_checker · 100%
info
Tool: harness-tools manifest_parser · 75%
low
Tool 'lookup-order' has no annotations annotation_checker · 100%
low
Tool 'ping' has no annotations annotation_checker · 100%
low
Tool 'calculateSum' has no annotations annotation_checker · 100%
low
Tool 'showDashboard' has no annotations annotation_checker · 100%
low
Tool 'read' has no annotations annotation_checker · 100%
low
Tool 'write' has no annotations annotation_checker · 100%
low
Tool 'edit' has no annotations annotation_checker · 100%
low
Tool 'bash' has no annotations annotation_checker · 100%
low
Tool 'grep' has no annotations annotation_checker · 100%
low
Tool 'find' has no annotations annotation_checker · 100%
low
Tool 'ls' has no annotations annotation_checker · 100%
low
Tool 'harness-tools' has no annotations annotation_checker · 100%
low
Tool 'contextual' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in vercel-ai-56d492f/packages/mcp/src/tool/oauth.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 636 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Suspicious package name: react-markdown dependency_analyzer · 60%
info
OSV.dev API query failed dependency_analyzer · 100%
medium
Buffer.from base64 in vercel-ai-56d492f/examples/ai-functions/src/e2e/feature-test-suite.ts:1154 entropy_analyzer · 75%
medium
Buffer.from base64 in vercel-ai-56d492f/examples/ai-functions/src/stream-translate/google/basic.ts:49 entropy_analyzer · 75%
medium
Buffer.from base64 in vercel-ai-56d492f/examples/ai-functions/src/stream-translate/openai/basic.ts:45 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in vercel-ai-56d492f/packages/replicate/src/replicate-image-model.test.ts:365 entropy_analyzer · 70%
info
Tool: contextual manifest_parser · 75%
medium
Hex string literal (>50 chars) in vercel-ai-56d492f/packages/harness-deepagents/src/deepagents-bootstrap.ts:18 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in vercel-ai-56d492f/packages/harness-deepagents/src/deepagents-bootstrap.ts:20 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: calculateSum manifest_parser · 70%
info
Tool: showDashboard manifest_parser · 85%
info
Tool: showDiceGame manifest_parser · 85%
info
Tool: getWeather manifest_parser · 85%
info
Tool: refreshDashboardData manifest_parser · 85%
info
Tool: lookup-order manifest_parser · 85%
info
Tool: ping manifest_parser · 70%
info
Tool: create_event manifest_parser · 85%
info
Tool: register_user manifest_parser · 85%
info
Tool: Alice manifest_parser · 75%
info
Tool: read manifest_parser · 75%
info
Tool: write manifest_parser · 75%
info
Tool: edit manifest_parser · 75%
info
Tool: bash manifest_parser · 75%
info
Tool: grep manifest_parser · 75%
info
Tool: find manifest_parser · 75%
info
Tool: ls manifest_parser · 75%
info
Required env vars (94) manifest_parser · 80%
high
High-risk OAuth scope: https://www.googleapis.com/auth/cloud-platform oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 373 components sbom_generator · 100%
critical
RSA Private Key found in vercel-ai-56d492f/packages/google-vertex/src/edge/google-vertex-auth-edge.ts secret_scanner · 95%
high
Generic API Key Assignment found in vercel-ai-56d492f/content/providers/01-ai-sdk-providers/00-ai-gateway.mdx secret_scanner · 75%
high
Generic API Key Assignment found in vercel-ai-56d492f/content/providers/03-observability/confident-ai.mdx secret_scanner · 75%
high
Generic API Key Assignment found in vercel-ai-56d492f/content/providers/05-community-providers/49-cencori.mdx secret_scanner · 75%
high
Generic API Key Assignment found in vercel-ai-56d492f/content/providers/05-community-providers/36-requesty.mdx secret_scanner · 75%
high
Generic API Key Assignment found in vercel-ai-56d492f/content/providers/05-community-providers/42-supermemory.mdx secret_scanner · 75%
high
Generic API Key Assignment found in vercel-ai-56d492f/content/providers/05-community-providers/11-cloudflare-ai-gateway.mdx secret_scanner · 75%
high
Generic API Key Assignment found in vercel-ai-56d492f/content/providers/05-community-providers/32-openrouter.mdx secret_scanner · 75%
high
Generic API Key Assignment found in vercel-ai-56d492f/content/providers/05-community-providers/25-llamagate.mdx secret_scanner · 75%
high
Generic API Key Assignment found in vercel-ai-56d492f/content/providers/05-community-providers/33-portkey.mdx secret_scanner · 75%
high
Hardcoded Password found in vercel-ai-56d492f/content/cookbook/05-node/57-mcp-elicitation.mdx secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%