On November 2, 2026, Vercel rolled out a suite of infrastructure and developer tooling updates focused on expanding AI integrations via the Model Context Protocol (MCP), accelerating Sandbox environments, and hardening npm supply chain security for all users.
Deep AI Integrations with MCP and ChatGPT
In the AI and developer assistant space, Vercel significantly enhanced its Model Context Protocol (MCP) support. Vercel MCP now renders deployments as interactive cards directly within ChatGPT and MCP Apps-compatible applications. Developers can monitor build statuses, inspect commits, forward logs into chat for AI-assisted debugging, or switch between linked projects on the fly.
Concurrently, Vercel transitioned to supporting Client ID Metadata Documents (CIMD) under the updated MCP authentication standard. Any MCP client can now initiate connection requests without requiring Vercel's manual allowlisting, while the authorization screen clearly surfaces the domain and provenance of the document.
2.4x Faster Sandboxes with Vercel Drives
On the performance and infrastructure front, Vercel Sandboxes attached to Vercel Drives deliver up to a 2.4x acceleration in boot times. Key latency improvements include:
* Median sandbox creation time: Dropped from 1.7 seconds to 0.7 seconds. * p95 latency: Decreased from 2.2 seconds to 1.6 seconds.
This optimization applies automatically to all Sandboxes backed by Drives, requiring no SDK upgrades or adjustments to pricing.
Automated Defense Against Malicious npm Packages
To strengthen build pipeline security, Vercel introduced automated blocking for malicious npm packages across two distinct stages: scanning lockfiles prior to installation and intercepting package downloads during install time. If a package flagged for containing malware or known critical vulnerabilities is detected, the deployment immediately aborts and the impacted build cache is purged.
vercel.toml and Enhanced Feature Flagging
Additionally, Vercel introduced support for 'vercel.toml', offering developers a flatter, comment-friendly alternative to 'vercel.json'. The Vercel Flags management system also gained Project Connections, allowing teams to share and evaluate flags across projects using deployment identities and OIDC tokens instead of manually copying SDK keys. Alongside this, the Flags Explorer inside the Vercel Toolbar has been redesigned to streamline sharing overrides among team members.