The deploy platform's 'eve' is an open source framework for building AI software that carries out multi step tasks; 'Passport' aims to bring employee built AI tools under enterprise oversight.
Vercel is making one argument with two products this week. The deploy platform released eve, an open source framework for building AI "agents" (software that can carry out multi-step tasks on a user's behalf), at its Ship event in London, and paired it with Passport, a product aimed at the AI tools employees build without IT oversight, the so-called "shadow AI" problem.
Vercel is also arguing that the build problem and the control problem have to be solved together, and that open source is what makes both sides credible to the same buyer. That puts the company in direct conversation with the agent-framework vendors on one side and the enterprise AI governance vendors on the other.
eve is published on GitHub under the Apache 2.0 license, written in TypeScript. An agent is a directory of files that defines instructions, skills, model provider, tools, authentication, channels, and schedule. The project structure is filesystem-first: each concern — tools, channels, skills, schedules — lives in a named subdirectory of an agent/ folder, and eve discovers them by location. The framework documentation describes sandboxed execution as a core primitive, with a sandbox/ directory slot for controlled workspaces. The framework ships with a testing mechanism that exercises the agent and scores the result. Developers can run npx eve dev locally, and the default deploy target is Vercel's own platform.
Those design choices are not arbitrary. A directory-as-agent model is exactly the kind of structured, inspectable artifact a governance layer can hook into. The sandboxed-execution default gives Passport something concrete to audit. The built-in evaluation mechanism produces signal a control surface can record. The framework's primitives are the prerequisites for the governance story Vercel is also selling.
Vercel CTO Malte Ubl framed the release in an on-record interview with The Register's Tim Anderson. The company wants developers to be able to "fill in the blanks" rather than wrestle with the choices existing agent frameworks force them to make. Ubl's argument is that the next layer of infrastructure is decided by what is easiest to stand up, not what is most powerful in isolation.
That argument has a built-in tension. Vercel is, in part, a hosting and deploy business. The default deploy target for eve is Vercel, and the AWS-via-Vercel cost question is already on the project's own issue tracker. Ubl told The Register that the premium of consuming AWS indirectly through Vercel is offset by more efficient use of compute. That is a company-positioned claim, not an independent benchmark, and it is the kind of cost math enterprise buyers will want to verify before they sign.
There is a smaller, sharper criticism on the same issue tracker: a user reported that eve requires a Vercel login even when configured to use a different model provider. For a framework that is supposed to be open and provider-agnostic, that login requirement is a friction point worth watching.
The governance half of the bet, Passport, is less well described in the public material so far. Vercel is positioning it as a way to bring employee-built AI applications under enterprise control. The company's public materials and the available reporting do not detail whether Passport operates at an identity layer, an enterprise gateway, a policy and observability surface, or some combination. That architectural detail will determine whether Passport lands as a credible enterprise product or as a marketing wrapper over the same hosting infrastructure Vercel already sells.
What to watch: whether Passport turns out to be a distinct governance control plane or a thin rebrand of Vercel's existing access and deploy products, and whether the open source release attracts the kind of community contributions that turn eve from a Vercel project into a de facto standard for directory-based agents. The build story and the control story are linked, and Vercel has made the first move on both.