Vercel agent runtimes: Python, Daemons, Drives

An agent runtime on Vercel is the set of processes that have to outlive one HTTP request: a Python backend, a Daemon that pulls work, a Sandbox with a Drive, and Connect when the agent needs another system. It is for founders, AI architects, creators, and people who ship SaaS or an agent platform and have to pick a runtime. The constraint is that general availability and public beta were published on the same 15 October 2026 changelog, so "Python is GA" does not make Daemons, MCP Events, or Enterprise-Managed Authorization generally available. Start from Python on Vercel is now generally available.

The narrative of the June tour is the Ship 2026 recap guide. The four calls are in the audience decision matrix on this page. The essay that ties them together is Vercel Ship 2026 decisions for people who ship agents.

Watch the recording

Keynote - Ship 26 London is the official Vercel recording of the London morning keynote, where the Agent Stack was walked through in the room. The written stack is still the Agent Stack post. The October runtime notes below are newer than that keynote.

Two shapes of compute

Keep the shapes apart or the architecture memo will lie.

A request path accepts HTTP, does the work, and returns. Dockerfile support is this shape. Dockerfile.vercel builds an image, Fluid compute runs it, and the process listens on $PORT. The page says the container is stateless.

A pull path waits on a queue, a database, or someone else's control plane. Vercel Daemons are this shape, and they are in public beta. You package the worker with a Dockerfile or Containerfile, then declare a daemons entry with a root, an entrypoint, a command, and a replica count per region. The changelog's example is one Celery worker in iad1. Daemons run on Fluid compute beside the app. Vercel restarts instances that exit. There is no inbound HTTP server in that design.

Services are the request-path way to put more than one build in a single project. The docs mark Services as beta. Public routes are top-level rewrites. A binding is how one service calls another without a public URL. The same docs point a worker that pulls its own work at Daemons. Services stay on the request path. A project may declare both. Declaring both does not promote Daemons out of beta.

Python is generally available. Several Python SDKs are not.

Python on Vercel says Python is now a first-class language and runtime. FastAPI, Flask, and Django are recognized automatically. The runtime is CPython on Linux, with uv and pyproject.toml. The post shows a frontend and a FastAPI backend deployed together through Services, which remain beta in the docs even though the Python runtime post is a GA announcement.

Read the SDK list on that Python page as a status table. Each row has its own mark:

• Sandbox, Connect, and Blob have Python SDK entries on the page.
• The AI SDK for Python is marked beta.
• The Workflow SDK for Python is marked beta.
• Queues are marked beta.

Adopt the runtime when the backend is already Python. Keep the beta SDKs off the critical path until you have read the current page and accepted the beta.

The Ship page links the same Python work as a current announcement. Use the changelog above for the sentences you are willing to repeat.

Drives are persistent. The Sandbox is not.

Vercel Drives are generally available for Vercel Sandbox on Hobby, Pro, and Enterprise. A Drive mounts as a directory. Files stay after the sandbox stops, so a later run or another sandbox can mount the same Drive. The page names agent workspaces, file-based memory, datasets, models, dependencies, and build artifacts as the uses. A fork inherits the source data, region, and maximum size, then stores its own changes, so parallel workers do not write on each other.

Drives do not make the sandbox a production database. The sandbox is still an isolated microVM, as described on the Agent Stack page. The Drive is the piece that outlives that VM. An earlier private-beta note said drives were not for production data. The GA page does not repeat that ban. It also does not say a Drive replaces a database. Put durable product records in a database. Put the workspace you would hate to rebuild in a Drive.

Connect events and workforce authorization

Connect itself is generally available. The rule on that page is a short-lived, scoped token requested at runtime. That is Vercel Connect is now generally available.

Two 15 October 2026 additions stay in public beta:

• MCP Events subscribe to events from a compatible MCP server. The documented functions are experimental_subscribe and experimental_verifyMcpEvent. An experimental prefix is a status. Treat the API as beta even if the product headline says public beta.
• Enterprise-Managed Authorization is public beta. Administrators grant or revoke access in the identity provider. Users sign in with a corporate account. The app requests scopes, and Connect exchanges and renews tokens. Access stays inside the approved scopes and the user's existing permissions. The page names Vercel Passport and Slack's MCP server as the worked example.

Chat SDK remains the channel layer from the Agent Stack. It is how an agent shows up in Slack or GitHub. The runtime underneath is still the request path or a Daemon.

Vercel Agent is a reviewer with a keyboard, still in public beta

The expanded Agent changelog is the page for dashboard chat, production investigations, and approved actions. It is public beta, Pro and Enterprise, gradual rollout, read-only until you approve a scoped plan. Sandbox runs the generated code before production. That is the consideration for an AI architect: the value is the production context, and the cost is an identity, an approval, and a token bill you have not put through review.

What to check before you change a production runtime

Use this list against the matrix. If a box fails, the call on that row stands.

1. Name the shape. Request and response, or pull from a queue. Containers and Daemons answer different sentences.
2. Name the status on today's primary page. Python runtime: generally available. Services: beta. Daemons, MCP Events, Enterprise-Managed Authorization, and Vercel Agent's approved actions: public beta. Drives: generally available.
3. Name the secret. Connect should mint a short-lived token. A long-lived provider token in the environment is the pattern the Connect GA note replaces.
4. Name what is allowed to survive a crash. A Drive can hold a workspace. A product ledger still wants a database.
5. Name the human approval. Vercel Agent does not get a standing write on production. The public beta note says it asks first.

The audience decision matrix is the same five checks collapsed to one call per audience.