agent-vercel

Answers the questions the vercel CLI cannot — which deploy is live across these projects, why this build failed, what env var is missing in prod, what DNS record is absent; all read-oriented, cross-project and historical

Credential and scope are separate axes — one keychain-stored token reaches many teams, so --auth picks the secret and --scope picks the team

The token has no way out — stored in the keychain, never printed, and there is no command to read it back

Fifteen command domains — auth, scope, deployment, project, env, domain, alias, firewall, cache, billing, webhook, drains, edge-config, api and config

Deployment triage end to end — list, get, checks, routes, what is current, build logs and runtime logs

Env diffing across environments without printing secret values, plus shared env vars and pull

Domain and cert work in one place — inspect intended vs actual nameservers, list DNS records, bulk cert expiry triage, and which project an apex is attached to

Firewall visibility — WAF config, live attack status and bypass rules

CDN cache invalidation by tag

Spend, broken down — charges by service, project or region, plus consumption

Observability plumbing — webhooks and log/trace/analytics drains, so you can see where data is being shipped

Mutation safety — promote, rollback, cancel, redeploy, env writes, domain and alias changes and cache purges all require --yes

Raw REST escape hatch for anything not yet wrapped

Tested offline against a fixture Vercel server, with opt-in live read-only shape checks