> ## Documentation Index
> Fetch the complete documentation index at: https://tbd-6fc993ce-hypeship-connect-registry-connector.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Eve Extension

> Give your Vercel Eve agent a Kernel cloud browser in 1 loc

## Overview

The [`@onkernel/eve-extension`](https://www.npmjs.com/package/@onkernel/eve-extension) package is a [Vercel Eve](https://vercel.com/eve) extension that gives your agent a Kernel cloud browser. Mount it and Kernel's browser toolset plus a `browse` skill show up under your mount automatically, so there's no browser tool code to write or maintain. See [included tools and skills](#included-tools-and-skills) for the full toolset.

The tools aren't reimplemented in the extension. It packages a single MCP connection to [Kernel's hosted MCP server](https://github.com/onkernel/kernel-mcp-server), and Eve discovers the tools at runtime under your mount namespace (e.g. `kernel__browser__manage_browsers`).

You can authenticate through [Vercel Connect](https://vercel.com/connect) or with a static Kernel API key. Connect is the recommended setup: no API key touches your app, and each user authenticates as themselves. Either way it's 1 loc, and you pick the auth model in the mount config.

## Prerequisites

* **Node 24+**
* An Eve agent project running **Eve `>= 0.25`**, which extensions require. Older Eve silently ignores `agent/extensions/` and nothing mounts. If you don't have a project yet:
  ```bash theme={null}
  npx eve@latest init my-agent && cd my-agent
  ```
* A [Kernel account](https://dashboard.onkernel.com), with either a Vercel Connect Kernel connector (recommended path below) or a Kernel API key

## Setup with Vercel Connect (recommended)

Vercel Connect is the recommended path because:

* No key touches your app, environment, or the model.
* Each user authenticates as themselves with a one-time consent that's cached afterward.
* Per-user identity is a good fit for Kernel's [managed auth](/auth/overview).

**1. Install** the extension:

```bash theme={null}
pnpm add @onkernel/eve-extension
```

**2. Create and attach the Kernel connector** in Vercel Connect. Name it `eve-extension` so the mount snippet works unedited:

```bash theme={null}
vercel connect create kernel --name eve-extension
vercel connect attach kernel/eve-extension
```

`kernel` is Kernel's entry in Vercel's connector registry, so Vercel fills in the MCP URL, auth type, and branding, then opens your browser for the authorization step. You can also add it from the Vercel dashboard under **Connectors → Browse all → Kernel**. Confirm the UID with `vercel connect list`.

**3. Mount the extension** in one line, passing the connector UID:

```typescript theme={null}
// agent/extensions/kernel.ts
import kernel from "@onkernel/eve-extension";

export default kernel({ connect: "kernel/eve-extension" });
```

**4. Run it:**

```bash theme={null}
npx eve dev     # or: npx eve deploy
```

Leave `KERNEL_API_KEY` unset. The first time a user drives the browser, Eve surfaces a Connect consent prompt; they approve once and it's cached from then on, persisting across threads and sessions.

<Note>
  Connectors created before Kernel was in the registry keep working. Leave them as they are and point `connect` at the UID `vercel connect list` prints for them, e.g. `mcp.onkernel.com/eve-extension`.
</Note>

## Included tools and skills

Once mounted, the agent has the following tools, namespaced under your mount (e.g. `kernel__browser__*`; discover the exact names via `connection_search`):

* **`manage_browsers`**: create, list, get, and delete browser sessions. Returns a `session_id` and a `live_view_url` you can watch or take over.
* **`execute_playwright_code`**: run Playwright against the live page to read, navigate, click, or type.
* **`computer_action`**: human-like mouse, keyboard, and screenshot controls for the same session.
* **`manage_auth_connections`**: Kernel's [managed auth](/auth/overview), so the agent logs into sites through a stored connection or a hosted login flow instead of typing credentials into the page.
* **`manage_profiles`**: create and reuse browser [profiles](/auth/profiles) (persistent cookies, logins, storage).
* **`manage_proxies`**: create and attach [proxies](/proxies/overview) (datacenter, ISP, residential, mobile) with geo-targeting.
* **`manage_replays`**: start, stop, and list video replay recordings for a session, so you can capture what the agent did as an MP4. Requires a paid Kernel plan.
* the **`browse` skill**: the loop the model follows to drive the browser end to end.

The `browse` skill runs autonomously but is human-in-the-loop friendly:

* It surfaces the live-view URL so you can take over.
* It hands off for sign-ins, ambiguous choices, and sensitive actions.
* It defaults to Kernel managed auth for authenticated sites.

A few heavier tools are off by default to keep an autonomous agent's blast radius small on a shared API key. Add any of them via a [connection override](#overriding-the-connection):

* `browser_curl`: raw HTTP through the session.
* `manage_credentials`: create, read, and delete stored credentials (the managed-auth flow above works without it).
* `exec_command`: shell exec in the VM.
* `manage_browser_pools`: manage pools of pre-warmed browsers.

<Warning>
  The default mount has no approval gate, and its toolset can run arbitrary JS in the browser VM (`execute_playwright_code`) and reuse logged-in sessions (`manage_auth_connections`). On a shared `KERNEL_API_KEY`, every agent user effectively acts as your whole org.

  * For a **personal or single-tenant** agent, the default is fine.
  * For **team or multi-tenant** deployments, add an approval gate via a [connection override](#overriding-the-connection): `approval: once()` (per session) or `approval: always()` (every controlled action).
</Warning>

## Authenticate with an API key instead

One shared credential, no connector setup. A good fit for a single-tenant or personal agent.

**1. Install** the extension:

```bash theme={null}
pnpm add @onkernel/eve-extension
```

**2. Get a Kernel API key** at [dashboard.onkernel.com/api-keys](https://dashboard.onkernel.com/api-keys) and set it in the agent's environment:

```bash theme={null}
# local dev: in the agent's .env.local
KERNEL_API_KEY=sk_...

# deploying to Vercel
npx vercel env add KERNEL_API_KEY
```

**3. Mount the extension** in a single file that reads `KERNEL_API_KEY` from the environment:

```typescript theme={null}
// agent/extensions/kernel.ts
export { default } from "@onkernel/eve-extension";
```

**4. Run:** `npx eve dev` or `npx eve deploy`.

To pass the key explicitly instead of via the environment:

```typescript theme={null}
// agent/extensions/kernel.ts
import kernel from "@onkernel/eve-extension";

export default kernel({ apiKey: process.env.KERNEL_API_KEY });
```

### Configuration

`kernel({ ... })` accepts:

| Option    | Default                  | Purpose                                                                                   |
| --------- | ------------------------ | ----------------------------------------------------------------------------------------- |
| `connect` | None                     | Vercel Connect connector UID that brokers a per-user token, so no API key is used.        |
| `apiKey`  | `KERNEL_API_KEY` env var | Kernel API key bearer token. Used when `connect` is not set; read lazily at request time. |

When `connect` is set it takes precedence. Otherwise the key is read from `apiKey`, and failing that from `KERNEL_API_KEY`.

## Overriding the connection

You only need this for advanced customization: widening the tool allowlist or adding an approval gate before irreversible actions. Auth is handled by the mount config above, so you don't override for that.

Mount the extension as a directory and name the connection file `browser.ts` to shadow the extension's built-in `browser` connection:

```
agent/extensions/kernel/
  extension.ts             # export default kernel({ connect: "kernel/eve-extension" })
  connections/browser.ts   # shadows the extension's "browser" connection
```

```typescript theme={null}
// agent/extensions/kernel/connections/browser.ts
import { defineMcpClientConnection } from "eve/connections";
import { connect } from "@vercel/connect/eve";
import { always } from "eve/tools/approval";

export default defineMcpClientConnection({
  url: "https://mcp.onkernel.com/mcp",
  description: "Kernel cloud browser.",
  auth: connect("kernel/eve-extension"), // or { getToken: async () => ({ token: process.env.KERNEL_API_KEY! }) }
  tools: {
    allow: [
      "manage_browsers",
      "execute_playwright_code",
      "computer_action",
      "browser_curl", // high blast radius: raw HTTP through the session
      "manage_auth_connections",
      "manage_credentials", // high blast radius: create/read/delete stored credentials
      "manage_profiles",
      "manage_proxies",
      "manage_replays",
      "manage_browser_pools", // heavier tools, off by default
      "exec_command", // high blast radius: shell exec in the VM
    ],
  },
  approval: always(), // re-check every controlled action; once() would auto-allow the rest of the session
});
```

## Additional resources

<CardGroup cols={3}>
  <Card title="Vercel Eve" icon="robot" href="https://vercel.com/eve">
    Vercel's agent framework
  </Card>

  <Card title="Kernel MCP Server" icon="github" href="https://github.com/onkernel/kernel-mcp-server">
    The hosted MCP server the extension connects to
  </Card>

  <Card title="Managed Auth" icon="key" href="/auth/overview">
    Log agents into sites without handling credentials
  </Card>
</CardGroup>

## Related

* [Vercel Marketplace Integration](/integrations/vercel/marketplace)
* [AI SDK Tool](/integrations/vercel/ai-sdk)
* [Browser Creation](/introduction/create)
* [Live View](/browsers/live-view)