In the AI Enablement Stack, Blekline is Layer 4 and Vercel Sandbox is Layer 1 (Firecracker microVMs for untrusted / AI-generated code).
This is not Blekline hosting on Vercel — it is running agent code execution in Vercel Sandbox while Blekline governs MCP tool calls at the ingress.
| Layer | Product | Role |
|---|---|---|
| L4 | Blekline | Mask prompts, classify risk, govern MCP tool calls, audit |
| L1 | Vercel Sandbox | Isolated microVM, Node/Python runtimes, ms cold start |
Wiring
- Connect
@blekline/mcp-proxy— MCP proxy - Use
@vercel/sandboxin your agent app for code execution - Optionally connect Vercel MCP for deploy/project ops (separate from sandbox execution)
export BLEKLINE_DOWNSTREAM_SERVER=vercel
export BLEKLINE_WORKSPACE_TOKEN=blw_...
# Vercel Sandbox auth via OIDC in CI or access token locally
Flow: L5 Agent → L4 Blekline proxy → your agent orchestrator → L1 Vercel Sandbox microVM.
See Vercel Sandbox docs and durable AI agent guide.
Next steps: Sandbox providers · AI Enablement Stack · MCP proxy · Open workspace