vercel-mcp

Switch between Vercel accounts instead of logging out. A vgate CLI plus an MCP server, so scripts and AI agents can change accounts too.

Why

The Vercel CLI holds one login at a time, machine-wide. Work on a client account for ten minutes and your own project's vercel deploy quietly starts targeting the wrong place — or fails with Not authorized. The usual fix, vercel logout followed by vercel login, means an email round-trip every single time.

Worse is the silent version: a saved credential that has expired. You get a bare 401 with no hint that the token simply aged out, because the access token was snapshotted without the refresh token or the expiry that would have explained it.

vgate stores the complete credential — token, refresh token, and expiry — for every account, tells you at a glance which ones are still good, and switches between them instantly.

It has no logout command, on purpose. vercel logout destroys the only credential on the machine. Switch instead.

Install

# Homebrew
brew tap ml-lubich/tap && brew install vgate

# pipx
pipx install vercel-mcp

# uv
uv tool install vercel-mcp

Quickstart

Log in once per account, saving each one as you go:

vercel login you@personal.com   && vgate sync
vercel login you@client.com     && vgate sync

Then switch whenever you like:

$ vgate ls
  #  email               username   teams  token
  1  you@personal.com    you           2  valid     active
  2  you@client.com      you-client    1  expiring-soon

$ vgate switch you@client.com
switched to you@client.com

$ vgate whoami
you@client.com  valid
team: client-projects

switch takes an email, a username, or the row number — so it works unattended in scripts and CI, not just as an interactive picker.

Commands

Run vgate sync after every vercel login — that is what makes an account switchable later.

MCP server

Register vgate-mcp with any MCP client to let an agent manage accounts:

{
  "mcpServers": {
    "vgate": {
      "command": "vgate-mcp"
    }
  }
}

Tools exposed: list_accounts, switch_account, whoami, use_team, doctor.

How it compares

Prior art: khanakia/vercelgate, a Go tool with the same goal.

Security

• Credentials live in ~/.config/vercel-mcp/accounts.json, written with 0600 (owner-only) permissions.
• auth.json is copied to auth.json.bak before every switch, so a bad switch is recoverable.
• Nothing leaves your machine except calls to api.vercel.com to identify a token.
• No logout command exists, by design.

Development

uv sync --locked --extra dev
uv run pytest -q
uv run ruff check .

The test command enforces an aggregate line-coverage floor of 80%.

The pytest configuration measures vercel_mcp and fails the suite below 80% aggregate line coverage. Tests use isolated temporary configuration and fake HTTP responses; they do not switch real Vercel accounts or call the live API.

License

MIT © 2026 Misha Lubich