EVE + Vercel AI SDK (Server-Only)

Compatibility: Experimental integration — structurally implemented but not included in the supported release-candidate adapter matrix.

The Vercel AI SDK adapter governs tool calls on the server so CoreGuard makes a deterministic ALLOW / BLOCK / MODIFY decision before a tool executes. This adapter is classified as server-only / gateway-enforced: governance runs in your server-side runtime, not in the browser. The adapter is structurally implemented, but the Vercel AI SDK was not installed during release-candidate validation, so it was not validated against a pinned live version and is marked UNTESTED / experimental. Only the generic adapter is SUPPORTED.

How governance works here

Tool execution happens server-side and is submitted to EVE before it runs. No LLM is in the decision path. Govern in your server route/handler, not in client code:

// eve-ai-governance is verification-only; enforce from Node via the REST API.
// Inside a server-side route handler, before executing a tool the model requested:
const res = await fetch("https://api.eveaicore.com/v1/decisions/evaluate", {
  method: "POST",
  headers: { Authorization: "Bearer eve_sk_...", "Content-Type": "application/json" },
  body: JSON.stringify({
    request_id: "req-001", tenant_id: "org_123",
    proposed_action: { type: "create_order", sku: "SKU-4410", qty: 2 },
    model_output: { decision: "approve", confidence: 0.85 },
    context: {},
    policy_set: "orders_v1",
  }),
});
const { decision, risk } = await res.json();

if (decision.status === "BLOCKED") {
  // do not execute the tool; return decision.reason_codes to the client
} else {
  await createOrder({ sku: "SKU-4410", qty: 2 });
}

eve-ai-governance (0.3.1, ESM, Node >= 18) is published on npm. It is an offline verification library — e.g. import { verifyDecisionCertificate } from "eve-ai-governance";. It never signs and holds no secrets, and there is no TypeScript enforcement client; enforce from Node via the REST API.

Hardened alternative

Keep tool execution and governance strictly server-side. Do not attempt to govern in the browser — the browser can only run the offline evidence verifier, never signing or the authoritative decision. For a boundary a direct call cannot route around:

• Put tools behind a restricted server-side tool registry so tools are only reachable through the governed server path.
• Proxy tool execution through a sidecar so governance runs out-of-process.
• Apply network enforcement so tool endpoints are only reachable via the governed path.

Readiness

• This adapter: experimental (server-only; UNTESTED against a pinned live Vercel AI SDK version).
• Generic TypeScript client: SUPPORTED for its client surface (govern via hosted mode, offline verify).
• EVE SDK core: RELEASE CANDIDATE WITH EXCLUSIONS.

Limitations

• Server-only: governance and any signing run in your server runtime, never in the browser. The browser can run only the offline verifier.
• Not validated against a pinned live framework version.
• ESM only; Node >= 18. Hosted mode requires a reachable endpoint.
• Evidence verification proves authenticity and integrity, not decision correctness; independent verification needs the ECDSA P-384 public key.