From 2bddcdeeac6e93fe6e1e055a028ff2ebab47fe63 Mon Sep 17 00:00:00 2001 From: glitchwhostolexmas Date: Mon, 24 Aug 2026 14:55:12 -0400 Subject: [PATCH 1/3] feat(vercel_ai): add privileged tool approval rule Co-authored-by: Cursor --- vercel_ai/approvals.yaml | 55 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 vercel_ai/approvals.yaml diff --git a/vercel_ai/approvals.yaml b/vercel_ai/approvals.yaml new file mode 100644 index 0000000..6099fad --- /dev/null +++ b/vercel_ai/approvals.yaml @@ -0,0 +1,55 @@ +policy: + id: vercel_ai_approvals + name: Vercel AI SDK tool approval gates + category: vercel_ai + description: > + Rules covering the human-in-the-loop approval gate the Vercel AI SDK + offers on sensitive tool calls. needsApproval on tool() and dynamicTool() + is deprecated in SDK 7 in favor of toolApproval at the agent or call + level, but its default is false everywhere, so a privileged tool ships + un-gated unless the author opts in. + +rules: + - id: VAI-013 + title: Privileged tool has no needsApproval gate + severity: high + confidence: 0.7 + language: typescript + applies_to: + - vercel_ai_tool + scope: tool + match: + all: + - any: + - has_shell_call: true + - has_code_exec_call: true + - has_write_call: true + - any: + - not: + tool_decorator_kwarg_present: + - needsApproval + - tool_decorator_kwarg_value: + kwarg: needsApproval + value: "false" + explanation: > + This Vercel AI SDK tool shells out, executes dynamic code, or writes the + filesystem, but has no needsApproval gate — the option is absent or + explicitly set to false. needsApproval is the Vercel AI SDK's + human-in-the-loop gate for sensitive tool calls, and its default is + false — so an un-gated privileged tool executes attacker-influenced + model output with no human checkpoint. Passing true or a per-call + approval function both count as a gate and do not fire. This complements + VAI-001 (subprocess), VAI-002 (eval / new Function), and write-path + rules: those flag the dangerous call; VAI-013 flags the missing approval + gate around it. SDK 7 deprecated needsApproval on tool() in favor of + toolApproval on generateText, streamText, or ToolLoopAgent; existing + code still works, but new code should migrate approval to the call or + agent level. + fix: > + Pass needsApproval: true to the tool() or dynamicTool() options for + tools that execute commands, run code, or mutate the filesystem, and + handle the resulting approval requests in your agent loop. For SDK 7+, + prefer configuring toolApproval on generateText, streamText, or + ToolLoopAgent instead. If approval is intentionally automated for a + trusted tool, gate the agent with input validation and document the + decision. From 3dd058407a147de8a7235503717dbdff1077cd44 Mon Sep 17 00:00:00 2001 From: "Calvin V." Date: Mon, 24 Aug 2026 15:08:04 -0400 Subject: [PATCH 2/3] docs(vercel_ai): clarify SDK 7 approval boundary --- vercel_ai/approvals.yaml | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/vercel_ai/approvals.yaml b/vercel_ai/approvals.yaml index 6099fad..d72df49 100644 --- a/vercel_ai/approvals.yaml +++ b/vercel_ai/approvals.yaml @@ -4,10 +4,8 @@ policy: category: vercel_ai description: > Rules covering the human-in-the-loop approval gate the Vercel AI SDK - offers on sensitive tool calls. needsApproval on tool() and dynamicTool() - is deprecated in SDK 7 in favor of toolApproval at the agent or call - level, but its default is false everywhere, so a privileged tool ships - un-gated unless the author opts in. + offers on sensitive tool calls. This policy inspects only the tool-level + needsApproval option, which defaults to false when omitted. rules: - id: VAI-013 @@ -41,15 +39,14 @@ rules: approval function both count as a gate and do not fire. This complements VAI-001 (subprocess), VAI-002 (eval / new Function), and write-path rules: those flag the dangerous call; VAI-013 flags the missing approval - gate around it. SDK 7 deprecated needsApproval on tool() in favor of - toolApproval on generateText, streamText, or ToolLoopAgent; existing - code still works, but new code should migrate approval to the call or - agent level. + gate around it. SDK 7 moved approval to toolApproval on generateText, + streamText, or ToolLoopAgent. This tool-scoped rule cannot verify that + separate setting, so a finding in SDK 7 code requires manual review. fix: > Pass needsApproval: true to the tool() or dynamicTool() options for tools that execute commands, run code, or mutate the filesystem, and - handle the resulting approval requests in your agent loop. For SDK 7+, - prefer configuring toolApproval on generateText, streamText, or - ToolLoopAgent instead. If approval is intentionally automated for a - trusted tool, gate the agent with input validation and document the - decision. + handle the resulting approval requests in your agent loop. SDK 7+ uses + toolApproval on generateText, streamText, or ToolLoopAgent, but this rule + cannot yet verify that call or agent-level setting. If approval is + intentionally automated for a trusted tool, gate the agent with input + validation and document the decision. From 537731a33eff5cf052a310019f716158c5f2a45b Mon Sep 17 00:00:00 2001 From: "Calvin V." Date: Mon, 24 Aug 2026 15:54:12 -0400 Subject: [PATCH 3/3] fix(vercel_ai): narrow approval rule scope --- vercel_ai/approvals.yaml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/vercel_ai/approvals.yaml b/vercel_ai/approvals.yaml index d72df49..599245f 100644 --- a/vercel_ai/approvals.yaml +++ b/vercel_ai/approvals.yaml @@ -21,7 +21,6 @@ rules: - any: - has_shell_call: true - has_code_exec_call: true - - has_write_call: true - any: - not: tool_decorator_kwarg_present: @@ -30,22 +29,22 @@ rules: kwarg: needsApproval value: "false" explanation: > - This Vercel AI SDK tool shells out, executes dynamic code, or writes the - filesystem, but has no needsApproval gate — the option is absent or + This Vercel AI SDK tool shells out or executes dynamic code, but has no + needsApproval gate — the option is absent or explicitly set to false. needsApproval is the Vercel AI SDK's human-in-the-loop gate for sensitive tool calls, and its default is false — so an un-gated privileged tool executes attacker-influenced model output with no human checkpoint. Passing true or a per-call approval function both count as a gate and do not fire. This complements - VAI-001 (subprocess), VAI-002 (eval / new Function), and write-path - rules: those flag the dangerous call; VAI-013 flags the missing approval - gate around it. SDK 7 moved approval to toolApproval on generateText, + VAI-001 (subprocess) and VAI-002 (eval / new Function): those flag the + dangerous call; VAI-013 flags the missing approval gate around it. SDK 7 + moved approval to toolApproval on generateText, streamText, or ToolLoopAgent. This tool-scoped rule cannot verify that separate setting, so a finding in SDK 7 code requires manual review. fix: > Pass needsApproval: true to the tool() or dynamicTool() options for - tools that execute commands, run code, or mutate the filesystem, and - handle the resulting approval requests in your agent loop. SDK 7+ uses + tools that execute commands or run code, and handle the resulting + approval requests in your agent loop. SDK 7+ uses toolApproval on generateText, streamText, or ToolLoopAgent, but this rule cannot yet verify that call or agent-level setting. If approval is intentionally automated for a trusted tool, gate the agent with input