Eve Extension

Overview

The @onkernel/eve-extension package is a Vercel Eve extension that gives your agent a Kernel cloud browser. Mount it and Kernel's browser toolset plus a browse skill show up under your mount automatically, so there's no browser tool code to write or maintain. See included tools and skills for the full toolset.

The tools aren't reimplemented in the extension. It packages a single MCP connection to Kernel's hosted MCP server, and Eve discovers the tools at runtime under your mount namespace (e.g. kernel__browser__manage_browsers).

You can authenticate through Vercel Connect or with a static Kernel API key. Connect is the recommended setup: no API key touches your app, and each user authenticates as themselves. Either way it's 1 loc, and you pick the auth model in the mount config.

Prerequisites

• Node 24+
• An Eve agent project running Eve >= 0.25, which extensions require. Older Eve silently ignores agent/extensions/ and nothing mounts. If you don't have a project yet:

  npx eve@latest init my-agent && cd my-agent

• A Kernel account, with either a Vercel Connect Kernel connector (recommended path below) or a Kernel API key

Setup with Vercel Connect (recommended)

Vercel Connect is the recommended path because:

• No key touches your app, environment, or the model.
• Each user authenticates as themselves with a one-time consent that's cached afterward.
• Per-user identity is a good fit for Kernel's managed auth.

1. Install the extension:

pnpm add @onkernel/eve-extension

2. Create and attach the Kernel connector in Vercel Connect. Name it eve-extension so the mount snippet works unedited:

vercel connect create mcp.onkernel.com --name eve-extension
vercel connect attach mcp.onkernel.com/eve-extension

You can also add it from the Vercel dashboard under Connectors → Browse all → Kernel. Confirm the UID with vercel connect list.

3. Mount the extension in one line, passing the connector UID:

// agent/extensions/kernel.ts
import kernel from "@onkernel/eve-extension";

export default kernel({ connect: "mcp.onkernel.com/eve-extension" });

4. Run it:

npx eve dev     # or: npx eve deploy

Leave KERNEL_API_KEY unset. The first time a user drives the browser, Eve surfaces a Connect consent prompt; they approve once and it's cached from then on, persisting across threads and sessions.

Included tools and skills

Once mounted, the agent has the following tools, namespaced under your mount (e.g. kernel__browser__*; discover the exact names via connection_search):

• manage_browsers: create, list, get, and delete browser sessions. Returns a session_id and a live_view_url you can watch or take over.
• execute_playwright_code: run Playwright against the live page to read, navigate, click, or type.
• computer_action: human-like mouse, keyboard, and screenshot controls for the same session.
• manage_auth_connections: Kernel's managed auth, so the agent logs into sites through a stored connection or a hosted login flow instead of typing credentials into the page.
• manage_profiles: create and reuse browser profiles (persistent cookies, logins, storage).
• manage_proxies: create and attach proxies (datacenter, ISP, residential, mobile) with geo-targeting.
• manage_replays: start, stop, and list video replay recordings for a session, so you can capture what the agent did as an MP4. Requires a paid Kernel plan.
• the browse skill: the loop the model follows to drive the browser end to end.

The browse skill runs autonomously but is human-in-the-loop friendly:

• It surfaces the live-view URL so you can take over.
• It hands off for sign-ins, ambiguous choices, and sensitive actions.
• It defaults to Kernel managed auth for authenticated sites.

A few heavier tools are off by default to keep an autonomous agent's blast radius small on a shared API key. Add any of them via a connection override:

• browser_curl: raw HTTP through the session.
• manage_credentials: create, read, and delete stored credentials (the managed-auth flow above works without it).
• exec_command: shell exec in the VM.
• manage_browser_pools: manage pools of pre-warmed browsers.

Authenticate with an API key instead

One shared credential, no connector setup. A good fit for a single-tenant or personal agent.

1. Install the extension:

pnpm add @onkernel/eve-extension

2. Get a Kernel API key at dashboard.onkernel.com/api-keys and set it in the agent's environment:

# local dev: in the agent's .env.local
KERNEL_API_KEY=sk_...

# deploying to Vercel
npx vercel env add KERNEL_API_KEY

3. Mount the extension in a single file that reads KERNEL_API_KEY from the environment:

// agent/extensions/kernel.ts
export { default } from "@onkernel/eve-extension";

4. Run: npx eve dev or npx eve deploy.

To pass the key explicitly instead of via the environment:

// agent/extensions/kernel.ts
import kernel from "@onkernel/eve-extension";

export default kernel({ apiKey: process.env.KERNEL_API_KEY });

Configuration

kernel({ ... }) accepts:

When connect is set it takes precedence. Otherwise the key is read from apiKey, and failing that from KERNEL_API_KEY.

Overriding the connection

You only need this for advanced customization: widening the tool allowlist or adding an approval gate before irreversible actions. Auth is handled by the mount config above, so you don't override for that.

Mount the extension as a directory and name the connection file browser.ts to shadow the extension's built-in browser connection:

agent/extensions/kernel/
  extension.ts             # export default kernel({ connect: "mcp.onkernel.com/eve-extension" })
  connections/browser.ts   # shadows the extension's "browser" connection

// agent/extensions/kernel/connections/browser.ts
import { defineMcpClientConnection } from "eve/connections";
import { connect } from "@vercel/connect/eve";
import { always } from "eve/tools/approval";

export default defineMcpClientConnection({
  url: "https://mcp.onkernel.com/mcp",
  description: "Kernel cloud browser.",
  auth: connect("mcp.onkernel.com/eve-extension"), // or { getToken: async () => ({ token: process.env.KERNEL_API_KEY! }) }
  tools: {
    allow: [
      "manage_browsers",
      "execute_playwright_code",
      "computer_action",
      "browser_curl", // high blast radius: raw HTTP through the session
      "manage_auth_connections",
      "manage_credentials", // high blast radius: create/read/delete stored credentials
      "manage_profiles",
      "manage_proxies",
      "manage_replays",
      "manage_browser_pools", // heavier tools, off by default
      "exec_command", // high blast radius: shell exec in the VM
    ],
  },
  approval: always(), // re-check every controlled action; once() would auto-allow the rest of the session
});

Additional resources

Related

• Vercel Marketplace Integration
• AI SDK Tool
• Browser Creation
• Live View