Vercel MCP / create-project auth

Bottom line

Same fact graph as REPORT.md · no invented findings

Cloud Agents / Grok Bot MCP OAuth is broken or incomplete (Connected UI + dead refresh / no_auth_link), often compounded by team-scope 403, while the box has no VERCEL_TOKEN fallback.

Ranked causes

For THIS symptom: new agents fail, old succeed

Confirmed incident symptoms

This org · operator-verified ✓✓

Path A — Team / Full Account VERCEL_TOKEN

Preferred systemic durable fix ✓✓

1. Open vercel.com/account/tokens signed into the account that is Owner|Member of the target team (team switcher: team for team_Xo6grVYYjwjtGm0gLG59yOos, not personal hobby slug alone).
2. Create token: prefer that Team (All Projects), or Full Account if agents must touch multiple teams. Not single-project scope if the goal is creating new projects. Expiration e.g. 90d + calendar rotation.
3. Copy once (vcp_…). Store as VERCEL_TOKEN (+ optional VERCEL_TEAM_ID=team_Xo6grVYYjwjtGm0gLG59yOos).
4. Verify on box (expect 200; delete probe after) — copyable blocks below.
5. Playbooks: prefer REST/CLI with VERCEL_TOKEN when MCP ≠ ready; do not block on MCP auth loops.
6. Optional: mint narrower project tokens later with vercel tokens add using the classic Full Account token.

Smoke — list projects

export VERCEL_TOKEN='…'
export VERCEL_TEAM_ID='team_Xo6grVYYjwjtGm0gLG59yOos'
curl -sS -o /dev/null -w "%{http_code}\n" \
  -H "Authorization: Bearer $VERCEL_TOKEN" \
  "https://api.vercel.com/v10/projects?teamId=$VERCEL_TEAM_ID&limit=1"
# expect 200

Smoke — create project (delete probe after)

curl -sS -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"agent-auth-probe-'$(date +%s)'"}' \
  "https://api.vercel.com/v11/projects?teamId=$VERCEL_TEAM_ID"
# expect 200 with project JSON; delete probe after

CLI checks

vercel whoami --token "$VERCEL_TOKEN"
vercel project add agent-cli-probe --token "$VERCEL_TOKEN" --scope <team-slug>

Path B — Repair MCP write grant

Parallel · may be blocked by Vercel/Cursor until redirect fix ~ / ✓ product defect

1. In cursor.com/agents and each bot’s MCP panel, identify all Vercel servers: user-Vercel, user-Vercel--infrastructor, etc.
2. Disconnect / remove grant; in Vercel Account → Sign in with Vercel / connected apps, revoke Cursor/Grok/Vercel MCP authorizations.
3. Re-auth only while the browser is logged into the correct Vercel user (Owner/Member of target team). Complete consent selecting that team if prompted.
4. If authorize shows “redirect URL is invalid” or AuthenticateMcpServer returns no_auth_link: stop retrying — known Cloud/Grok OAuth defect (F1/F2). Escalate to Cursor + Vercel MCP; fall back to Path A.
5. After healthy connect: catalog includes deploy_to_vercel, list_teams, list_projects; list_teams shows target; probe deploy_to_vercel with teamId.
6. If OAuth “succeeds” but list_teams is [] or team calls 403 (F5): Path A remains the unblock.

Path C + hygiene

Hygiene for future agents

• Standardize one Vercel connector identity per org team; document which account each user-Vercel--* binds.
• Bootstrap for new bots: (1) VERCEL_TOKEN present, (2) MCP ready or explicitly optional, (3) teamId constant, (4) smoke POST /v11/projects.
• Never rely on project OIDC for create-project — OIDC is project-bound.

Vercel-side verify table

API smoke (after token)

# List teams for token identity
curl -sS -H "Authorization: Bearer $VERCEL_TOKEN" https://api.vercel.com/v2/teams

# Create (team)
curl -sS -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"probe-…"}' \
  "https://api.vercel.com/v11/projects?teamId=team_Xo6grVYYjwjtGm0gLG59yOos"

Findings F1–F14

Badges: ✓✓ docs/operator · ✓ docs or strong community · ~ community / incomplete

Key URLs / sources

Gaps — still needed

Recommended Manager decision

CHANGELOG

Companion: REPORT.md (authoritative facts) · sources/vercel-create-project-auth-research.md · live reports.tiesa.tech/…/2026-09-25_vercel-mcp-create-project-auth/