Learn AI SDK 7 Scoped Tool Context With a Two-Tool Secret Boundary

Vercel's AI SDK 7 adds scoped tool context: a tool can declare a contextSchema , while the caller supplies per-tool values through toolsContext . The purpose is practical—third-party tools do not need to receive every secret or configuration value held by an agent. Primary source: Vercel, “AI SDK 7 is now available” . Let's turn that feature into a tiny security exercise. We will create two tools: lookupOrder may receive an internal order-service URL; createTicket may receive a support token; neither tool should receive the other's value. Setup Use a fresh project and pin the versions you actually install in your lockfile: mkdir scoped-tools && cd scoped-tools npm init -y npm install ai zod npm install -D typescript tsx @types/node Create demo.ts : import { tool } from ' ai ' ; import { z } from ' zod ' ; const lookupOrder = tool ({ description : ' Read the status of one order ' , inputSchema : z . object ({ orderId : z . string (). min ( 1 ) }), contextSchema : z . object ({ baseUrl : z . string (). url () }), execute : async ({ orderId }, { context }) => ({ orderId , source : new URL ( `/orders/ ${ orderId } ` , context . baseUrl ). toString (), status : ' demo-only ' , }), }); const createTicket = tool ({ description : ' Create a support ticket ' , inputSchema : z . object ({ subject : z . string (). min ( 3 ) }), contextSchema : z . object ({ supportToken : z . string (). min ( 12 ) }), execute : async ({ subject }, { context }) => ({ subject , accepted : context . supportToken . startsWith ( ' support_ ' ), }), }); const tools = { lookupOrder , createTicket }; const toolsContext = { lookupOrder : { baseUrl : ' https://orders.invalid ' }, createTicket : { supportToken : ' support_demo_token ' }, }; async function run () { const order = await lookupOrder . execute ! ( { orderId : ' A-17 ' }, { context : toolsContext . lookupOrder } as never , ); const ticket = await createTicket . execute ! ( { subject : ' Order is delayed ' }, { context : toolsContext . createTi