The Vercel Firewall and Observability Plus has first-class support for Server Actions.

Starting with Next.js 15.5, customers can now configure custom rules targeting specific server action names. In the example below, you can rate limit app/auth/actions.ts#getUser actions to 100 requests per minute per IP address.

// app/auth/actions.ts 
'use server' 
export async function getUser(userId: string) { 
  // ... 
}

Server Action Name is available in the Firewall for all plans at no additional cost. Read the docs to learn more.