Arcjet

Arcjet is an AI agent runtime security platform that ships inside the code you already deploy. Rather than sitting outside the application as a gateway, proxy or control plane, Arcjet provides real-time security building blocks that you call inside your app, in the code path that takes the action, before the action happens. It is built for engineering and security teams putting AI agents into production who need every prompt, tool call, API request and database call to pass through a policy decision first. The platform combines agent-focused protections — prompt injection detection, agent tool controls, sensitive information and data loss prevention, and token and spend budgets — with classic web protections such as Shield WAF, bot detection, rate limiting, email validation and signup form protection, all returning decisions that your own code branches on. Arcjet frames the core problem directly: identity tells you who is asking, but it cannot tell you what happens next. You cannot answer the question of whether an agent is about to take an unsafe or unauthorized action at the door; it has to be answered at every step. Arcjet illustrates this with a support workflow: an agent reads an inbound support email from a known address with a new cc address, queries a customer database that returns names, emails and bank account details, and then sends a reply to the original address plus the new one that was cc'd. Any single step can look acceptable, but the sequence ends with unexpected personal data being emailed out. Risks in a single step are amplified across a workflow. Arcjet also points out that other controls miss the real boundary: a prompt scanner sees tokens, a gateway sees a packet, and a dashboard sees yesterday, while the action that actually makes the call is the new boundary. The platform names four risks it is designed to address at that action boundary. Unauthorized tool calls occur when a request looks clean but the workflow then issues a refund, opens a file share, or hits an internal API that was never in scope for the user; Arcjet enforces at the action boundary, on both inputs and outputs. Data exfiltration happens when sensitive data, including PII, slips out through prompts, tool outputs and third party calls — it rarely looks like theft at the moment it happens — so Arcjet checks inputs to stop PII leaking into the LLM context and checks outputs before they are sent out. Cost explosion occurs when a runaway loop burns a month of token budget in an afternoon, and without enforcement in the path the first anyone hears about it is the invoice; Arcjet holds the quota in the loop itself. Sequence drift describes an agent that starts a session reading records and ends it writing to production, where no single step crossed a line; Arcjet judges the shape of each run over time so the drift itself trips the rule. Prompt injection detection is one of the platform's core agent protections. Arcjet catches hostile instructions in user input, API responses and tool output before either reaches the model. In the documented example, a developer launches an Arcjet client, creates a prompt injection rule and applies it to both the message the user typed and the text an agent's tool fetched from a page, then branches on the returned decision — on a DENY conclusion the code returns before the risky content reaches the model. The documentation notes that Arcjet runs a specialist detection model ahead of the provider call, adding around 100ms, and returns a decision you can act on, with a dry run mode available to see what would have been blocked without changing behavior. Content moderation and filters are also listed among the building blocks available from the same client. Agent tool controls let you scope what every agent may do by identity, role, route and typed input, then enforce it at the moment the tool is called rather than in the prompt that asks for it. The documented pattern wraps an agent tool call with a guard that declares the action, takes the actor from your session rather than from the model, and validates inputs through typed policy inputs such as an amount and a role; on a DENY decision the underlying tool never runs. Sensitive information and Data Loss Prevention strip names, addresses, national IDs, bank and card numbers before they reach model context, logs, or a third party tool. Arcjet's example uses a local detector configured with rampart() that detects on device, screens a support ticket's notes before they become context or a tool call, and strips the notes when the decision is a denial. Token and spend budgets cap tokens and calls per user, per org and per agent. The budget belongs to the run, so a loop cannot spend it four times over by touching four different endpoints. The documented example uses a token bucket with a refill rate, an interval and a maximum token count, keyed on the user id, with the estimated token cost of the call passed as the requested amount; the decision comes back as a denial when the budget is spent, before the model call is made. Alongside the agent protections, Arcjet covers the classic HTTP surface where the AI stack still runs. Shield WAF, bot detection with real-time threat feeds across 25 tracked categories, email validation and signup form protection all come from the same client and return the same decision object, with the example showing shield, detectBot and validateEmail rules and a single protect() call branching on whether the decision was denied. Arcjet states it detects 600+ bot types across 25 categories without serving a CAPTCHA. Arcjet describes its methodology as three phases: Observe, Enforce, Audit. First, every action an agent takes is captured inside your application and grouped into the run it belongs to — not sampled traffic, and not a dashboard that catches up tomorrow. What is seen includes the user, session, route, actor, tool label, typed arguments and prior steps. Second, each action is checked for what it actually is and a decision comes back before it executes; your code acts on that decision, which is the part that changes what happens. The checks include prompt injection, sensitive info, bot signals, action policy and run history, and the returned decisions are allow, block, redact or hold for review. Third, every decision and the context behind it is kept as evidence while sensitive checks run in process so the data never leaves your environment. What is kept includes decisions, policy version, actor, inputs and run history. A sample decision log shows individual actions such as a support reply send, a billing refund issue, an orders history read, a CRM customer lookup and a support ticket read being allowed or denied. Arcjet splits policy from inputs so that two routes to policy can both be true at once. Engineers want rules in the repository, reviewed and tested like everything else; security teams need to change policy without waiting for a release. Rules in code live next to the handler they protect, go through review, are covered by tests and ship on the normal release path. Arcjet states these rules are version controlled and diffable, unit testable with helpers for captured actions, and support a dry run mode before anything blocks. Remote policies are managed in the cloud and take effect immediately, so nobody has to open a pull request to tighten a rule. They can be changed in real time without a code deploy, are consistent across every service and workflow, let teams model the blast radius before turning a policy on, and record every decision so it is audit ready. Arcjet positions itself as an import you ship this afternoon rather than a control plane to roll out. There is no gateway, no proxy and no migration to get there, and a coding agent can set it up. Because Arcjet runs in the code you already deploy, the failure domain does not grow and coverage rolls out service by service. Arcjet argues that anything in front of your application sees traffic but does not see the function that moves the money, the arguments about to be passed to it, or the three steps that made this one risky. Its stated advantage is that it sees the arguments — a refund of $12,000 and a refund of $12 look the same from the network — and that it works everywhere actions are taken, including coding agents, queue consumers, scheduled jobs and workflow steps, with no sidecars or containers to run and nothing new to scale. On performance and compliance, Arcjet reports local decision overhead under 1ms and 20 to 30ms when the cloud API is needed, along with SOC 2 Type II with an unqualified opinion covering security, availability and confidentiality. Evidence can be stored in Arcjet cloud, in a single tenant or private VPC deployment, or in storage you manage yourself. Concrete use cases follow the integration points. In an HTTP route the call is protect(); in an agent tool handler, MCP server, queue consumer or workflow step it is guard(). Both return a decision object that your code branches on, so the unsafe action never runs rather than being caught afterwards. Teams can add Arcjet to one route or one tool handler and watch it in dry run before trusting it. The platform is LLM and framework agnostic and deploys through coding agent hooks, OpenTelemetry, provider integration, AI framework integrations and native SDKs. SDK and runtime support covers JavaScript, Python and Go, including Astro, Bun, Deno, Express, Fastify, Hono, NestJS, Next.js, Node.js, Nuxt, React Router, Remix, SvelteKit, FastAPI, Flask and Go. AI framework integrations include Claude Agent SDK, Claude Managed Agents, CrewAI, Genkit, Google ADK, LangChain, LangGraph, Mastra, Microsoft Agent Framework, OpenAI Agents, Strands Agents, TanStack AI, Vercel AI SDK and Vercel Eve, and Arcjet states it works with Claude Code, Codex, Copilot and many others. Related tooling includes Arcjet Guards, the Arcjet Plugin, Arcjet Skills, an MCP Server and a CLI. Taken together, Arcjet's proposition is straightforward: put the decision where the action is. Rather than trying to answer questions about agent safety outside the application, Arcjet puts the check inside the code path that takes the action, using the user, the typed inputs and the run history as context, and returns a decision your code can enforce before anything happens. That makes it possible to block prompt injection, stop PII leaks, block bots, hold spend inside a run, and keep evidence of what was decided — shipped service by service, starting in dry run.