Arcjet

Runtime security platform for AI agents: prompt-injection detection and tool-call authorization.

Freemium Security
Visit Website ↗ by Arcjet

What is Arcjet?

Arcjet is a runtime security platform that ships inside your AI app as SDK middleware and intercepts actions before they happen. It detects prompt injection in user input, API responses, and tool output; authorizes agent tool calls at defined boundaries with guardTool(); redacts sensitive information before it reaches model context; enforces token and spend budgets; and blocks bots and common web attacks. Policies live in code or are managed remotely, with integrations across JS, Python, Go, and major agent frameworks.

Key features

  • Prompt injection detection before requests reach the model
  • Agent tool-call authorization with guardTool() scoping by identity, role, route
  • Sensitive information and DLP redaction with local WASM detection
  • Token and spend budgets per user, org, or agent run
  • Bot protection and Shield WAF for common web attacks
  • Content moderation for agent outputs and user inputs
  • Native SDKs for JS/TS, Python, Go plus agent framework integrations
  • Agent Skill so coding agents can self-integrate protection

Pros

  • Enforcement happens inside your code at action time, not as an afterthought
  • Covers the full agent threat surface: injection, tool abuse, data leaks, runaway spend
  • Policies as code are version-controlled and unit-testable

Cons

  • Adds latency and complexity to every guarded call
  • Detection models can produce false positives that block legitimate use

Arcjet at a glance

PricingFreemium
CategorySecurity
Platformsweb, api
CompanyArcjet
Official websitearcjet.com
securityai-agentsprompt-injectionsdktool-authorizationruntime-security

How to choose the right Security tool

Security tools protect accounts, devices and data, so the first question is what exactly is being protected — passwords, browsing, files, identity or a whole network — and against which threats. Prefer tools from established vendors with transparent practices: independent audits, clear data policies and a record of fixing vulnerabilities quickly matter more than long feature lists. Check how the tool balances protection with friction; security you disable because it annoys you protects nothing. For password and identity tools, strong encryption and zero-knowledge design are the standards to look for. Finally, remember that no tool replaces basic hygiene — unique passwords, two-factor authentication and regular updates do most of the protective work, and a good tool makes all three easier.

Compare all Security tools →

Arcjet FAQs

What is Arcjet?

Arcjet is a runtime security platform that ships inside your AI app as SDK middleware and intercepts actions before they happen. It detects prompt injection in user input, API responses, and tool output; authorizes agent tool calls at defined boundaries with guardTool(); redacts sensitive information before it reaches model context; enforces token and spend budgets; and blocks bots and common web attacks. Policies live in code or are managed remotely, with integrations across JS, Python, Go, and major agent frameworks.

What are the main features of Arcjet?

Arcjet offers Prompt injection detection before requests reach the model, Agent tool-call authorization with guardTool() scoping by identity, role, route, Sensitive information and DLP redaction with local WASM detection, Token and spend budgets per user, org, or agent run, Bot protection and Shield WAF for common web attacks, Content moderation for agent outputs and user inputs, Native SDKs for JS/TS, Python, Go plus agent framework integrations and Agent Skill so coding agents can self-integrate protection.

How much does Arcjet cost?

Arcjet follows a freemium model: a free tier is available, and paid plans unlock higher limits and advanced features. Check its official website for current plan prices.

What are the pros and cons of Arcjet?

Strengths of Arcjet include Enforcement happens inside your code at action time, not as an afterthought; Covers the full agent threat surface: injection, tool abuse, data leaks, runaway spend; Policies as code are version-controlled and unit-testable. On the downside, Adds latency and complexity to every guarded call; Detection models can produce false positives that block legitimate use.