arcjet/arcjet-js

Runtime security for AI apps and agents: prompt injection detection, tool-call authorization, sensitive-data redaction, bot protection, and rate limiting. Drop it into your JS/TS code.

What it solves

Arcjet provides runtime security for AI applications and agents. It prevents common AI-specific threats like prompt injection and sensitive data leaks (PII), while also managing operational risks such as bot abuse, rate limiting for AI token budgets, and standard web attacks (WAF).

How it works

Arcjet operates as a set of security building blocks called within the application code before an action is executed. It offers two primary protection paths:

  • Request Protection: SDKs for various JS frameworks (Next.js, Node, Bun, etc.) that protect HTTP route handlers and API endpoints.
  • Guard Protection: A dedicated package (@arcjet/guard) for non-HTTP entry points, such as AI agent tool calls, MCP server handlers, and background jobs.

Who it’s for

Developers building AI-powered applications, LLM-integrated services, and AI agents who need to enforce security and audit actions in real-time.

Highlights

  • AI-Specific Security: Built-in detection for prompt injection and sensitive information (PII) like credit card numbers and emails.
  • AI Cost Control: Token bucket rate limiting to manage AI token budgets per user.
  • Bot & Abuse Prevention: Advanced bot detection by category or specific bot name, and a Shield WAF for OWASP Top 10 protection.
  • Broad Framework Support: Native SDKs for Next.js, Node.js, Bun, Deno, Express, Fastify, NestJS, Nuxt, Remix, SvelteKit, and Astro.
  • Network Intelligence: IP analysis for geolocation, VPN, proxy, and Tor detection.

Related

  • Project
    superagent-ai/superagent

    An open-source SDK for AI agent safety that blocks prompt injections, redacts sensitive data, and scans repositories for AI-targeted threats.

  • Project
    tophant-ai/ClawVault

    A security vault and proxy gateway that protects AI agents by detecting sensitive data leaks, blocking prompt injections, and intercepting dangerous system commands.

  • Project
    PrismorSec/prismor

    A runtime security framework for AI agents and coding assistants that prevents prompt injection, secret leaks, and destructive actions through policy-based enforcement.

  • Project
    AISecurityLab/hackagent

    A security red-teaming toolkit for AI agents that automates the discovery of vulnerabilities like prompt injection and jailbreaking using research-backed attack techniques.

  • Project
    agentcontrol/agent-control

    A centralized guardrail system for AI agents that enforces runtime safety rules to block prompt injections and PII leaks without changing agent code.