arcjet/arcjet-js

What it solves

Arcjet provides a security layer specifically designed for AI applications and agents. It helps developers prevent common vulnerabilities like prompt injection, unauthorized tool usage, and data leaks, while also managing AI costs through rate limiting and bot protection.

How it works

Arcjet functions as a set of security building blocks integrated directly into your application code. It offers two primary modes: Request protection for HTTP-based endpoints (like API routes) and Guard protection for non-HTTP environments (like background jobs, queue workers, or AI agent tool calls). Developers define security rules—such as token budgets or PII redaction—which are evaluated in real-time before an action is executed.

Who it’s for

This project is for developers building AI-powered applications, LLM agents, or MCP servers who need to secure their infrastructure against abuse, manage token usage, and ensure sensitive data is not inadvertently sent to models.

Highlights

• Prompt Injection Detection: Blocks malicious attempts to override model instructions before they reach the LLM.
• Sensitive Information Detection: Uses on-device models to redact PII, credit card numbers, and other sensitive data locally.
• AI Cost Control: Implements token bucket rate limiting to enforce per-user budgets and prevent excessive API costs.
• Bot & WAF Protection: Includes a Web Application Firewall (WAF) and bot detection to stop scrapers, credential stuffers, and unauthorized AI crawlers.
• Framework Agnostic: Provides dedicated SDKs for popular frameworks like Next.js, Express, Bun, Deno, and more.