Arcjet Js

Arcjet - JS SDK

[Arcjet][arcjet] is the runtime security platform that ships in your AI code. Detect prompt injection, authorize agent tool calls, redact sensitive data, and block bots and abuse. Real-time security building blocks you call inside your app, before an action happens.

This is the monorepo containing various [Arcjet][arcjet] open source packages for JS.

Why Arcjet?

Your app's AI features and agents take real actions, calling tools, reading data, hitting APIs. Arcjet runs inside that code and lets you enforce security on each action in real time, then audit what happened

Which package do I need?

Arcjet protects two types of entry points. Pick the right path for your use case:

| Entry point | When to use | Package | | ---------------------- | -------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | Request protection | HTTP route handlers, API endpoints, middleware — anything with an incoming Request object. | @arcjet/next, @arcjet/node, @arcjet/bun, etc. | | Guard protection | AI agent tool calls, MCP server handlers, queue workers, background jobs — anything without an HTTP request. | [@arcjet/guard](./arcjet-guard/README.md) |

Not sure? If you have an HTTP request, use a [framework SDK](#sdks). If you don't, use [@arcjet/guard](./arcjet-guard/README.md). You can use both in the same project.

Getting started

The fastest way to get started is with an AI coding agent. Log in, install a skill, and let your agent handle the rest.

Step 1: Log in with the CLI

npx @arcjet/cli auth login

You can also sign up and manage keys at app.arcjet.com, or connect the Arcjet MCP server to your AI assistant.

Step 2: Install a skill

Skills give your agent the documentation to detect your framework, install the SDK, and wire up request or guard protection rules.

npx skills add arcjet/skills

> You can also use the Arcjet plugin for Claude Code and > Cursor, which bundles skills, MCP, > and coding rules.

Step 3: Install the package

For request protection — pick the SDK for your framework:

| Framework | Package | Install | | ------------ | ------------------------------- | ---------------------------- | | Next.js | @arcjet/next | npm i @arcjet/next | | Node.js | @arcjet/node | npm i @arcjet/node | | Bun | @arcjet/bun | bun add @arcjet/bun | | Deno | @arcjet/deno | deno add npm:@arcjet/deno | | Express | @arcjet/node | npm i @arcjet/node | | Fastify | @arcjet/fastify | npm i @arcjet/fastify | | Hono | @arcjet/node or @arcjet/bun | npm i @arcjet/node | | NestJS | @arcjet/nest | npm i @arcjet/nest | | Nuxt | @arcjet/nuxt | npm i @arcjet/nuxt | | Remix | @arcjet/remix | npm i @arcjet/remix | | React Router | @arcjet/react-router | npm i @arcjet/react-router | | SvelteKit | @arcjet/sveltekit | npm i @arcjet/sveltekit | | Astro | @arcjet/astro | npm i @arcjet/astro |

For guard protection:

npm i @arcjet/guard

Step 4: Tell your agent what to protect

Ask your coding agent to implement protection. The skill you installed in Step 2 gives it everything it needs. For example:

> "Add Arcjet bot protection and rate limiting to my /api/chat route"

> "Add Arcjet guard with prompt injection detection to my MCP tool handler"

The agent will install the right package, configure rules, and wire up protect() or guard() calls — or see the [full list of protections](#features) below.

Get help

[Join our Discord server][discord-invite] or [reach out for support][support].

• Documentation — full reference and guides
• [Example apps](#example-apps) — working starter projects for every framework
• [Blueprints](#blueprints) — recipes for common security patterns

Features

| Feature | Request SDKs | Guard | | ----------------------------------------------------------------------------------------------------------------- | :----------: | :---: | | 🛑 [Rate Limiting](#rate-limiting) — token bucket, fixed window, sliding window | ✅ | ✅ | | 🔒 [Prompt Injection Detection](#prompt-injection-detection) — block attacks before they reach your LLM | ✅ | ✅ | | 🕵️ [Sensitive Information Detection](#sensitive-information-detection) — block PII, credit cards, custom patterns | ✅ | ✅ | | 🤖 [Bot Protection](#bot-protection) — stop scrapers, credential stuffers, AI crawlers | ✅ | — | | 🛡️ [Shield WAF](#shield-waf) — protect against SQL injection, XSS, OWASP Top 10 | ✅ | — | | 📧 [Email Validation](#email-validation) — block disposable, invalid, undeliverable addresses | ✅ | — | | 📝 [Signup Form Protection][feature-signup-protection] — bot + email + rate limiting combined | ✅ | — | | 🎯 [Request Filters](#request-filters) — expression-based rules on IP, path, headers | ✅ | — | | 🌐 [IP Analysis](#ip-analysis) — geolocation, ASN, VPN, proxy, Tor, hosting detection | ✅ | — | | 🔧 [Custom Rules](#custom-rules-guard) — define your own local evaluation logic | — | ✅ |

Request SDKs = @arcjet/next, @arcjet/node, @arcjet/bun, etc. — for HTTP routes. Guard = @arcjet/guard — for tool calls, MCP servers, queues, and anything without an HTTP request.

Example apps

• [Astro][github-arcjet-example-astro]
• [Deno][github-arcjet-example-deno]
• [Express][github-arcjet-example-express]
• [FastAPI][github-arcjet-example-fastapi]
• [Fastify][github-arcjet-example-fastify]
• [NestJS][github-arcjet-example-nestjs]
• [Next.js][github-arcjet-example-nextjs] ([try live][arcjet-example])
• [Nuxt][github-arcjet-example-nuxt]
• [React Router][github-arcjet-example-react-router]
• [Remix][github-arcjet-example-remix]
• [SvelteKit][github-arcjet-example-sveltekit]
• [Tanstack Start][github-arcjet-example-tanstack-start]

Blueprints

• [AI quota control][blueprint-ai-quota-control]
• [Cookie banner][blueprint-cookie-banner]
• [Custom rule][blueprint-custom-rule]
• [IP geolocation][blueprint-ip-geolocation]
• [Feedback form][blueprint-feedback-form]
• [Malicious traffic][blueprint-malicious-traffic]
• [Payment form][blueprint-payment-form]
• [Sampling traffic][blueprint-sampling-traffic]
• [VPN & proxy][blueprint-vpn-proxy]

Usage

Read the docs at [docs.arcjet.com][arcjet-docs].

> Note: Examples below use @arcjet/next for illustration. Replace with > the SDK for your runtime — @arcjet/node, @arcjet/bun, @arcjet/sveltekit, > etc. The API is identical across all [SDKs](#sdks).

Vercel AI SDK example

This example protects a Next.js AI chat route using the [Vercel AI SDK][vercel-ai-sdk]: blocking automated clients that inflate costs, enforcing per-user token budgets, detecting sensitive information in messages, and blocking prompt injection attacks before they reach the model.

// app/api/chat/route.ts
import { openai } from "@ai-sdk/openai";
import arcjet, {
  detectBot,
  detectPromptInjection,
  sensitiveInfo,
  shield,
  tokenBucket,
} from "@arcjet/next";
import type { UIMessage } from "ai";
import { convertToModelMessages, isTextUIPart, streamText } from "ai";

const aj = arcjet({
  key: process.env.ARCJET_KEY!, // Get your key with: npx @arcjet/cli sites get-key
  // Track budgets per user — replace "userId" with any stable identifier
  characteristics: ["userId"],
  rules: [
    // Shield protects against common web attacks e.g. SQL injection
    shield({ mode: "LIVE" }),
    // Block all automated clients — bots inflate AI costs
    detectBot({
      mode: "LIVE", // Blocks requests. Use "DRY_RUN" to log only
      allow: [], // Block all bots. See https://arcjet.com/bot-list
    }),
    // Enforce budgets to control AI costs. Adjust rates and limits as needed.
    tokenBucket({
      mode: "LIVE",
      refillRate: 2_000, // Refill 2,000 tokens per hour
      interval: "1h",
      capacity: 5_000, // Maximum 5,000 tokens in the bucket
    }),
    // Block messages containing sensitive information to prevent data leaks
    sensitiveInfo({
      mode: "LIVE",
      // Block PII types that should never appear in AI prompts.
      // Remove types your app legitimately handles (e.g. EMAIL for a support bot).
      deny: ["CREDIT_CARD_NUMBER", "EMAIL"],
    }),
    // Detect prompt injection attacks before they reach your AI model
    detectPromptInjection({
      mode: "LIVE",
    }),
  ],
});

export async function POST(req: Request) {
  const userId = "user-123"; // Replace with your session/auth lookup
  const { messages }: { messages: UIMessage[] } = await req.json();
  const modelMessages = await convertToModelMessages(messages);

  // Estimate token cost: ~1 token per 4 characters of text (rough heuristic)
  const totalChars = modelMessages.reduce((sum, m) => {
    const content =
      typeof m.content === "string" ? m.content : JSON.stringify(m.content);
    return sum + content.length;
  }, 0);
  const estimate = Math.ceil(totalChars / 4);

  // Extract the most recent user message to scan for injection and PII
  const lastMessage: string = (messages.at(-1)?.parts ?? [])
    .filter(isTextUIPart)
    .map((p) => p.text)
    .join(" ");

  const decision = await aj.protect(req, {
    userId,
    requested: estimate,
    sensitiveInfoValue: lastMessage,
    detectPromptInjectionMessage: lastMessage,
  });

  if (decision.isDenied()) {
    if (decision.reason.isBot()) {
      return new Response("Automated clients are not permitted", {
        status: 403,
      });
    } else if (decision.reason.isRateLimit()) {
      return new Response("AI usage limit exceeded", { status: 429 });
    } else if (decision.reason.isSensitiveInfo()) {
      return new Response("Sensitive information detected", { status: 400 });
    } else if (decision.reason.isPromptInjection()) {
      return new Response(
        "Prompt injection detected — please rephrase your message",
        { status: 400 },
      );
    } else {
      return new Response("Forbidden", { status: 403 });
    }
  }

  const result = await streamText({
    model: openai("gpt-4o"),
    messages: modelMessages,
  });

  return result.toUIMessageStreamResponse();
}

Prompt injection detection

Detect and block prompt injection attacks — attempts to override your AI model's instructions — before they reach your model. Pass the user's message via detectPromptInjectionMessage on each protect() call.

import arcjet, { detectPromptInjection } from "@arcjet/next";

const aj = arcjet({
  key: process.env.ARCJET_KEY!,
  rules: [
    detectPromptInjection({
      mode: "LIVE", // Blocks requests. Use "DRY_RUN" to log only
    }),
  ],
});

export async function POST(request: Request) {
  const { message } = await request.json();

  const decision = await aj.protect(request, {
    detectPromptInjectionMessage: message,
  });

  if (decision.isDenied() && decision.reason.isPromptInjection()) {
    return new Response(
      "Prompt injection detected — please rephrase your message",
      { status: 400 },
    );
  }

  // Forward to your AI model...
}

Bot protection

Arcjet allows you to configure a list of bots to allow or deny. Specifying allow means all other bots are denied. An empty allow list blocks all bots.

Available categories: CATEGORY:ACADEMIC, CATEGORY:ADVERTISING, CATEGORY:AI, CATEGORY:AMAZON, CATEGORY:APPLE, CATEGORY:ARCHIVE, CATEGORY:BOTNET, CATEGORY:FEEDFETCHER, CATEGORY:GOOGLE, CATEGORY:META, CATEGORY:MICROSOFT, CATEGORY:MONITOR, CATEGORY:OPTIMIZER, CATEGORY:PREVIEW, CATEGORY:PROGRAMMATIC, CATEGORY:SEARCH_ENGINE, CATEGORY:SLACK, CATEGORY:SOCIAL, CATEGORY:TOOL, CATEGORY:UNKNOWN, CATEGORY:VERCEL, CATEGORY:WEBHOOK, CATEGORY:YAHOO. You can also allow or deny [specific bots by name][bot-list].

import arcjet, { detectBot } from "@arcjet/next";
import { isSpoofedBot } from "@arcjet/inspect";

const aj = arcjet({
  key: process.env.ARCJET_KEY!,
  rules: [
    detectBot({
      mode: "LIVE", // Blocks requests. Use "DRY_RUN" to log only
      allow: [
        "CATEGORY:SEARCH_ENGINE", // Google, Bing, etc
        // Uncomment to allow these other common bot categories:
        // "CATEGORY:MONITOR",  // Uptime monitoring services
        // "CATEGORY:PREVIEW",  // Link previews e.g. Slack, Discord
        // See the full list at https://arcjet.com/bot-list
      ],
    }),
  ],
});

export async function GET(request: Request) {
  const decision = await aj.protect(request);

  if (decision.isDenied() && decision.reason.isBot()) {
    return new Response("No bots allowed", { status: 403 });
  }

  // Arcjet verifies the authenticity of common bots using IP data.
  // Verification isn't always possible, so check the results separately.
  // https://docs.arcjet.com/bot-protection/reference#bot-verification
  if (decision.results.some(isSpoofedBot)) {
    return new Response("Forbidden", { status: 403 });
  }

  return new Response("Hello world");
}

Bots can be configured by [category][feature-bot-protection] and/or by [specific bot name][bot-list]. For example, to allow search engines and the OpenAI crawler, but deny all other bots:

detectBot({
  mode: "LIVE",
  allow: ["CATEGORY:SEARCH_ENGINE", "OPENAI_CRAWLER_SEARCH"],
});

Rate limiting

Arcjet supports token bucket, fixed window, and sliding window algorithms. Token buckets are ideal for controlling AI token budgets — set capacity to the max tokens a user can spend, refillRate to how many tokens are restored per interval, and deduct tokens per request via requested in protect(). The interval accepts strings ("1s", "1m", "1h", "1d") or seconds as a number. Use characteristics to track limits per user instead of per IP.

import arcjet, { tokenBucket } from "@arcjet/next";

const aj = arcjet({
  key: process.env.ARCJET_KEY!,
  characteristics: ["userId"], // Track per user
  rules: [
    tokenBucket({
      mode: "LIVE",
      refillRate: 2_000, // Refill 2,000 tokens per hour
      interval: "1h",
      capacity: 5_000, // Maximum 5,000 tokens in the bucket
    }),
  ],
});

const decision = await aj.protect(request, {
  userId: "user-123",
  requested: estimate, // Number of tokens to deduct
});

if (decision.isDenied() && decision.reason.isRateLimit()) {
  return new Response("AI usage limit exceeded", { status: 429 });
}

Sensitive information detection

Detect and block PII in request content. Pass the content to scan via sensitiveInfoValue on each protect() call. Built-in entity types: CREDIT_CARD_NUMBER, EMAIL, PHONE_NUMBER, IP_ADDRESS. You can also provide a custom detect callback for additional patterns.

import arcjet, { sensitiveInfo } from "@arcjet/next";

const aj =

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [arcjet](https://github.com/arcjet)
- **Source:** [arcjet/arcjet-js](https://github.com/arcjet/arcjet-js)
- **License:** Apache-2.0
- **Homepage:** https://arcjet.com

Install and usage instructions live in the source repository linked above.