arcjet-js

Why we included this project

AI features that take real actions, like calling tools, reading data, or hitting external APIs, carry risks that ordinary web security doesn't cover. Arcjet is built for that gap. It's a JS/TS SDK that runs inside your application, with runtime building blocks that check each action before it happens: flagging prompt injection attempts, authorizing which tools an agent may call, redacting sensitive data before it leaves your system, and adding bot detection and rate limiting. The packages split into request protection for HTTP routes and middleware, and guard protection for agent tool calls, MCP server handlers, and background jobs, so one policy can cover both entry points. If you're shipping an agent, an MCP server, or an AI feature that touches user data, this is a practical way to enforce guardrails and keep an audit trail without standing up a separate proxy.