Arcjet

Contents

• Add Arcjet protection to your app
• Choose protections
• Resources

Python Guard adapters for LangChain, CrewAI, OpenAI Agents, Claude Agent SDK, Claude Managed Agents, Strands Agents, and Google ADK are dedicated skills (see Step 3). JS Guard adapters that ship on npm are per-file references under references/guards_js_*.md. Unpublished JS Cloudflare Think is a dedicated skill. Shared fundamentals stay in references/guards_javascript.md and references/guards_python.md.

Add Arcjet protection to your app

Checklist

• Step 1: Verify language support (JS/TS, Python, or Go only – stop if unsupported)
• Step 2: Connect to Arcjet platform (CLI → MCP → manual Console setup)
• Step 3: Detect protection type and read the appropriate reference file
• Step 4: Implement protection (separate client file, correct SDK, correct patterns)
• Step 5: Verify decisions are firing correctly (trigger a real call, then check CLI / MCP / Console)

Step 1: Check language support

If the project's server-side code is not JavaScript, TypeScript, Python, or Go → tell the user in chat that Arcjet doesn't support their language yet. Don't modify the project, don't write a NOTES.md, don't invent a package. Just say it and stop.

Step 2: Get an ARCJET_KEY into the project's env file

Before writing any code, the project needs a real ARCJET_KEY in its env file. Don't write Arcjet code first and "leave the key as a TODO" – that just produces dead code. Get the key first, then wire it up.

In order of preference:

1. Arcjet CLI (preferred). Check whether you're already signed in, then retrieve a key.
2. Arcjet MCP server (endpoint: https://api.arcjet.com/mcp) – for clients with built-in MCP. See references/mcp.md.
3. Manual (last resort): tell the user to grab a key from https://console.arcjet.com.

CLI bootstrap (the normal path)

npx -y @arcjet/cli@latest auth status        # is the user already signed in?
# if not signed in:
npx -y @arcjet/cli@latest auth login         # browser device flow, see references/cli.md

npx -y @arcjet/cli@latest teams list --output json --fields id,name
npx -y @arcjet/cli@latest sites list --team-id <team_id> --output json --fields id,name
# if no suitable site exists:
npx -y @arcjet/cli@latest sites create --team-id <team_id> --name "<project>"

npx -y @arcjet/cli@latest sites get-key --site-id <site_id> --output json --fields key

Write the key value to the project's env file as ARCJET_KEY=ajkey_.... Match whatever the project already does – filename, .env.example companion, .gitignore entry. If the project doesn't have a convention yet, default to whatever the framework expects and add the env file to .gitignore. Never hardcode the key in source.

See references/cli.md for install options beyond npx, agent-mode flags, and the full command reference.

Install the SDK with the project's package manager

Once you know which SDK you need (see Step 3), install it with the package manager the project already uses: npm install, pnpm add, yarn add, bun add, pip install, uv add, poetry add, or go get. Don't hand-edit package.json / requirements.txt / go.mod and guess a version: typed versions go stale (@arcjet/next is currently 1.13.0; Python arcjet is 1.2.0; Go must use a module tag, not a copied pseudo-version), and the lockfile/module metadata won't get updated. Let the package manager pick the real version and pin it.

Step 3: Detect protection type and read the reference

Determine which protection type applies:

A single project can use both – for example, request-based on API routes and Guard on agent tool calls. If the project already uses a supported agent framework, prefer the official wrapper over hand-wrapping every tool. In Python, load the dedicated skill (table below) — not a raw guard() around every callable, and not the JS @arcjet/guard/... path. In JavaScript, load fundamentals plus exactly one adapter from the JS table — not the sibling adapters. Cloudflare Think loads integrate-arcjet-guard-cloudflare-think from that table, not a guards_js_*.md file and not @arcjet/guard/vercel-ai/v7. Install published @arcjet/guard plus the @cloudflare/think peer. In Go, load the Microsoft Agent Framework skill when that framework is present; otherwise use GuardAction from the Go Guard reference.

Coding-agent hooks (Claude Code / GitHub Copilot) are a third path. There is no SDK and no guard() call. Publishing a policy attached to Execute on (Tool call or Prompt) turns it on. Install the HTTP hooks from https://docs.arcjet.com/coding-agents — copy the templates, do not invent URLs. Hook URLs must not name a policy and must omit ?surface= (managed settings reach CLI, IDE, Desktop, and cloud; a hard-coded cli mislabels most traffic). Author the policy via MCP (references/mcp.md).

Common misclassifications to watch for:

• MCP servers: the word "server" is misleading. MCP tools don't receive HTTP requests – they're invoked by an MCP client over stdio or SSE. Use Guard, not request-based.
• Background jobs / queue consumers: no HTTP request at the protection site. Use Guard.
• Server actions / RPC over HTTP (Next.js server actions, tRPC): there is an HTTP request underneath. Use request-based.
• Agent tool calls inside a request handler: if you want to limit per-user-per-route, request-based is fine. If you want per-tool budgets independent of any HTTP boundary, use Guard at the tool call site.

Read the appropriate reference:

• Request-based JS/TS: references/requests_javascript.md
• Request-based Python: references/requests_python.md
• Request-based Go: references/requests_go.md
• Guard JS/TS fundamentals: references/guards_javascript.md — then exactly one adapter file from the table in that file (source of truth; do not copy it here)
• Guard Python: references/guards_python.md
• Guard Go: references/guards_go.md

When the project already uses an official JS agent framework, open the fundamentals file and load exactly one adapter from its table. Do not open sibling adapters. Cloudflare Think is the dedicated-skill exception: load that skill from the table.

When the project already uses an official Python agent framework, load the dedicated skill instead of the long adapter sections that used to live in the Python Guard reference:

When the project is Go and already uses Microsoft Agent Framework for Go, load the dedicated skill:

These references explain architectural decisions and patterns that can't be inferred from the source code alone. For exact API signatures, read the installed package's types and doc comments.

Step 4: Implement protection

Follow the patterns in the reference file from Step 3. Key principles:

Request-based (HTTP routes):

• Create shared clients outside handlers and include Shield as a base rule. Use the exact constructor and rule names from the language reference. JS HTTP rules omitted mode default to DRY_RUN – pass mode: "LIVE" to enforce. Python HTTP factories require mode= (TypeError if omitted). Go HTTP Protect rules also default to dry run – set Mode: arcjet.ModeLive to enforce.
• In JavaScript/TypeScript, create one arcjet() client and use withRule() for route-specific extras so clones share the decision cache. Check decision.isDenied(). Sibling arcjet() constructors do not share cache. detectBot requires exactly one of allow or deny (neither or both throws).
• In Python, create one arcjet() / arcjet_sync() client and use with_rule() for route-specific extras so clones share DecisionCache. Check decision.is_denied(). Sibling constructors do not share cache.
• In Go, create one NewClient at package scope. WithRule() derives route-specific clients that share the parent cache, and returns (*Client, error), so handle initialization errors. Check decision.IsDenied(). Separate NewClient calls do not share cache.
• Call protect() / Protect() inside each route handler (not in app-level middleware), once per request.
• Map denial reasons to HTTP responses. Only branch on reasons that produce a different response – there is no point in a Shield-specific arm that returns the same status as the default 403.
• Put the language's userId characteristic selector on the specific rule that needs it, then pass a trusted, authenticated user ID at protection time. Never rate limit by a client-controlled header unless a trusted proxy strips and rewrites it.
• Treat client-IP provenance as security configuration. JavaScript, Python, and Go may fall back to common forwarding headers when no usable public address is available and produce one client_ip_provenance="unverified-header" warning for the lifetime of each SDK client instance. Configure every trusted proxy and verify the application is reachable only through infrastructure that overwrites or safely appends forwarding headers. Never silence the warning by copying a client-controlled header into a manual override.
• If the application already has an independently trusted client IP, pass it explicitly: ipSrc (JS), ip_src (Python; also set disable_automatic_ip_detection=True when constructing the client), or WithIPSrc (Go). The SDKs reject malformed values, although JS treats an empty ipSrc as omitted. Syntax validation does not prove provenance. Before shipping, inspect representative requests with JS clientIpDetails() / findIpDetails(), Python client_ip_details(), or Go ClientIPDetails().
• protect() accepts nested-JSON metadata (same shape as Guard). It does not affect fingerprinting. Do not put secrets or PII in it. When present, request decisions also expose optional IP threat intelligence (decision.ip.threat / ip_details.threat / IP.Threat).

Guard (non-HTTP code):

• Client at module scope: launchArcjet() (JS), launch_arcjet() / launch_arcjet_sync() (Python – match async vs sync), NewGuardClient (Go).
• Rules at module scope. One guard() per operation with a hardcoded slug label (tools.get-weather). Interpolated labels break grep and Console grouping. Slugs: lowercase letters, digits, -, ., _ only; start and end with a lowercase letter or digit; max 256 bytes.
• metadata is nested JSON for audit only. No secrets or PII. capture() is visibility, never a decision – flush on shutdown. Python helper success is not "the action ran" – see the Python Guard reference.
• Free guard() (JS/Python registration) fail-opens if nothing is registered. Go has no registration API. Prefer an explicit client.
• Prefer official wrappers over hand-wrapping. Import the versioned JS path and load that adapter file from Step 3. Load the dedicated Python skill from Step 3. Unversioned @arcjet/guard/<adapter> aliases do not resolve.
• Branch on which rule denied, not just DENY. Guard decision.reason is a flat string ("PROMPT_INJECTION") and is undefined on ALLOW. A denial by one rule still spends the others' budget in the same rules array – split calls if a PII false positive must not drain a rate limit.
• Every rate-limit rule needs a key and a bucket. Use a trusted user/session id when you have one; otherwise a stable identifier you control.

JS adapters: wrappers fail closed; core guard() fails open. Load the Step 3 file (or the Cloudflare Think skill) for the project's framework. npm install @arcjet/guard or pnpm add @arcjet/guard is enough for every published adapter — plus actor / inputs / validateGuardLabel. Cloudflare Think is the same published @arcjet/guard install plus peer @cloudflare/think; load integrate-arcjet-guard-cloudflare-think. Do not pin a git SHA.

Python: guard_action / guard_action_sync is core. Load the dedicated skill for the project's extra (arcjet[langchain], arcjet[langchain-agents], arcjet[openai-agents], arcjet[claude-agent-sdk], arcjet[claude-managed-agents], arcjet[strands-agents], arcjet[google-adk]). There is no arcjet[crewai] extra. validate_guard_label and adapter actor / inputs are in PyPI arcjet 1.2.0. Google ADK is pip install "arcjet[google-adk]" or uv add "arcjet[google-adk]" — load integrate-arcjet-guard-google-adk-py. Do not pin a git SHA.

Traps that run without error and enforce nothing (full write-up in the Guard references and https://docs.arcjet.com/llms.txt):

• Guard has no sensitiveInfo rule – that is HTTP protect() only. Use localDetectSensitiveInfo / LocalDetectSensitiveInfo.
• Python LocalDetectSensitiveInfo() with neither allow nor deny fail-opens as ALLOW (AJ1203). Always pass a list. JS works with no args; still pass a list.
• The sensitive-info rule does not inherit the client's backend. Entity types beyond EMAIL / PHONE_NUMBER / IP_ADDRESS / CREDIT_CARD_NUMBER need backend on the rule. Share one Rampart instance with the client.
• A label the service will not match reads as ALLOW with hasFailedOpen() / has_failed_open() false, so the guard silently does not run. @arcjet/guard 1.13.0 and PyPI arcjet 1.2.0 refuse one up front: adapter factories throw / raise ArcjetInvalidLabelError, and a capture warns AJ1023 and still sends. Check a label you build yourself with validateGuardLabel / validate_guard_label.
• A remote policy that declares actor or typed inputs only fires if this call sends them. Import policyInput from @arcjet/guard (not an adapter path). Python uses server_input / local_input. Check installed types — do not pass fields a helper does not declare.
• A missing decision is not a denial. If the model asks a question or masks values itself, Guard never runs. Verify in Console/CLI.
• Guarding one tool only helps if it is the only path. Claude Agent SDK needs settingSources: [] / setting_sources=[] and strictMcpConfig: true / strict_mcp_config=True.
• HITL (needsApproval, human_input, can_use_tool, event.interrupt(), always_ask) is not a policy gate.

Conventions outside the Arcjet flow

For everything that isn't an Arcjet-specific decision – dev scripts, file/module layout, named-vs-default exports, comment style, env-file naming, type hints, error class patterns – match the project's existing conventions. If the project has no convention yet, default to modern best practice for the language. This skill is opinionated about where Arcjet goes and how its API is used; it must not reach further than that.

Step 5: Verify decisions

After wiring up protection, confirm it's actually firing. Three steps:

1. Type-check / build first. Run tsc, next build, python -m py_compile, or whatever check command the project uses. Catches wrong imports, wrong rule names, and stale type signatures before the user does.

2. Trigger a real call so a decision exists to check. Without one, the Console and CLI are empty and you can't tell whether protection is actually wired up.

• Request-based: start the dev server (npm run dev, uvicorn main:app --reload) and curl the protected route with the method the route actually accepts (curl -I is HEAD – FastAPI GET-only routes answer 405, not the documented 403). Empty bots.allow / allow=[] denies CURL before later rules run – temporarily allow: ["CURL"] when you need to reach email or rate-limit checks, then drop it. To trip a rate limit: for i in {1..50}; do curl -s -o /dev/null -w "%{http_code}\n" http://localhost:3000/api/your-route; done.
• Guard: invoke the protected function so a decision exists. A missing decision is not a denial – read Console/CLI, not the absence of a side effect. Don't test Guard by curling anything.

3. Confirm the decision in the Arcjet platform.

• CLI: npx -y @arcjet/cli@latest requests list --site-id <id> (request-based) or ... guards list --site-id <id> (Guard)
• MCP: list-requests / list-guards
• Console: https://console.arcjet.com

For deeper investigation: arcjet requests explain --site-id <id> --request-id <id> or arcjet guards explain --site-id <id> --guard-id <id>.

If you can't run the app in the current environment, tell the user exactly what to do (which command to run, what to look for in the output) instead of silently skipping verification.

Gotchas

• Wrong SDK/client: @arcjet/guard, arcjet.guard, and Go's NewGuardClient are for non-HTTP code. @arcjet/node / @arcjet/next / Python arcjet() / Go NewClient are for HTTP routes.
• Wrong placement: protect() must not be called in Express middleware or Next.js middleware. Call it inside each route handler.
• Wrong layer for guard(): don't put guard() in a generic dispatcher. Use the official wrapper from the table above, or put guard() inside the specific tool. Load the dedicated Python skill instead of hand-wrapping.
• Python adapter denials and HITL: load the dedicated skill. Capture handlers never block. HITL is not a policy gate. Helper metadata.outcome details live in the Python Guard reference.
• Hand-edited dependency manifests: run the project's package manager so the version is real (@arcjet/* 1.13.0, Python arcjet 1.2.0).
• Double-counting: calling protect() or guard() multiple times for the same operation counts against rate limits multiple times.
• Client-IP warning bypass: never "fix" an unverified-header warning by copying X-Forwarded-For into ipSrc / ip_src / WithIPSrc.
• JS denial envelopes: one ArcjetDenialResult payload; delivery is per-framework. Read the adapter file from Step 3 before inventing a status or throwing. guardTool and guardAction are different handlers.
• Never hardcode ARCJET_KEY – always use environment variables.

Choose protections

When you need to pick which rules address the user's concern – bot abuse, rate limits, prompt injection, signup spam, PII, or IP filtering – load references/choosing_protections.md. It maps common problems to Arcjet rules and explains the tradeoffs between strategies (for example token bucket vs sliding window). The mapping doesn't need to be in your context for the rest of the workflow.

Resources

For exact API signatures, parameter names, and the full set of rules and helpers, read the installed SDK's source – types and docstrings are the source of truth:

• Python SDK: https://github.com/arcjet/arcjet-py – arcjet package (request protection) and arcjet.guard subpackage (non-HTTP guard).
• Python Guard integration skills: integrate-arcjet-guard-langchain-py, integrate-arcjet-guard-crewai, integrate-arcjet-guard-openai-agents-py, integrate-arcjet-guard-claude-agent-sdk-py, integrate-arcjet-guard-claude-managed-agents-py, integrate-arcjet-guard-strands-agents-py, integrate-arcjet-guard-google-adk-py.
• JS Cloudflare Think skill: integrate-arcjet-guard-cloudflare-think.
• JavaScript / TypeScript SDK: https://github.com/arcjet/arcjet-js – monorepo with framework-specific packages (@arcjet/next, @arcjet/node, @arcjet/fastify, @arcjet/sveltekit, @arcjet/guard). JS Guard adapter files: references/guards_js_vercel_ai.md and siblings listed in Step 3.
• Go SDK: https://github.com/arcjet/arcjet-go – github.com/arcjet/arcjet-go module with request and guard clients. go get github.com/arcjet/arcjet-go resolves v1.0.0 (Go 1.25+). Microsoft Agent Framework helpers live in a separate module: go get github.com/arcjet/arcjet-go/agentframework resolves v0.1.0 and needs Go 1.26+.
• Guard policies: author and publish via MCP (list-guard-policies / describe-guard-policy / validate-guard-policy / put-guard-policy). The CLI has no policy commands. Application policies select by label / action. Coding-agent policies attach by Execute on (Tool call or Prompt); publishing turns them on — the hook URL must not name a policy and must omit ?surface=. Install templates: https://docs.arcjet.com/coding-agents.
• Docs: https://docs.arcjet.com – narrative guides, blueprints, and product reference.
• Console: https://console.arcjet.com – sites, keys, and decision history.