OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Agent Security & Sandboxing

Arcjet – JS SDK

Arcjet - JS SDK is an open-source TypeScript monorepo of JavaScript packages for applying runtime security rules within applications, including checks for prompt injection, tool calls, sensitive information, bots and rate limits.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Arcjet - JS SDK — OpenViST project profile in Agent Security & Sandboxing.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use the SDK when security checks need to run within a JavaScript or TypeScript application before an HTTP request, agent tool call or other action proceeds. Choose a framework SDK for incoming HTTP requests and `@arcjet/guard` for non-HTTP actions such as tool calls and background jobs.

Who it is for

  • JavaScript and TypeScript developers building AI applications or agents.
  • Teams protecting HTTP endpoints, agent tools, MCP handlers, queue workers or background jobs.

Documented uses

  • Check agent input for prompt injection before it reaches a model or protected action.
  • Apply authorization-related checks and rules to agent tool-call flows.
  • Detect sensitive information in application or AI messages.
  • Apply bot protection and rate limits to requests or agent actions.
Before you choose

Requirements & limits

The repository is public and identifies the packages as open source under the Apache-2.0 license. Setup documentation uses an Arcjet key.

  • The SDK runs checks from within application code rather than serving as a standalone agent builder.
  • Package choice depends on the entry point: use a framework adapter for HTTP requests and @arcjet/guard for non-HTTP actions.
  • Request protection can depend on client IP information; the README warns that forwarding headers may be spoofed unless proxy handling is configured appropriately.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Add prompt-injection and rate-limit checks to an agent tool call

Configure Guard rules and check their decision before a tool handler proceeds.

Before you start

  • A JavaScript or TypeScript project
  • The @arcjet/guard package
  • An Arcjet key available as ARCJET_KEY
  • A stable user key and the user message for the tool call

Steps

  1. Install the package with the command below.

    Documented command
    npm i @arcjet/guard

  2. Import launchArcjet, tokenBucket and detectPromptInjection, then create the Arcjet client with the key.

  3. Configure a token-bucket rule and a prompt-injection rule.

  4. For each tool call, build the rule inputs, call arcjet.guard() with a label and the rules, and check the decision before proceeding.

Expected outcome

The handler receives a Guard decision for the configured checks and can stop when the conclusion is DENY.

Guide limitations

  • The example demonstrates prompt-injection detection and token-bucket limiting; it does not show a complete tool implementation.
  • The example's token-bucket values are configuration examples, not universal limits.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
13 October 2026
Original website title
arcjet/arcjet-js · Official homepage title · retained in its source language
How we review sourcesSuggest a correction