Skip to content
Gauge

ax-check.com

by Gauge

Arcjet

arcjet.com

ax-check.com

Checked 21 October 2026

A

100/100

Agents need your login

Arcjet's docs, pricing, and setup are clear and fully machine-readable.

All 23 checklist items passed, covering docs, onboarding, pricing and activation. Pricing is stated openly with no gating or interaction needed.

1 fix to start with

Concrete changes, backed by what we found.

Onboarding

Give agents a clear login handoff and a way to resume setup.

Agents cannot progress through onboarding without human help. Provide an agent-accessible path through authentication and setup.

Recorded coding sessions

Same task, 3 models, no arcjet.com account. Recorded 21 October 2026 on Pi.

3 recorded · 1m 20s

1m 20s · recorded

Session findings

Select a finding to see it in context.

piv0.84.2
modelQwen 3.8 Maxcwd/sandbox/repo
Help me build a simple example using Arcjet. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop.
Thinking…

The user wants to create a simple example using Arcjet, and also wants to know about pricing, as well as whether it can be easily managed. I should check the sandbox — maybe network access is restricted. Let me verify the environment and see if I can access Arcjet's documentation.

First, let me check the current directory and network access.

ls /sandbox/repo && node -v && npm -v
v22.23.2
v22.23.2
10.9.8

curl -sS -m 15 -o /dev/null -w "%{http_code}\n" https://docs.arcjet.com/ 2>&1 | head -5
200
200
Thinking…

Network access is normal, and the repository is empty. Let's quickly check the Arcjet documentation for the quickstart and pricing info.

curl -sS -m 20 https://docs.arcjet.com/quick-start -L | sed 's/<[^>]*>/ /g' | tr -s ' \n' ' \n' | head -100
404 | Arcjet Docs {"@context":"https://schema.org","@graph":[{"@type":"ImageObject","@id":"https://arcjet.com/#logo","url":"https://arcjet.com/arcjet-logo-ligh
 404 | Arcjet Docs {"@context":"https://schema.org","@graph":[{"@type":"ImageObject","@id":"https://arcjet.com/#logo","url":"https://arcjet.com/arcjet-logo-light-essential.svg","contentUrl":"https://arcjet.com/arcjet-logo-light-essential.svg","width":453,"height":157,"caption":"Arcjet"},{"@type":"Organization","@id":"https://arcjet.com/#organization","name":"Arcjet","legalName":"Arcjet Labs, Inc.","url":"https://arcjet.com","description":"Arcjet is the AI agent runtime security platform. Discover the agents running in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence to prove what happened. Detect prompt injection, authorize agent tool calls, redact PII, and block bots and abuse.","logo":{"@id":"https://arcjet.com/#logo"},"image":{"@id":"https://arcjet.com/#logo"},"email":"support@arcjet.com","contactPoint":{"@type":"ContactPoint","contactType":"customer support","email":"support@arcjet.com"},"address":{"@type":"PostalAddress","addressLocality":"San Francisco","addressRegion":"CA","addressCountry":"US"},"sameAs":["https://github.com/arcjet","https://www.linkedin.com/company/arcjet","https://x.com/arcjet","https://www.youtube.com/@arcjethq","https://www.reddit.com/r/arcjet/","https://www.g2.com/sellers/arcjet","https://www.crunchbase.com/organization/arcjet"],"knowsAbout":["AI agent runtime security","Coding agent security","Prompt injection detection","Agent tool-call authorization","Malicious destination and MCP server detection","Sensitive data protection","Bot and API abuse protection","Application security"]},{"@type":"SoftwareApplication","@id":"https://arcjet.com/#software","name":"Arcjet","url":"https://arcjet.com","description":"Arcjet is the AI agent runtime security platform. Discover the agents running in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence to prove what happened. Detect prompt injection, authorize agent tool calls, redact PII, and block bots and abuse.","applicationCategory":"SecurityApplication","publisher":{"@id":"https://arcjet.com/#organization"},"sameAs":["https://www.g2.com/products/arcjet/reviews"],"featureList":["Coding agent security","Prompt injection detection","Agent tool-call authorization","Destination threat analysis for agent requests","SIEM export","Sensitive data detection and redaction","Bot and API abuse protection","Rate limiting"],"softwareHelp":{"@id":"https://docs.arcjet.com/#website"}},{"@type":"WebSite","@id":"https://docs.arcjet.com/#website","name":"Arcjet Docs","url":"https://docs.arcjet.com","description":"Arcjet documentation for the AI agent runtime security platform. Discover the agents running in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence to prove what happened.","publisher":{"@id":"https://arcjet.com/#organization"},"about":{"@id":"https://arcjet.com/#software"},"inLanguage":"en"},{"@type":"WebPage","@id":"https://docs.arcjet.com/404/#webpage","url":"https://docs.arcjet.com/404/","name":"404","isPartOf":{"@id":"https://docs.arcjet.com/#website"},"about":{"@id":"https://arcjet.com/#software"},"publisher":{"@id":"https://arcjet.com/#organization"},"inLanguage":"en"}]} 
	window.StarlightThemeProvider = (() => {
		const storedTheme =
			typeof localStorage !== 'undefined' && localStorage.getItem('starlight-theme');
		const theme =
			storedTheme ||
			(window.matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark');
		document.documentElement.dataset.theme = theme === 'light' ? 'light' : 'dark';
		return {
			updatePickers(theme = storedTheme || 'auto') {
				document.querySelectorAll('starlight-theme-select').forEach((picker) => {
					const select = picker.querySelector('select');
					if (select) select.value = theme;
					/** @type {HTMLTemplateElement | null} */
					const tmpl = document.querySelector(`#theme-icons`);
					const newIcon = tmpl && tmpl.content.querySelector('.' + theme);
					if (newIcon) {
						const oldIcon = picker.querySelector('svg.label-icon');
						if (oldIcon) {
							oldIcon.replaceChildren(...newIcon.cloneNode(true).childNodes);
						}
					}
				});
			},
		};
	})();
 @layer starlight.components{:root{--sl-badge-default-border:var(--sl-color-accent);--sl-badge-default-bg:var(--sl-color-accent-low);--sl-badge-default-text:#fff;--sl-badge-note-border:var(--sl-color-blue);--sl-badge-note-bg:var(--sl-color-blue-low);--sl-badge-note-text:#fff;--sl-badge-danger-border:var(--sl-color-red);--sl-badge-danger-bg:var(--sl-color-red-low);--sl-badge-danger-text:#fff;--sl-badge-success-border:var(--sl-color-green);--sl-badge-success-bg:var(--sl-color-green-low);--sl-badge-success-text:#fff;--sl-badge-caution-border:var(--sl-color-orange);--sl-badge-caution-bg:var(--sl-color-orange-low);--sl-badge-caution-text:#fff;--sl-badge-tip-border:var(--sl-color-purple);--sl-badge-tip-bg:var(--sl-color-purple-low);--sl-badge-tip-text:#fff}[data-theme=light]:root{--sl-badge-default-bg:var(--sl-color-accent-high);--sl-badge-note-bg:var(--sl-color-blue-high);--sl-badge-danger-bg:var(--sl-color-red-high);--sl-badge-success-bg:var(--sl-color-green-high);--sl-badge-caution-bg:var(--sl-color-orange-high);--sl-badge-tip-bg:var(--sl-color-purple-high)}.sl-badge:where(.astro-f4zorn72){border:1px solid var(--sl-color-border-badge);font-family:var(--sl-font-system-mono);color:var(--sl-color-text-badge);background-color:var(--sl-color-bg-badge);overflow-wrap:anywhere;border-radius:.25rem;line-height:normal;display:inline-block}.sidebar-content .sl-badge:where(.astro-f4zorn72){line-height:1;font-size:var(--sl-text-xs);padding:.125rem .375rem}.sidebar-content a[aria-current=page]>.sl-badge:where(.astro-f4zorn72){--sl-color-bg-badge:transparent;--sl-color-border-badge:currentColor;color:inherit}.default:where(.astro-f4zorn72){--sl-color-bg-badge:var(--sl-badge-default-bg);--sl-color-border-badge:var(--sl-badge-default-border);--sl-color-text-badge:var(--sl-badge-default-text)}.note:where(.astro-f4zorn72){--sl-color-bg-badge:var(--sl-badge-note-bg);--sl-color-border-badge:var(--sl-badge-note-border);--sl-color-text-badge:var(--sl-badge-note-text)}.danger:where(.astro-f4zorn72){--sl-color-bg-badge:var(--sl-badge-danger-bg);--sl-color-border-badge:var(--sl-badge-danger-border);--sl-color-text-badge:var(--sl-badge-danger-text)}.success:where(.astro-f4zorn72){--sl-color-bg-badge:var(--sl-badge-success-bg);--sl-color-border-badge:var(--sl-badge-success-border);--sl-color-text-badge:var(--sl-badge-success-text)}.tip:where(.astro-f4zorn72){--sl-color-bg-badge:var(--sl-badge-tip-bg);--sl-color-border-badge:var(--sl-badge-tip-border);--sl-color-text-badge:var(--sl-badge-tip-text)}.caution:where(.astro-f4zorn72){--sl-color-bg-badge:var(--sl-badge-caution-bg);--sl-color-border-badge:var(--sl-badge-caution-border);--sl-color-text-badge:var(--sl-badge-caution-text)}.small:where(.astro-f4zorn72){font-size:var(--sl-text-xs);padding:.125rem .25rem}.medium:where(.astro-f4zorn72){font-size:var(--sl-text-sm);padding:.175rem .35rem}.large:where(.astro-f4zorn72){font-size:var(--sl-text-base);padding:.225rem .45rem}.sl-markdown-content :is(h1,h2,h3,h4,h5,h6) .sl-badge:where(.astro-f4zorn72){vertical-align:middle}}
@layer starlight.components{.card-grid:where(.astro-7qmvx3iy){grid-template-columns:100%;gap:1rem;display:grid}.card-grid:where(.astro-7qmvx3iy)>*{margin-top:0!important}@media (width>=50rem){.card-grid:where(.astro-7qmvx3iy){grid-template-columns:1fr 1fr;gap:1.5rem}.stagger:where(.astro-7qmvx3iy){--stagger-height:5rem;padding-bottom:var(--stagger-height)}.stagger:where(.astro-7qmvx3iy)>:nth-child(2n){transform:translateY(var(--stagger-height))}}}
@layer starlight.components{svg:where(.astro-hkc32dio){color:var(--sl-icon-color);font-size:var(--sl-icon-size,1em);width:1em;height:1em}}
@layer starlight.components{starlight-tabs:where(.astro-scn3uvmv){display:block}.tablist-wrapper:where(.astro-scn3uvmv){overflow-x:auto}:where(.astro-scn3uvmv)[role=tablist]{border-bottom:2px solid var(--sl-color-gray-5);padding:0;list-style:none;display:flex}.tab:where(.astro-scn3uvmv){display:flex}.tab:where(.astro-scn3uvmv)>:where(.astro-scn3uvmv)[role=tab]{--sl-tab-color-border:var(--sl-color-gray-5);line-height:var(--sl-line-height-headings);box-shadow:0 2px 0 var(--sl-tab-color-border);color:var(--sl-color-gray-3);outline-offset:var(--sl-outline-offset-inside);overflow-wrap:initial;align-items:center;gap:.5rem;padding:.275rem 1.25rem;text-decoration:none;display:flex}.tab:where(.astro-scn3uvmv) :where(.astro-scn3uvmv)[role=tab][aria-selected=true]{--sl-tab-color-border:var(--sl-color-text-accent);color:var(--sl-color-white);font-weight:600}.tablist-wrapper:where(.astro-scn3uvmv)~[role=tabpanel]{margin-top:1rem}}
@layer starlight.components{.sl-link-card:where(.astro-zaaezwya){border:1px solid var(--sl-color-gray-5);box-shadow:var(--sl-shadow-sm);border-radius:.5rem;grid-template-columns:1fr auto;gap:.5rem;padding:1rem;display:grid;position:relative}a:where(.astro-zaaezwya){line-height:var(--sl-line-height-headings);text-decoration:none}a:where(.astro-zaaezwya):before{content:"";position:absolute;inset:0}.stack:where(.astro-zaaezwya){flex-direction:column;gap:.5rem}.title:where(.astro-zaaezwya){color:var(--sl-color-white);font-weight:600;font-size:var(--sl-text-lg)}.description:where(.astro-zaaezwya){color:var(--sl-color-gray-3);line-height:1.5}.icon:where(.astro-zaaezwya){color:var(--sl-color-gray-3)}.sl-link-card:where(.astro-zaaezwya):hover{background:var(--sl-color-gray-7,var(--sl-color-gray-6));border-color:var(--sl-color-gray-2)}.sl-link-card:where(.astro-zaaezwya):hover .icon:where(.astro-zaaezwya){color:var(--sl-color-white)}}
 :root[data-theme=dark] ._Skeleton_xtugx_1{--unstable_wave-bg:rgba(var(--aj-palette-source-neutralRgb-06) / .3)}:root[data-theme=light] ._Skeleton_xtugx_1{--unstable_wave-bg:rgba(var(--aj-palette-source-neutralRgb-10) / .3)}._Skeleton_xtugx_1{min-height:calc(var(--sp) * 16);border-radius:var(--rad);height:auto;display:block;position:relative;overflow:hidden}._Skeleton_xtugx_1._Level1_xtugx_17{background:var(--aj-palette-block-level1-glare), var(--aj-palette-block-level1-bg)}._Skeleton_xtugx_1._Level1_xtugx_17._Fade_xtugx_20:before{z-index:10;background:var(--aj-palette-block-level1-fadeBg)}._Skeleton_xtugx_1._Level2_xtugx_24{background-color:var(--aj-palette-block-level2-bg)}._Skeleton_xtugx_1._Level3_xtugx_27{background:var(--aj-palette-block-level3-glare), var(--aj-palette-block-level3-bg)}._Skeleton_xtugx_1._Inline_xtugx_30{vertical-align:text-bottom;width:60px;min-height:1em;margin:0;display:inline-block}._Skeleton_xtugx_1:before{content:"";width:100%;height:100%;position:absolute}._Skeleton_xtugx_1:after{content:"";z-index:var(--unstable_pseudo-zIndex);background:linear-gradient(90deg, transparent, var(--unstable_wave-bg,#00000014), transparent);animation:1.6s linear .5s infinite _wave_xtugx_1;position:absolute;inset:0;transform:translate(-100%)}@keyframes _wave_xtugx_1{0%{transform:translate(-100%)}50%{transform:translate(100%)}to{transform:translate(100%)}}
@layer starlight.components{.sl-steps{--bullet-size:calc(var(--sl-line-height) * 1rem);--bullet-margin:.375rem;counter-reset:steps-counter var(--sl-steps-start,0);padding-inline-start:0;list-style:none}.sl-steps>li{counter-increment:steps-counter;padding-inline-start:calc(var(--bullet-size) + 1rem);min-height:calc(var(--bullet-size) + var(--bullet-margin));padding-bottom:1px;position:relative}.sl-steps>li+li{margin-top:0}.sl-steps>li:before{content:counter(steps-counter);top:0;width:var(--bullet-size);height:var(--bullet-size);line-height:var(--bullet-size);font-size:var(--sl-text-xs);text-align:center;color:var(--sl-color-white);background-color:var(--sl-color-gray-6);box-shadow:inset 0 0 0 1px var(--sl-color-gray-5);border-radius:99rem;font-weight:600;position:absolute;inset-inline-start:0}.sl-steps>li:after{--guide-width:1px;content:"";top:calc(var(--bullet-size) + var(--bullet-margin));bottom:var(--bullet-margin);width:var(--guide-width);background-color:var(--sl-color-hairline-light);position:absolute;inset-inline-start:calc((var(--bullet-size) - var(--guide-width)) / 2)}}@layer starlight.content{.sl-steps>li>:first-child{--lh:calc(1em * var(--sl-line-height));--shift-y:calc(.5 * (var(--bullet-size) - var(--lh)));transform:translateY(var(--shift-y));margin-bottom:var(--shift-y)}.sl-steps>li>:first-child:where(h1,h2,h3,h4,h5,h6){--lh:calc(1em * var(--sl-line-height-headings))}@supports (--prop:1lh){.sl-steps>li>:first-child{--lh:1lh}}}
 Skip to content try{(()=>{function e(e){if(!e)return;let t=e.getAttribute(`tabindex`)!==null,n=e.scrollWidth>e.clientWidth;n&&!t?e.setAttribute(`tabindex`,`0`):!n&&t&&e.removeAttribute(`tabindex`)}var t=window.requestIdleCallback||(e=>setTimeout(e,1)),n=window.cancelIdleCallback||clearTimeout;function r(e){let r=new Set,i,a;return new ResizeObserver(o=>{o.forEach(e=>r.add(e.target)),i&&clearTimeout(i),a&&n(a),i=setTimeout(()=>{a&&n(a),a=t(()=>{r.forEach(t=>e(t)),r.clear()})},250)})}function i(e,t){e.querySelectorAll?.(`.expressive-code pre > code`).forEach(e=>{let n=e.parentElement;n&&t.observe(n)})}var a=r(e);i(document,a),new MutationObserver(e=>e.forEach(e=>e.addedNodes.forEach(e=>{i(e,a)}))).observe(document.body,{childList:!0,subtree:!0}),document.addEventListener(`astro:page-load`,()=>{i(document,a)})})()}catch(e){console.error(`[EC] tabindex-js-module failed:`,e)}try{(()=>{function e(e){let t=document.createElement(`pre`);Object.assign(t.style,{opacity:`0`,pointerEvents:`none`,position:`absolute`,overflow:`hidden`,left:`0`,top:`0`,width:`20px`,height:`20px`,webkitUserSelect:`auto`,userSelect:`all`}),t.ariaHidden=`true`,t.textContent=e,document.body.appendChild(t);let n=document.createRange();n.selectNode(t);let r=getSelection();if(!r)return!1;r.removeAllRanges(),r.addRange(n);let i=!1;try{i=document.execCommand(`copy`)}finally{r.removeAllRanges(),document.body.removeChild(t)}return i}async function t(t){let n=t.currentTarget,r=n.dataset,i=!1,a=r.code.replace(/\u007f/g,`
`);try{await navigator.clipboard.writeText(a),i=!0}catch{i=e(a)}if(!i||n.parentNode?.querySelector(`.feedback`))return;let o=document.createElement(`div`);o.classList.add(`feedback`),o.append(r.copied),n.before(o),o.offsetWidth,requestAnimationFrame(()=>o?.classList.add(`show`));let s=()=>!o||o.classList.remove(`show`),c=()=>{!o||parseFloat(getComputedStyle(o).opacity)>0||(o.remove(),o=void 0)};setTimeout(s,1500),setTimeout(c,2500),n.addEventListener(`blur`,s),o.addEventListener(`transitioncancel`,c),o.addEventListener(`transitionend`,c)}function n(e){e.querySelectorAll?.(`.expressive-code .copy button`).forEach(e=>e.addEventListener(`click`,t))}n(document),new MutationObserver(e=>e.forEach(e=>e.addedNodes.forEach(e=>{n(e)}))).observe(document.body,{childList:!0,subtree:!0}),document.addEventListener(`astro:page-load`,()=>{n(document)})})()}catch(e){console.error(`[EC] copy-js-module failed:`,e)} Arcjet Docs Search Ctrl K Cancel 
	(() => {
		const openBtn = document.querySelector('button[data-open-modal]');
		const shortcut = openBtn?.querySelector('kbd');
		if (!openBtn || !(shortcut instanceof HTMLElement)) return;
		const platformKey = shortcut.querySelector('kbd');
		if (platformKey && /(Mac|iPhone|iPod|iPad)/i.test(navigator.platform)) {
			platformKey.textContent = '⌘';
			openBtn.setAttribute('aria-keyshortcuts', 'Meta+K');
		}
		shortcut.style.display = '';
	})();
 GitHub Twitter YouTube Discord Email astro-island,astro-slot,astro-static-slot{display:contents} (()=>{var e=async t=>{await(await t())()};(self.Astro||(self.Astro={})).load=e;window.dispatchEvent(new Event("astro:load"));})(); (()=>{var g=Object.defineProperty;var w=(a,s,c)=>s in a?g(a,s,{enumerable:!0,configurable:!0,writable:!0,value:c}):a[s]=c;var l=(a,s,c)=>w(a,typeof s!="symbol"?s+"":s,c);var E=new Set(["__proto__","constructor","prototype"]);{let a={0:t=>y(t),1:t=>c(t),2:t=>new RegExp(t),3:t=>new Date(t),4:t=>new Map(c(t)),5:t=>new Set(c(t)),6:t=>BigInt(t),7:t=>new URL(t),8:t=>new Uint8Array(t),9:t=>new Uint16Array(t),10:t=>new Uint32Array(t),11:t=>Number.POSITIVE_INFINITY*t},s=t=>{let[p,e]=t;return p in a?a[p](e):void 0},c=t=>t.map(s),y=t=>typeof t!="object"||t===null?t:Object.fromEntries(Object.entries(t).map(([p,e])=>[p,s(e)]));class f extends HTMLElement{constructor(){super(...arguments);l(this,"Component");l(this,"hydrator");l(this,"hydrate",async()=>{var b;if(!this.hydrator||!this.isConnected)return;let e=(b=this.parentElement)==null?void 0:b.closest("astro-island[ssr]");if(e){e.addEventListener("astro:hydrate",this.hydrate,{once:!0});return}let r=this.querySelectorAll("astro-slot"),n={},d=this.querySelectorAll("template[data-astro-template]");for(let o of d){let i=o.closest(this.tagName);i!=null&&i.isSameNode(this)&&(n[o.getAttribute("data-astro-template")||"default"]=o.innerHTML,o.remove())}for(let o of r){let i=o.closest(this.tagName);i!=null&&i.isSameNode(this)&&(n[o.getAttribute("name")||"default"]=o.innerHTML)}let u;try{u=this.hasAttribute("props")?y(JSON.parse(this.getAttribute("props"))):{}}catch(o){let i=this.getAttribute("component-url")||" ",v=this.getAttribute("component-export");throw v&&(i+=` (export ${v})`),console.error(`[hydrate] Error parsing props for component ${i}`,this.getAttribute("props"),o),o}let h;await this.hydrator(this)(this.Component,u,n,{client:this.getAttribute("client")}),this.removeAttribute("ssr"),this.dispatchEvent(new CustomEvent("astro:hydrate"))});l(this,"unmount",()=>{this.isConnected||this.dispatchEvent(new CustomEvent("astro:unmount"))})}disconnectedCallback(){document.removeEventListener("astro:after-swap",this.unmount),document.addEventListener("astro:after-swap",this.unmount,{once:!0})}connectedCallback(){if(!this.hasAttribute("await-children")||document.readyState==="interactive"||document.readyState==="complete")this.childrenConnectedCallback();else{let e=()=>{document.removeEventListener("DOMContentLoaded",e),r.disconnect(),this.childrenConnectedCallback()},r=new MutationObserver(()=>{var n;((n=this.lastChild)==null?void 0:n.nodeType)===Node.COMMENT_NODE&&this.lastChild.nodeValue==="astro:end"&&(this.lastChild.remove(),e())});r.observe(this,{childList:!0}),document.addEventListener("DOMContentLoaded",e)}}async childrenConnectedCallback(){let e=this.getAttribute("before-hydration-url");e&&await import(e),this.start()}getRetryImportUrl(e){let r=new URL(e,document.baseURI);return r.searchParams.set("astro-retry",Date.now().toString()),r.toString()}async importWithRetry(e){try{return await import(e)}catch(r){return await new Promise(n=>setTimeout(n,1e3)),import(this.getRetryImportUrl(e))}}handleHydrationError(e){let r=this.getAttribute("component-url"),n=new CustomEvent("astro:hydration-error",{cancelable:!0,bubbles:!0,composed:!0,detail:{error:e,componentUrl:r}});this.dispatchEvent(n)&&console.error(`[astro-island] Error hydrating ${r}`,e)}async start(){let e=JSON.parse(this.getAttribute("opts")),r=this.getAttribute("client");if(Astro[r]===void 0){window.addEventListener(`astro:${r}`,()=>this.start(),{once:!0});return}try{await Astro[r](async()=>{let n=this.getAttribute("renderer-url");try{let[d,{default:u}]=await Promise.all([this.importWithRetry(this.getAttribute("component-url")),n?this.importWithRetry(n):Promise.resolve({default:()=>()=>{}})]),h=this.getAttribute("component-export")||"default";if(h.includes(".")){this.Component=d;for(let m of h.split(".")){if(E.has(m)||!this.Component||typeof this.Component!="object"&&typeof this.Component!="function"||!Object.hasOwn(this.Component,m))throw new Error(`Invalid component export path: ${h}`);this.Component=this.Component[m]}}else{if(E.has(h))throw new Error(`Invalid component export path: ${h}`);this.Component=d[h]}return this.hydrator=u,this.hydrate}catch(d){return this.handleHydrationError(d),()=>{}}},e,this)}catch(n){this.handleHydrationError(n)}}attributeChangedCallback(){this.hydrate()}}l(f,"observedAttributes",["props"]),customElements.get(

Showing the first 20,000 characters. Full output is available in raw details.

curl -sS -m 20 https://arcjet.com/pricing -L | sed 's/<[^>]*>/ /g' | tr -s ' \n' ' \n' | grep -iE "free|\\$|plan|month|request" | head -60
);--aj-palette-block-level2Event-challenge-blurBorder:rgba(var(--aj-palette-source-tint-01Rgb-05) / 0.3);--aj-palette-glowChannel:130 124 140;--aj-palette-dang
 );--aj-palette-block-level2Event-challenge-blurBorder:rgba(var(--aj-palette-source-tint-01Rgb-05) / 0.3);--aj-palette-glowChannel:130 124 140;--aj-palette-dangerGlowChannel:191 58 50;--aj-shadowRing:0 0 #000;--aj-shadowChannel:21 21 21;--aj-shadowOpacity:0.12;} html{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;box-sizing:border-box;-webkit-text-size-adjust:100%;}*,*::before,*::after{box-sizing:inherit;}strong,b{font-weight:var(--aj-fontWeight-lg);}body{margin:0;color:var(--aj-palette-text-secondary, var(--aj-palette-neutral-700, #32383E));font-family:var(--aj-fontFamily-body, "Inter", var(--aj-fontFamily-fallback, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"));font-size:var(--aj-fontSize-md, 1rem);line-height:var(--aj-lineHeight-md, 1.5);background-color:var(--aj-palette-background-body);}@media print{body{background-color:var(--aj-palette-common-white);}}body::backdrop{background-color:var(--aj-palette-background-backdrop);}[data-joy-color-scheme="light"]{-webkit-print-color-scheme:light;color-scheme:light;}[data-joy-color-scheme="dark"]{-webkit-print-color-scheme:dark;color-scheme:dark;} Product Building blocks Shield WAF Bot protection Rate limiting Signup form protection Email validation Sensitive information Prompt injection New Content moderation New Filters For agents Arcjet Guards Arcjet Plugin Arcjet Skills MCP Server CLI Protections Abuse protection Budget control Data loss prevention Prompt injection detection Integrations SDKs Astro Deno Express Fastify Next.js NestJS React Router Nuxt Bun SvelteKit Hono Flask Node.js FastAPI Remix AI Agent Frameworks Claude Agent SDK Claude Managed Agents Cloudflare Think CrewAI Genkit Google ADK LangChain LangGraph Mastra Microsoft Agent Framework OpenAI Agents Strands Agents TanStack AI Vercel AI SDK Vercel Eve Resources About Learning center Comparisons MCP Server CLI Support Trust Terms Pricing Docs Blog Sign in Sign up {"@context":"https://schema.org","@graph":[{"@type":"ImageObject","@id":"https://arcjet.com/#logo","url":"https://arcjet.com/arcjet-logo-light-essential.svg","contentUrl":"https://arcjet.com/arcjet-logo-light-essential.svg","width":453,"height":157,"caption":"Arcjet"},{"@type":"Organization","@id":"https://arcjet.com/#organization","name":"Arcjet","legalName":"Arcjet Labs, Inc.","url":"https://arcjet.com","description":"Arcjet is the AI agent runtime security platform. Discover the agents running in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence to prove what happened. Detect prompt injection, authorize agent tool calls, redact PII, and block bots and abuse.","logo":{"@id":"https://arcjet.com/#logo"},"image":{"@id":"https://arcjet.com/#logo"},"email":"support@arcjet.com","contactPoint":{"@type":"ContactPoint","contactType":"customer support","email":"support@arcjet.com"},"address":{"@type":"PostalAddress","addressLocality":"San Francisco","addressRegion":"CA","addressCountry":"US"},"sameAs":["https://github.com/arcjet","https://www.linkedin.com/company/arcjet","https://x.com/arcjet","https://www.youtube.com/@arcjethq","https://www.reddit.com/r/arcjet/","https://www.g2.com/sellers/arcjet","https://www.crunchbase.com/organization/arcjet"],"knowsAbout":["AI agent runtime security","Coding agent security","Prompt injection detection","Agent tool-call authorization","Malicious destination and MCP server detection","Sensitive data protection","Bot and API abuse protection","Application security"]},{"@type":"WebSite","@id":"https://arcjet.com/#website","name":"Arcjet","url":"https://arcjet.com","description":"Arcjet is the AI agent runtime security platform. Discover the agents running in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence to prove what happened. Detect prompt injection, authorize agent tool calls, redact PII, and block bots and abuse.","publisher":{"@id":"https://arcjet.com/#organization"}},{"@type":"SoftwareApplication","@id":"https://arcjet.com/#software","name":"Arcjet","url":"https://arcjet.com","description":"Arcjet is the AI agent runtime security platform. Discover the agents running in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence to prove what happened. Detect prompt injection, authorize agent tool calls, redact PII, and block bots and abuse.","applicationCategory":"SecurityApplication","publisher":{"@id":"https://arcjet.com/#organization"},"sameAs":["https://www.g2.com/products/arcjet/reviews"],"featureList":["Coding agent security","Prompt injection detection","Agent tool-call authorization","Destination threat analysis for agent requests","SIEM export","Sensitive data detection and redaction","Bot and API abuse protection","Rate limiting"]}]} {"@context":"https://schema.org","@graph":[{"@type":"WebPage","@id":"https://arcjet.com/pricing#webpage","url":"https://arcjet.com/pricing","name":"AI agent runtime security pricing | Arcjet","description":"Arcjet pricing for AI runtime security: Individual at $25/mo, Startup at $299/mo, and Enterprise with custom pricing for mission critical apps. Usage fees apply. 15-day free trial.","isPartOf":{"@id":"https://arcjet.com/#website"},"about":{"@id":"https://arcjet.com/#software"},"mainEntity":{"@id":"https://arcjet.com/#software"},"breadcrumb":{"@id":"https://arcjet.com/pricing#breadcrumb"}},{"@type":"SoftwareApplication","@id":"https://arcjet.com/#software","name":"Arcjet","url":"https://arcjet.com","description":"Arcjet is the AI agent runtime security platform. Discover the agents running in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence to prove what happened. Detect prompt injection, authorize agent tool calls, redact PII, and block bots and abuse.","applicationCategory":"SecurityApplication","publisher":{"@id":"https://arcjet.com/#organization"},"sameAs":["https://www.g2.com/products/arcjet/reviews"],"featureList":["Coding agent security","Prompt injection detection","Agent tool-call authorization","Destination threat analysis for agent requests","SIEM export","Sensitive data detection and redaction","Bot and API abuse protection","Rate limiting"],"offers":[{"@type":"Offer","name":"Individual","url":"https://arcjet.com/pricing","price":"25","priceCurrency":"USD","description":"Individual base price per application per month, plus usage fees.","priceSpecification":{"@type":"UnitPriceSpecification","price":25,"priceCurrency":"USD","billingDuration":"P1M","referenceQuantity":{"@type":"QuantitativeValue","value":1,"unitText":"application"}}},{"@type":"Offer","name":"Startup","url":"https://arcjet.com/pricing","price":"299","priceCurrency":"USD","description":"Startup base price per application per month, plus usage fees.","priceSpecification":{"@type":"UnitPriceSpecification","price":299,"priceCurrency":"USD","billingDuration":"P1M","referenceQuantity":{"@type":"QuantitativeValue","value":1,"unitText":"application"}}}]},{"@type":"BreadcrumbList","@id":"https://arcjet.com/pricing#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://arcjet.com"},{"@type":"ListItem","position":2,"name":"Pricing","item":"https://arcjet.com/pricing"}]},{"@type":"FAQPage","@id":"https://arcjet.com/pricing#faq","isPartOf":{"@id":"https://arcjet.com/#website"},"mainEntity":[{"@type":"Question","@id":"https://arcjet.com/pricing#faq-question-1","name":"Can I book a demo?","acceptedAnswer":{"@type":"Answer","text":"Of course! Book a demo with our team."}},{"@type":"Question","@id":"https://arcjet.com/pricing#faq-question-2","name":"How does usage-based pricing work?","acceptedAnswer":{"@type":"Answer","text":"Any protect() SDK call counts as a web request, billed at $5 per million. Rate limit, filter, and Shield WAF rules are included in that single request. Protecting coding agents and custom agents counts as an agent request, billed at $50 per million."}},{"@type":"Question","@id":"https://arcjet.com/pricing#faq-question-3","name":"Are there any request limits?","acceptedAnswer":{"@type":"Answer","text":"There are no hard request limits on paid accounts (the trial has usage limits). All protections are billed based on actual usage at the per-unit rates shown in the usage fees table. You only pay for what you use and you can set budget thresholds to avoid surprises. Billing guarantees are available to insure against volumetric attacks - your app will never go down because you hit a limit."}},{"@type":"Question","@id":"https://arcjet.com/pricing#faq-question-4","name":"Is there a free plan?","acceptedAnswer":{"@type":"Answer","text":"Yes. When the 15 day trial ends, your account continues on a free plan limited to 10,000 requests per month. The limit is a hard stop rather than metered overage, so you are never billed for going over it. Set up billing and choose a plan to lift the cap."}},{"@type":"Question","@id":"https://arcjet.com/pricing#faq-question-5","name":"Do you support open source projects?","acceptedAnswer":{"@type":"Answer","text":"Yes. Many open source projects use Arcjet on the Individual plan. The Individual plan works well for non-commercial, community-maintained open source projects and includes access to all protections with discounted or free pricing. Reach out to us to discuss how Arcjet can help."}},{"@type":"Question","@id":"https://arcjet.com/pricing#faq-question-6","name":"What payment methods do you accept?","acceptedAnswer":{"@type":"Answer","text":"We accept all major credit and debit cards on all plans. Enterprise plans can optionally be purchased through an annual contract and paid by ACH/Wire."}},{"@type":"Question","@id":"https://arcjet.com/pricing#faq-question-7","name":"Who is behind Arcjet?","acceptedAnswer":{"@type":"Answer","text":"Arcjet Labs, Inc. is headquartered in San Francisco and also has an office in New York. We raised a seed round in 2023 and Series A in 2025. We're backed by Andreessen Horowitz, Plural, Seedcamp, and 20+ angel investors. Our CEO, David Mytton, writes the console.dev devtools newsletter."}}]}]} .css-5am9f0{--Icon-fontSize:calc(1em * undefined);--Icon-color:currentColor;margin:var(--Typography-margin, 0px);display:block;font-size:var(--Typography-fontSize, inherit);color:var(--variant-solidColor, var(--aj-palette-primary-solidColor, var(--aj-palette-common-white, #FFF)));border-radius:var(--aj-radius-xs);padding-block:min(0.1em, 4px);padding-inline:0.25em;margin-inline:-0.25em;--variant-borderWidth:0px;background-color:var(--variant-solidBg, var(--aj-palette-primary-solidBg, var(--aj-palette-primary-500, #0B6BCB)));font-weight:var(--aj-fontWeight-md);} Arcjet pricing .css-10hjjl9{--Icon-fontSize:calc(1em * undefined);--Icon-color:currentColor;margin:var(--Typography-margin, 0px);display:block;font-size:var(--Typography-fontSize, inherit);color:var(--variant-plainColor, rgba(undefined / 1));border-radius:var(--aj-radius-xs);padding-block:min(0.1em, 4px);padding-inline:0.25em;margin-inline:-0.25em;font-weight:var(--aj-fontWeight-md);} Put the decision where the action is. .css-y3knef{--padT:calc(var(--sp) * 3);--padR:calc(var(--sp) * 3);--padB:calc(var(--sp) * 3);--padL:calc(var(--sp) * 3);--rad:calc(var(--sp) * 2);} .css-ph7x90{--Icon-fontSize:calc(1em * var(--aj-lineHeight-xs, 1.33334));--Icon-color:currentColor;margin:var(--Typography-margin, 0px);display:block;font-family:var(--aj-fontFamily-display, "Inter", var(--aj-fontFamily-fallback, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"));font-weight:var(--aj-fontWeight-xl, 700);font-size:var(--Typography-fontSize, var(--aj-fontSize-xl4, 2.25rem));line-height:var(--aj-lineHeight-xs, 1.33334);letter-spacing:-0.025em;color:var(--variant-plainColor, rgba(var(--aj-palette-primary-mainChannel) / 1));border-radius:var(--aj-radius-xs);padding-block:min(0.1em, 4px);padding-inline:0.25em;margin-inline:-0.25em;font-weight:var(--aj-fontWeight-md);} Individual .css-h8n4os{--Icon-fontSize:calc(1em * var(--aj-lineHeight-md, 1.5));--Icon-color:currentColor;margin:var(--Typography-margin, 0px);display:block;font-family:var(--aj-fontFamily-body, "Inter", var(--aj-fontFamily-fallback, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"));font-size:var(--Typography-fontSize, var(--aj-fontSize-lg, 1.125rem));line-height:var(--aj-lineHeight-md, 1.5);color:var(--variant-plainColor, rgba(undefined / 1));border-radius:var(--aj-radius-xs);padding-block:min(0.1em, 4px);padding-inline:0.25em;margin-inline:-0.25em;font-weight:var(--aj-fontWeight-md);} Get started. $ 25 / mo Start a 15 day trial 1 team member .css-1oq6rh{--Divider-thickness:1px;--Divider-lineColor:var(--aj-palette-divider);--_Divider-inset:var(--Divider-inset, 0px);margin:initial;margin-inline:var(--_Divider-inset);margin-block:initial;position:relative;-webkit-align-self:stretch;-ms-flex-item-align:stretch;align-self:stretch;-webkit-flex-shrink:0;-ms-flex-negative:0;flex-shrink:0;border:none;list-style:none;background-color:var(--Divider-lineColor);inline-size:initial;block-size:var(--Divider-thickness);--Divider-inset:calc(-1 * var(--List-padding));margin-block-start:calc(var(--List-gap) + var(--ListDivider-gap));margin-block-end:var(--ListDivider-gap);} 1 hour log retention Email support .css-yt03wz{--Icon-fontSize:calc(1em * var(--aj-lineHeight-md, 1.5));--Icon-color:currentColor;margin:var(--Typography-margin, 0px);display:block;font-family:var(--aj-fontFamily-body, "Inter", var(--aj-fontFamily-fallback, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"));font-size:var(--Typography-fontSize, var(--aj-fontSize-sm, 0.875rem));line-height:var(--aj-lineHeight-md, 1.5);color:var(--variant-solidColor, var(--aj-palette-primary-solidColor, var(--aj-palette-common-white, #FFF)));border-radius:var(--aj-radius-xs);padding-block:min(0.1em, 4px);padding-inline:0.25em;margin-inline:-0.25em;--variant-borderWidth:0px;background-color:var(--variant-solidBg, var(--aj-palette-primary-solidBg, var(--aj-palette-primary-500, #0B6BCB)));font-weight:var(--aj-fontWeight-md);} .css-1bqup1q{--Icon-fontSize:1.25em;--Icon-color:currentColor;--CircularProgress-size:1.25em;--CircularProgress-thickness:3px;font:inherit;-webkit-text-decoration:none;text-decoration:none;text-decoration-thickness:max(0.08em, 1px);text-underline-offset:0.15em;display:-webkit-inline-box;display:-webkit-inline-flex;display:-ms-inline-flexbox;display:inline-flex;-webkit-align-items:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-tap-highlight-color:transparent;background-color:transparent;outline:0;border:0;margin:0;border-radius:var(--aj-radius-xs);padding:0;cursor:pointer;text-decoration-color:var(--variant-outlinedBorder, rgba(var(--aj-palette-primary-mainChannel) / var(--Link-underlineOpacity, 0.72)));padding-block:min(0.1em, 4px);padding-inline:0.25em;-moz-appearance:none;-webkit-appearance:none;position:relative;--variant-borderWidth:0px;color:var(--variant-solidColor, var(--aj-palette-primary-solidColor, var(--aj-palette-common-white, #FFF)));background-color:var(--variant-solidBg, var(--aj-palette-primary-solidBg, var(--aj-palette-primary-500, #0B6BCB)));}@media (hover: hover){.css-1bqup1q:hover{text-decoration-line:underline;}}.css-1bqup1q::-moz-focus-inner{border-style:none;}.css-1bqup1q.Mui-focusVisible,.css-1bqup1q:focus-visible{outline-offset:var(--focus-outline-offset, var(--aj-focus-thickness, 2px));outline:var(--aj-focus-thickness, 2px) solid var(--aj-palette-focusVisible, #0B6BCB);}@media (hover: hover){.css-1bqup1q:hover{background-color:var(--variant-solidHoverBg, var(--aj-palette-primary-solidHoverBg, var(--aj-palette-primary-600, #185EA5)));}}.css-1bqup1q:active{background-color:var(--variant-solidActiveBg, var(--aj-palette-primary-solidActiveBg, var(--aj-palette-primary-700, #12467B)));}.css-1bqup1q.Mui-disabled{pointer-events:none;cursor:default;--Icon-color:currentColor;color:var(--variant-solidDisabledColor, var(--aj-palette-primary-solidDisabledColor, var(--aj-palette-neutral-400, #9FA6AD)));background-color:var(--variant-solidDisabledBg, var(--aj-palette-primary-solidDisabledBg, var(--aj-palette-neutral-100, #F0F4F8)));} See usage fees .css-61owou{display:-webkit-inline-box;display:-webkit-inline-flex;display:-ms-inline-flexbox;display:inline-flex;-webkit-margin-start:clamp(4px, var(--Link-gap, 0.25em), 0.5rem);margin-inline-start:clamp(4px, var(--Link-gap, 0.25em), 0.5rem);} .css-bb2jb1{-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;margin:var(--Icon-margin);width:1em;height:1em;display:inline-block;-webkit-flex-shrink:0;-ms-flex-negative:0;flex-shrink:0;font-size:var(--Icon-fontSize, var(--aj-fontSize-xl2));color:var(--Icon-color, var(--aj-palette-text-icon));} Startup For growing teams. $ 299 / mo Start a 15 day trial 2 team members 24 hour log retention Email + Slack support See usage fees Enterprise For teams at scale. .css-17n55b3{--Icon-fontSize:calc(1em * var(--aj-lineHeight-xs, 1.33334));--Icon-color:currentColor;margin:var(--Typography-margin, 0px);display:block;font-family:var(--aj-fontFamily-display, "Inter", var(--aj-fontFamily-fallback, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"));font-weight:var(--aj-fontWeight-xl, 700);font-size:var(--Typography-fontSize, var(--aj-fontSize-xl4, 2.25rem));line-height:var(--aj-lineHeight-xs, 1.33334);letter-spacing:-0.025em;color:var(--variant-plainColor, rgba(undefined / 1));border-radius:var(--aj-radius-xs);padding-block:min(0.1em, 4px);padding-inline:0.25em;margin-inline:-0.25em;font-weight:var(--aj-fontWeight-md);} Custom Book a demo Unlimited team members SIEM export Priority support See usage fees .css-1iy83q4{--padT:calc(var(--sp) * 2.5);--padR:calc(var(--sp) * 12);--padB:calc(var(--sp) * 2.5);--padL:calc(var(--sp) * 12);--rad:calc(var(--sp) * 1);} Enterprise requirements? See more Usage fees Pay for what you use. Discounts available for committed usage. Feature Price Web Requests Protecting websites and web apps with bot protection, Shield WAF, email validation, etc. $5 per 1M requests Agent Requests Protecting coding agents and custom agents with PII detection, prompt injection protection, tool guards, etc. $50 per 1M requests Questions? .css-kbl3mq{--padT:calc(var(--sp) * 0);--padR:calc(var(--sp) * 0);--padB:calc(var(--sp) * 0);--padL:calc(var(--sp) * 0);--rad:calc(var(--sp) * 1);} .css-z18j96{--Icon-fontSize:calc(1em * var(--aj-lineHeight-md, 1.5));--Icon-color:currentColor;margin:var(--Typography-margin, 0px);display:block;font-family:var(--aj-fontFamily-body, "Inter", var(--aj-fontFamily-fallback, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"));font-size:var(--Typography-fontSize, var(--aj-fontSize-md, 1rem));line-height:var(--aj-lineHeight-md, 1.5);color:var(--variant-solidColor, var(--aj-palette-primary-solidColor, var(--aj-palette-common-white, #FFF)));border-radius:var(--aj-radius-xs);padding-block:min(0.1em, 4px);padding-inline:0.25em;margin-inline:-0.25em;--variant-borderWidth:0px;background-color:var(--variant-solidBg, var(--aj-palette-primary-solidBg, var(--aj-palette-primary-500, #0B6BCB)));font-weight:var(--aj-fontWeight-md);} Can I book a demo? How does usage-based pricing work? Are there any request limits? Is there a free plan? Do you support open source projects? What payment methods do you accept? Who is behind Arcjet? Still not sure? .css-1hz4a2r{--padT:calc(var(--sp) * 4);--padR:calc(var(--sp) * 4);--padB:calc(var

Showing the first 20,000 characters. Full output is available in raw details.

Thinking…

Got the pricing info. Next I need the quickstart docs. Let me search for the correct URL on docs.arcjet.com. I'll try the sitemap or a known path like /get-started. The Arcjet docs used to be at docs.arcjet.com/quick-start... now it's 404. Let me check the sitemap.

Got the pricing info. Next, I'll find the current quickstart documentation and check the SDK on npm.

curl -sS -m 20 https://docs.arcjet.com/sitemap-index.xml | head -20; echo ---; curl -sS -m 20 https://docs.arcjet.com/sitemap-0.xml | grep -oE '<loc>[^<]+' | sed 's/<loc>//' | grep -iE "start|install|node|express" | head -20
<?xml version="1.0" encoding="UTF-8"?><sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><sitemap><loc>https://docs.arcjet.com/sitemap-0.xml</loc
<?xml version="1.0" encoding="UTF-8"?><sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><sitemap><loc>https://docs.arcjet.com/sitemap-0.xml</loc><lastmod>2026-10-14T16:40:24.000Z</lastmod></sitemap></sitemapindex>---
https://docs.arcjet.com/agent-get-started/
https://docs.arcjet.com/redact/quick-start/
https://docs.arcjet.com/reference/nodejs/
https://docs.arcjet.com/sdk/astro/bot-protection/quick-start/
https://docs.arcjet.com/sdk/astro/filters/quick-start/
https://docs.arcjet.com/sdk/astro/get-started/
https://docs.arcjet.com/sdk/bun/bot-protection/quick-start/
https://docs.arcjet.com/sdk/bun/content-moderation/quick-start/
https://docs.arcjet.com/sdk/bun/email-validation/quick-start/
https://docs.arcjet.com/sdk/bun/filters/quick-start/
https://docs.arcjet.com/sdk/bun/get-started/
https://docs.arcjet.com/sdk/bun/nosecone/quick-start/
https://docs.arcjet.com/sdk/bun/plus/hono/get-started/
https://docs.arcjet.com/sdk/bun/rate-limiting/quick-start/
https://docs.arcjet.com/sdk/bun/sensitive-info/quick-start/
https://docs.arcjet.com/sdk/bun/shield/quick-start/
https://docs.arcjet.com/sdk/bun/signup-protection/quick-start/
https://docs.arcjet.com/sdk/claude-agent-sdk/content-moderation/quick-start/
https://docs.arcjet.com/sdk/claude-agent-sdk/get-started/
https://docs.arcjet.com/sdk/claude-agent-sdk/guards/quick-start/

npm view arcjet version dist-tags.latest 2>&1 | head; echo ---; npm view @arcjet/node version 2>&1 | head -3
version = '1.14.1'
version = '1.14.1'
dist-tags.latest = '1.14.1'
---
1.14.1
Thinking…

The user wants to use the hosted product "lightly" via SDK/API. No local service stack, and no long-running commands either. Arcjet requires an account/API key (ARCJET_KEY) obtained from app.arcjet.com — I can't create an account. But I can build a sample app. The question is whether it can run without an API key. The Arcjet SDK requires a key, and without a key protect() will fail (if failOpen? Actually, if there's no key, does the SDK throw an error at initialization time? The Arcjet Node SDK requires a key and throws "Arcjet key is required").

User's instruction: "If there is a developer workflow you can't execute for this product, clearly say so and stop." Arcjet does have a developer workflow that I can execute: install the SDK, write code. The only thing I can't do is sign up for an account and obtain a key. I can build the sample, install the SDK, write the code, verify that compilation/type-checking passes, and note that running it requires an ARCJET_KEY from the hosted console (a simple web signup — this is a limitation, but the workflow exists).

Let me check the Node.js get-started docs to get accurate sample code.

curl -sS -m 20 "https://docs.arcjet.com/sdk/nodejs/get-started/" | python3 -c "
import sys,re,html
h=sys.stdin.read()
m=re.search(r'<main.*?</main>', h, re.S)
h=m.group(0) if m else h
h=re.sub(r'<script.*?</script>','',h,flags=re.S)
h=re.sub(r'<style.*?</style>','',h,flags=re.S)
h=re.sub(r'<[^>]+>','\n',h)
h=html.unescape(h)
lines=[l.strip() for l in h.split('\n')]
print('\n'.join(l for l in lines if l))
" | head -150
404
404
Page not found. Check the URL or try using the search bar.
Thinking…

Hmm, the sitemap lists paths like /sdk/nodejs/... . Let me try grepping the nodejs path from the sitemap.

curl -sS -m 20 https://docs.arcjet.com/sitemap-0.xml | grep -oE '<loc>[^<]+' | sed 's/<loc>//' | grep -E "nodejs" | head -20
https://docs.arcjet.com/reference/nodejs/
https://docs.arcjet.com/reference/nodejs/
Thinking…

Does Node.js not have a get-started page? In the sitemap grep from earlier, sdk/nodejs/get-started wasn't displayed. Let's check the get-started pages across the entire sitemap and grab the Express one (an Express sample is the most lightweight — a single small server file). Actually running the server would be "long-running," but we don't need to run it. We just need to build it. Maybe we can do a dry test without keys... Arcjet requires a key. Can we test with a fake key? The SDK might accept any string, but protect() calls will fail with a network error. Actually, does the Arcjet SDK have a "test mode"? There's ARCJET_TEST_ENV and a test option... in the old version there was process.env.ARCJET_TEST_ENV. For now, let's fetch the express get-started documentation and build that.

curl -sS -m 20 https://docs.arcjet.com/sitemap-0.xml | grep -oE '<loc>[^<]+' | sed 's/<loc>//' | grep -E "express" | head
https://docs.arcjet.com/sdk/node/plus/express/get-started/
https://docs.arcjet.com/sdk/node/plus/express/get-started/
Thinking…

Hmm, the SDK list mentioned Express: "SDKs Astro Deno Express Fastify Next.js NestJS React Router Nuxt Bun SvelteKit Hono Flask Node.js FastAPI Remix". In the sitemap, only express shows up under node/plus. Could it be that the Express docs are at /sdk/express/get-started/ but not included in the sitemap? Let me check the sitemap for a complete list of "get-started" and grab the node get-started URL.

curl -sS -m 20 https://docs.arcjet.com/sitemap-0.xml | grep -oE '<loc>[^<]+' | sed 's/<loc>//' | grep -E "/sdk/(node|express|fastify)" | head -30
https://docs.arcjet.com/sdk/fastify/filters/quick-start/
https://docs.arcjet.com/sdk/fastify/filters/quick-start/
https://docs.arcjet.com/sdk/fastify/get-started/
https://docs.arcjet.com/sdk/node/bot-protection/advanced-signals/
https://docs.arcjet.com/sdk/node/bot-protection/quick-start/
https://docs.arcjet.com/sdk/node/bot-protection/reference/
https://docs.arcjet.com/sdk/node/content-moderation/
https://docs.arcjet.com/sdk/node/content-moderation/quick-start/
https://docs.arcjet.com/sdk/node/email-validation/quick-start/
https://docs.arcjet.com/sdk/node/email-validation/reference/
https://docs.arcjet.com/sdk/node/filters/quick-start/
https://docs.arcjet.com/sdk/node/filters/reference/
https://docs.arcjet.com/sdk/node/get-started/
https://docs.arcjet.com/sdk/node/nosecone/quick-start/
https://docs.arcjet.com/sdk/node/plus/express/get-started/
https://docs.arcjet.com/sdk/node/plus/hono/get-started/
https://docs.arcjet.com/sdk/node/rate-limiting/quick-start/
https://docs.arcjet.com/sdk/node/rate-limiting/reference/
https://docs.arcjet.com/sdk/node/sensitive-info/quick-start/
https://docs.arcjet.com/sdk/node/sensitive-info/reference/
https://docs.arcjet.com/sdk/node/shield/quick-start/
https://docs.arcjet.com/sdk/node/shield/reference/
https://docs.arcjet.com/sdk/node/signup-protection/quick-start/
https://docs.arcjet.com/sdk/node/signup-protection/reference/
Thinking…

The user resent the request. I have the pricing info. Next, I need to fetch the Node get-started documentation, create a sample, install the SDK, verify it, and report back. Keeping it light: no server execution needed, just build and verify. Let me grab the docs.

curl -sS -m 20 "https://docs.arcjet.com/sdk/node/get-started/" | python3 -c "
import sys,re,html
h=sys.stdin.read()
m=re.search(r'<main.*?</main>', h, re.S)
h=m.group(0) if m else h
h=re.sub(r'<script.*?</script>','',h,flags=re.S)
h=re.sub(r'<style.*?</style>','',h,flags=re.S)
h=re.sub(r'<[^>]+>','\n',h)
h=html.unescape(h)
lines=[l.rstrip() for l in h.split('\n')]
print('\n'.join(l for l in lines if l.strip()))
" | head -180
Get started with Node.js
Get started with Node.js
Arcjet
 is the AI agent runtime security platform. Discover
the agents running in your organization, enforce policy across every action,
prompt, and tool call, and keep the evidence to prove what happened. Detect
prompt injection, authorize agent tool calls, redact PII, and block bots and
abuse.
Tip
Using an AI coding assistant? See the
Agent get started
 guide, or
tell your agent:
“Set up Arcjet security for my app. Connect to the Arcjet MCP
server to get my API key, then add shield, bot detection, and rate
limiting.”
This guide shows you how to add Arcjet to your application. For an AI agent
framework it publishes one policy and guards one tool call with it. For an
HTTP framework it blocks automated clients that inflate costs and enforces
per-user token budgets. To secure Claude Code, GitHub Copilot, Muse Code,
OpenAI Codex, or Cursor, which need no SDK, see
Secure coding agents
.
1. Install Arcjet
Section titled “1. Install Arcjet”
In your project root, run the following:
Terminal window
npm
i
@arcjet/node
@arcjet/inspect
Terminal window
pnpm
add
@arcjet/node
@arcjet/inspect
Terminal window
yarn
add
@arcjet/node
@arcjet/inspect
Requirements
Section titled “Requirements”
Node.js 22.21.0 or later
CommonJS is not supported. Arcjet is ESM only.
2. Set your key
Section titled “2. Set your key”
Create a free Arcjet account
 then follow the
instructions to add a site and get a key.
Add your key to a
.env.local
 file in your project root.
You can also set
ARCJET_ENV
and other values in
.env
 files.
.env.local
1
# Run Arcjet in development <https://docs.arcjet.com/environment#arcjet-env>.
2
ARCJET_ENV
=
development
3
# Arcjet key for your site (from <https://console.arcjet.com>).
4
# More info: <https://docs.arcjet.com/environment#arcjet-key>.
5
ARCJET_KEY
=
ajkey_yourkey
.ARCJET_ENV=development# Arcjet key for your site (from
).# More info:
.ARCJET_KEY=ajkey_yourkey">
3. Configure
Section titled “3. Configure”
This adds Arcjet to your application code, where it can see who is acting and
what they are asking for.
Create a new file at
index.ts
 with the contents:
index.ts
1
import
arcjet
,
{
detectBot
,
shield
,
tokenBucket
}
from
"
@arcjet/node
"
;
2
import
{
isSpoofedBot
}
from
"
@arcjet/inspect
"
;
3
import
http
from
"
node:http
"
;
4
5
const
aj
=
arcjet
(
{
6
key
:
process
.
env
.
ARCJET_KEY
!
,
// Get your site key from https://console.arcjet.com
7
rules
:
 [
8
// Shield protects your app from common attacks such as SQL injection
9
shield
(
{
mode
:
"
LIVE
"
}
)
,
10
// Create a bot detection rule
11
detectBot
(
{
12
mode
:
"
LIVE
"
,
// Blocks requests. Use "DRY_RUN" to log only
13
// Block all bots except the following
14
allow
:
 [
15
"
CATEGORY:SEARCH_ENGINE
"
,
// Google, Bing, etc
Thinking…

Alright, I've got a grasp of the core pattern. Let me check the rest of the docs to nail down the complete example (how to use the handler with node:http, the protect call, decision handling). I'll try grabbing more lines.

curl -sS -m 20 "https://docs.arcjet.com/sdk/node/get-started/" | python3 -c "
import sys,re,html
h=sys.stdin.read()
m=re.search(r'<main.*?</main>', h, re.S)
h=m.group(0) if m else h
h=re.sub(r'<script.*?</script>','',h,flags=re.S)
h=re.sub(r'<style.*?</style>','',h,flags=re.S)
h=re.sub(r'<[^>]+>','\n',h)
h=html.unescape(h)
lines=[l.rstrip() for l in h.split('\n')]
print('\n'.join(l for l in lines if l.strip()))
" | sed -n '180,340p'
// Google, Bing, etc
// Google, Bing, etc
16
// Uncomment to allow these other common bot categories
17
// See the full list at https://arcjet.com/bot-list
18
//"CATEGORY:MONITOR", // Uptime monitoring services
19
//"CATEGORY:PREVIEW", // Link previews such as Slack, Discord
20
]
,
21
}
)
,
22
// Create a token bucket rate limit. Other algorithms are supported.
23
tokenBucket
(
{
24
mode
:
"
LIVE
"
,
25
// Tracked by IP address by default, but this can be customized
26
// See https://docs.arcjet.com/fingerprints
27
//characteristics: ["ip.src"],
28
refillRate
:
5
,
// Refill 5 tokens per interval
29
interval
:
10
,
// Refill every 10 seconds
30
capacity
:
10
,
// Bucket capacity of 10 tokens
31
}
)
,
32
]
,
33
}
)
;
34
35
const
server
=
http
.
createServer
(
async
function
(
36
req
:
http
.
IncomingMessage
,
37
res
:
http
.
ServerResponse
,
38
)
{
39
const
decision
=
await
aj
.
protect
(
req
,
{
 requested
:
5
}
)
;
// Deduct 5 tokens from the bucket
40
console
.
log
(
"
Arcjet decision
"
,
decision
)
;
41
42
if
 (
decision
.
isDenied
())
{
43
if
 (
decision
.
reason
.
isRateLimit
())
{
44
res
.
writeHead
(
429
,
{
"
Content-Type
"
:
"
application/json
"
}
)
;
Thinking…

Got enough info to write a solid example. Let me build the project: package.json (ESM), install @arcjet/node and @arcjet/inspect, index.js (use JS to avoid needing a TS build? Docs use TS. For lightness, use plain ESM JS or TS with Node 22 type stripping — Node 22.23 supports --experimental-strip-types, and actually type stripping is enabled by default in 22.18+). Keep it simple: write index.ts and run with node index.ts (Node 22 natively supports type stripping from 22.18). Node v22.23.2 — yes, type stripping is unflagged since 22.18.0.

Can't run the server (it's long-running, and forbidden). But install, type-check, and maybe verify initialization without running? Running requires ARCJET_KEY and starting the server — user said no long-running commands. Write it, install deps, validate syntax with node --check.

One consideration: can the SDK be initialized without a real key? Does Arcjet throw if the key is missing/malformed? Key validation — ajkey_ prefix. Can't call protect() without a real key from the hosted console (would fail). So workflow: code is actionable, but running requires the user to sign up for a free account and add ARCJET_KEY. This is a light constraint but the product has an actionable dev workflow, so proceed.

Let me scaffold the project.

I have all the information I need. Arcjet has a workflow that I can actually handle (install the SDK → write code → add key). So I'll continue. I'll build a minimal Node.js example using the hosted Arcjet service via @arcjet/node — no local stack, no long-running processes (the server startup will be left to you).

cd /sandbox/repo && mkdir -p arcjet-example && cd arcjet-example && npm init -y >/dev/null && npm pkg set type=module name=arcjet-example scripts.start="node index.ts" && npm i @arcjet/node @arcjet/inspect 2>&1 | tail -2
found 0 vulnerabilities

found 0 vulnerabilities
Thinking…

The user has resent the same message (probably a retry/continuation). I'm in the middle of a task: I've already created the scaffold and installed the dependencies. Next up is writing index.ts and .env.local, doing validation (node --check), and then wrapping things up including pricing and manageability. I'll continue from where I left off.

Continuing — the project scaffold is done and the SDK is installed. Now writing the example code:

File edits

1 file

Completed
Writtenarcjet-example/index.tsView changes

/sandbox/repo/arcjet-example/index.ts

Written content · previous contents were not recorded

import arcjet, { detectBot, shield, tokenBucket } from "@arcjet/node";
import { isSpoofedBot } from "@arcjet/inspect";
import http from "node:http";
 
const aj = arcjet({
  // Get your site key from https://console.arcjet.com
  key: process.env.ARCJET_KEY!,
  rules: [
    // Shield protects your app from common attacks such as SQL injection
    shield({ mode: "LIVE" }),
    // Block all bots except search engines (Google, Bing, etc.)
    // Full list: https://arcjet.com/bot-list
    detectBot({
      mode: "LIVE", // Blocks requests. Use "DRY_RUN" to log only
      allow: ["CATEGORY:SEARCH_ENGINE"],
    }),
    // Token bucket rate limit, tracked by IP address by default
    // See https://docs.arcjet.com/fingerprints
    tokenBucket({
      mode: "LIVE",
      refillRate: 5, // Refill 5 tokens per interval
      interval: 10, // Refill every 10 seconds
      capacity: 10, // Bucket capacity of 10 tokens
    }),
  ],
});
 
const server = http.createServer(async function (
  req: http.IncomingMessage,
  res: http.ServerResponse,
) {
  const decision = await aj.protect(req, { requested: 5 }); // Deduct 5 tokens
  console.log("Arcjet decision:", decision.decision, decision.reason);
 
  if (decision.isDenied()) {
    if (decision.reason.isRateLimit()) {
      res.writeHead(429, { "Content-Type": "application/json" });
      res.end(JSON.stringify({ message: "Too many requests" }));
    } else if (decision.reason.isBot()) {
      res.writeHead(403, { "Content-Type": "application/json" });
      res.end(JSON.stringify({ message: "No bots allowed" }));
    } else if (decision.reason.isShield()) {
      res.writeHead(403, { "Content-Type": "application/json" });
      res.end(JSON.stringify({ message: "Request blocked by WAF" }));
    } else {
      res.writeHead(403, { "Content-Type": "application/json" });
      res.end(JSON.stringify({ message: "Forbidden" }));
    }
    return;
  }
 
  if (decision.results.some(isSpoofedBot)) {
    // Example: extra checks for spoofed search engine bots
    res.writeHead(403, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ message: "Spoofed bot detected" }));
    return;
  }
 
  res.writeHead(200, { "Content-Type": "application/json" });
  res.end(JSON.stringify({ message: "Hello world" }));
});
 
server.listen(3000, () => {
  console.log("Arcjet-protected server listening on http://localhost:3000");
});

File edits

1 file

Completed
Writtenarcjet-example/.env.localView changes

/sandbox/repo/arcjet-example/.env.local

Written content · previous contents were not recorded

# Run Arcjet in development: https://docs.arcjet.com/environment#arcjet-env
ARCJET_ENV=development
# Arcjet key for your site (from https://console.arcjet.com)
# More info: https://docs.arcjet.com/environment#arcjet-key
ARCJET_KEY=ajkey_yourkey
Thinking…

Continuing: add a README and verify that the code passes the syntax/type check. Node 22.23 natively supports TS type stripping for .ts files (from 22.18 onward, no flag needed). Run node --check against the ts file — does it support it? node --check does parsing, but for .ts, type stripping might apply. Just run node --check index.ts. Also, without a key, can we do a quick import check? If we import @arcjet/node without ARCJET_KEY — the arcjet() constructor might validate the format of the key. Since the environment variable isn't set, it'll probably error out. Just do the syntax check only.

File edits

1 file

Completed
Writtenarcjet-example/README.mdView changes

/sandbox/repo/arcjet-example/README.md

Written content · previous contents were not recorded

# Arcjet example (Node.js)
 
Minimal example protecting an HTTP server with the hosted Arcjet service via its
SDK (`@arcjet/node`). Rules: Shield WAF, bot detection (search engines allowed),
and a token-bucket rate limit.
 
## Run
 
1. Create a free account at https://app.arcjet.com, add a site, and copy the key.
2. Put the key in `.env.local` (`ARCJET_KEY=ajkey_...`).
3. `npm start` (Node.js >= 22.21, runs TypeScript directly)
4. Test:
   - `curl http://localhost:3000` → 200 Hello world
   - `curl -A "Googlebot" http://localhost:3000` → allowed (search engine)
   - `curl -A "curl" http://localhost:3000` repeatedly → 429 after the bucket empties
     (default `ARCJET_ENV=development` runs rules in DRY_RUN; set `ARCJET_ENV=production`
     or keep `mode: "LIVE"` per rule to actually block)
 
## Pricing
 
See https://arcjet.com/pricing — 15-day trial, then a free plan (10k requests/mo,
hard stop). Paid plans: Individual $25/mo, Startup $299/mo, Enterprise custom
(per application, plus usage: $5 per 1M web requests via `protect()`, $50 per 1M
agent requests).
 
Docs: https://docs.arcjet.com/sdk/node/get-started/
 
cd /sandbox/repo/arcjet-example && node --check index.ts && echo "syntax OK" && ls node_modules/@arcjet | head
syntax OK
syntax OK
analyze
analyze-wasm
body
cache
duration
env
headers
inspect
ip
logger
Thinking…

The task is essentially complete. One thing to verify: does npm start work (node runs TS directly on 22.23)? Node 22.18+ supports type stripping by default. I shouldn't actually start the server (since it's long-running). Without a real key, the SDK might throw an exception at initialization time. Can I do a quick smoke test with a fake key and an immediately-exiting import? I could also test whether module initialization with a fake key throws an exception, but... that would end up calling the hosted API at protect time, not at initialization time. I could also run a quick test that just imports the module with ARCJET_KEY set and exits — but index.ts starts the server (long-running). I could import the SDK with a fake key, construct arcjet(), and then test a small snippet that exits. That's fast. Let me try running it with a timeout.

One last quick sanity check that the SDK initializes (without starting the server or making real requests):

cd /sandbox/repo/arcjet-example && timeout 20 node --input-type=module -e "
import arcjet, { shield, detectBot, tokenBucket } from '@arcjet/node';
const aj = arcjet({
  key: 'ajkey_test_dummy_key_for_init_check',
  rules: [shield({mode:'DRY_RUN'}), detectBot({mode:'DRY_RUN', allow:['CATEGORY:SEARCH_ENGINE']}), tokenBucket({mode:'DRY_RUN', refillRate:5, interval:10, capacity:10})],
});
console.log('SDK initialized OK:', typeof aj.protect === 'function');
" 2>&1 | tail -3
SDK initialized OK: true
SDK initialized OK: true
Thinking…

The task is complete. I need to provide the final summary: what I built, how the pricing works, whether it's easy for me to manage, and the status of the block. The previous message ended with a sanity check. Now is the time to wrap things up.

Done. Everything is built and verified in /sandbox/repo/arcjet-example/.

What I built

A minimal Node.js server protected by Arcjet's hosted service via @arcjet/node (v1.14.1):

  • index.ts — HTTP server with three Arcjet rules: Shield WAF (SQL injection etc.), bot detection (blocks bots, allows search engines, plus spoofed-bot checks via @arcjet/inspect), and a token-bucket rate limit (10 capacity, refill 5/10s). Returns 429/403 with reasons on denial.
  • .env.local — ARCJET_ENV=development + ARCJET_KEY placeholder
  • README.md — run/test instructions
  • Verified: deps installed clean, node --check passes, SDK initializes correctly. Node 22.23 here runs the TypeScript directly (npm start).

I did not start the server or make live requests — running it needs your key, and per your constraints I avoided long-running commands. Nothing blocked me: docs, npm, and the pricing page were all reachable.

How pricing works

  • 15-day free trial, then a free plan: 10,000 requests/month (hard stop, never billed for overage)
  • Paid plans (per application/month, plus usage): Individual $25/mo (1 member), Startup $299/mo (2 members), Enterprise custom
  • Usage fees: $5 per 1M web requests (each protect() call counts; rate limit/WAF/bot rules included in that single request) and $50 per 1M agent requests (AI agent protections)
  • No hard request limits on paid accounts; budget thresholds available

Is it easy for me to manage?

Yes, mostly. The code side is fully actionable: standard npm SDK, clean typed API, ESM-only but that's it — I can install, write, edit, and typecheck rules without friction. The one thing I can't do is the account step: getting an ARCJET_KEY requires signing up at app.arcjet.com through the web console (there's an MCP server/CLI for agents, but it still needs your credentials). Once you drop a key into .env.local, everything else is code I can iterate on.

AX Fundamentals

23 checks. Open an area for details.

This check is a quick preview. Test more tasks and models with Gauge Agents.

Test your product with Gauge Agents

AX Check by Gauge