Skip to content
Agents tracked: 444 Releases (7d): 644 Agent status: 3 with issuesSince last limit reset: Claude 31d · Codex 3d Updated Oct 23, 2026
AgentGid
✦ Ask

App and agent security · by Arcjet Labs, Inc.

Arcjet

A security SDK plus cloud decision API that you call from your own code (JS/TS, Python, Go) to rate-limit, block bots, validate emails, run a WAF, detect prompt injection and redact PII, with hooks to allow or block coding-agent and MCP tool calls.

You add bot blocking, rate limits and prompt-injection checks as a few lines inside a route handler or agent tool call instead of putting a proxy or WAF in front of the app.

APIFree tierCommercial: conditions

Open arcjet.com ↗ agent.md

For your project

Official API
Official API · Free tier Free plan after the 15-day trial: 10,000 requests per month, hard stop; paid usage $5 per 1M web requests, $50 per 1M agent requests
“Native SDKs for JavaScript, TypeScript, Python, and Go protect services, queues, jobs, and workflow steps – not only HTTP handlers.” arcjet.com/llms.txt
Key
Needed
“ARCJET_KEY=ajkey_yourkey” docs.arcjet.com/llms-full.txt
Formats
JSON
Data download
Not stated
Price
Free tier · from $25/mo 15-day trial, then a free plan limited to 10,000 requests per month (hard stop)
“Individual Get started. $ 25 / mo Start a 15 day trial 1 team member 1 hour log retention Email support” arcjet.com/pricing
License
Arcjet Terms of Service Use of the hosted service for personal use or internal business purposes; SDK source is Apache-2.0
Commercial use
Commercial use with conditions
“you are hereby granted a non-exclusive, limited, non-transferable, and freely revocable license to access and use the Service, solely for your personal use or internal business purposes” arcjet.com/terms
Credit
Not stated
Embedding
Embedding unclear
Using the website
Free tier

Read on Arcjet's own pages on Oct 24, 2026 · license or terms · API docs · pricing. Check the license page before you ship.

For your agent

  • Install the framework SDK (e.g. npm i @arcjet/next or @arcjet/node, pip install arcjet, go get github.com/arcjet/arcjet-go) and set ARCJET_KEY; skills via `npx skills add arcjet/skills`; management MCP at https://api.arcjet.com/mcp uses OAuth; full docs at https://docs.arcjet.com/llms-full.txt.
  • Keep ARCJET_KEY in environment variables, not source control
  • Free plan stops protecting at 10,000 requests/month; plan for that limit in production
  • Hosted service is licensed for your own internal business use; no reselling

llms.txt: arcjet.com/llms.txt · MCP: https://api.arcjet.com/mcp

Paste into your agent: Read https://agentgid.com/resources/arcjet/agent.md before using Arcjet.

Quick answers

Does Arcjet have an API?

Yes. Arcjet has an official API documented at https://docs.arcjet.com/.

Does the Arcjet API need a key?

Yes, you need an API key. Limits: Free plan after the 15-day trial: 10,000 requests per month, hard stop; paid usage $5 per 1M web requests, $50 per 1M agent requests

Is Arcjet free?

Yes, there is a free tier: 15-day trial, then a free plan limited to 10,000 requests per month (hard stop) Paid plans start at $25 a month.

Can I use Arcjet in a commercial project?

Yes, with conditions. Its terms say: "you are hereby granted a non-exclusive, limited, non-transferable, and freely revocable license to access and use the Service, solely for your personal use or internal business purposes"

What you can build

  • Rate-limit and bot-protect a signup form and public API in a Next.js or FastAPI app
  • Screen user prompts for injection and redact PII before they reach an LLM in a chatbot
  • Gate a custom agent's tool calls so risky actions are denied or held for review

Alternatives in App and agent security

All 5 →

ClawSecure Before you let a third-party skill or MCP server touch your files and keys, you can look up or run an audit and have your agent check a clearance verdict and content hash in one API call. API, no keyFree tierLicense unclear AEVS (Agent Execution Verification System) A model saying it refunded a customer is not proof; AEVS gives you a checkable record of which tool ran, with what inputs and output, without changing your tools. APIOpen sourceLicense unclear DCP (Delegated Custody Protocol) Agents can sign, pay or call an API without ever reading the raw key from a .env file, and anything over a limit waits for your approval on desktop, Telegram or phone. Open sourceFree tierCommercial OK MonoCloud You add login, sessions and API token checks to an app with an SDK instead of building password storage, social providers and passkeys yourself, and the free plan covers up to 50,000 monthly active users. APIFree tierCommercial OK

Something wrong or out of date? Tell us.