tripwireTriggered or rejectContent. Arcjet is a check that you call: guard() before run(), and guardTool on authored FunctionTool.invoke. Hosted tools, MCP, and handoffs are outside both as an Arcjet deny.What is the difference between OpenAI Agents guardrails and Arcjet?
OpenAI Agents guardrails are SDK tripwires. inputGuardrails, outputGuardrails, and defineToolInputGuardrail / defineToolOutputGuardrail set tripwireTriggered or rejectContent. Arcjet is an in-process deny that you call: guard() before run(), and guardTool on authored FunctionTool.invoke. They aren't the same control.
A tripwire can stop a turn the SDK itself considers unsafe. An Arcjet deny can stop an authored execute with application labels, rate limits, and openaiAgentsContext. Neither covers hosted tools, MCP, handoffs, or agent.asTool().
The usual bake-off treats "guardrails" as one product. OpenAI's word is a tripwire API. Arcjet's word is a function you call. A team that ships inputGuardrails and then asks why refund_order still ran mixed those jobs. The inbound string was filtered. The authored invoke was not.
This page is the layer split. How do I secure an OpenAI Agents SDK agent? is the how-to.
What do OpenAI input and output guardrails stop?
OpenAI inputGuardrails run on the inbound payload the SDK is about to send to the model. outputGuardrails run on model output. Tool guardrails (defineToolInputGuardrail, defineToolOutputGuardrail) run on tool arguments or tool results. callModelInputFilter is another SDK filter on model input.
Those surfaces return tripwires. tripwireTriggered aborts the turn. rejectContent rejects the text. They are OpenAI code. They don't call Arcjet. They don't share Arcjet labels or fail-open behavior.
A well-written input guardrail can refuse a jailbreak string before the model sees it. That is a content check the SDK owns. It isn't a labeled allow or deny on lookup_order with a token bucket keyed on the order number.
What does an in-process deny stop?
A direct guard() call before run() screens user text that you already have. On DENY, you skip run(). Direct guard() fails open, so an ALLOW isn't proof the rules ran. Gate on decision.hasFailedOpen() when that site must fail closed.
guardTool wraps authored tool({ execute }). On DENY the original invoke never runs. The helper returns a plain ArcjetDenialResult. The runner stringifies it onto a function_call_result with status: "completed". guardTool defaults to deny when Guard can't be evaluated.
Hosted tools, MCP servers, handoffs, agent.asTool(), and computer/shell don't go through that authored invoke. Runner agent_tool_start is observe-only. There is no guardHooks and no guardToolNode on this adapter. Import the helpers from @arcjet/guard/openai-agents/v0; the unversioned path doesn't resolve. Realtime and Sandbox are outside the adapter too.
protect() is the HTTP check on a route. Don't mint a fake Request inside a tool. Guard doesn't detect bots.
The two controls also meet each other. Because guardTool returns the denial as the tool's output rather than throwing, an outputGuardrails check and a customDataExtractor both receive that ArcjetDenialResult object. A guardrail written to expect a tool payload sees arcjetDenied: true instead. That is worth knowing before you write an output guardrail that assumes every tool result is real data.
How they differ
| Question | OpenAI Agents guardrails | Arcjet on OpenAI Agents |
|---|---|---|
| What it is | SDK tripwires: | A check you call: |
| Inbound text |
| Direct |
| Authored tool deny | Tool input/output guardrails on the SDK tool surface |
|
| Hosted tools, MCP, handoffs | SDK-owned; not an Arcjet deny | Not a deny point on this adapter |
| Human hold |
| HITL, not policy. See
|
| Outage behavior | SDK tripwire path | Direct |
How do I screen inbound prompts in OpenAI Agents SDK? is the inbound recipe. OpenAI Agents SDK vs Claude Agent SDK is the first-party SDK compare.
When to use which
Keep OpenAI guardrails when you want the SDK's own tripwires on input, output, or tool text. They stay in the OpenAI programming model.
Add Arcjet when you want a labeled deny you call, with application identity and rules, before authored execute runs. Screen the inbound string with guard(). Wrap tool() with guardTool.
You can keep both. A tripwire that rejects a jailbreak and a guardTool deny on refund_order answer different questions. A bake-off that treats them as substitutes still leaves hosted MCP and agent.asTool() without an Arcjet deny.
For more information about the series hub, see agent framework security. The adapter docs are the OpenAI Agents agent guard.
Frequently asked questions
What is the difference between OpenAI Agents guardrails and Arcjet?
OpenAI Agents guardrails are SDK tripwires (tripwireTriggered, rejectContent). Arcjet is an in-process deny that you call: guard() before run(), and guardTool on authored FunctionTool.invoke. They aren't the same control.
Do OpenAI inputGuardrails replace a direct guard() call?
No. inputGuardrails, outputGuardrails, defineToolInputGuardrail, and callModelInputFilter are OpenAI surfaces. They don't call guard() and don't share Arcjet labels or fail-open behavior.
Can Arcjet deny hosted tools or MCP on OpenAI Agents?
No. guardTool wraps authored invoke only. Hosted tools, MCP, handoffs, and agent.asTool() aren't deny points. Runner agent_tool_start is observe-only. Realtime and Sandbox are outside the adapter too.
Does a direct guard() call fail closed?
No. Direct guard() fails open. Gate hasFailedOpen() when the inbound site must fail closed. guardTool defaults to deny when Guard can't be evaluated.
Can I use both OpenAI guardrails and Arcjet?
Yes. A tripwire that rejects a jailbreak and a guardTool deny on refund_order answer different questions. Treating them as substitutes still leaves hosted MCP without an Arcjet deny.
AI runtime security in your code
Protect your AI agent workflows with Arcjet
Arcjet runs inside your application, where it can use runtime context to enforce agent actions and budgets, detect prompt injection, and protect sensitive information before a workflow acts.