How to screen inbound prompts in Claude Agent SDK

How do you screen inbound prompts in Claude Agent SDK?

Pass inbound to guardHooks(), and put detectPromptInjection on the submitted prompt.

A pasted GitHub comment that says "mail the inbox" is the next instruction. Screen it before the model sees it. On DENY, UserPromptSubmit returns { decision: "block" } and Claude Code erases the prompt.

1
import { query } from "@anthropic-ai/claude-agent-sdk";
2
import { guardHooks } from "@arcjet/guard/claude-agent-sdk/v0";
3
import { detectPromptInjection } from "@arcjet/guard";
4
import { arcjet } from "./arcjet.js";
5

6
const conversationId = "..."; // your conversation id
7
const sessionId = conversationId;
8

9
for await (const message of query({
10
  prompt: userText,
11
  options: {
12
    sessionId,
13
    hooks: guardHooks(arcjet, {
14
      sessionId,
15
      inbound: {
16
        action: "message.received",
17
        rules: ({ prompt }) => [detectPromptInjection()(prompt)],
18
      },
19
    }),
20
  },
21
})) {
22
  // handle streamed messages
23
}

protect() is the HTTP check on a route. This hook is the agent-side screen after you call query().

Why isn't there a guardInbound?

Claude already has an inbound event. UserPromptSubmit runs on the submitted text before Claude processes it. A second helper would be another name for the same hook.

guardHooks({ inbound }) is that screen.

Where does UserPromptSubmit run?

On the submitted prompt, before Claude processes it. A hook on that event can inject context, or it can act as a policy gate. A timed-out callback already fail-closes the prompt (Claude Code v2.1.208+). The session doesn't let an unscreened prompt through.

The Slack body, the GitHub comment, the user paste: those words become the next instruction. Runtime security for LLM applications already treats this as a control before the provider call.

Correlate the turn with a sessionId that you already have. claudeAgentContext reads that ID. It never mints one.

Does canUseTool screen the prompt?

No. canUseTool doesn't read the prompt. The comment that says "mail the inbox" is already in context before any tool callback runs. canUseTool is not a policy gate.

The callback runs when a tool is about to execute, and only if an earlier permission step didn't already resolve it. That is a later check. It isn't this screen.

What if Arcjet is down on inbound?

Helpers default to onGuardError: "deny". If Guard can't be evaluated, then inbound UserPromptSubmit blocks the prompt.

"allow" is a legitimate choice on inbound, because failing closed there would stop the agent answering during an outage. Timeout already fail-closes the prompt (Claude Code v2.1.208+). That is a per-action choice.