Arcjet Learning Center
Short, framework-specific recipes for Eve, Mastra, Claude Agent SDK, OpenAI Agents SDK, LangGraph JS, LangChain Python, and the Vercel AI SDK.
How-tos are short recipes for one enforcement point in a specific agent framework. They assume you already know the threat model and need the helper that sits on this channel, connection, or tool. Eve screens inbound channel text and gates connections that have no local execute. Mastra screens messages in processors and denies unwrapped MCP, workspace, and toolset tools on beforeToolCall. Claude Agent SDK screens prompts on UserPromptSubmit and denies unwrapped built-ins on PreToolUse. OpenAI Agents screens text with a direct guard() before run() and wraps authored invoke. LangGraph JS screens before graph.invoke and denies MCP inside ToolNode. LangChain Python and the Vercel AI SDK wrap authored tools. Each recipe names the helper, the deny shape, and the control that is not a policy gate.
Read the matching framework overview in AI Security first. Then open the recipe for the surface you are wiring: inbound text, a connection, an authored tool, or an unwrapped MCP or built-in tool.
Screen inbound HTTP and channel text, gate tools and MCP before the side effect, and treat observe-only hooks as a diary. Budgets, local PII, and prompt-injection checks sit on those same two boundaries.
Read guideScreen the Slack or GitHub body with guardInbound and detectPromptInjection after the signature check, before the Eve agent starts.
Read guideSecure Eve MCP and OpenAPI connections with guardApproval() on the connection's approval field. There is no local execute to wrap.
Read guideGate Mastra MCP, workspace, and toolset tools with guardHooks so beforeToolCall can deny. Do not also wrap the same authored tool with guardTool.
Read guideScreen inbound prompts on guardHooks({ inbound }) via UserPromptSubmit. A DENY returns { decision: "block" } and Claude Code erases the prompt.
Read guideDeny Bash on PreToolUse. That is the only labeled deny for unwrapped built-in tools. canUseTool and a bare allowedTools name are not a policy gate.
Read guideScreen user text with a direct guard() before run(). Wrap authored tool() with guardTool. needsApproval and hosted requireApproval are HITL, not policy. Hosted tools, MCP, and handoffs are not deny points.
Read guideScreen user text with a direct guard() call before run(). There is no guardInbound. On DENY do not call run(). Direct guard() fails open; gate hasFailedOpen() if the site must fail closed.
Read guideScreen inbound text with guard() before graph.invoke or in the first node. guardTool wraps authored tool(). guardToolNode wraps ToolNode in place for unwrapped and MCP tools. interrupt() is HITL, not policy.
Read guideMCP and unwrapped tools execute inside ToolNode. Graph hooks and HITL pauses cannot stop tool.invoke. guardToolNode is the gate. Wrap the node in place; a copy leaves the original unguarded.
Read guideUse guard_action on a callable, guard_tool on a BaseTool (arcjet[langchain]), or ArcjetMiddleware plus ToolPolicy on create_agent (arcjet[langchain-agents]). ArcjetCaptureHandler cannot deny.
Read guideWrap tool() with guardTool, create a run context with createAgentContext, and pass aiToolsContext on generateText. The wrapped tool must have execute and cannot already declare contextSchema.
Read guideneedsApproval, hosted requireApproval, and LangGraph interrupt() park a call for a person. They are not a remote allow or deny. Same trap as Eve user-approval, Mastra requireApproval, and Claude canUseTool.
Read guide