How-tos
Short, framework-specific recipes for Eve, Mastra, Claude Agent SDK, OpenAI Agents SDK, LangGraph JS, LangChain Python, and the Vercel AI SDK.
These recipes put one Guard helper on one framework surface. They do not replace the framework overviews. Use them when the question is where the deny sits: Eve inbound and connection approval, Mastra processors and beforeToolCall, Claude UserPromptSubmit and PreToolUse, OpenAI Agents before run() and authored invoke, LangGraph JS before invoke and ToolNode, or LangChain Python and Vercel AI SDK authored tools.
Read the matching framework security guide in AI Security first. Then start with inbound screening, and the connection or unwrapped-tool recipe if the host call is the risk.
Screen inbound HTTP and channel text, gate tools and MCP before the side effect, and treat observe-only hooks as a diary. Budgets, local PII, and prompt-injection checks sit on those same two boundaries.
Read guideScreen the Slack or GitHub body with guardInbound and detectPromptInjection after the signature check, before the Eve agent starts.
Read guideSecure Eve MCP and OpenAPI connections with guardApproval() on the connection's approval field. There is no local execute to wrap.
Read guideGate Mastra MCP, workspace, and toolset tools with guardHooks so beforeToolCall can deny. Do not also wrap the same authored tool with guardTool.
Read guideScreen inbound prompts on guardHooks({ inbound }) via UserPromptSubmit. A DENY returns { decision: "block" } and Claude Code erases the prompt.
Read guideDeny Bash on PreToolUse. That is the only labeled deny for unwrapped built-in tools. canUseTool and a bare allowedTools name are not a policy gate.
Read guideScreen user text with a direct guard() before run(). Wrap authored tool() with guardTool. needsApproval and hosted requireApproval are HITL, not policy. Hosted tools, MCP, and handoffs are not deny points.
Read guideScreen user text with a direct guard() call before run(). There is no guardInbound. On DENY do not call run(). Direct guard() fails open; gate hasFailedOpen() if the site must fail closed.
Read guideScreen inbound text with guard() before graph.invoke or in the first node. guardTool wraps authored tool(). guardToolNode wraps ToolNode in place for unwrapped and MCP tools. interrupt() is HITL, not policy.
Read guideMCP and unwrapped tools execute inside ToolNode. Graph hooks and HITL pauses cannot stop tool.invoke. guardToolNode is the gate. Wrap the node in place; a copy leaves the original unguarded.
Read guideUse guard_action on a callable, guard_tool on a BaseTool (arcjet[langchain]), or ArcjetMiddleware plus ToolPolicy on create_agent (arcjet[langchain-agents]). ArcjetCaptureHandler cannot deny.
Read guideWrap tool() with guardTool, create a run context with createAgentContext, and pass aiToolsContext on generateText. The wrapped tool must have execute and cannot already declare contextSchema.
Read guideneedsApproval, hosted requireApproval, and LangGraph interrupt() park a call for a person. They are not a remote allow or deny. Same trap as Eve user-approval, Mastra requireApproval, and Claude canUseTool.
Read guide