What are Mastra guardrails?
Mastra ships input and output processors that run on conversation text: PromptInjectionDetector, PIIDetector, ModerationProcessor, and SystemPromptScrubber. They sit before the model sees a user message, or before the user sees a model reply. You can block, warn, redact, or rewrite.
The injection and PII detectors are themselves LLM classifiers. Mastra's documentation says so: they call a model, they add latency, and they take a threshold. A 0.8 "injection" score is a judgment about text, not a decision about this createPullRequest.
Simon Willison's grade on vendor catch-rates applies here: a high score is a failing grade if the miss is a send. For more information, see the lethal trifecta. Scan anyway, but don't let the scan be the only gate on the tool.
What do Mastra guardrails catch well?
They catch hostile wording in the places where they are wired: a user turn that says "ignore your instructions," a reply that echoes the system prompt, and an email address that you don't want in the transcript.
They are the right control when the failure is "this text must not enter the model" or "this text must not reach the user." Runtime security for LLM applications already splits prompt injection, exfiltration, and unsafe actions. Guardrail processors are mostly the first of those, on the messages that Mastra already has.
What do they miss?
They miss a well-formed tool call. A PII detector on the model's prose doesn't see createPullRequest({ body: privateFile }). An injection detector on the user prompt doesn't see a GitHub issue, a tool summary, or an MCP result that becomes the next prompt. The lethal trifecta is how those show up together: private data, untrusted content, and external communication. None of them have to look like a jailbreak.
Mastra can load tools from MCP. Those tools never pass through a message processor. A processor that never runs at execute can't deny them.
Output processors that run after the model has replied also can't un-send. If the tool already fired, then logging the theft doesn't undo the send.
What is beforeToolCall, then?
Mastra's tool hooks (beforeToolCall and afterToolCall) are the framework's own action boundary. beforeToolCall can return { proceed: false, output } and skip execute. That is a real stop. It is also your function, written for each agent or run.
Treat it as an extension point. You still have to decide what to check, which tools it wraps, and what happens when your checker is down. afterToolCall is too late for a deny.
Human approval (requireApproval, suspend) is a third stop: a person in the path of the external action. For more information, see human approval gates. Rubber-stamping every call doesn't remove a trifecta leg.
An action gate is that last reversible point, with a different question: a labeled allow or deny on this tool, with application context. On Mastra, Arcjet Guards wrap createTool, or sit on beforeToolCall for MCP and workspace tools that you didn't wrap. They don't replace Mastra's processors. For more information about that job, see AI agent runtime security.
When do you need both?
Let Mastra's processors shrink the untrusted-content leg on the turns that they see. Put a gate on send, fetch, write, and every MCP tool that can leave the trust boundary.
Authorize the tool where it runs. The processor never sees createPullRequest.
Frequently asked questions
Is an LLM prompt-injection detector an action gate?
No. It scores text. It does not allow or deny execute.
If I rewrite the injected prompt, can I skip the tool gate?
No. Rewrite is a best-effort on the message. The model can still pick a tool from what remains, or from a tool result you never scanned.
Does blocking on beforeToolCall replace a guardrail processor?
No. The hook never sees a turn you should not have started. Screen inbound text and gate the send.
Does Arcjet replace Mastra guardrails?
No. Processors are message classifiers in Mastra's loop. An action gate is a deny on this tool. Use the processor for the text; use the gate for the side effect.
AI runtime security in your code
Protect your AI agent workflows with Arcjet
Get allow, deny, and redact on agent actions before the side effect.