guardProcessor, wrap createTool, and deny MCP with guardHooks. Work through the full checklist in the Mastra security guide.How do you secure a Mastra agent?
Screen inbound messages with guardProcessor, wrap authored createTool execute with guardTool, and deny unwrapped MCP, workspace, and toolset tools with guardHooks.
The full checklist is the Mastra security guide. This page is the wiring recipe.
A Mastra agent has three places where work can start: a message that reaches processInput, an authored createTool with a local execute function, and an MCP or workspace tool that has none. Those are different jobs. Treating them as one processor list is how createPullRequest still runs after you "blocked prompt injection."
protect() is the HTTP check on a route. The product map is the Mastra agent guard.
How do you screen inbound Mastra messages?
Put guardProcessor on inputProcessors. On deny, processInput and processInputStep call abort(). processInputStep screens later agentic steps so a tool continuation can't skip the inbound gate.
See Screen inbound with guardProcessor and the inbound sample in the Mastra security guide.
Why isn't requireApproval a security policy?
requireApproval parks the call until a person clicks. It's a human hold, not a remote policy. See human approval is not a security policy.
How do you gate authored tools vs MCP and workspace tools?
Wrap createTool with guardTool. MCP, workspace, and toolset tools skip that wrap: use guardHooks. Don't apply both helpers to the same authored tool.
See How to secure Mastra MCP tools.
Are Mastra guardrails enough?
No. Mastra's PromptInjectionDetector and PIIDetector classify, redact, or abort text. They don't see the tool name. See Mastra guardrails vs an action gate.
Frequently asked questions
How do I secure a Mastra agent?
Screen inbound messages with guardProcessor, wrap authored createTool execute with guardTool, and deny unwrapped MCP, workspace, and toolset tools with guardHooks. This page is the wiring recipe. Work through the full checklist in the Mastra security guide.
Is requireApproval a policy gate?
No. requireApproval parks the call until a person clicks. It is human-in-the-loop, not a remote policy. Use guardTool for authored tools or guardHooks for unwrapped tools.
Where do I put prompt injection checks on Mastra?
On guardProcessor in inputProcessors. Mastra channels already hit processInput. On DENY, processInput and processInputStep call abort() and Mastra raises a tripwire.
What if Arcjet is down on the inbound processor?
Helpers default to onGuardError: "deny", which aborts the turn. "allow" is a legitimate choice on the inbound processor, because failing closed there would stop the agent answering during an outage.
If I wrap every createTool, are MCP tools covered?
No. MCP, workspace, and toolset tools have no local execute. Deny them with guardHooks on beforeToolCall. afterToolCall is observe-only.
AI runtime security in your code
Protect your AI agent workflows with Arcjet
Screen messages in a processor, and deny the MCP, workspace, and toolset tools you did not wrap on beforeToolCall.