Skip to content
Arcjet Docs

AI app abuse protection for LangGraph

Automated clients – scrapers, data harvesters, and script-based attackers - treat AI features as free compute. Without bot protection, every request from a bot reaches your AI provider and inflates your costs.

Arcjet bot detection runs inside your application, before the AI call, so denied requests never reach your provider. It classifies known bots, verifies good bots, and detects emerging threats in real time so you can control access per route with full application context (identity, subscription level, session state).

Get started

Section titled “Get started”

Bot detection is a request-based rule. On an agent, abuse control is a rate limit plus inbound prompt-injection screening so a single actor cannot loop tools or jailbreak the model.

We assume you already have a LangGraph project set up. For helper options and denial behavior, see the LangGraph agent guard.

Install the dependencies:

Terminal window
# Export your Arcjet API key from https://console.arcjet.com
export ARCJET_KEY="ajkey_..."


npm install @arcjet/guard @langchain/langgraph @langchain/core

Create the example:

agent.ts
import { launchArcjet, detectPromptInjection, tokenBucket } from "@arcjet/guard";
import { guardTool, langgraphAgentContext } from "@arcjet/guard/langgraph/v1";
import { tool } from "@langchain/core/tools";
import { z } from "zod";


const arcjet = launchArcjet({ key: process.env.ARCJET_KEY! });


const lookupLimit = tokenBucket({
  bucket: "lookups",
  refillRate: 5,
  intervalSeconds: 10,
  maxTokens: 10,
});
const inbound = detectPromptInjection();


export const lookupOrder = guardTool(
  arcjet,
  tool(
    async ({ orderId }) => ({ orderId, status: "shipped" }),
    {
      name: "lookup_order",
      description: "Look up an order by ID",
      schema: z.object({ orderId: z.string() }),
    },
  ),
  {
    action: "order.looked-up",
    rules: (input) => [lookupLimit({ key: input.orderId, requested: 5 })],
  },
);


export async function runAgent(
  graph: { invoke: Function },
  conversationId: string,
  userText: string,
) {
  const config = { configurable: { thread_id: conversationId } };
  const decision = await arcjet.guard({
    label: "message.received",
    rules: [inbound(userText)],
    ...langgraphAgentContext(config),
  });


  if (decision.conclusion === "DENY" || decision.hasFailedOpen()) {
    throw new Error("Message blocked");
  }


  return graph.invoke(
    { messages: [{ role: "user", content: userText }] },
    config,
  );
}

Then start or invoke the agent with a test prompt.

Requests appear in your Arcjet dashboard in real time.

Configure bot detection

Section titled “Configure bot detection”

allow: [] blocks all automated clients. This is the recommended default for AI routes where no bot traffic is legitimate.

To allow specific categories or named bots from our list of known bots, add them to the allow list:

detectBot({
  mode: "LIVE",
  allow: [
    "CURL", // Allow curl-based scripts
    "CATEGORY:MONITOR",  // Uptime monitoring services
    "CATEGORY:PREVIEW",  // Link previewers (Slack, Discord, etc.)
  ],
})

Budget control

Section titled “Budget control”

Bot protection controls who can call your AI features. To also control how much each user can consume, combine it with AI budget control:

rules: [
  detectBot({ mode: "LIVE", allow: [] }),
  tokenBucket({ // Token bucket rate limiting is best for AI budget control
    mode: "LIVE",
    characteristics: ["userId"], // Link limits to users
    refillRate: 2_000, // Refill 2000 tokens per interval
    interval: "1h", // Refill interval
    capacity: 5_000, // Max tokens
  }),
]

The get started guide shows the combined pattern.

Prompt injection detection

Section titled “Prompt injection detection”

Bot protection controls who can call your AI features, but legitimate users can still submit malicious prompts. Combine bot detection with prompt injection detection to also block jailbreaks, role-play escapes, and instruction overrides before they reach your AI model.

Learn more

Section titled “Learn more”