Get started with Strands Agents
Arcjet is the AI agent runtime security platform. Discover the agents running in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence to prove what happened. Detect prompt injection, authorize agent tool calls, redact PII, and block bots and abuse.
This guide shows you how to add Arcjet to your application. For an AI agent framework it publishes one policy and guards one tool call with it. For an HTTP framework it blocks automated clients that inflate costs and enforces per-user token budgets. To secure Claude Code, GitHub Copilot, OpenAI Codex, or Cursor, which need no SDK, see Secure coding agents.
1. Install Arcjet
Section titled “1. Install Arcjet”In your project root, run the following:
pip install "arcjet[strands-agents]"Or with uv:
uv add "arcjet[strands-agents]"npm i @arcjet/guard @strands-agents/sdkpnpm add @arcjet/guard @strands-agents/sdkyarn add @arcjet/guard @strands-agents/sdkRequirements
Section titled “Requirements”- Node.js 22 or later.
- CommonJS is not supported. Arcjet is ESM only.
@strands-agents/sdk>=1.1.0 <2.
- CPython 3.10 or later.
arcjet[strands-agents]depends onstrands-agents>=1.11.0,<2.
2. Set your key
Section titled “2. Set your key”Create a free Arcjet account then follow the instructions to add a site and get a key.
Add your key to a .env.local file in your project root.
ARCJET_KEY=ajkey_yourkeyARCJET_ENV=developmentSet your environment variables:
# Export your Arcjet API key from https://console.arcjet.comARCJET_KEY=ajkey_yourkeyARCJET_ENV=development3. Configure
Section titled “3. Configure”This adds Arcjet to your application code, where it can see who is acting and what they are asking for.
First, create the policy that decides. In the
Arcjet Console, go to Policies, choose to
guard an action in your own application, enter order.looked-up as the Guard
label, and paste this description:
Deny when order_id is not in the owned_orders list.Arcjet writes the conditions and opens the draft in the visual builder. It
declares order_id as a SERVER string and owned_orders as a SERVER
string list. Set the rule live, add a test, and publish.
Every generated rule starts in dry run, so a draft can’t begin denying production traffic before you have read it. A live rule needs at least one stored test before it can be published.
Until you publish, the label matches nothing and every guard call comes back
NOT_CONFIGURED, which allows the action. For the other statuses, see
Testing and reference.
Then create a client, wrap the tool, and pass guard_hooks on
Agent(hooks=[...]):
import os
from strands import Agent, toolfrom arcjet.guard import launch_arcjet, server_inputfrom arcjet.guard.strands_agents import guard_hooks, guard_tool
arcjet = launch_arcjet(key=os.environ["ARCJET_KEY"])
@tooldef lookup_order(order_id: str) -> dict: """Look up an order by ID.""" return {"order_id": order_id, "status": "shipped"}
def run_agent(user_id: str, owned_orders: list[str], user_text: str): guarded_lookup = guard_tool( guard=arcjet, tool=lookup_order, # The action selects the policy you published. action="order.looked-up", # Actor and the order list come from trusted application state. actor=user_id, # Map only the values the policy needs. inputs=lambda arguments: { "order_id": server_input.string(arguments["order_id"]), "owned_orders": server_input.string_list(owned_orders), }, )
agent = Agent( tools=[guarded_lookup], # The hooks gate tools this file did not wrap. hooks=[guard_hooks(guard=arcjet, session_id=user_id)], ) return agent(user_text)Then create a client, wrap the tool, and pass guardHooks on
new Agent({ plugins }):
import { launchArcjet, policyInput } from "@arcjet/guard";import { guardTool, guardHooks } from "@arcjet/guard/strands-agents/v1";import { Agent, tool } from "@strands-agents/sdk";import { z } from "zod";
const arcjet = launchArcjet({ key: process.env.ARCJET_KEY! });
export function orderTools(user: { id: string; orderIds: string[] }) { return guardTool( arcjet, tool({ name: "lookup_order", description: "Look up an order by ID", inputSchema: z.object({ orderId: z.string() }), callback: ({ orderId }) => ({ orderId, status: "shipped" }), }), { // The action selects the policy you published. action: "order.looked-up", // Actor and the order list come from trusted application state. actor: user.id, // Map only the values the policy needs. inputs: (input: { orderId: string }) => ({ order_id: policyInput.server.string(input.orderId), owned_orders: policyInput.server.stringList(user.orderIds), }), }, );}
export async function runAgent( user: { id: string; orderIds: string[] }, userText: string,) { const agent = new Agent({ tools: [orderTools(user)], // The hooks gate tools this file did not wrap. plugins: [guardHooks(arcjet, { sessionId: user.id })], });
return agent.invoke(userText, { invocationState: { sessionId: user.id } });}4. Start app
npx tsx --env-file .env.local agent.tsThen invoke the agent. Denied tool calls appear in your Arcjet dashboard in real time.
python -c "from agent import run_agent; print(run_agent('user123', ['1001'], 'Look up order 1001'))"Pass the caller-owned session_id that you already have. Don’t mint
one. Denied tool calls appear in your
Arcjet dashboard in real time.
For helper options, denial payloads, and correlation, see the Strands Agents agent guard.
The requests also appear in the Arcjet dashboard.
Do I need to run any infrastructure, such as Redis?
No, Arcjet handles all the infrastructure for you so you don't need to worry about deploying global Redis clusters, designing data structures to track rate limits, or keeping security detection rules up to date.
What is the performance overhead?
Arcjet SDK tries to do as much as possible asynchronously and locally to minimize latency for each request. Where decisions can be made locally or previous decisions are cached in-memory, latency is usually <1ms.
When a call to the Cloud API is required, such as when tracking a rate limit in a serverless environment, there is some additional latency before a decision is made. The Cloud API has been designed for high performance and low latency, and is deployed to multiple regions around the world. The SDK will automatically use the closest region which means the total overhead is typically no more than 20-30ms, often significantly less.
What happens if Arcjet is unavailable?
Where a decision has been cached locally, such as blocking a client, Arcjet will continue to function even if the service is unavailable.
If a call to the Cloud API is needed and there is a network problem or Arcjet is unavailable, the default behavior is to fail open and allow the request. You have control over how to handle errors, including choosing to fail close if you prefer. See the reference docs for details.
How does Arcjet protect me against DDoS attacks?
Network layer attacks tend to be generic and high volume, so these are best handled by your hosting platform. Most cloud providers include network DDoS protection by default.
Arcjet sits closer to your application so it can understand the context. This is important because some types of traffic may not look like a DDoS attack, but can still have the same effect. For example, a customer making too many API requests and affecting other customers, or large numbers of signups from disposable email addresses.
Network-level DDoS protection tools find it difficult to protect against this type of traffic because they don't understand the structure of your application. Arcjet can help you to identify and block this traffic by integrating with your codebase and understanding the context of the request, such as the customer ID or the sensitivity of the API route.
Volumetric network attacks are best handled by your hosting provider. Application level attacks need to be handled by the application. That's where Arcjet helps.
What next?
Section titled “What next?”Get help
Section titled “Get help”Need help with anything? Email us or join our Discord to get support from our engineering team.