integrate-arcjet-guard-agents

Integrate Arcjet Guard into a Vercel AI SDK app

@arcjet/guard's Vercel AI v7 namespace wraps the app's existing Arcjet client. It never talks to the Arcjet API itself. Three surfaces, one decision rule:

• Model-invoked (the LLM decides to call a tool) → guardTool()
• App-invoked (your code performs a risky action) → guardAction()
• Observe-only (record that something happened) → captureAction()

All three attach the same correlation ID so the Arcjet Console reconstructs the whole run as one Sequence. This is not hosted Claude Managed Agents (@arcjet/guard/claude-managed-agents/v0).

Questions to ask the human first

Ask only what you cannot infer from the code; suggest defaults.

1. Which tool calls / actions are risky (external side effects, irreversible, spends money, sends messages)? Those get rules. Purely informational ones can be wrapped with no rules (recorded, nothing enforced locally) or left to captureAction().
2. What limits? (e.g. "10 lookups/min per user" → tokenBucket; "5 posts/min" → slidingWindow.)
3. Who is the user for metadata — an opaque user/tenant/installation ID (never PII)?
4. Is there an existing run identifier (request ID, job ID, review ID) to use as the correlation ID? Default: auto-generated ULID.

Step 1: Install and find the guard client

Install @arcjet/guard (required), plus ai and @ai-sdk/provider-utils (optional peers, needed only for @arcjet/guard/vercel-ai/v7). Every agent helper lives on that one path. Always use explicit versions: @arcjet/guard/vercel-ai/v7 resolves, but @arcjet/guard/vercel-ai does not — omitting the version is deliberate (it prevents silent API breaking changes when a new major version is supported). Attempting to import from an unversioned path throws ERR_PACKAGE_PATH_NOT_EXPORTED.

npm install @arcjet/guard ai @ai-sdk/provider-utils

If the app has no guard client yet, launch one once at module scope:

import { launchArcjet } from "@arcjet/guard";
export const arcjet = launchArcjet({ key: process.env.ARCJET_KEY! });