Arcjet is a runtime security platform for AI agents. For coding agents, it checks each tool call and prompt against your policies before the agent acts, and it records the whole session so that you can see what every agent did.

A coding agent runs shell commands, edits files, fetches URLs, and calls MCP servers with a developer’s credentials. Claude Code, Cursor, GitHub Copilot, OpenAI Codex, and Muse Code fire hooks as they work, including before a tool call runs. Arcjet connects to those hooks, so there’s no SDK to install and no code to change. You write a policy once in the Arcjet Console, and it applies to every supported agent.

Arcjet adds the following controls to a coding agent:

• Block risky tool calls before they run, such as destructive shell commands or reads of credential files. Each check is a separate policy, so you publish only the ones you need.
• Screen prompts for prompt injection and sensitive information before they reach the model.
• Limit outbound requests to approved domains, and deny destinations that Arcjet IP threat intelligence rates as high or critical risk.
• Limit which models developers can use.
• Flag a session when Arcjet finds a risk in what the agent read or did, such as a prompt injection in a fetched page, and refuse the risky tool calls that follow.
• Record each session in the Console, including prompts, tool calls, tool results, subagents, and session start and end.
• Run each rule in dry run first, review what it would have denied, and then set it live.

Each use case in the following table has a starter policy that you can publish from the Console and adjust.

┌─────────────┐      hook      ┌───────────────┐    allow    ┌───────────────┐
│ Coding agent│───────────────▶│ Arcjet policy │────────────▶│ Tool runs     │
└─────────────┘                └───────┬───────┘             └───────────────┘
                                       │
                                       │ deny
                                       ▼
                               ┌───────────────┐
                               │ Agent stops   │
                               └───────────────┘

1. You install the Arcjet hooks through the agent’s managed settings, MDM, or a repository file. Claude Code and Copilot post each event to Arcjet over HTTP. Codex, Cursor, and Muse Code run hooks as commands, so the install adds a small wrapper script that posts the event with curl.
2. When the agent fires a hook, Arcjet runs every policy attached to that point in the session: Tool call, Prompt, or Model switch. Policies run at the edge in over 300 data centers, so the added latency stays small.
3. If every policy allows the action, Arcjet answers {} and the agent continues through its own permission flow. If a policy denies it, Arcjet answers in the agent’s own denial format, and the agent stops and reports the rule that fired.
4. Arcjet records the event, along with the events that no policy runs on, such as tool results and session start and end. The session appears in the site’s Activity in the Arcjet Console.
5. With session analysis, Arcjet also screens the tool results it records and flags the session when it finds a risk. A published policy then refuses the risky tool calls that follow.

For the endpoint, the full event list, and each agent’s denial format, see Coding agent hook reference.

Coding agent policies are Arcjet Guard policies. You write them in Rego or assemble them in the Console’s visual builder. Arcjet builds a fixed set of inputs from each hook payload, including the shell command, file paths, domains, the MCP server, the prompt, and the model. It maps each agent’s tool names to one tool_kind, such as shell or file_write, so a single policy covers every agent. A policy can also use Arcjet detectors for prompt injection, sensitive information, and IP threat intelligence.

The hook file doesn’t name any policy. Publishing a policy turns it on, and a change takes effect without touching the hooks. Arcjet runs every policy attached to the same Execute on option in one round trip and applies the most restrictive decision. Each rule can run live or in dry run, which logs the decision without denying anything.

Arcjet includes a starter policy for each use case in the Use cases table. Pick a starter in the Console, edit its Rego to match your environment, and publish it in dry run. For the input contract, the starters, and how to write your own, see Coding agent policies.

Copilot drops hook output on a prompt, so Arcjet records a prompt denial but Copilot doesn’t apply it. Copilot enforcement covers the Copilot CLI and the cloud coding agent, because VS Code agent hooks don’t support the HTTP hook type. Cursor cloud agents run tool-call hooks but not prompt hooks.

Codex and Cursor don’t fire a model switch hook. Instead, an allowed-models policy refuses their prompts and tool calls while a disallowed model is selected. For coverage by agent, see Allowed models.

• Claude Code and Copilot HTTP hooks fail open on a timeout or an error, so enforcement depends on Arcjet answering in time. The Codex, Cursor, and Muse Code wrappers fail closed: if Arcjet can’t be reached or the key is wrong, the agent’s prompts and tool calls are denied.
• Arcjet can’t block what a tool returns. A poisoned web page or MCP response arrives after the tool has run, so Arcjet can’t withhold it from the agent. Arcjet screens the result instead and can flag the session, so a published policy refuses the risky tool calls that follow. For more information, see Session analysis.
• A hook covers one installed client. To find sessions that never reached a hook, use OpenTelemetry or Compliance API ingest. To keep personal accounts off managed devices, see Block personal accounts. To find AI apps and services in use on managed devices, see Shadow AI discovery.

For every limit by agent, see Enforcement limitations.

To start, install the hooks for your agent, and then publish a starter policy in dry run.