@arcjet/skills
choose-protections
Choose which Arcjet rules address a security problem. Use when deciding between detectBot, shield, rate limits, detectPromptInjection, sensitiveInfo, validateEmail, filter, or Guard-only content moderation.
Choose Arcjet protections
Load this skill when you need to pick rules. Then load @arcjet/skills#protect or @arcjet/skills#guard to implement them.
| Problem | Rule | Where |
|---|---|---|
| Bots, scrapers, automated clients | detectBot (allow or deny, not both) | Request only |
| SQLi / XSS / common probes | shield (mode: "LIVE") | Request only |
| Cost / abuse quotas | tokenBucket, fixedWindow, slidingWindow | Request and Guard |
| Jailbreaks, instruction overrides | detectPromptInjection (binary; no threshold) | Request and Guard |
| PII in text (names, addresses, gov IDs, card, email, phone, IP) | sensitiveInfo / localDetectSensitiveInfo + backend: rampart() | Request and Guard (server runtime) |
| Unsafe / abusive text | moderateContent | Guard only |
| Signup spam, disposable email | validateEmail + protectSignup | Request only |
| VPN / Tor / country / IP lists | filter | Request only |
| Dangerous tool calls | Guard per-tool label + rate limits | Guard only |
Token bucket: variable-cost AI (requested per call). Fixed window: hard cap. Sliding window: no boundary burst. Request rate limits default to IP; set characteristics: ["userId"] for a user key. Guard rate limits always need key and bucket.
Sensitive-info rules use @arcjet/sensitive-info-rampart. Always pass backend: rampart() on the rule; Rampart entities never match without it. Rampart needs Node.js, Bun, or Deno – not Cloudflare Workers or edge runtimes.
capture() records that an action happened. It is not a protection rule.
Remote bot and filter rules can be managed with the CLI or MCP without a redeploy — load @arcjet/skills#cli or @arcjet/skills#mcp.
Claude Code / Copilot hooks are not this table. Publish a coding-agent policy via @arcjet/skills#mcp (Execute on: Tool call, Prompt, or Model switch) and install hooks from https://docs.arcjet.com/coding-agents (omit ?surface=).