Vendor, ranked 11 (tied) of 15

Arcjet

In short

Arcjet is a developer SDK that runs bot checks inside application code, which earns it 3 of 10 points and a shared 11th place. Verification, per-purpose policy and reporting grade partial; charging and commerce agents are not published, and paid plans begin at USD 25 a month.

Developer security SDK that runs bot detection, rate limits and WAF rules inside application code; it verifies known bots by IP and reverse DNS and in late 2026 added runtime security for AI agents. Vendor description of itself, checked against its documents on 2026-11-04.

Alternatives to Arcjet · arcjet.com

Type: Bot management
Homepage: arcjet.com
Last read: 2026-11-05

The rubric, with evidence

Question	Grade	What the vendor documents	Evidence
Tells a verified agent from a spoof	Partial	IP data and reverse DNS for known bots; Web Bot Auth not mentioned in docs (checked 2026-11-04)	Bot protection concepts page. Source, read 2026-11-04.
Per-purpose policy (train, search, answer, act)	Partial	allow or deny by bot name or category (e.g. CATEGORY:AI) per route	Reference page allow/deny lists. Source, read 2026-11-04.
Charging for access	Not published	support (checked 2026-11-04)	No charging feature in bot protection docs. Source, read 2026-11-04.
Lets signed commerce agents through	Not published	Visa TAP or Mastercard Agent Pay support (checked 2026-11-04)	Not mentioned in docs. Source, read 2026-11-04.
Cost	Not graded	published: from USD 25/month plus USD 5 per 1M web requests	Pricing page. Source, read 2026-11-04.
Reporting	Partial	request decision logs with 1 to 24 hours retention on self-serve plans	Pricing page log retention. Source, read 2026-11-04.
Where it runs	Not graded	app: SDK calls in application code	Concepts page: configured in your application code. Source, read 2026-11-04.

Cost

Individual USD 25/month, Startup USD 299/month, Enterprise custom; usage USD 5 per 1M web requests and USD 50 per 1M agent requests; free plan 10,000 requests/month (hard stop) after a 15-day trial. Source, read 2026-11-04.

What Arcjet does not do

No Web Bot Auth or cryptographic agent verification in bot protection docs (checked 2026-11-04).
Does not run at the CDN edge; requests reach the app before Arcjet decides (concepts page).
No AI crawler monetization or pay-per-crawl (docs read 2026-11-04).
Arcjet does not decide at a CDN; the request reaches the application before the SDK rule runs.

Documented facts

Features are as the vendor documents them; we have not tested them. A claim a vendor makes about itself is marked as a vendor claim.

Primary source Arcjet bot protection detects more than 600 bots grouped into 23 categories such as CATEGORY:AI. Source, read 2026-11-04.
Primary source Arcjet checks that a bot is who it claims to be using IP data and reverse DNS lookups. Source, read 2026-11-04.
Primary source Bot rules are configured inside the application code through the Arcjet SDK rather than at a CDN. Source, read 2026-11-04.
Primary source A rule takes exactly one of an allow or deny list; an empty allow list blocks every detected bot. Source, read 2026-11-04.
Primary source Allow and deny lists draw on Arcjet's published bot list and bot categories, and docs advise checking verification status after an allow decision. Source, read 2026-11-04.
Primary source Paid plans cost USD 25/month (Individual) or USD 299/month (Startup), plus USD 5 per 1M web requests and USD 50 per 1M agent requests. Source, read 2026-11-04.
Primary source After a 15-day trial the free plan allows 10,000 requests a month as a hard stop rather than metered overage. Source, read 2026-11-04.
Primary source Log retention is 1 hour on Individual and 24 hours on Startup. Source, read 2026-11-04.
Primary source On 17 Sep 2026 Arcjet launched Agent Runtime Security, which observes agent activity via OpenTelemetry, enforces policies on tool calls, APIs and databases, and records an audit trail. Source, read 2026-11-04, dated 2026-09-17.
Primary source On 8 Oct 2026 Arcjet added security policies for coding agents including Claude Code, Codex, Cursor, Muse Code and Copilot. Source, read 2026-11-04, dated 2026-10-08.

Dated news

2026-09-17Arcjet launches Agent Runtime Security. Arcjet introduced a product for teams building AI agents: it observes agent activity through OpenTelemetry without code changes, enforces deterministic policies on tool calls, APIs and databases before and after they run, and records inputs and decisions for audit. Source.
2026-10-08Arcjet for coding agents. Arcjet extended its policies to coding agents, covering Claude Code, Codex, Cursor, Muse Code and Copilot, so teams can control what those agents may do in their environments. Source.
2026-10-14Arcjet details agent behavior drift analysis. Arcjet described how it monitors AI coding agent sessions in real time to spot behavior drift, using Cloudflare Clef. Source.

Compared with

Arcjet vs Vercel: Arcjet verifies known bots by IP and reverse DNS inside application code through its SDK; Vercel verifies by IP, reverse DNS and Web Bot Auth at its edge and splits AI crawlers from AI assistants in a managed ruleset since 2026-10-29.
Arcjet vs Cloudflare: Arcjet runs in application code with published prices from USD 25 a month; Cloudflare runs at its edge with AI controls on the free plan.

What Arcjet does for this layer

From the vendor's own pages

Arcjet's detectBot rule accepts individual bot names such as GOOGLE_CRAWLER and BING_CRAWLER or category names, and runs in LIVE mode to block or DRY_RUN mode to log only. (docs.arcjet.com) Arcjet defines CATEGORY:AI as bots that scrape data for AI and LLM purposes, beside categories such as CATEGORY:SEARCH_ENGINE, CATEGORY:PREVIEW and CATEGORY:ARCHIVE. (docs.arcjet.com) Arcjet exposes the same bot identifiers in TypeScript, Python and Go; Python gets a BotCategory enum and Go gets BotCategory constants. (docs.arcjet.com) Arcjet's isVerifiedBot helper (is_verified_bot in Python) lets application code allow verified search engine bots while ignoring other signals. (docs.arcjet.com)

Arcjet's product menu lists Shield WAF, bot protection, rate limiting, signup form protection, email validation and sensitive information detection. (arcjet.com)

Products and plans

Product	What it does	Price model	From	As of
Bot protection (detectBot)	In-app bot detection with allow or deny lists of named bots and 23 categories.	monthly plan plus usage Individual USD 25 a month, Startup USD 299 a month; usage fees apply.	USD 25	2026-11-05
Arcjet Guards	Runtime security policies for agent frameworks and coding agents.	No price recorded

Standards

Standard	Status	Evidence
Web Bot Auth	No statement	Bot protection docs read 2026-11-05 mention IP data and reverse DNS only.
Published IP list	Supports	Arcjet verifies detected bots by checking IP data. (docs.arcjet.com)
Reverse DNS check	Supports	Arcjet performs reverse DNS lookups to catch spoofed bots. (docs.arcjet.com)

Our checks

Check	Result	Method	Date
Homepage fetch	HTTP 200	GET with the crawl user agent after a robots.txt check	2026-11-05

All bot management vendors 23 profiles
The full vendor list 73 profiles in four types
Alternatives to Arcjet graded on the rubric

Sources

arcjet.com: arcjet.com read 2026-11-04
arcjet.com: pricing read 2026-11-04
docs.arcjet.com: concepts read 2026-11-04
docs.arcjet.com: reference read 2026-11-04
arcjet.com: introducing agent runtime security observe enforce audit read 2026-11-04
arcjet.com: introducing arcjet for coding agents read 2026-11-04
arcjet.com: how we built ai agent behavior drift analysis with cloudflare clef read 2026-11-04
Identifying bots | Arcjet Docs read 2026-11-05

Last reviewed 2026-11-05