# AX Check: arcjet.com Checked 2026-10-21. Arcjet's docs, pricing, and setup are clear and fully machine-readable. All 23 checklist items passed, covering docs, onboarding, pricing and activation. Pricing is stated openly with no gating or interaction needed. ## Onboarding needs a login ## Coding sessions Three independent sessions (DeepSeek V4.1 Flash, Kimi K3, Qwen 3.8 Max) all completed the pricing task, each correctly quoting the $25/mo and $299/mo plans, usage fees of $5 and $50 per 1M requests, the 15-day trial, and the 10,000 request/month free tier cap straight from the pricing page. ### DeepSeek V4.1 Flash [View public run](https://agents.withgauge.com/p/runs/6d0bb3f9-d176-4dbe-a25a-21174e70fce0) · [Read transcript](https://www.ax-check.com/arcjet.com/sessions/deepseek.json) Quoted $25 and $299 per app per month plus $5/1M web and $50/1M agent requests. Named the 15-day trial, the 10k/month free cap and that one protect() call is one request. (seq 29, seq 103, seq 117, README.md) #### End-to-end onboarding - **Onboarding needs a login**: The agent never obtained real Arcjet credentials. It only tested with a placeholder key ("ajkey_test") and a bogus string ("bogus"), both producing ERROR decisions when a cloud call was needed. Getting a real ARCJET_KEY requires interactive signup/login, which the agent explicitly flagged as something it cannot do autonomously. No authenticated operation against the real hosted Arcjet API was ever demonstrated. Event 77: ```text ARCJET_KEY=ajkey_test ARCJET_ENV=development PORT=8137 timeout 25 node index.mjs ``` Event 94: ```text ajkey_test + browser-UA: conclusion=ERROR reason=ERROR ``` Event 117: ```text I could not run a **real hosted decision end-to-end** because there's no `ARCJET_KEY` in this environment. Getting one requires interactive signup/login (`npx @arcjet/cli auth login` or the console), which I can't do autonomously. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No real Arcjet API key available, blocking hosted verification**: The sandbox had no ARCJET_KEY and obtaining one requires interactive account signup/login, which the agent cannot complete without a human. This is a session/credential limitation, not a product defect. The example code was verified structurally (syntax, SDK construction, decision branching) but never exercised a genuine authenticated cloud decision; bot-detection DENY came from a local analysis engine, and invalid keys produced ERROR decisions. Event 77: ```text ARCJET_KEY=ajkey_test ARCJET_ENV=development PORT=8137 timeout 25 node index.mjs ``` Event 94: ```text bogus-key + curl-UA: conclusion=DENY reason=BOT ``` Event 117: ```text Getting one requires interactive signup/login (`npx @arcjet/cli auth login` or the console), which I can't do autonomously. ``` #### Suggested Changes - **Clarify that bot-detection decisions can bypass the cloud API entirely**: A request with a bot-like User-Agent returned DENY even with an invalid key, while other rules returned ERROR on the same bad key, indicating bot detection runs through a local analysis engine independent of key validity. This was found by trial and error, not documented. Add a note to the Node.js quickstart clarifying which rules resolve locally vs. require a live API call, so developers testing without a valid key don't mistake local-only results for confirmed cloud connectivity. Event 86: ```text bogus-key + curl-UA": conclusion=DENY reason=BOT ``` Event 94: ```text ajkey_test + browser-UA: conclusion=ERROR reason=ERROR ``` - **Document fail-open behavior on ERROR decisions in the quickstart example**: The quickstart code checks decision.isDenied() but never branches on an ERROR conclusion; testing showed isDenied() is false for ERROR results, so requests silently pass through on API/key failures. Add a note or code branch to the Node.js quick start showing how to detect decision.conclusion === "ERROR" for fail-closed deployments. Event 94: ```text ajkey_test + browser-UA: conclusion=ERROR reason=ERROR ``` Event 117: ```text an `ERROR` decision has `isDenied() === false`, so the request proceeds. Handle it explicitly if you want fail-closed behavior. ``` ### Kimi K3 [View public run](https://agents.withgauge.com/p/runs/e970c7da-cb6c-4dc0-8f3c-5eaf12abd6e2) · [Read transcript](https://www.ax-check.com/arcjet.com/sessions/kimi.json) Quoted $25/mo and $299/mo plans plus $5 per 1M web and $50 per 1M agent requests, tied to plan tier, the 15-day trial and the free tier's hard cap of 10k requests a month. (seq 14, seq 20, seq 98) #### End-to-end onboarding - **Onboarding needs a login**: Agent never obtained real Arcjet account credentials. It inspected the CLI's auth command and found that signup/login requires a browser-based flow, which cannot be completed by an autonomous agent. All subsequent SDK calls used a placeholder key ('test' / 'missing-key') and consistently returned '[unauthenticated] unauthorized' from the hosted decision API. Only local, unauthenticated bot-detection heuristics worked; no authenticated operation against the hosted product was ever demonstrated. Event 53: ```text Manage authentication Usage: arcjet auth [flags] Available Commands: login Log in to Arcjet via browser ``` Event 46: ```text 1 ERROR ERROR [unauthenticated] unauthorized | remaining: 0 ``` Event 56: ```text CLI auth is browser-based login only — that's my blocker. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No non-interactive signup/login path for Arcjet**: Arcjet account creation and the CLI's auth login both require a human to complete a browser-based flow. This is normal product behavior (protecting account security), not an agent error or environment limitation, but it fully prevented the agent from obtaining a real API key and therefore from exercising any hosted-API-backed rule (rate limiting, Shield WAF via the decision API, reporting). Event 53: ```text Available Commands: login Log in to Arcjet via browser ``` Event 56: ```text CLI auth is browser-based login only — that's my blocker. ``` - **Rate-limit and Shield decisions fail without a valid key**: Running the example with a placeholder key against the hosted decision API returned ERROR/[unauthenticated] unauthorized for every protect() call needing server-side state (rate limiting), confirming those features are gated behind real authentication and cannot be demoed end-to-end in this session. Event 46: ```text 1 ERROR ERROR [unauthenticated] unauthorized | remaining: 0 ``` Event 71: ```text 1 ERROR | ALLOW:SHIELD, ALLOW:RATE_LIMIT, ALLOW:BOT [unauthenticated] unauthorized ``` #### Suggested Changes - **Add a documented non-interactive API key creation path**: On the Arcjet CLI auth page or docs, offer a way to mint an API key without a browser login (e.g., an API-key creation endpoint or CLI flag usable with an existing account token). Verify by running 'arcjet auth login' or 'arcjet auth token' in a headless shell and confirming a usable key is returned without opening a browser. Event 53: ```text Available Commands: login Log in to Arcjet via browser logout Log out and remove stored credentials status Show current authentication status token Print the current Arcjet token as a shell-evaluable export ``` - **Clarify ArcjetNodeRequest shape in the quickstart example**: The default/sample request object in docs or generated quickstart code should show headers as a plain object (not a Headers instance) and ip sourced from socket.remoteAddress, since the agent's first attempt using 'new Headers()' and a bare 'ip' field failed with a fingerprint error. Check by running the quickstart snippet as-is and confirming no fingerprint ERROR occurs on a first try. Event 26: ```text error: "unable to generate fingerprint: error generating identifier - requested `ip` characteristic but the `ip` value was empty" ``` Event 36: ```text export interface ArcjetNodeRequest { /** * Headers of the request. */ headers?: Record | undefined; ``` ### Qwen 3.8 Max [View public run](https://agents.withgauge.com/p/runs/b3d67c37-99c6-453a-b453-23c2d7df00f4) · [Read transcript](https://www.ax-check.com/arcjet.com/sessions/qwen.json) Gave prices taken from the fetched pricing page and named the basis: a 15-day trial, then a free tier capped at 10k requests/month; $25 and $299 per application per month plus usage; $5 per 1M web requests and $50 per 1M agent requests (seq 15, seq 80, arcjet-example/README.md) #### End-to-end onboarding - **Onboarding needs a login**: The agent built a complete Node.js example wired to the hosted Arcjet SDK (@arcjet/node) but never obtained a real ARCJET_KEY. It used a placeholder key value and only initialized the SDK locally (no network call), explicitly stating it could not get credentials without a human signing up at the web console. Event 64: ```text ARCJET_KEY=ajkey_yourkey ``` Event 77: ```text key: 'ajkey_test_dummy_key_for_init_check', ``` Event 80: ```text The one thing I can't do is the **account step**: getting an `ARCJET_KEY` requires signing up at app.arcjet.com through the web console ``` #### Hallucinated URLs - **Guessed node get-started URL returned 404 before correct path found**: The agent first tried https://docs.arcjet.com/sdk/nodejs/get-started/ (guessing the SDK folder name as 'nodejs'), which 404'd. It then checked the sitemap and found the real path uses 'node' instead of 'nodejs', confirming the first URL was an invented guess rather than a broken documented link. Event 27: ```text https://docs.arcjet.com/sdk/nodejs/get-started/ ``` Event 28: ```text 404 Page not found. Check the URL or try using the search bar. ``` Event 47: ```text https://docs.arcjet.com/sdk/node/get-started/ ``` - **Guessed generic quick-start URL returned 404**: The agent tried https://docs.arcjet.com/quick-start without first checking the sitemap, which returned 404; the real docs use nested SDK-specific paths like /sdk/node/get-started/. Event 11: ```text https://docs.arcjet.com/quick-start ``` Event 14: ```text 404 | Arcjet Docs ``` #### Blockers - **No self-serve path to a real API key within the session**: Getting an ARCJET_KEY requires signing up at the hosted web console (app.arcjet.com), which the agent could not do itself. This is a normal login/account-creation requirement, not a product defect, but it meant the SDK was never exercised against the live service end-to-end. Event 80: ```text getting an `ARCJET_KEY` requires signing up at app.arcjet.com through the web console (there's an MCP server/CLI for agents, but it still needs your credentials) ``` #### Suggested Changes - **Fix or redirect the generic /quick-start docs link**: Requesting https://docs.arcjet.com/quick-start returns a 404; the actual Node.js quickstart lives at /sdk/node/get-started/. Add a redirect or landing page at /quick-start that routes to the SDK-specific get-started pages, and verify by curling the URL and confirming a 200 instead of 404. Event 11: ```text https://docs.arcjet.com/quick-start ``` Event 14: ```text 404 | Arcjet Docs ``` ### Task given to each agent Help me build a simple example using Arcjet. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop. No product credentials were supplied and no purchases were authorized. ## Score: A · 100/100 (provisional) Grades come from completed site checks. Coding sessions and skipped checks do not affect the score. ### Clarity - **Pass** — Homepage answers Markdown requests ```text Homepage returned text/markdown with 200 when requested with Accept: text/markdown. ``` - **Pass** — llms.txt provides an actionable documentation index ```text llms.txt links docs, agent get-started, skills, CLI, MCP server, plugin, quick starts. ``` - **Pass** — llms.txt provides navigation guidance ```text llms.txt organizes content into Get started, Key facts, and product entry points. ``` - **Pass** — llms.txt mentions offered API, MCP, and skills ```text llms.txt mentions MCP server, CLI, skills, and plugin surfaces. ``` - **Pass** — A compact guide representation exists ```text llms.txt is a compact Markdown guide covering product, get-started, pricing and key facts. ``` - **Pass** — A focused guide is directly retrievable ```text llms.txt fetched directly at arcjet.com/llms.txt with 200 and useful starting guidance. ``` - **Pass** — Equivalent instructions fit a token budget ```text llms.txt is 1322 tokens, well under the 8000-token budget, and remains actionable. ``` - **Pass** — Product-docs links survive format changes ```text llms.txt links to docs, skills, CLI, MCP server and quick-start guides. ``` - **Pass** — The compact guide is independently actionable ```text Shield and bot quickstarts give concrete steps: install SDK, set key, protect route, simulate request. ``` - **Pass** — Install and next-step links resolve ```text Fetched install/next-step pages (Shield, bot, FastAPI quickstarts) all returned HTTP 200. ``` ### Onboarding - **Pass** — Docs lead to a relevant quickstart ```text llms.txt and docs link framework quickstarts; Shield and Bot quickstarts give numbered install-to-test steps. ``` - **Pass** — Installation commands are extractable ```text CLI page shows npx, npm, Homebrew, and install-script commands; quickstarts show SDK install steps. ``` - **Pass** — Code examples are available without interaction ```text Quickstarts and CLI docs present inline code blocks and terminal commands without interaction. ``` - **Pass** — Prerequisites and auth boundaries are explicit ```text Quickstarts say create a free account and get a key; CLI documents auth login and ARCJET_TOKEN. ``` ### Pricing - **Pass** — Pricing is readable without interaction ```text Pricing page served as static Markdown with all plan and usage prices visible, no interaction needed. ``` - **Pass** — Prices are stated, not gated ```text Individual $25/mo, Startup $299/mo, and usage fees $5/$50 per 1M requests stated openly. ``` - **Pass** — Pricing units and limits are explicit ```text Units explicit: per-month plan fees, per-1M-request usage, free plan capped at 10,000 requests/month. ``` - **Pass** — Agents identify pricing and its assumptions ```text 3 of 3 sessions were judged on pricing; 0 fell short. DeepSeek V4.1 Flash: Quoted $25 and $299 per app per month plus $5/1M web and $50/1M agent requests. Named the 15-day trial, the 10k/month free cap and that one protect() call is one request. (seq 29, seq 103, seq 117, README.md) Kimi K3: Quoted $25/mo and $299/mo plans plus $5 per 1M web and $50 per 1M agent requests, tied to plan tier, the 15-day trial and the free tier's hard cap of 10k requests a month. (seq 14, seq 20, seq 98) Qwen 3.8 Max: Gave prices taken from the fetched pricing page and named the basis: a 15-day trial, then a free tier capped at 10k requests/month; $25 and $299 per application per month plus usage; $5 per 1M web requests and $50 per 1M agent requests (seq 15, seq 80, arcjet-example/README.md) This behavioural item does not affect the fast grade. ``` ### Activation - **Pass** — An API reference or OpenAPI spec is reachable ```text SDK reference pages for Astro, Bun, Deno, Go, Next.js, Node.js, Python and more are linked from the docs nav. ``` - **Pass** — An MCP server is documented and well-formed ```text MCP server documented at https://api.arcjet.com/mcp with OAuth, client setup and full tool list. ``` - **Pass** — A CLI install path is documented ```text CLI install documented via npx, npm, Homebrew, install script and release binaries. ``` - **Pass** — SDK packages resolve on their registries ```text npm registry lookups for @arcjet/next, node, bun, fastify, nest and cli all returned HTTP 200. ``` - **Pass** — Agent skills are published ```text Agent skills published at arcjet/skills, installed via npx skills add arcjet/skills. ``` [Full report data](https://www.ax-check.com/arcjet.com/report.json)