Captcha Mcp
If you're shipping an MCP server that costs real money per call and don't want to gate it behind OAuth or API keys, this wraps the PowForge captcha service into three tools: challenge, verify, and status. Agents solve a SHA-256 proof-of-work puzzle for free tier access or pay 3 sats over Lightning via L402 for instant tokens. No accounts, no credit cards, no confirmation emails. Runs over stdio by default or HTTP with SSE for browser hosts. The PoW difficulty is tunable and tokens last five minutes. Pair it with your own backend by verifying tokens against the captcha service before fulfilling expensive requests.
- tools
- 3
- transport
- STDIO
- env var
- 1
- last updated
- May 10, 2026
Tools
3 toolsPublic tool metadata for what this MCP can expose to an agent.
challengeRequest a fresh proof-of-work puzzle. Returns {id, salt, difficulty, signature}.
Request a fresh proof-of-work puzzle. Returns {id, salt, difficulty, signature}.
No parameter schema in public metadata yet.
verifySubmit a solved nonce. Returns a 5-minute HMAC-signed access token.
Submit a solved nonce. Returns a 5-minute HMAC-signed access token.
No parameter schema in public metadata yet.
statusServer health, lifetime stats, L402 endpoint metadata.
Server health, lifetime stats, L402 endpoint metadata.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
CAPTCHA_URLdefault: https://captcha.powforge.devPowForge captcha backend URL. Defaults to public production endpoint when running via npx; override for self-hosted or local dev.
Readme
@powforge/captcha-mcp
Your MCP server returns 429 when agents pound it. captcha-mcp makes them earn their next call instead. Hand the agent a proof-of-work puzzle (free, ~5s of CPU) or a 3-sat Lightning invoice — both are machine-readable backoff signals an autonomous caller can satisfy without an account, email, or API key.
Three tools over stdio or HTTP. Stdlib only. No signup, free fallback, self-hosted, no revenue share.
Why not 429?
429 Too Many Requests is the wrong shape for the agent era. Three patterns recur across MCP server reports:
- Agent frameworks treat 429 as a connection failure. They retry immediately, often with exponential backoff that is still too aggressive, and amplify the overload that triggered the limit in the first place.
- There is no per-caller signal. A 429 fires for the bucket, not the agent. One noisy caller gets every other caller throttled, and the server has no way to ask the noisy one to slow down specifically.
- Retry-After is advisory and frequently ignored. Agents do not consistently parse it, do not consistently respect it, and have no incentive to wait — the cost of retrying is zero.
Details
- Repository
- github.com/zekebuilds-lab/captcha-mcp
- Website
- powforge.dev/captcha
- Package
@powforge/captcha-mcp- Transport
- STDIO
- Registry
- MCP registry, active