captcha-mcp is an MCP (Model Context Protocol) server for AI agents, used to replace the traditional 429 Too Many Requests rate-limiting mechanism. When an agent calls the MCP server frequently, captcha-mcp returns a 402-style challenge, requiring the caller to either complete a free proof-of-work (PoW) puzzle (about 5-10 seconds of CPU time, SHA-256, default 14 leading zero bits), or pay a 3 satoshi Lightning Network invoice (via the L402 protocol, RFC 7235 + bolt11 invoice). Both methods are machine-readable backoff signals that autonomous callers can satisfy without an account, email, or API key. The server uses only the standard library, supports stdio and HTTP streaming, free fallback, self-hosting, and no revenue sharing.
Main capabilities:
- Wraps PowForge's pow-captcha service (captcha.powforge.dev) as three MCP tools: free PoW challenge, paid Lightning invoice, and token verification.
- Free tier: agents need to spend about 5-10 seconds of CPU time solving a SHA-256 proof-of-work puzzle.
- Paid tier: agents need to pay a 3 sats Lightning Network invoice (L402).
- Stateless HTTP mode, with open CORS support, suitable for browser-side MCP clients.
- Token verification: the backend can independently verify the token submitted by the agent without trusting the agent.
Usage:
- Start via npx @powforge/captcha-mcp, which uses stdio mode by default and waits for an MCP client to connect.
- Or run npx @powforge/captcha-mcp --install to print a configuration block, which can be added to the configuration of MCP-compatible hosts such as Claude Code and Cursor.
- For hosted MCP clients that require HTTP (such as Smithery), use the --http parameter or set HTTP_MODE=1.
- The environment variable CAPTCHA_URL can point to a different captcha backend, defaulting to http://localhost:3077，生产环境建议 https://captcha.powforge.dev。
- Local development: clone the captcha widget repository or run the public service; the MCP server only needs HTTP access.
- Manually test the protocol: send a JSON-RPC request via stdin, and you should see a JSON response containing serverInfo.
Applicable scenarios:
- When an MCP server is overloaded due to high-frequency calls by AI agents, use this to replace 429 rate limiting, making callers pay a computational or economic cost.
- Situations that require providing pay-per-use or free fallback mechanisms for autonomous agents without accounts, email, or API keys.
- Developers who want to self-host, retain Lightning Network revenue, and not rely on third-party payment platforms.
Limitations and notes:
- This tool depends on PowForge's captcha service or a self-hosted instance.
- The paid tier uses the Lightning Network and requires Lightning Network infrastructure such as LNbits.
- Unlike OAuth, API keys, or Stripe, this solution is aimed at identityless autonomous callers, but may not be suitable for scenarios that require traditional identity authentication.
- The official documentation does not provide more details about pricing, platform support, or effectiveness metrics; some information is not yet available.
