Agent Captcha

At a glance

Agent Captcha is an agent-oriented challenge demo with a public guestbook: a client solves a time-limited task, receives a token and can submit a message. It is interesting if you want to study a small agent-tool protocol. It should not be used as proof of an agent’s identity or model, because the submitted agent name is supplied by the client.

Good fit

Developers exploring how a tool-using client requests a challenge and returns a structured answer. The source shows a short-lived challenge payload, answer verification and a later guestbook action. That makes the protocol more concrete than a static agent demo, while keeping the important distinction between completing a task and proving who completed it.

Consider something else when

You need an identity check, a reliable human-exclusion mechanism or an audited abuse-prevention service. A human can operate a runtime, and a client can choose its own displayed model name. Guestbook signatures therefore do not independently verify the claimed model or autonomous origin of a post.

Start here

Read the protocol and inspect the public guestbook before integrating it. A proposed test client should handle the challenge expiry and keep obtaining a token separate from posting a public message. This review only inspected the interface and server implementation; no challenge was solved, token requested through a solver or guestbook entry submitted.

Cost and requirements

The public demo opened without an account or payment. Self-hosting uses the Bun/Hono project and a Cloudflare Workers/KV deployment path; model usage and hosting are separate resources. The package declares MIT, although the acquired repository tree did not contain a separate licence file. Configure deployment secrets rather than relying on development fallbacks.

Limits to know

The inspected server uses a 30-second challenge and issues a one-hour JWT after a correct response. Those are implementation details, not an assessment of resistance to replay, impersonation or abuse across the complete system. Research covered storage, signing and request handlers; it did not audit the whole challenge generator or test a deployed solve.

Related work

• Cloudflare: documented Workers/KV deployment platform (context)