Hopi

CAPTCHA embed code generator

hopi_captcha_embed_code_generator

Read-onlyIdempotent

Generate the embed code for a CAPTCHA on a web form plus the server code that checks the token. Providers: turnstile (Cloudflare Turnstile), hcaptcha, recaptcha2 (reCAPTCHA v2 checkbox), recaptcha3 (reCAPTCHA v3 score) and altcha (self-hosted proof of work, no account). Servers: php, node (Express), python (Flask), cloudflare (Pages Function), netlify (Netlify Function) and vercel (Vercel Function), plus two form services that check the token themselves, so no server code is returned: netlify-forms (reCAPTCHA v2 only; with no site key Netlify supplies its own reCAPTCHA) and formspree (not altcha). ALTCHA server code is given for node and python only. The secret key is never asked for: the server code reads it from an environment variable. Set useTestKey to use the provider's official always-pass test site key (not available for recaptcha3 or altcha). Source: https://hopi.co.uk/captcha-embed-code-generator/

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "hopi_captcha_embed_code_generator"
  }
}

Input Schema

Name	Required	Description	Default
`size`	No	Widget size. flexible is Turnstile only. Ignored for recaptcha3 and altcha	normal
`theme`	No	Widget theme. auto is Turnstile's automatic theme and the default look elsewhere. Ignored for recaptcha3 and altcha	auto
`action`	No	Action name. Optional for turnstile (up to 32 letters, numbers, - and _), defaults to submit for recaptcha3; checked on the server. Ignored for the others
`server`	No	Where the form is handled: your own server, a serverless function, or a form service that checks the token itself	php
`siteKey`	No	Your public site key (letters, numbers, - and _). Leave empty for a YOUR_SITE_KEY placeholder. Ignored for altcha
`language`	No	Widget language code such as fr or pt-BR; empty means automatic. Ignored for recaptcha3 and altcha
`provider`	No	Which CAPTCHA	turnstile
`threshold`	No	recaptcha3 only: lowest score to accept, 0.1 to 0.9. Ignored for the form services, which run the check themselves
`useTestKey`	No	Use the provider's official test site key, which always passes

Output Schema

Name	Required	Description
`html`	No
`note`	No
`action`	No
`server`	No
`siteKey`	No
`summary`	Yes
`provider`	No
`warnings`	No
`threshold`	No
`verifyUrl`	No
`serverCode`	No
`source_url`	Yes	The tool's page on hopi.co.uk (cite or open to check the figure)
`tokenField`	No
`providerName`	No
`secretEnvVar`	No
`usingTestKey`	No
`testSecretKey`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed7 schema fields changedNov 1, 2026

addedOutput schema / properties / action / type
```
Added value: +[
+  "string",
+  "null"
+]
```

changedOutput schema / properties / secretEnvVar / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / serverCode / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / siteKey / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

addedOutput schema / properties / testSecretKey / type
```
Added value: +[
+  "string",
+  "null"
+]
```
addedOutput schema / properties / threshold / type
```
Added value: +[
+  "number",
+  "null"
+]
```

changedOutput schema / properties / verifyUrl / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

AddedNov 1, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive and openWorld=false, so the safety profile is covered. The description adds genuinely useful behavioural context beyond that: the secret key is never requested, server code reads it from an environment variable, and some combinations deliberately return no server code. Return-shape detail is left to the output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first clause, followed by dense but useful enumeration. It does restate the provider and server enum values already present in the schema, though the parenthetical glosses (e.g. 'recaptcha2 (reCAPTCHA v2 checkbox)') add value over bare enum names.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter generator with an output schema and full annotation coverage, the description supplies the missing pieces: valid cross-parameter combinations, test-key limitations, and secret-handling behaviour. An agent can construct a correct call without guessing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the baseline is 3, but the description goes further by stating cross-parameter constraints the schema does not: useTestKey is unavailable for recaptcha3 and altcha, and server code is omitted for the two form services. These conditional rules materially change which parameter combinations an agent should send.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Generate the embed code for a CAPTCHA on a web form plus the server code that checks the token') and enumerates the provider/server dimensions it spans. No sibling tool covers CAPTCHA generation, so there is nothing to confuse it with, and an agent can tell immediately what it produces.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear operational context: which provider/server combinations are valid (netlify-forms is reCAPTCHA v2 only, formspree excludes altcha, ALTCHA server code is node/python only) and that form services return no server code. It does not need to name an alternative tool since none exists, but it also never states the plain 'use this when you need X' framing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Hopi tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?