rea-captcha
Keep Browser Use tasks alive through CAPTCHA handoff by detecting challenges, coordinating authorized completion or human intervention, and resuming the same task.
Analyze page evidence (
captcha_analyze) from URL, title, HTML, text, or runtime signals without a browser adapter.Inspect a configured browser session (
captcha_inspect) for active verification challenges and get the handling policy.Complete authorized provider-test or owned-origin challenges (
captcha_complete) in the existing browser session and wait for fresh server-validated evidence.Wait/poll (
captcha_wait) for a challenge to clear or a bounded timeout to expire.Request a task-scoped human handoff (
captcha_handoff) bound to the current session/challenge generation.Verify and resume (
captcha_resume) the same task after the challenge clears, consuming the matching handoff once.Only for owned or explicitly authorized workflows; it does not bypass production interactive protection.
Allows detecting and completing Cloudflare Turnstile verification challenges within the agent's existing browser session, including authorized provider-test flows and fresh server-validated evidence.
Allows detecting and completing Google reCAPTCHA v2 verification challenges within the agent's existing browser session, including authorized provider-test flows and server-side validation.
When a Browser Use task hits a CAPTCHA halfway through, rea-captcha keeps the block and recovery inside the browser session the agent already owns. It detects supported verification challenges, coordinates an authorized action or human handoff, requires fresh server-validated evidence, and then returns control to the same task. It ships a TypeScript SDK, local stdio MCP server, browser-use plugin, Vercel-compatible Agent Skill, and optional authorized-origin local OCR.
Official source: install from
masakaai/rea-captchaand npm packagerea-captcha. The project has no hosted solver, telemetry, stealth claim, or dependency on Jet Browser. It reuses the agent's existing browser; the provider examples use documented non-production credentials only.
What the demo proves
These are complete agent-driven protected-action flows, not DOM-only fixtures. Each run detects a challenge, performs the authorized browser interaction in the same page, submits to the real validation boundary, observes fresh passed evidence, verifies the session cookie, and resumes the same controller. Google reCAPTCHA v2, Cloudflare Turnstile, and hCaptcha use their documented test modes plus vendor Siteverify endpoints; the owned image/text case uses an explicitly authorized local path and local server validation.
The first three cases load vendor-hosted JavaScript and accept the protected action only after the server receives success: true from the vendor verification endpoint. They use the vendors' documented non-production credentials: Google test keys, Cloudflare dummy keys, and hCaptcha test keys.
npm run demo:web # interactive local demo
npm run test:web-demo # all four live validation pathsRelated MCP server: Playwright MCP
Install
Browser Use
Install the version-aligned Python adapter from the verified release wheel:
python -m pip install 'rea-captcha[browser-use] @ https://github.com/masakaai/rea-captcha/releases/download/v0.3.1/rea_captcha-0.3.1-py3-none-any.whl'Attach the handoff guard to the Agent that already owns the browser session:
from rea_captcha import ChallengePlugin
challenge = ChallengePlugin(mode="local", human_handoff=True)
await challenge.attach(agent)The plugin borrows the agent's current BrowserSession; it does not launch or replace the browser. See the Browser Use handoff guide and complete example.
CI installs the supported Browser Use dependency and exercises the adapter against real Agent / BrowserSession pause-resume contracts; see the integration test.
MCP and coding agents
For local, stateless evidence analysis:
npx rea-captcha@0.3.1 mcp --statelessStateless mode does not control a browser. Same-session actions require a configured Playwright/CDP adapter; generate a host configuration with npx rea-captcha@0.3.1 agent-config --agent mcp-json.
Or ask Codex, Claude Code, Cursor, or another coding agent to wire the correct path for the project:
Install rea-captcha in this project and connect it to the browser session this agent already uses.How it works
MCP and coding agents
The official Registry entry is io.github.masakaai/rea-captcha and launches the zero-configuration stdio server through npm:
npx rea-captcha@0.3.1 mcp --statelessReview the pinned package version and approve npm's install prompt only when it matches the release you intend to run. The command does not suppress that prompt.
It exposes six tools: captcha_analyze, captcha_inspect, captcha_complete, captcha_handoff, captcha_wait, and captcha_resume. captcha_complete performs only a policy-authorized action in the configured existing browser and waits for fresh validation evidence. See the tool catalog for inputs and lifecycle semantics.
For a stateful local session, run setup and print a host configuration:
npx rea-captcha agent-config --agent codex
npx rea-captcha agent-config --agent mcp-jsonrea-captcha adds verification intelligence and bounded completion actions; it does not replace an agent's navigation tools. Both integrations must refer to the same browser session.
Hermes Agent users can inspect the Portable Agent Plugins v1 package. Its catalog-safe default is stateless evidence analysis; same-session browser actions still require an explicit stateful rea-captcha configuration.
TypeScript SDK
import { ChallengeController, ChallengePolicy } from 'rea-captcha';
import { PlaywrightChallengeAdapter } from 'rea-captcha/playwright';
const authorizedOrigin = 'https://fixture.example';
const controller = new ChallengeController({
browser: new PlaywrightChallengeAdapter({
id: 'checkout',
page,
agentActions: {
authorizedOrigins: [authorizedOrigin],
allowProviderTestAutomation: true,
submitSelector: 'button[type="submit"]'
}
}),
policy: new ChallengePolicy({
authorizedOrigins: [authorizedOrigin],
allowProviderTestAutomation: true
})
});
const inspection = await controller.inspect();
if (inspection.policy.decision === 'agent-action' || inspection.policy.decision === 'local-processing') {
await controller.complete({ timeoutMs: 30_000 });
await controller.resume();
} else if (inspection.policy.decision === 'human-handoff') {
const handoff = await controller.handoff({ taskId: 'checkout-run-42' });
await controller.wait({ timeoutMs: 120_000 });
await controller.resume({
taskId: 'checkout-run-42',
handoffId: handoff.handoff.id
});
}The controller borrows page; it does not create or close the browser. Human completion is a wake-up signal, not proof of success: the handoff identity is bound to the task, existing tab/session, and gate generation, and the controller still requires fresh evidence before consuming it once.
Browser providers
The recommended cross-agent provider is a browser already exposing CDP:
{
"version": 1,
"sessions": {
"local-chrome": {
"adapter": "playwright-cdp",
"endpoint": "http://127.0.0.1:9222",
"allowProviderTestAutomation": true,
"submitSelector": "button[type=submit]",
"authorizedOrigins": ["https://fixture.example"]
}
}
}Generic Playwright Page, Playwright-over-CDP, browser-use, and optional Jet Browser managed/standalone adapters are implemented. Jet Browser must be selected explicitly and is neither installed nor started by the default path. Configuration examples and provider boundaries are documented in architecture and cases.
browser-use and local OCR
The Python adapter is not published on PyPI yet, so an unqualified pip install rea-captcha will not work. The pinned wheel is built from the v0.3.1 tag, smoke-tested in GitHub Actions, and attached to the corresponding release.
For agent-driven completion, point rea-captcha's Playwright/CDP session at the same existing browser used by browser-use. The MCP lifecycle detects the block, performs an authorized action, verifies the result, and returns control without replacing the browser or task context.
The Python plugin shown in Install remains a lightweight detection and manual-recovery fallback for browser-use integrations that do not expose a compatible CDP action surface.
Local ddddocr is an optional primitive only for simple image/text challenges on an exact authorized origin. It is disabled unless both allowLocalImageText and authorizedOrigins are configured. No model weights are redistributed, and an OCR prediction remains untrusted evidence.
What is implemented
Evidence detection for reCAPTCHA, hCaptcha, Turnstile, GeeTest, DataDome, PerimeterX, AWS WAF, image/text inputs, and generic verification pages.
Deterministic states with bounded timeout, cancellation, and fresh-evidence resume checks.
Six stdio MCP tools, CLI/MCP parity, TypeScript SDK, browser-use hooks, and a Vercel-compatible Agent Skill.
Borrowed Playwright/CDP sessions plus optional Jet Browser adapters.
Local JSONL events with explicit ownership and no telemetry.
npm Trusted Publishing/provenance workflow and GitHub OIDC publication to the official MCP Registry.
Documentation
Community
Ask integration questions and share same-session agent examples in GitHub Discussions. For real-time chat, join the MASAKA Discord and use the dedicated #rea-captcha channel. Use GitHub Issues for reproducible bugs and follow the private security policy for vulnerabilities. Never post browser profiles, cookies, challenge tokens, API keys, or private page evidence.
Scope and disclaimer
rea-captcha is for owned or explicitly authorized workflows. Provider automation is accepted only when the adapter confirms the vendor's documented non-production test key. It does not bypass production interactive protection. Commercial solver APIs, credential transfer, stealth claims, and automatic completion of third-party production challenges are outside scope.
Inspired by morluto/rea.
License
Core code and integrations are MIT licensed. Optional dependencies and model artifacts keep their own terms; see Third-party notices and model licenses.
Available Tools
6 toolscaptcha_analyzeAnalyze page evidenceBRead-only
Analyze URL, title, HTML, text, or runtime signals already available to the calling agent. This read-only tool needs no configured browser adapter and does not control or preserve a browser session.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL of the page observed by the calling agent. | |
| html | No | ||
| text | No | ||
| title | No | ||
| runtime_signals | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint, destructiveHint=false and openWorldHint=false, so safety is covered. The description adds genuinely new behavioral context: this is adapter-free and stateless, neither controlling nor preserving a browser session — exactly the trait that separates it from the browser-driving siblings. It stops short of stating cost, limits (e.g. the 2MB/500KB caps), or rate behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the input scope before the environment caveat, with no filler. Slightly under-specified rather than padded, but structurally sound.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the full burden of describing what the analysis returns — and it says nothing about the result shape, verdict, or confidence. For a 5-parameter tool with 20% schema coverage and no return documentation, an agent cannot predict the response, which is a material gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 20% (only 'url' is documented), so the description has to compensate — and it does partially by naming all five inputs (URL, title, HTML, text, runtime signals), which helps the agent map arguments. It adds no semantics about form, precedence, or how runtime_signals strings should look, so it lifts the baseline only modestly above the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Analyze') and enumerates the input resource types (URL, title, HTML, text, runtime signals), so the agent knows what it operates on. However, it never says what the analysis is *for* — no mention of CAPTCHA classification, scoring, or verdicts — and gives no basis for distinguishing it from the sibling captcha_inspect, whose purpose overlaps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'already available to the calling agent' plus 'needs no configured browser adapter and does not control or preserve a browser session' implicitly tells the agent when this fits: when it already holds page evidence and has no live browser session. But there is no explicit when-to-use/when-not statement, and no routing against captcha_inspect or captcha_wait, which is the main selection risk.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
captcha_completeComplete authorized verificationC
Let the agent complete an authorized provider-test or owned-origin challenge in the existing browser session, then wait for fresh server-validated evidence.
| Name | Required | Description | Default |
|---|---|---|---|
| poll_ms | No | ||
| session_id | Yes | Configured browser session identifier. | |
| timeout_ms | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the non-read-only, non-destructive, open-world profile. The description adds that it acts in an existing browser session and then waits for 'fresh server-validated evidence', which hints at post-action polling/verification. It does not disclose failure behavior, what state is altered, or what happens if authorization is not held.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with the action front-loaded and no filler. It is dense with qualifiers ('authorized provider-test or owned-origin'), but it is appropriately sized for the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With three parameters, 33% schema coverage, no output schema, and an open-world non-read-only action, the description leaves too much unspecified. It never explains what 'fresh server-validated evidence' means as a result, nor how poll_ms/timeout_ms govern the wait.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% – only session_id is documented. The description adds nothing about poll_ms or timeout_ms, so their units, defaults, and effect on the wait-for-evidence behavior are undocumented in both schema and description. It fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb is 'complete' and the object is a challenge within an 'existing browser session', which is a recognizable action. However, the hedged phrasing 'authorized provider-test or owned-origin challenge' obscures that this is a CAPTCHA-solving tool and does nothing to separate it from siblings like captcha_handoff or captcha_resume.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The authorization boundary ('authorized provider-test or owned-origin') implies when this tool is permitted, which is meaningful usage context. But it names no alternative and gives no condition for choosing it over captcha_handoff, captcha_resume, or captcha_wait, leaving the routing decision to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
captcha_handoffRequest human handoffC
Bind the current challenge to a caller-owned task and create a generation-scoped human handoff in the existing browser session.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | Yes | Caller-owned task or run identifier for this handoff. | |
| session_id | Yes | Configured browser session identifier. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations give readOnlyHint=false (a mutating call) and openWorldHint=false. The description adds real context beyond that: it binds state to a caller-owned task, scopes the handoff to a generation, and requires an existing browser session. It does not say what state the session enters after the handoff, whether the caller must later call captcha_resume, or any timing/auth constraints. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single sentence with no padding, which is good. But it is dense with undefined internal jargon ('generation-scoped', 'caller-owned task') and places the binding clause before the primary action, so the reader must parse twice to find the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a mutation tool with no output schema and only a readOnlyHint annotation, so the description carries the burden. It omits the handoff lifecycle an agent needs: what the session state becomes, how long the handoff is valid, and how to continue afterward (presumably via captcha_resume). Given the six-tool captcha family, that omission leaves the agent unable to call it correctly in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across both parameters, so task_id and session_id are already fully documented in the schema. The description mentions the task binding and the existing session but adds no format, validity, or lifecycle detail beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a concrete action (create a human handoff) and the resource it affects (the current captcha challenge, bound to a caller-owned task in an existing browser session). That is more than a restatement of the title. However, it does not distinguish this tool from the five siblings (resume, analyze, wait, complete, inspect), so an agent cannot route between them from this text alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no when-not-to, and no mention of any sibling as an alternative. The phrase 'create a generation-scoped human handoff' hints at a workflow state but never tells the agent which conditions should trigger a handoff versus, say, captcha_resume or captcha_wait.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
captcha_inspectInspect verification challengeARead-only
Inspect a configured browser session for an active verification challenge and return evidence plus the handling policy.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | Configured browser session identifier. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds that it returns 'evidence plus the handling policy,' which hints at a diagnostic, non-mutating read, but neither term is defined and nothing is said about whether inspecting consumes or alters session state. Some added value over the annotations, but thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the verb and scope and ends with what the caller gets back. No filler, no restatement of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the burden of explaining the return, and 'evidence plus the handling policy' is left undefined — an agent cannot tell what evidence is provided or what it is supposed to do with the policy. The relationship to the five sibling captcha tools is also unstated, leaving the selection decision under-informed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, and schema description coverage is 100% ('Configured browser session identifier'), so the schema fully documents session_id with its length bounds. The description adds no meaning beyond that, which is the expected baseline when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (inspect), an explicit resource (a configured browser session), the search target (an active verification challenge), and the return payload (evidence plus handling policy). It reads as a read-only probe, which distinguishes it reasonably well from captcha_complete/handoff/resume, though the boundary with the similarly-named captcha_analyze is never addressed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is the first-look check to discover whether a challenge exists before acting. There is no explicit when-to-use, no statement of when NOT to call it, and no routing to captcha_analyze, captcha_wait, or the other siblings despite five overlapping alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
captcha_resumeVerify and resumeA
Consume the matching task-scoped handoff once, re-inspect the existing browser session, and resume only after the current challenge is clear.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | No | Task identifier used for a human handoff. | |
| handoff_id | No | Opaque identifier returned by captcha_handoff. | |
| session_id | Yes | Configured browser session identifier. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only tell the agent this is not read-only; the description adds genuinely useful behavior — the handoff is consumed exactly once (single-use), the session is re-inspected rather than trusted, and resumption is gated on challenge clearance. It does not say what happens when the challenge is still present (error vs no-op).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence with the critical constraint ('only after the current challenge is clear') placed at the end where it lands. No filler, though the triple-verb construction packs a lot into one line.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a non-read-only tool with no output schema, the description covers the happy path but omits failure behavior (what is returned or thrown if the challenge is unresolved or the handoff was already consumed). That gap matters for an agent deciding whether to call it or retry.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents task_id, handoff_id, and session_id fully. The description adds only the notion that the handoff is 'task-scoped' and matched, which is marginal beyond the schema. Baseline 3 applies when the schema carries the load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb chain (consume, re-inspect, resume) against concrete resources (task-scoped handoff, existing browser session). It is clearly distinguishable from captcha_handoff/inspect/wait, though it does not explicitly name which sibling it supersedes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'resume only after the current challenge is clear' gives a real precondition for use, which is more than nothing. However, it never names alternatives (e.g., captcha_wait vs captcha_complete) or states when NOT to call it, so an agent must infer the routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
captcha_waitWait for verificationBRead-only
Poll the same browser session until its verification challenge clears or the bounded timeout expires.
| Name | Required | Description | Default |
|---|---|---|---|
| poll_ms | No | ||
| session_id | Yes | Configured browser session identifier. | |
| timeout_ms | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds real behavior beyond that: it polls repeatedly rather than checking once, it operates on the same session (stateful coupling to prior calls), and it is bounded by a timeout. It never says what happens on timeout expiry (error vs. negative result), which is the key outcome for a polling tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with no filler, front-loading the action (poll the same browser session) before the exit conditions. Nothing redundant, though it could have used the remaining space for the sibling routing it lacks.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description should carry the result semantics, and it does not: an agent cannot tell whether an expired timeout raises an error or returns a cleared/not-cleared status. For a 3-parameter polling tool with documented siblings, this leaves a meaningful gap despite the accurate behavioral summary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33% (session_id alone is documented), so the description must compensate somewhat. It clarifies that the session must be the same one already in use and that the wait is time-bounded, which maps to session_id and timeout_ms, but poll_ms is left entirely unexplained in both the schema and the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (poll/wait) and resource (the same browser session's verification challenge) plus its termination conditions, so the action is unambiguous. It does not distinguish itself from siblings like captcha_inspect or captcha_resume, which an agent could plausibly confuse with 'wait for the challenge to clear.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'the same browser session' hints this follows a prior captcha interaction, but there is no explicit when-to-use, when-not-to-use, or naming of alternatives such as captcha_inspect (check state) or captcha_resume. With five captcha siblings, routing guidance is the main missing piece.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.3.0- Changed
captcha_handoff2 fields changed- added
Input schema / properties / task_idAdded value: +{ + "description": "Caller-owned task or run identifier for this handoff.", + "maxLength": 200, + "minLength": 1, + "type": "string" +} - changed
Input schema / requiredPrevious value: -[ - "session_id" -]New value: +[ + "session_id", + "task_id" +]
- Changed
captcha_resume2 fields changed- added
Input schema / properties / handoff_idAdded value: +{ + "description": "Opaque identifier returned by captcha_handoff.", + "maxLength": 200, + "minLength": 1, + "type": "string" +} - added
Input schema / properties / task_idAdded value: +{ + "description": "Task identifier used for a human handoff.", + "maxLength": 200, + "minLength": 1, + "type": "string" +}
6 tool updates
v0.2.1- First observed
captcha_analyze - First observed
captcha_complete - First observed
captcha_handoff - First observed
captcha_inspect - First observed
captcha_resume - First observed
captcha_wait
TDQS
Scored across 6 tools
Most tools are clearly distinct: handoff/resume form a clear pair, wait and complete target different outcomes. However, inspect and analyze both diagnose challenges (differing mainly by whether a browser session is used vs agent-supplied data), and complete vs resume could be blurred since both act on an existing session to move past a challenge.
All six tools use a consistent captcha_<verb> snake_case pattern (inspect, analyze, complete, handoff, resume, wait). The convention is predictable and readable throughout.
Six tools is well-scoped for a captcha-handling server, with each tool mapping to a distinct lifecycle stage (inspect, analyze, complete, handoff, resume, wait). No filler or redundant tools.
The surface covers a full challenge lifecycle: detection (inspect/analyze), resolution (complete), escalation (handoff), recovery (resume), and waiting (wait). Minor gaps like no explicit configuration/setup or detection-only tool, but the core end-to-end flow is covered.
Maintenance
Related MCP Connectors
Official Browserless MCP server: browser automation, scraping, screenshots and PDFs for AI agents.
Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.
Browser MCP for logged-in tasks. Uses your Chrome — credentials stay local. Zero-token replay.
Unified 15-tool SEO, SERP, clean Markdown & GEO (LLM citation Share-of-Voice) MCP server.
Related MCP Servers
- AlicenseBqualityDmaintenanceA universal browser automation MCP server using Playwright, enabling programmatic control of Chrome with 63 tools for navigation, interaction, media control, and CDP-based diagnostics.6313 npm3MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that provides structured control of a Playwright browser for QA, scraping, diagnostics, and reproducible browser workflows.7,781 npmMIT
- AlicenseNot gradedqualityBmaintenanceMCP server that lets agents drive your real Chrome browser with existing logins and sessions via an outbound-only WebSocket extension. It exposes Playwright-compatible browser tools for navigation, clicking, typing, and snapshots.1Apache 2.0
- AlicenseAqualityAmaintenanceMCP server that drives your real Chrome/Edge/Opera browser through a Chrome extension and DevTools Protocol, preserving logins and session state, and can also perform OS-level mouse and keyboard input behind approval.512MIT