Verification challenges
What an agent can and cannot get through: the measured status per challenge type, the four measuring tools that make it possible, and why there is no captcha-solving service in this product.
Most sign-ups end at a challenge. This page is what has actually been measured, not what would be nice.
What this product does not do
No paid third-party solver. No account with a solving service, no key, no per-challenge fee, and no code path that could send a challenge anywhere.
No detect-captcha tool. An agent recognises a challenge on the page it is already reading, and works it with the ordinary tools. A tool whose only job is to say "this is a captcha" would add a name for something the agent can already see.
What "solved" is allowed to mean
Three conditions, all three required, or a row does not move:
- End to end against the real page, never a reproduction. A reproduction proves the mechanics and never the scoring.
- Through the MCP tools only. A helper script driving the same browser is evidence about the challenge, not about this product.
- The next step is reached. The account exists, the page moved on. "No error" is not success.
One run is an observation. Two independent runs are the minimum.
The status
| Challenge | Status |
|---|---|
| Press and hold (HUMAN Security) | Solved, in one tool call. |
| Cloudflare Turnstile, invisible | Passed with no interaction at all. |
| Cloudflare Turnstile, managed | Passed, including the variant that forces a click. |
| reCAPTCHA v3 | Passed with the same score ordinary Chrome gets on the same line. |
| reCAPTCHA v2, image grid | The puzzle opens for ordinary Chrome too, and it was solved. |
| reCAPTCHA v2, audio alternative | Solved, by transcribing the clip. |
| hCaptcha, image task | Solved, five runs out of five on one deployment. |
| GeeTest v3 and v4, slider | Solved on the first drag. |
| GeeTest v4, icon order, gobang, icon crush | Solved, first attempt each. |
| Click captcha, icons in order in a photo | Solved. |
| Text in an image, two providers | Solved. |
| MTCaptcha | Solved. |
| A question in words, no image | Solved. The question is in the page map; no image work needed. |
| Lemin, fit the piece | Solved. Addressable only through the document container. |
| Rotation captcha | Not solved. See below. |
| Arkose / FunCaptcha | Never presented, across five attempts on four real services. |
One deployment passed and another refused the same answers. hCaptcha's own demo rejected the identical correct answers from the identical browser in the same minute on the same line, while a third-party deployment accepted them. The difference was the site key, not the browser.
That is the honest shape of this whole area: a challenge is scored per site and per request, and no browser passes all of them all of the time.
The rotation captcha is worth reading about
It looks like a failure of ours and is not. Eleven of twenty-four grid positions were tried, covering the whole plausible range with the figure visibly upright, and every one was rejected. The page performs no network request while checking.
It compares locally against a value its own rotation controls never set. The challenge is not passable through its own interface, by anyone.
The four measuring tools
A text map describes controls. It cannot describe how far an image is turned or how wide a gap is, and that is the one place an agent needs something else. All four are in the extended set:
| Tool | What it answers |
|---|---|
measure_frames | How a moving element behaves over time, for a slider or an animation. |
measure_gap | The distance between two elements, for a puzzle piece and its slot. |
measure_rotation | How far an image is turned. |
transcribe_audio | An audio challenge as text, through a command you configure. |
transcribe_audio ships no model and calls no service. You name a program in [mcp] transcribe_command; it takes one argument and prints the text. A local Whisper build transcribed a reCAPTCHA audio clip in 1.3 seconds.
Two more tools carry the rest: press_and_hold for hold gestures, and click with at_x/at_y for a challenge that draws its whole task into one canvas, where the element is a picture rather than a control.
Two conditions that ruin a run
Both were measured, and both are outside the tools.
A real mouse pointer over a visible window spoils it. Moving your own mouse over the window mixes genuine input into the dispatched input, and the challenge refuses. Measure headless, or keep your hands off.
A widget can swap its nodes faster than a reference lives. Lemin's does. Address the document container instead of the widget's own elements.
Press and hold, in one call
The challenge asks for two presses and says so: press once, wait for the confirmation, press again. A single long press lands correctly and is ignored anyway, because the check is still asleep; after that the widget rebuilds and every further report is delivered into a different execution context, so what gets scored is an empty hold.
Wake press, pause and the long hold with its returning pressure are therefore one timeline inside the daemon. The agent calls press_and_hold once.
Next
- Human input: why the gesture looks the way it does.
- Tool reference: the measuring tools in the catalog.
- Email inboxes: the step right after most challenges.