Universal captcha solver for AI Agents using Playwright — hCaptcha + reCAPTCHA v2 via NopeCHA API. Python lib, CLI, MCP server, Hermes skill.
SaferSkills independently audited auto-captcha-solver (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Auto-detect and solve captchas during Playwright browser automation using the NopeCHA API.
NOPECHA_API_KEY env var set (get free credits at https://nopecha.com)requests and playwright installedpython -m playwright install chromium)from auto_captcha_solver import CaptchaSolver
solver = CaptchaSolver(api_key="your-key")
# Auto-detect + solve + inject (one-liner)
results = solver.auto_solve(page)captchas = solver.detect(page)
# Returns: [{"type": "hcaptcha"|"recaptcha2", "sitekey": "...", "url": "...", "frame": ...}]result = solver.solve("hcaptcha", sitekey, page_url)
# Returns: CaptchaResult(success=True, token="...", attempts=5, elapsed_sec=38.0)solver.inject(page, "hcaptcha", token)
# Injects token into page's captcha callbackresults = solver.auto_solve(page)
for r in results:
print(f"{r.captcha_type}: {'OK' if r.success else r.error}")from auto_captcha_solver import smart_page
with smart_page(api_key="your-key") as page:
page.goto("https://protected-site.com")
page.fill("#email", "[email protected]")
page.click("#submit") # captcha auto-solved after each action| Type | API Endpoint | Status |
|---|---|---|
| hCaptcha (checkbox) | /v1/token/hcaptcha | Working |
| hCaptcha (enterprise) | /v1/token/hcaptcha | Working |
| reCAPTCHA v2 | /v1/token/recaptcha2 | Works but queue can be slow |
| reCAPTCHA v3 | /v1/token/recaptcha3 | Working (needs data.action) |
| Cloudflare Turnstile | /v1/token/turnstile | Working with a proxy — proxy is Required in NopeCHA's schema for this endpoint (solver exit IP must match browser IP); check_proxy_egress() / CLI proxy-check verify first. Error 10 bodies carry a diagnostic type field, now surfaced in the error string. |
apply_stealth(context) masks the in-page headless leaks (navigator.webdriver, window.chrome, navigator.plugins, WebGL vendor string). Call right after browser.new_context(...).
from auto_captcha_solver import CaptchaSolver, apply_stealth
from playwright.sync_api import sync_playwright
with sync_playwright() as p:
browser = p.chromium.launch()
context = browser.new_context()
apply_stealth(context) # mask fingerprint
page = context.new_page()
solver = CaptchaSolver(api_key="your-key")
results = solver.auto_solve(page) # clones UA + cookies automaticallyauto_solve(..., clone_context=True) (default) forwards the browser's real User-Agent and cookies to NopeCHA so the token is minted in a context matching the presenting browser. Turnstile solves without a proxy emit a warning, because Cloudflare requires the solver IP to match the client IP.
from auto_captcha_solver import auto_solve_url
report = auto_solve_url("https://site.com", api_key="key", stealth=True)
print(report.summary) # "https://site.com — hcaptcha:OK"
# proxy_pool=[...] + round_robin_rotator rotate proxies per session;
# auto_solve_page(page, solver) solves captchas on a page you already own.https://api.nopecha.comAuthorization: Basic <API_KEY> header (NOT query param, NOT Bearer)GET /v1/statusPOST /v1/token/hcaptcha body {"sitekey": "...", "url": "..."}POST /v1/token/recaptcha2 body {"sitekey": "...", "url": "..."}GET /v1/token/<type>?id=<job_id>{"data": "<token>"} on success, {"error": 14} = still in queue (retryable), other errors = failhcaptcha.com in frame URLs; some sites load hCaptcha without an iframe (use DOM fallback: document.querySelector('[data-sitekey]')). Always add time.sleep(3) after page load for lazy loading.recaptcha AND /anchor in frame URL; the ?k=<sitekey> param has the key___grecaptcha_cfg to exist; if site uses enterprise, injection may fail silentlysolver.get_credits()headless=False or stealth plugins if neededpip install auto-captcha-solver
python -m playwright install chromiumWorks with Claude Code, OpenClaw, and any MCP-compatible agent:
claude mcp add auto-captcha-solver -- python -m auto_captcha_solver.mcp_server~/.hermes/skills/auto-captcha-solver/~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.