tiagozip/cap

What It Does

cap is a self-hosted alternative to hosted CAPTCHA services. Instead of showing image puzzles that ask visitors to identify traffic lights, it has the browser quietly solve small challenges in the background, including GPU-resistant proof-of-work and instrumentation checks, with no tracking and no third parties observing visitors. The instrumentation challenges can optionally be configured to block autonomous AI agents from consuming resources. It ships with no dependencies by default, is described as roughly 200x smaller than hCaptcha, and can be deployed with Docker, on Workers, or on Railway.

Quick Start

1. Read the official documentation at trycap.dev for the current installation path and deployment options.
2. To see the behavior first, open the live demo.
3. Choose a deployment target (Docker, Cloudflare Workers, or Railway) and follow the matching guide in the docs; the README does not include the full command sequence, so the docs are the source of truth for setup steps.
4. Wire the client widget into your form and verify the issued token server-side, per the integration section of the docs.

Constraints and Requirements

The project is JavaScript-based and self-hosted, so you need to operate the challenge server yourself rather than rely on a managed vendor. Deployment options are Docker, Workers, and Railway. The challenge mechanism relies on browser-side computation, so very old or restricted browsers may need consideration. Licensing is stated as Apache 2.0, though the GitHub license field reports NOASSERTION, so confirm the actual license text before redistribution. Production usage is claimed by bunny.net and AdGuard.

HotRepo's Take

On the JavaScript daily list for 2026-11-11, cap ranked as high as 5th with 8,330 stars and 32 stars gained that day, against 650 forks overall. The project appeared in January 2025 and has grown steadily; the single recorded snapshot supports only that day's standing rather than a long trend. For teams uncomfortable routing every visitor through a third-party CAPTCHA vendor, the self-hosted proof-of-work approach and dependency-free footprint are the notable points to evaluate.