FCaptcha guards your forms with an invisible check that spots bots, headless browsers, and AI agents steering real browsers, all from a server you run yourself. Drop the widget into a signup or contact form and it quietly watches how the visitor actually behaves: pointer movement, typing cadence, scroll shape, and dozens of other signals that separate a person from a script. Vision agents that screenshot and click, and computer-use agents driving a browser through automation protocols, leave input traces the scoring engine catches. Self-declaring crawlers get flagged by name, and signed agent requests are verified cryptographically so polite, identified bots can be allowed while anonymous automation is blocked. A proof-of-work challenge adds a liveness gate behind the scenes. Humans see no puzzle at all, in any of 34 languages, and the widget meets accessibility standards for screen-reader and keyboard-only visitors. Your backend verifies each token through the same siteverify contract that Turnstile, reCAPTCHA, and hCaptcha use, so switching providers is a change of address rather than a rewrite. No cookies are set, no visitor data travels to a third party, and nothing phones home. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

CAPTCHAs make every visitor solve a puzzle to prove they are human; Mosparo takes the opposite route and checks the submitted content itself, no challenges, no image grids, and no tracking cookies. Drop the customizable checkbox widget into any form and Mosparo inspects each field separately, scoring the entry against your rules the way an email spam filter scores a message. Build field rules for banned words, domains, email addresses, IP addresses and subnets, providers, Unicode blocks, user agents, and websites, each with its own rating weight, or subscribe to shared rule packages that refresh themselves automatically. Every submission lands in an admin inbox with its spam rating, IP address, and verification status, and dashboard charts show valid versus spam traffic plus delayed or blocked requests over time. Legitimate users notice nothing but a plain checkbox, which stays fully usable with assistive technology, while everything Mosparo stores is encrypted and automatically deleted after 14 days. Run one instance for many sites with separate projects, project groups, and member roles, and connect your forms over the documented API from any stack that can send an HTTP request. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

The CAPTCHA bargain - annoy your users and feed their behavior to Google - gets replaced with economics by mCaptcha. Instead of image puzzles, it uses SHA256 proof-of-work: every visitor's browser silently solves a small computational challenge (via a WebAssembly library) before submitting a form. Humans never notice the milliseconds; bots hammering your site must burn more compute sending requests than your server spends answering them, which makes attacks more expensive than defense - the property that also makes mCaptcha genuine DoS protection, not just bot filtering. Written in Rust, the system is fully automated: difficulty scales with traffic, so challenges stay trivial in normal conditions and harden under attack. The privacy and accessibility wins are structural rather than promised: no tracking, no profiling, no user-pattern data collection, and no visual puzzles that exclude users with visual or cognitive impairments - the design was published in Communications of the ACM. Rate limiting is IP-independent, so users behind NATs, VPNs, or Tor get the same experience instead of endless challenge loops, and proofs resist replay attacks, neutering captcha farms. Migration is deliberately easy: the API is compatible with reCAPTCHA and hCaptcha, making it a drop-in replacement. AGPL-licensed core with proprietary-friendly client libraries.