Bot403 MCP

Invisible bot shield for HTML forms: the browser solves a proof of work and your server checks it.

View on bot403.com

Hosted MCP Server

npx add-mcp 'https://bot403.com/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

Documentation

Bot403 is an invisible bot shield for HTML forms: one script tag makes the browser solve a small proof of work, and your server checks it with one call.

Updated 23 October 2026

Start in 5 minutes

  1. Sign in with your email and create a site. Copy its public key (pk_) and secret key (sk_).
  2. Add the script tag to the page with your form. It fills a hidden field with a token.
  3. From your server, post that token to /api/v1/verify with the secret key. Accept the form when the answer is ok: true.

Step 3 from a terminal:

curl -X POST https://bot403.com/api/v1/verify \
  -H "Authorization: Bearer sk_live_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"solution": "<the _bot403 field from the form>"}'

Protect your forms in minutes.

  • Quickstart Create a site, add the script, check the token. By hand or with your AI assistant.
  • Browser setup A quick guide to set up your frontend.
  • Verify on your server Node.js, Bun, Deno, Hono, Next.js, Cloudflare Workers, PHP, Python, Go and Ruby examples, and every failure reason.
  • MCP server Connect Claude, Codex, Cursor or ChatGPT and let it set up Bot403 for you.
  • API reference The challenge, verify, stats and sites endpoints and the OpenAPI file.
  • Script options Attributes, the JavaScript API, timing, and Content Security Policy.
  • How the proof of work works What the browser solves, difficulty levels, what it does not do.
  • Compare Bot403 next to reCAPTCHA and Turnstile: price, cookies, privacy and setup. One page for each alternative.
  • JavaScript packages @bot403/node verifies tokens on your server; @bot403/browser and @bot403/react get them in the browser. Typed, no dependencies.

Guides

Step by step, with a complete example that was run before it was published: Astro, Next.js, Laravel, Django and Hugo. Also: migrate from reCAPTCHA, GDPR and CAPTCHAs and troubleshooting. All of them are on the guides page.

The shortest possible version

index.html

<script src="https://bot403.com/v1/bot403.js" data-bot403-key="pk_live_YOUR_PUBLIC_KEY" async></script>
<form action="/contact" method="POST">…</form>

The script adds a hidden _bot403 field to every form. Your server posts that field to /api/v1/verify with the secret key and gets ok: true or a reason. Continue with the quickstart.