cfsolve: an open-source library that gets past Cloudflare without opening a browser. A HN post got pulled back to the front page and the repo gained 411 stars in one day
What it is An open-source tool written in Rust that gets past Cloudflare's "verify you are human" check and the 5-second shield without opening a browser, so programs and AI agents can keep accessing sites that were blocking them.
Why it took off Everyone who writes scrapers or lets AI agents browse the web has hit this wall, and the open-source alternatives all launch a disguised browser. The line "no headless browser required" hit the HN front page. The author knew the space, answered skeptics on the spot, and talked about how he used Claude to reverse-engineer it.
BHow you could ride it Don't build another solver. Wrap it in Python bindings or an HTTP service you can run with one docker line, or build a pipeline that automatically tracks Cloudflare updates, sell it on "always works," and post to HN using its playbook.
- Data (updated daily) · Repo created 2026-10-26 · 677 stars · 7 days +228
GitHub · stars Data 2026-10-30 → 2026-11-08 (10 days, 10 observations). Points before 10-28 come from deeply / archive backfill, not every day has one
On Oct 2026 28, a HN account named costco posted: "Cloudflare Turnstile solver library (no headless browser required)." The post didn't take off at the time. Three days later HN pulled it out of the second-chance pool and back to the front page, where it reached 317 points and 115 comments, and the GitHub repo gained 411 stars the next day. Over 11 days it reached 602 stars and 112 forks. What it is, why one headline was enough, and what you can learn from it if you want your own open-source project to get stars like this: this piece covers it.
"I posted this a few days ago, looks like it got put into the second-chance pool"
Just after midnight UTC on Oct 31, the author commented under his own post:
Author here. I submitted this a few days ago but seems like it was added to the second chance pool so now it's on the front page.
("I posted this a few days ago, looks like it got put into the second-chance pool, so it's on the front page now.") He went on to say that some users reported it failing through European proxies but working through US ones, probably because Cloudflare serves different challenge versions to different regions, and that he would "fix it soon." On Nov 1 he came back to say the problems reproducible with German and French IPs were fixed.
115 of the comments landed on 100 alone, on 10-31. The GitHub numbers line up: 10-31 is 38 stars, and 11-01 is 449 (daily-recorded star counts, 11-01 snapshot).
What it is
A Rust library plus a command-line tool, under the MIT license. Give it a web address blocked by Cloudflare and it outputs a Turnstile token (the "confirm you are human" widget in login forms) or a cf_clearance cookie (from the "checking your browser" 5-second shield page). With that, your program can keep accessing the site like a person would.
The key point is that it doesn't open a browser. It fully reverse-engineered the obfuscated JavaScript virtual machine inside the Cloudflare challenge, then works out the answer with plain HTTP requests and sends it back. It presents itself as iPhone Safari (iOS 26), with TLS and HTTP/2 fingerprints imitated using a BoringSSL the author patched, plus wreq. It also includes a capture-proxy: you run through the challenge once in a real browser, and it records the responses sent to Cloudflare and generates a new browser profile.
Why one headline was enough
Everyone has hit this wall. The comments split into two camps. One is the blocked users: "Even a junk site with 0.5 visitors a day got onto it," and someone said that after Russia blocked Cloudflare, no link found by search could be opened without a VPN. The other is site operators: sites like OpenStreetMap were overwhelmed by LLM crawlers and had to add challenge pages. A third group put it most bluntly, user jwr: "We want bots to do our chores for us (AI doing the work so people don't have to), and we keep getting blocked by dumb anti-bot rules. This is really useful." By 2026 AI agents browsing the web had become routine, and Turnstile is the wall they hit most often.
Every alternative is "launch a disguised browser." FlareSolverr (16k stars), undetected-chromedriver (13k), camofox-browser for AI agents (12k), and patchright all take the route of opening a modified Chromium or Firefox to get past the challenge. The older pure-request cloudscraper (6800 stars) has basically stopped working against the newer Turnstile and hasn't been updated since June 2025. An open-source, pure-request tool that solves both the Turnstile widget and the challenge page is hard to find elsewhere; the closest in approach, xKiian/cloudflare-jsd (Go, 391 stars), only handles one of the two challenge types. So "no headless browser required" is the selling point in itself. The author explained the reasoning in the comments: "If you want to do millions of requests a day, you won't want a headless browser." For people doing large-scale scraping, that's a cost difference of an order of magnitude.
The author knew his stuff and handled the skepticism on the spot. When someone said "I don't see TLS cipher ordering, Cloudflare must check that," the author linked directly to the code. He has spent five or six years in this space: 2020's commercial-bot-detectors (collecting JS code from commercial bot-detection services, 137 stars), puppeteer-bypassing-bot-detection (96 stars), and projects reverse-engineering Zoom and Hulu.
"Claude helped me reverse-engineer Cloudflare" was a topic in itself. When asked which model he used and how he got it to help, the author said mainly Claude and Muse Spark, and that "as long as it believes I control the site with the test captcha, it's pretty willing to help." He really did deploy his own test site on Cloudflare Workers and tried every Turnstile type one by one. He also said that each time Cloudflare updated, he mostly just told the agent "they changed something, please fix it" and waited a few hours (most of that time spent compiling Rust). That passage set off a long thread in the comments about how to get models to help with this kind of work.
Where the stars came from
| Date | Stars (same-day snapshot) | What happened |
|---|---|---|
| 10-26 | — | Repo created |
| 10-28 | — | Posted to HN, didn't take off |
| 10-30, 10-31 | 29, 38 | Pulled back to the front page from the second-chance pool, comments concentrated on 10-31 |
| 11-01 | 449(+411) | The wave that came with the front-page placement |
| 11-02 to 11-06 | 489 → 537 → 564 → 592 → 602 | daily.dev, PithWire, theterminal.space and other HN aggregators picked it up one after another; 11-05 Taiwanese blogger gslin wrote a short Chinese commentary |
Almost all of it came from this one HN run. In the nearly 30 days before that, searching cfsolve on X turned up not a single post, and Reddit had no threads dedicated to it either. No website, no promotion. The repo was under two months old, too new to make GitHub trending. By 11-06 it was only gaining 10 stars a day, and that wave had essentially passed.
One number is worth noting: 112 forks, a fork-to-star ratio close to 1:5, which is high for a repo of the same age and shows people are actually modifying and using it. One of the forks came from penumbra-x, the author of wreq, the HTTP library underneath cfsolve. His fork's description reads "currently broken due to update am fixing" (Cloudflare updated and broke it; I'm fixing it). The main repo updated the browser profile 11-05; whether it works right now is unverified.
Its weak spot is the gap you can fill
The question asked most often in the HN comments was: Cloudflare updates and it breaks, so who maintains it? User teravor put it plainly: the valuable part isn't this version of the solver, it's a pipeline that keeps tracking Cloudflare: automatically pulling the latest obfuscated code, reverse-engineering it, and updating the solver. Without that, nobody dares build on top of it. The author's own answer was equally candid: "I'll update it over the next few weeks, but probably not forever."
Other gaps: it's only a Rust library and command-line tool, with no Python or Node bindings and no out-of-the-box HTTP service like FlareSolverr; it ships only one iOS Safari browser profile; and you have to install CMake, libclang, and patch BoringSSL yourself just to compile it. Python is the main language in the scraping world, so this hurdle filters out most people right away.
If it were you
B. Going after stars in this area is feasible: demand is strong, few people know about it yet, and the existing open-source options are almost all browser-based. But the bar is high, and you'd be fighting Cloudflare in a battle that never ends. Someone who doesn't understand reverse engineering can't build this, and if you build it without maintaining it, it becomes a broken library within weeks.
Who it's for: developers who have built scrapers, worked on anti-detection or reverse engineering, and can read obfuscated JS virtual machine code; anyone who already has a scraping-related open-source project and wants a new one that can pull in stars.
Who it's not for: people with no reverse-engineering experience who expect AI to produce it in one go (the author's use of AI rests on five or six years of accumulated expertise and a self-built test site); people unwilling to maintain it long term; and anyone whose company or country has legal concerns about bypassing access controls. Someone in the comments raised the US CFAA, and that question has no settled answer.
How to do it, three paths, from easiest to hardest:
- Build what cfsolve left undone: wrap cfsolve in Python bindings or a FlareSolverr-style HTTP service that runs with one docker line, and connect it to Scrapy, Playwright, and various AI agent frameworks. You follow upstream on the low-level work and focus on making it easy to use. The risk: if upstream stops updating, you stop too.
- Build the "always works" version: build the pipeline teravor described. Run scheduled checks on failure rates, automatically pull Cloudflare's new code, have an agent fix it, run tests, and ship a release. Put a badge in the README showing "last passing time." This is the biggest criticism raised on HN, and also what the author said he won't keep doing forever.
- Take on a different wall: use the same approach to build pure-request solvers for DataDome, Akamai, hCaptcha, or AWS WAF. Each has a group of users it blocks, and open source is similarly dominated by browser-based tools. The difficulty is no lower than cfsolve's.
How to get users: follow its playbook. Write the HN title as a one-line contrast like "X solver (no headless browser required)," not an architecture description. If the first post doesn't take off, don't delete it, since HN may give you a second chance. For the 48 hours it was on the front page, the author stayed in the comments himself, fixing reported bugs the same day and replying that they were fixed. Writing up "how I used AI to reverse-engineer it" in the post or README gives you a ready-made discussion point.
Deadline: 1 and 2 comments suggest the window is roughly the next month or two, before cfsolve's original author stops updating or someone else builds it first. The author himself said "the next few weeks."
Wrong bet: ① Cloudflare specifically changed its detection for this library, and neither the main repo nor the penumbra-x fork has been fixed in one or two months. Pure request-based scraping costs too much to maintain, and every project that follows it turns into a broken repo. ② Within a month the first Python bindings and API-service versions appeared, yet none of them picked up 200 stars. The stars came from the novelty of "no browser needed," not from real demand. ③ GitHub took down similar libraries after complaints.
Data and sources
- GitHub: chris124567/cfsolve's README and commit history; daily stars and forks (10-30 to 11-06). The star counts for the author's other repos come from GitHub.
- Hacker News: item 50277379,317 with 115 points and comments; the author replies and comments quoted in the article from jwr, teravor, vlyan, matkoniecz and others all come from this thread.
- Reposts and commentary: daily.dev, PithWire, theterminal.space, blog.jojomensah.com, blog.gslin.org (11-05).
- Competitor star counts: FlareSolverr, undetected-chromedriver, camofox-browser, patchright, cloudscraper, xKiian/cloudflare-jsd. GitHub, as of 11-06.
- Forks: the description for penumbra-x/cfsolve comes from the search result title.
- X: searches for "cfsolve" and "chris124567" over the past 30 days, 0 posts.
Research notes: competitor table, acquisition evidence, full research report
- Competitors
Name Where Launched Scale How it differs from this one FlareSolverr Open source 2020-06 16,146 stars Runs real Chromium behind a proxy, heavy; cfsolve doesn't open a browser undetected-chromedriver / nodriver Open source 2019-12 / 2024-02 12,899 / 4,916 stars Anti-detection browser automation, requires running a browser camofox-browser Open source 2026-01 12,176 stars Stealth browser for AI agents, same use case but browser-based patchright / invisible_playwright Open source 2023-11 / 2026-05 5,099 / 2,551 stars Anti-detection fork of Playwright, browser-based cloudscraper Open source 2019-04 6,809 stars, essentially no longer maintained An older generation pure-request IUAM solver, largely ineffective against Turnstile; cfsolve is the new-generation equivalent Theyka/Turnstile-Solver Open source 2024-10 967 stars Python + patchright, still requires a browser xKiian/cloudflare-jsd Open source 2025-01 391 stars Pure Go request-based, but only solves the jsd challenge and doesn't cover the Turnstile widget. Closest in approach to cfsolve, but far smaller in scale 2Captcha, CapSolver and other captcha-solving services Other Years Commercial API, pay per request Paid and closed source; cfsolve is free and self-hosted Apple Private Access Tokens Big-company features 2022 System level Needs real devices and Apple IDs, rate-limited, can't scale - Where users come from
- Verified Hacker News front page (second chance pool): the author costco wrote in the thread that it was "added to the second chance pool so now it's on the front page"; 317 points, 115 of 100 comments among the 10-31 thread; 11-01 +411 stars
- Verified HN aggregators and reposting sites, tech blogs: daily.dev, hacker-news.news, PithWire, theterminal.space, GlobeWire, La Lettre IT, jojomensah, and the gslin Chinese blog, posting gradually from 10-31 to 11-05
- Inferred X / Reddit: x-radar found 0 posts over the past 30 days; Brave turned up no Reddit discussion
chris124567/cfsolve: a Rust Cloudflare Turnstile solver, and why it gained 600 stars in 11 days
Verdict
cfsolve fully reverse-engineers the Cloudflare Turnstile and 5-second shield challenge pages, solving them with plain HTTP requests, without a headless browser. It's nearly unique among open-source tools. Almost all the stars came from one Hacker News thread: the post 10-28 didn't take off at first, but after HN's second chance pool pushed it back to the front page, it gained 411 stars between 10-31 and 11-01 in a single day. Afterward, the long tail from HN aggregator sites and auto-reposting blogs added 10–50 stars a day. Three things drove the interest: Cloudflare is everywhere, AI agents and scrapers are the ones hit hardest by it, and open-source alternatives mostly work by driving a disguised browser. The author also openly said Claude helped with the reverse engineering. Its differentiation, with no browser and capacity for millions of requests a day, is what made it take off. The author previously researched bot detection, and that background is the foundation of the project.
Basic data (GitHub repo, repo_day, 2026-10-30 to 11-06)
- Repo created 2026-10-26, MIT license, written in Rust. Today it has 602 stars and 112 forks; the fork-to-star ratio of about 19% is high for a new repo of its age, which suggests people are actually forking it to modify and use it.
- Daily star counts: 10-30 29 → 10-31 38 → 11-01 449 (+411) → 11-02 489 → 11-03 537 → 11-04 564 → 11-05 592 → 11-06 602. Growth is clearly tapering, and it only added 10 today.
- The repo is less than 60 days old, too new to appear on trending; trending_days = 0 in the repo data says nothing meaningful.
- The author chris124567's other repos follow the same approach: commercial-bot-detectors (137 stars, 2020 years old, collects JS code from commercial bot-detection and fingerprinting services), puppeteer-bypassing-bot-detection (96 stars, 2020 years old), a hulu downloader (224 stars, code removed on request), and zoomer (reverse-engineers the Zoom websocket to build chatbots). He has worked on anti-scraping countermeasures for five or six years.
Where users come from (growth levers)
- Hacker News Show post, pushed to the front page by the second chance pool (confirmed, main channel)
- The post "Cloudflare Turnstile solver library (no headless browser required)" by the author costco (the author himself), submitted 2026-10-28, ended with 317 points and 115 comments (HN Algolia item 50277379).
- The author himself wrote in the thread: "I submitted this a few days ago but seems like it was added to the second chance pool so now it's on the front page."
- 100 of the 115 comments were concentrated around 10-31 (UTC). Our database shows the star count rose 411 in the 11-01 snapshot, which matches the time it hit the front page exactly.
- The long tail of HN aggregators and auto-reposting sites (confirmed, small volume): daily.dev, hacker-news.news, PithWire, theterminal.space, circuitobserver, GlobeWire Daily, La Lettre IT (in French), and blog.jojomensah.com all published rewrites between 10-31 and 11-04, most generated automatically or semi-automatically from the HN thread. Taiwanese blogger Gea-Suan Lin (gslin) wrote a short Chinese review in 11-05, saying after testing it that it "looks pretty good." trendshift.io and DeepWiki also list the repo.
- X / Reddit: no evidence of spread found. x-radar's local corpus returned 0 posts each for "cfsolve" and "chris124567" over the past 30 days. Brave searches of Reddit also turned up no threads specifically about it (only a general Turnstile question on r/webscraping from March this year). The conclusion: it didn't rely on big accounts reposting it; it rode a single HN front-page appearance.
- No ads, influencer deals or any paid promotion were seen, and there is no official site or homepage.
Why it took off
- Demand is big and getting urgent: some HN commenters complain that "even a small site getting 0.5 visits a day is behind Cloudflare", and note that after Russia blocked Cloudflare, parts of the web became unusable. Others side with site owners, saying LLM crawlers ignore robots.txt, and sites like OpenStreetMap were forced to add challenge pages. User jwr writes: "For those of us who want to use bots to help them with daily tasks (so that AI does the chores…) … this is really helpful." 2026 AI agents browsing the web is becoming routine, and Turnstile is the wall they hit most often.
- The contrast in approach: the mainstream open-source ways to bypass Cloudflare all drive a disguised browser (FlareSolverr, undetected-chromedriver, camoufox, patchright, SeleniumBase UC). cfsolve is "full reverse engineering plus pure requests," and can obtain the Turnstile token and cf_clearance. The author explained his motivation in comments: "if you want to scale to millions per day you don't want to have to use headless browsers." For people doing large-scale collection, that is a difference of an order of magnitude in cost.
- Solid engineering that shows real understanding: it emulates Safari on iOS 26, with TLS / HTTP2 fingerprints built on a self-patched BoringSSL plus wreq / http2. It also ships a capture-proxy that records challenge responses from a real browser to generate profiles. When someone in the comments asked "I don't see TLS cipher ordering," the author immediately pasted the relevant code.
- "AI reverse-engineered Cloudflare for me" is the hook: people asked which model he used and how he got it to help, and he answered "Mainly Claude and Muse Spark… happy to help if it was convinced that I controlled the website," adding that the more project context Claude remembers, the less it hesitates. That part sparked a long comment thread, and "LLMs reverse-engineering anti-bot systems" is itself something HN has loved to talk about for 2026 years.
- The author kept fixing it after reaching the front page: he fixed an issue where European IPs got different challenge versions in 10-31, fixed a bug with randomized VM versions in 11-01, added CI in 11-03, and updated profiles in 11-05. In 11-03, external contributor abadawe-dev and Claude co-submitted 6 commits. The most common skepticism on HN was "Cloudflare updates break it constantly, who maintains it?" Ongoing updates directly answer that concern.
Competitors
| Name | Where | Launched | Scale | How cfsolve differs |
|---|---|---|---|---|
| FlareSolverr | Open source | 2020-06 | 16,146 stars, +75 this week | Runs a real Chromium behind a proxy server to pass challenges; heavy to deploy and resource-hungry, and doesn't specifically handle the Turnstile widget |
| undetected-chromedriver / nodriver | Open source | 2019-12 / 2024-02 | 12,899 / 4,916 stars | Browser automation with anti-detection patches, requires running a browser |
| camofox-browser(jo-inc) | Open source | 2026-01 | 12,176 stars, +127 this week | Stealth headless browser for AI agents, aimed at the same agent use case but still browser-based |
| patchright / invisible_playwright | Open source | 2023-11 / 2026-05 | 5,099 / 2,551 stars | Anti-detection fork of Playwright, browser-based |
| cloudscraper(VeNoMouS) | Open source | 2019-04 | 6,809 stars, essentially no longer maintained (last push 2025-06) | A Python library that once solved Cloudflare IUAM with pure requests, now largely ineffective against the newer Turnstile / managed challenge. cfsolve is essentially the cloudscraper of the new era |
| Theyka/Turnstile-Solver | Open source | 2024-10 | 967 stars | Python + patchright, multithreaded, still requires a browser |
| Sophomoresty/turnstile-bypass, ZFC-Digital/cf-clearance-scraper, Xewdy444/CF-Clearance-Scraper | Open source | 2022–2026 | 500–750 stars | All rely on a browser to obtain cf_clearance |
| xKiian/cloudflare-jsd | Open source | 2025-01 | 391 stars | Pure Go request-based, but only solves the jsd challenge and doesn't cover the Turnstile widget. Its approach is closest to cfsolve, but at a much smaller scale |
| enetx/surf, curl_cffi, wreq | Open source | Around 2025 | surf has 1,850 stars | Only does TLS / HTTP fingerprint spoofing and doesn't solve challenges; cfsolve itself is built on wreq |
| 2Captcha, CapSolver, CapMonster and other captcha-solving services | Web / API | Years | Commercial, pay per request | Paid API, backed by human labor or a private solver; cfsolve is free, self-hosted and open source |
| Apple Private Access Tokens(PAT) | Big-company features | 2022 | System level | A commenter suggested using the PAT from a real Mac Safari. The author's view is that PAT is rate-limited per Apple ID, so it can't scale. |
Bottom line: browser-based solutions are plentiful and have plenty of stars, but one that is open source, request-based, and covers both the Turnstile widget and challenge pages has no second match in our GitHub database. Commercial CAPTCHA-solving services privately have similar capabilities, but they don't make them public.
Copycats and what came after
- 112 forks. One is worth noting: penumbra-x/cfsolve (from Brave search results). penumbra-x is the author of wreq / rquest, the HTTP library underneath cfsolve. After forking, they changed the description to "(currently broken due to update am fixing)". This suggests Cloudflare pushed an update that broke it once, and insiders are following along and fixing it.
- The other forks (ollym, Bharathboy1, 93Pd9s8Jt, 0xTox, abadawe-dev) look like plain copies. I didn't see any independent projects that renamed and repackaged it.
- I haven't seen Python or Node bindings, or API-service copycats (unverified, since I didn't review each fork individually).
How many people know about it now
It spread quietly in small circles: one HN front-page run (317 points), plus a batch of automated HN repost sites and a Taiwanese tech blog. No big accounts on X wrote about it, and it didn't make mainstream Reddit discussion. It's a free open-source library with no revenue. But its capability has direct value for CAPTCHA-solving services and scraping SaaS, and it's likely being quietly integrated into commercial services where outsiders can't see it.
What to borrow
- Hardcore reverse engineering + a one-line contrast headline ("no headless browser required") worked well on HN. If the first post doesn't take off, don't delete it; HN's second chance pool gives you another shot.
- During the 48 hours on the front page, the author personally answered technical challenges in the comments and fixed a bug others reported the same day. That's what turned "toy" credibility into stars.
- Being open about the AI-assisted reverse engineering process was itself a point of spread. The framing "reverse engineering X with Claude" is reusable.
- The author's years of anti-bot work (such as commercial-bot-detectors) is the foundation. Similar projects didn't get this many stars because pure request-based reverse engineering of Turnstile's VM / obfuscation has a high barrier, and people who previously built it mostly sold it as CAPTCHA-solving services without open-sourcing it.
Unknowns
- Real usage and success rates can't be verified. The penumbra-x fork's description says "currently broken due to update"; whether the main repo recovered after the 11-05 profile update is unverified.
- Whether Cloudflare responded specifically to this library (for example, by fingerprinting it), is unverified.
- Whether the star gains on 11-01 came from other sources (such as Telegram or Discord scraping groups) — there's no evidence, but HN is presumed to be the main driver.
- The author's identity (costco / chris124567) and business background weren't found; the GitHub API hit rate limits at the time, so I couldn't get the account creation date or follower count.
Sources
- Data sources: GitHub repo repo_profile / repo_day (2026-10-30 to 11-06), plus search results for similar libraries.
- HN: news.ycombinator.com/item?id=50277379 (Algolia API, 317 points, 115 comments; the author's replies on the second chance pool, model usage, and the EU version fix)
- README and commit history: github.com/chris124567/cfsolve, /commits/master (read via Jina)
- Repost articles: daily.dev/posts/cloudflare-turnstile-solver-library-no-headl…, pithwire.com/en/articles/cloudflare-turnstile-solver-library…, theterminal.space/software/cfsolve-turnstile-solver-rust-no-…, blog.jojomensah.com/posts/cloudflare-turnstile-rust-cfsolve, blog.gslin.org/archives/2026/11/05/13328/
- Fork: github.com/penumbra-x/cfsolve (title from Brave search results)
- X: x-radar search for "cfsolve" and "chris124567" over the past 30 days, 0 results