Prosopo is a privacy-focused, self-hosted CAPTCHA alternative that provides multiple challenge types—image selection, puzzle (image jigsaw), proof-of-work, and frictionless (behavioral bot detection). The system comprises an Express-based provider API (with MongoDB and Redis for persistence and caching), a CLI for administrative tasks, client-side embeddable widgets (vanilla JS bundle, React/Angular/Vue/Svelte wrappers), and a suite of supporting libraries for cryptography, locale, datasets, and native Rust modules (JA4 TLS fingerprinting, Merkle tree acceleration, puzzle rendering). Bot detection is multi-layered: client-side behavioral data (mouse/keyboard/touch events, SIMD readings) is collected and server-side scored, combined with JA4 TLS fingerprint analysis, IP reputation (ipapi.is + MaxMind), DNS asymmetry detection, spam email heuristics, and custom decision machines per site key. The architecture is a monorepo with ~70 workspaces, leveraging Vite for bundling, Vitest for unit/integration tests, and Cypress for E2E visual regression testing. The provider enforces access policies (allow/block/restrict) via a Redis-backed rules engine and maintains usage counters for rate limiting. Asset sealing (AES-256-GCM) protects image CDN URLs, and puzzle difficulty is sampled with a CSPRNG-stratified ladder to frustrate solver calibration.