The client side of OpenWAF Verify is now open source under the Apache License 2.0, at github.com/openwaf-dev/verify (external link): the browser widget, the proof-of-work worker, the browser challenge page template and CSS, the protocol spec, siteverify libraries for Go, Node and PHP, and components for React and Vue. For now the libraries and components install from GitHub (go get github.com/openwaf-dev/verify/siteverify@v0.1.0, the npm tarballs of the v0.1.0 release (external link), Composer from the repository); the npm and Packagist packages are coming soon. See Use the libraries.
Risk scoring, the browser-consistency rule, the in-page automation checks, reputation and threat feeds and the edge itself stay closed. The widget the edge serves is the open code plus one closed module of yes/no automation checks, which adds one opaque integer to the solve request and reads no canvas, WebGL, audio, fonts or high-entropy client hints, so it is not byte-identical to a build from the repository. See OpenWAF Verify open source.