A free, open-source watermark remover for ChatGPT, Claude and Gemini text that runs on your own key

Claude and Gemini mark the text they generate, and on October 5 OpenAI announced that ChatGPT would do the same, at first for users in the EU. The mark is statistical. It sits in the word choices made by the model, so it survives copying, and a Unicode cleaner does not remove it. In August, I published an article detailing which models implement this feature and who can detect it, followed by a post testing what removes the mark. A complete rewrite performed by a different model fell below the threshold of the reference detector in 10 of 10 reports.

Since then, this rewrite has been running behind the watermark remover on this site. This week I pulled it out into a separate program and released it under the MIT license. The project is hosted at github.com/balakhonoff/claude-watermark-remover.

It is an MCP server, so it can be called by Claude Desktop, Claude Code, Codex and Cursor. It runs locally on your computer and sends your text to one place, OpenRouter, using your own API key. It only uses the free models on OpenRouter, so it costs nothing. You pay with time, and the second half of this article shows how much.

What it does to a text

1. The program masks links, email addresses, quoted passages, currency amounts and percentages, because they must come back unchanged. The model never sees these parts.
2. The system requests a single rewritten version from the model. The prompt instructs the model to reconstruct every sentence using different syntax and word order while preserving all technical terms, proper names, numerical values, list markers, and headings in their original positions.
3. A local verification process, involving no external model, checks the draft. It ensures all placeholders are present, the length remains within 80 to 125 percent of the original, and that paragraphs, lines and list markers match the source. At least 80 percent of the five-word sequences must be new.
4. If the draft fails any check, the system requests a second attempt and specifies the failure points. If the second draft violates layout or length constraints, the tool returns an error without providing any text.
5. Once verified, the protected segments are reinserted, and the final result is returned along with the percentage of five-word sequences that were replaced.

No second model checks the meaning. An independent review of my hosted version identified five instances of meaning alteration across six test texts. In one case, “should” was changed to “must”, and in another, “covers 17.5%” became “covers up to 17.5%”. I added these cases to the instructions, and the next runs of those texts came back clean, though each text was only run once. You should always compare the output against your source before using it.

How good are the free models?

OpenRouter provides a list of free models, which are shared resources subject to rate limits: 20 requests per minute and 50 per day for accounts that have never purchased credit. After you have bought $10 of credit at any point, the daily limit becomes 1,000. Since a rewrite requires one or two requests, a new account can process between 25 and 50 texts daily.

On October 3, the list contained 22 free models. I tested my production prompt against thirteen of these models and OpenRouter’s free router using a 1,316-character text that included a heading and a numbered list.

Model	What happened on October 3
Qwen3.8 27B	46 seconds, 81% of five-word sequences replaced, layout kept
Nemotron 3 Super 120B	12 and 25 seconds, 78% and 63%, layout kept
Nemotron 3 Ultra 550B	80%, but it took 5 minutes
Nemotron 3.5 Lightning	155 seconds with reasoning off, and my text came back unchanged
Space Bunny, a “stealth” preview model	3 seconds, 78%, layout kept; preview models come and go
Gemma 4 (both sizes), Laguna S and XS	“Temporarily rate-limited” on every attempt
Ling 3.0 flash	Returned my text almost unchanged
Apodex mini, Cohere North mini	10% and 27%; Cohere also broke the lines
Inkling	Refused: only for coding agents
The openrouter/free router	Picked a model for me; once the answer was empty, once it was a copy of my text

I initially set Qwen3.8 as the default. Two days later, it was removed from the free list. OpenRouter stated the model was “unavailable for free” and suggested the paid version instead.

So on October 5 I went back to the list, which then held 20 models. I tested ten of them on a 1,074-character text consisting of three paragraphs. Ling 3.0 flash, which had only copied my text two days earlier, now worked with low reasoning. Three runs of the same text took 61, 158, and 216 seconds, replacing 87%, 70%, and 70% of the five-word sequences. The layout remained intact in all instances. Both Gemma models were busy again. Apodex broke the paragraph structure twice, which this program reports as an error. Two models failed to respond within four minutes.

Following these tests, I modified the program. It now accepts a list of free models and attempts them sequentially until one produces a usable rewrite. The output identifies the successful model and those that failed. You can include any model whose name ends in :free on this list, as my default list will become outdated quickly.

Two settings decide whether a free model works at all.

Free models reason before they answer. With default settings, Qwen3.8 consumed all 4,096 output tokens on thinking and returned an empty string. Ling, with reasoning disabled, exhausted its token limit, and with medium reasoning, it returned nothing. The working configuration uses low reasoning and a large output budget, which the server applies automatically.

The Nemotron, Laguna, and Liquid endpoints only respond if your OpenRouter account permits free providers to train on your inputs. This is a privacy setting, disabled by default. If you are rewriting sensitive documents like a thesis chapter or legal memo, this setting is more critical than the wait time.

So it is free, and it works like a lottery. Some days, the free model achieves the 80% target within a minute. Other days, it stops at 70% after three minutes, and the tool says so in its answer.

How to install it

You need an OpenRouter account and a key from the keys page. A free account is enough.

For Claude Desktop, download the .mcpb file from the repository’s releases folder and open it. Claude Desktop will ask for the key in its own window and store it itself.

Claude Code requires only a single command.

claude mcp add watermark-remover -e OPENROUTER_API_KEY=sk-or-… -- npx -y --package=https://github.com/balakhonoff/claude-watermark-remover/raw/main/releases/claude-watermark-remover-0.2.3.tgz claude-watermark-remover

The README provides identical steps for Codex and Cursor, along with a command-line mode that rewrites files without an assistant interface.

What I have not measured

The 10 of 10 result corresponds to the August prompt on Qwen3.7 Plus at temperature 0, using the published SynthID Text scheme. The open-source version uses stricter instructions regarding terms, layout, and statement strength, samples at temperature 0.7, and runs on free models. I have not run this configuration through the reference detector.

I have not tested this tool against textGrain, the scheme OpenAI announced for ChatGPT. It is a distinct scheme with its own detector, accessible only to approved researchers. OpenAI’s own post states that replacing a quarter of words with synonyms reduced their detection rate from approximately 92 percent to 17 on 400-token English answers. This is their experiment on their scheme and provides no certain information about this tool.

No one outside OpenAI, Anthropic, and Google can verify their production watermarks. None of the three detectors is public, so the tool reports only the extent of wording changes, not the status of the mark itself.

It is not built to pass AI detectors like GPTZero or Turnitin. These tools guess whether text resembles model output and lack watermark keys. I ran several rewrites through three free detectors: the most lenient one stopped flagging them, while the two stricter ones maintained their verdicts.

On texts shorter than about 750 characters, the replaced share is a coarse metric. A single citation like “(Huang and Chang, 2023)” is sufficient to reduce a 40-word paragraph to 74%.

If you would rather not wait or install anything

The hosted version runs the same rewrite on a paid model. A text of 1,000 characters comes back in 2 to 10 seconds. Since browser-based and mobile versions of Claude cannot launch applications on your device, a local MCP server is unavailable in those environments. The hosted service works as a connector. Add https://painintheagent.com/mcp in Claude’s connector settings and sign in. It also operates without API keys via the web tool. Three runs on the first 500 characters are free, and after that it is $5 a month for 100,000 characters.