wcagc — accessibility scanning

io.github.WCAG-CompliancePublished by GitHub account WCAG-Compliancev0.8.0Updated Oct 29, 2026

Deterministic axe-core accessibility scans (WCAG 2.1 AA, EN 301 549, PDF/UA) via your account.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingDeveloper Tools

Overview

AI-generated overview

Runs deterministic axe-core accessibility scans (WCAG 2.1 AA, EN 301 549, PDF/UA) through a wcagc account and reads back findings, site runs and trends.

What you can do
  • Scan a public URL or a registered site, and run a PDF/UA-1 structure check on a public PDF
  • Read a scan's status, severity counts and findings, for recorded or one-off scans
  • List registered sites and crawl every reachable page of one (Pro+)
  • Read full-site runs, group repeated DOM patterns into root causes, replay saved multi-step journeys and view violation trends (Pro+)
  • Every scan response carries a coverage disclaimer and no score or conformance verdict
When to use it
Useful when you want an assistant to check pages or PDFs for accessibility barriers with real automated tooling rather than model guesses, and to pull findings, root causes or trends from an existing wcagc account. Suited to teams doing WCAG or EN 301 549 review work who accept that automated checks cover only part of the issues.
Requirements
Either the hosted remote endpoint with managed OAuth login, or a local process via npx @wcagc/mcp over stdio. Local and CI use need a wcagc API key with the mcp:scan scope in WCAGC_MCP_KEY; WCAGC_API_BASE_URL only for self-hosting. Some tools require a Pro or higher plan, and Free/Starter plans have a daily quota.
Before you install
scan_url and scan_site create scans, which is not a read-only operation and consumes plan quota. The API key in WCAGC_MCP_KEY grants scan access and should be kept out of shared configs. The hosted connector binds to one Organization and forwards your bearer to the wcagc API. Results are partial by design and never certify compliance.

Installation

In SourceWeft

  1. Open wcagc — accessibility scanning in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.WCAG-Compliance%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "wcagc-accessibility-scanning": {
      "type": "http",
      "url": "https://mcp.wcagc.com/mcp"
    }
  }
}

README

wcagc-mcp

[WCAG-Compliance/wcagc-mcp MCP server] [smithery badge]

An MCP server that lets an AI assistant (Claude, ChatGPT, or any MCP-compatible client) run real, deterministic accessibility scans through wcagc — axe-core under the hood, not an LLM guess. Every scan result carries an explicit coverage disclaimer and never claims "compliant": automated testing finds only a portion of accessibility barriers, and this tool says so in every response.

This package is a thin, stateless adapter. It holds no database, no scan logic, and no secrets beyond the wcagc API base URL — it translates MCP tool calls into HTTP calls against the wcagc API and forwards the caller's own bearer. All authentication, entitlements, quotas, and scan orchestration live in the API; this code is safe to read end to end.

Two ways to run it

Local (stdio) — for Claude Desktop, Cursor, or any MCP client that spawns a local process:

bash
npx @wcagc/mcp

Configure your MCP client with:

json
{  "mcpServers": {    "wcagc": {      "command": "npx",      "args": ["-y", "@wcagc/mcp"],      "env": {        "WCAGC_MCP_KEY": "<your mcp:scan API key>"      }    }  }}

Mint an mcp:scan key from your wcagc account under Settings → API keys — available on every plan, with a daily quota on Free/Starter and unlimited on Pro/Agency.

Hosted (Streamable HTTP + managed OAuth) — what Claude web/desktop/mobile connectors and ChatGPT use, since neither runs a local process for you. Add this remote MCP connector:

https://mcp.wcagc.com/mcp

The client discovers /.well-known/oauth-protected-resource/mcp, opens the wcagc login/consent flow, and binds the connection to one Organization. No key copy/paste is required. API-key bearer authentication remains supported for local stdio and CI.

ChatGPT availability depends on the ChatGPT plan and on whether the client permits action tools; scan_url creates a scan and is not a read-only operation. See wcagc.com/integrations/mcp.

Tools

ToolPlanWhat it does
scan_urlallScan any public URL, or a registered site for full tracking (Pro+).
check_pdfallRun a PDF/UA-1 structure check on a public PDF.
get_scan · get_findingsallRead a scan_url scan's status, severity counts, and findings — either kind, recorded or one-off.
list_sitesPro+List the account's registered sites.
scan_sitePro+Crawl and scan every reachable page of a registered site.
get_run · get_run_findingsPro+Read a full-site run from scan_site.
get_root_causesPro+Group a run's repeated DOM patterns and return factual element/page blast radius.
run_journeyPro+Replay a saved multi-step journey and check each step.
get_trendsPro+Read a site's violation-count history over time.

One id, one poll tool: whatever scan_url did with a URL, get_scan and get_findings read it back. get_run and get_run_findings are only for full-site runs from scan_site.

Every scan-producing tool returns the coverage disclaimer in both the text content and the structured content. There is no score, grade, or conformance verdict — automated testing finds roughly 30–57% of accessibility issues, and the remainder needs manual review.

Configuration

Env varUsed byMeaning
WCAGC_API_BASE_URLbothThe wcagc API to call. Defaults to https://api.wcagc.com; set it only when self-hosting.
WCAGC_MCP_KEYstdioYour mcp:scan API key.
PORThostedPort to listen on (default 8080).
WCAGC_MCP_ALLOWED_HOSTShostedComma-separated Host-header allowlist (DNS-rebinding protection when bound to 0.0.0.0).
WCAGC_MCP_INTROSPECT_TTL_SECONDShostedHow long a verified bearer is cached before re-checking with the API (default 60).
WCAGC_MCP_OAUTH_ISSUERhostedExpected OAuth issuer (defaults to WCAGC_API_BASE_URL).
WCAGC_MCP_OAUTH_JWKS_URLhostedAuthorization Server public JWKS URL.
WCAGC_MCP_URLhostedCanonical RFC 9728 protected-resource URL (defaults to https://mcp.wcagc.com/mcp).
WCAGC_MCP_JWKS_TTL_SECONDShostedJWKS cache TTL; an unknown kid triggers an immediate refetch.
WCAGC_OPENAI_APPS_CHALLENGEhostedOpenAI Plugins Directory domain-verification token; keep it in the deployment secret store, never in source.

Development

Hosted HTTP requests to /mcp and discovery endpoints produce JSON logs with a generated request ID, HTTP status, MCP method, error code and duration. Tokens, headers, query strings, tool arguments and results are excluded. Health probes are not logged.

The Docker entrypoint preloads the New Relic ESM agent. Set NEW_RELIC_AGENT_ENABLED=true, NEW_RELIC_APP_NAME=wcagc-mcp and the deployment secret NEW_RELIC_LICENSE_KEY to enable APM and forwarding of these safe request logs. The license key must belong to the existing New Relic account; never commit it. The stdio entrypoint does not load the agent.

bash
npm installnpm run dev        # hosted, watch modenpm run start:stdio # stdio modenpm run typechecknpm run verify      # node:test against a local fixture API

License

MIT — see LICENSE.

Source: README.md at commit de6e3ba

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

4
  1. v0.8.0LatestOct 29, 2026
  2. v0.7.5Oct 12, 2026
  3. v0.7.4Oct 7, 2026
  4. v0.7.3Sep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts