WCAG-Compliance/wcagc-mcp

An MCP server that lets an AI assistant (Claude, ChatGPT, or
any MCP-compatible client) run real, deterministic accessibility scans through
wcagc — axe-core under the hood, not an LLM guess. Every scan result carries
an explicit coverage disclaimer and never claims "compliant": automated testing finds only a
portion of accessibility barriers, and this tool says so in every response.
This package is a **thin, stateless adapter**. It holds no database, no scan logic, and no
secrets beyond the wcagc API base URL — it translates MCP tool calls into HTTP calls against the
wcagc API and forwards the caller's own bearer. All authentication, entitlements, quotas, and
scan orchestration live in the API; this code is safe to read end to end.
Two ways to run it
**Local (stdio)** — for Claude Desktop, Cursor, or any MCP client that spawns a local process:
Configure your MCP client with:
Mint an mcp:scan key from your wcagc account under Settings → API keys — available on every
plan, with a daily quota on Free/Starter and unlimited on Pro/Agency.
**Hosted (Streamable HTTP + managed OAuth)** — what Claude web/desktop/mobile connectors and
ChatGPT use, since neither runs a local process for you. Add this remote MCP connector:
The client discovers /.well-known/oauth-protected-resource/mcp, opens the wcagc login/consent
flow, and binds the connection to one Organization. No key copy/paste is required. API-key bearer
authentication remains supported for local stdio and CI.
ChatGPT availability depends on the ChatGPT plan and on whether the client permits action tools;
scan_url creates a scan and is not a read-only operation. See
wcagc.com/integrations/mcp.
Tools
| Tool | Plan | What it does |
|---|---|---|
| scan_url | all | Scan any public URL, or a registered site for full tracking (Pro+). |
| check_pdf | all | Run a PDF/UA-1 structure check on a public PDF. |
| get_scan · get_findings | all | Read a scan_url scan's status, severity counts, and findings — either kind, recorded or one-off. |
| list_sites | Pro+ | List the account's registered sites. |
| scan_site | Pro+ | Crawl and scan every reachable page of a registered site. |
| get_run · get_run_findings | Pro+ | Read a full-site run from scan_site. |
| get_root_causes | Pro+ | Group a run's repeated DOM patterns and return factual element/page blast radius. |
| run_journey | Pro+ | Replay a saved multi-step journey and check each step. |
| get_trends | Pro+ | Read a site's violation-count history over time. |
One id, one poll tool: whatever scan_url did with a URL, get_scan and get_findings read it
back. get_run and get_run_findings are only for full-site runs from scan_site.
Every scan-producing tool returns the coverage disclaimer in both the text content and the
structured content. There is no score, grade, or conformance verdict — automated testing finds
roughly 30–57% of accessibility issues, and the remainder needs manual review.
Configuration
| Env var | Used by | Meaning |