Back to Browse
Free
Server data from the Official MCP Registry
Deterministic axe-core accessibility scans (WCAG 2.1 AA, EN 301 549, PDF/UA) via your account.
About
Deterministic axe-core accessibility scans (WCAG 2.1 AA, EN 301 549, PDF/UA) via your account.
Remote endpoints: streamable-http: https://mcp.wcagc.com/mcp
Security Report
5.2
Moderate5.2Moderate Riskwcagc-mcp is a well-architected, stateless MCP adapter for accessibility scanning. Authentication is properly enforced via API keys passed through environment variables and HTTP Bearer tokens. Code quality is strong with proper input validation, error handling, and no malicious patterns detected. Permissions are appropriately scoped to HTTP network calls and environment variable access, matching the server's purpose as a thin API wrapper. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 4 high severity). Package verification found 1 issue.
7 files analyzed · 10 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
A wcagc API key with the mcp:scan scope. Mint one under Settings -> API keys; every plan can, with a daily quota on Free and Starter.Required
Environment variable: WCAGC_MCP_KEY
The wcagc API to call. Defaults to the hosted API; override only for a self-hosted deployment.
Environment variable: WCAGC_API_BASE_URL
How to Install & Connect
Available as Local & Remote
This plugin can run on your machine or connect to a hosted endpoint. during install.
Documentation
View on GitHubFrom the project's GitHub README.
wcagc-mcp
An MCP server that lets an AI assistant (Claude, ChatGPT, or any MCP-compatible client) run real, deterministic accessibility scans through wcagc — axe-core under the hood, not an LLM guess. Every scan result carries an explicit coverage disclaimer and never claims "compliant": automated testing finds only a portion of accessibility barriers, and this tool says so in every response.
This package is a thin, stateless adapter. It holds no database, no scan logic, and no secrets beyond the wcagc API base URL — it translates MCP tool calls into HTTP calls against the wcagc API and forwards the caller's own API key. All authentication, entitlements, quotas, and scan orchestration live in the API; this code is safe to read end to end.
Two ways to run it
Local (stdio) — for Claude Desktop, Cursor, or any MCP client that spawns a local process:
npx @wcagc/mcp
Configure your MCP client with:
{
"mcpServers": {
"wcagc": {
"command": "npx",
"args": ["-y", "@wcagc/mcp"],
"env": {
"WCAGC_MCP_KEY": "<your mcp:scan API key>"
}
}
}
}
Mint an mcp:scan key from your wcagc account under Settings → API keys — available on every
plan, with a daily quota on Free/Starter and unlimited on Pro/Agency.
Hosted (Streamable HTTP) — what Claude web/desktop/mobile connectors and ChatGPT use, since neither runs a local process for you. Add this as a remote MCP connector and paste the same API key as the bearer token:
https://mcp.wcagc.com/mcp
In ChatGPT, full tool access currently requires a Business, Enterprise, or Edu workspace; on Plus you can use the read-only Custom GPT Action instead. See wcagc.com/integrations/mcp.
Tools
| Tool | Plan | What it does |
|---|---|---|
scan_url | all | Scan any public URL, or a registered site for full tracking (Pro+). |
check_pdf | all | Run a PDF/UA-1 structure check on a public PDF. |
get_scan · get_findings | all | Read a scan's status, severity counts, and findings. |
list_sites | Pro+ | List the account's registered sites. |
scan_site | Pro+ | Crawl and scan every reachable page of a registered site. |
get_run · get_run_findings | Pro+ | Read a full-site run. |
run_journey | Pro+ | Replay a saved multi-step journey and check each step. |
get_trends | Pro+ | Read a site's violation-count history over time. |
Every scan-producing tool returns the coverage disclaimer in both the text content and the structured content. There is no score, grade, or conformance verdict — automated testing finds roughly 30–57% of accessibility issues, and the remainder needs manual review.
Configuration
| Env var | Used by | Meaning |
|---|---|---|
WCAGC_API_BASE_URL | both | The wcagc API to call. Defaults to https://api.wcagc.com; set it only when self-hosting. |
WCAGC_MCP_KEY | stdio | Your mcp:scan API key. |
PORT | hosted | Port to listen on (default 8080). |
WCAGC_MCP_ALLOWED_HOSTS | hosted | Comma-separated Host-header allowlist (DNS-rebinding protection when bound to 0.0.0.0). |
WCAGC_MCP_INTROSPECT_TTL_SECONDS | hosted | How long a verified bearer is cached before re-checking with the API (default 60). |
Development
npm install
npm run dev # hosted, watch mode
npm run start:stdio # stdio mode
npm run typecheck
npm run verify # node:test against a local fixture API
License
MIT — see LICENSE.
Reviews
No reviews yet
Be the first to review this server!
More Security MCP Servers
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
137
Stars
559
Installs
8.0
Security
4.8
Local
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
-
Stars
88
Installs
10.0
Security
4.6
Local
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
168.6K
Stars
60
Installs
4.2
Security
5.0
Local