io.github.snayyar00/webability

Est-ce que io.github.snayyar00/webability est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.snayyar00/webability » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 17 outils

• add_site≈ 448 tokens

  Add a website to the signed-in WebAbility account. The site gets the full widget for its first 30 days and a first scan. Returns the site id and plan tier. Next: put the get_install_snippet tag on the site, and use create_upgrade_link to get a payment link for the WebAbility Pro plan. Needs a free WebAbility account (an AI agent can sign itself up with "Sign in with AgentID").

  Paramètres, retour & exemple (3)

  Paramètres

  • url · string · requis
    The site to add, for example https://shop.example.com. One domain per site.
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.

  Exemple d'appel

  {"name": "add_site", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_aria≈ 736 tokens

  Validate ARIA attribute + accessible name/role/value usage — in an HTML snippet (`html`) or on a live page (`url`), optionally limited to one element and its descendants (`selector`). Runs axe-core `cat.aria` and `cat.name-role-value` rules (aria-* attribute correctness, role validity, required parents/children, aria-hidden-focus, accessible names). Returns `violations`. A selector that matches nothing, or a page that answers an HTTP error, is an error — never "no violations". Nodes cap at 5 per rule by default — every rule reports nodesTotal + truncated; raise nodeLimit (max 50). NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (`npx -y @webability/mcp`, simplest — nothing leaves the machine), or open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` together with the printed secret as `tunnel_secret`.

  Paramètres, retour & exemple (7)

  Paramètres

  • url · string · optionnel
    Live page to check (pass this or `html`)
  • html · string · optionnel
    HTML to test for ARIA correctness (pass this or `url`)
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • selector · string · optionnel
    Only report findings on this element and its descendants (e.g. the `selector` from a scan_page issue). ARIA references outside it still resolve.
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • nodeLimit · number · optionnel
    Max nodes returned per rule (default 5, max 50)
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "check_aria", "arguments": {"url": "texte", "html": "texte", "context": "texte", "selector": "texte", "llm_model": "texte", "nodeLimit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_color_contrast≈ 944 tokens

  Check text contrast against the WCAG AA threshold (4.5:1, or 3:1 for large text); the AAA verdict is shown only when you pass level: "AAA". Either pass a `foreground` / `background` color pair, or pass `url` + `selector` to read the element's own text color, background (composited from the nearest painted ancestors), font size and weight from the live page; explicit colors win over the page. A gradient or image background is reported as an error, never a guessed ratio. When it fails, suggests BRAND-aligned replacements — extracts the actual brand palette from the `url` page using our scanner (CSS vars + most-used colors), or use a provided `brandColors` array. No `url` and no `brandColors` = ratio + pass/fail only. NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (`npx -y @webability/mcp`, simplest — nothing leaves the machine), or open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` together with the printed secret as `tunnel_secret`.

  Paramètres, retour & exemple (11)

  Paramètres

  • url · string · optionnel
    Live page: with `selector`, the colors are read from that element; on a failing pair, the brand palette is extracted from it (uses our scanner — CSS vars + dominant colors).
  • level · string · optionnel · AA | AAA
    Conformance level to judge. Default "AA". "AAA" adds the enhanced-contrast (1.4.6) verdict and AAA palette suggestions.
  • isBold · boolean · optionnel
    Whether text is bold (default false, or the element's computed weight with url + selector)
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • fontSize · number · optionnel
    Font size in px (default 16, or the element's computed size with url + selector)
  • selector · string · optionnel
    CSS selector of the text element on `url` (e.g. the `selector` from a scan_page issue)
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • background · string · optionnel
    Background color (hex or rgb). Optional with url + selector.
  • foreground · string · optionnel
    Foreground color (hex or rgb). Optional with url + selector.
  • brandColors · array · optionnel
    Pre-supplied brand palette. Skips URL extraction if provided.
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "check_color_contrast", "arguments": {"url": "texte", "level": "AA", "isBold": true, "context": "texte", "fontSize": 1, "selector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_upgrade_link≈ 478 tokens

  Get a Stripe Checkout link that puts one site on the WebAbility Pro plan (the widget subscription). Give the link to the human who pays (your owner). When they pay, the plan activates on that site automatically; check with list_sites. You never handle card details. The site must be on the account (add_site first). Needs a free WebAbility account.

  Paramètres, retour & exemple (4)

  Paramètres

  • domain · string · requis
    The site to upgrade, as added with add_site (for example shop.example.com)
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • billing_interval · string · optionnel · monthly | yearly
    Billing period. Default monthly.

  Exemple d'appel

  {"name": "create_upgrade_link", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• detect_framework≈ 591 tokens

  Detect a page's stack as two separate fields: `framework` — the application framework, CMS or site builder (e.g. nextjs, nuxt, sveltekit, vitepress, astro, gatsby, wordpress, shopify, mediawiki, vue, react; "unknown" when no signal) — and `cssToolkit` (tailwind, bootstrap, mui, plain-css). Lists the evidence it used and the value to pass as generate_ai_fix `framework`. scan_page reports the same two fields from the same detection. NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (`npx -y @webability/mcp`, simplest — nothing leaves the machine), or open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` together with the printed secret as `tunnel_secret`.

  Paramètres, retour & exemple (4)

  Paramètres

  • url · string · requis
    URL to inspect
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "detect_framework", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• diff_scan≈ 1120 tokens

  Compare two scans of the same page and report what changed: `fixed[]` (in the baseline, gone now), `new[]` (regressions — not in the baseline, present now), `remaining[]` (still there). Page-level complement to verify_fix (one element). Baseline is a scan_history id (`baselineId`, local installs) or a live scan of `baselineUrl`; current is `url` (scanned live now) or another history id (`currentId`). Findings are matched by issue id (rule + element), so a changed class/id on a fixed element reads as fixed AND new — check `new[]` before calling it a regression. Typical loop: scan_page → edit → diff_scan(baselineId=<that scan id>, url=<same url>) → confirm new[] is empty. NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (`npx -y @webability/mcp`, simplest — nothing leaves the machine), or open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` together with the printed secret as `tunnel_secret`.

  Paramètres, retour & exemple (14)

  Paramètres

  • url · string · optionnel
    URL to scan now as the CURRENT side (deployed, staging, or http://localhost:3000). Omit when passing currentId.
  • wcag · array · optionnel
    Only these WCAG criteria. A prefix selects the whole guideline ("1.4") or principle ("2").
  • level · string · optionnel · A | AA | AAA
    Highest WCAG conformance level to report. Default "AA" — Level AAA criteria are not reported. Pass "AAA" to include them (naming one AAA criterion in `wcag`, e.g. "3.2.5", also includes it).
  • rules · array · optionnel
    Only these rule ids (WebAbility type such as "missing_alt" or axe rule id such as "image-alt"). See get_rules.
  • format · string · optionnel · json | compact
    "compact" prints one line per element with rule metadata once. "json" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JSON summary of every count.
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • viewport · string · optionnel · desktop | tablet | mobile
    Viewport for live scans (default: desktop). Use the same viewport the baseline used.
  • currentId · string · optionnel
    scan_history id to use as the CURRENT side instead of scanning `url`
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • minImpact · string · optionnel · critical | serious | moderate | minor
    Only findings at this severity or above (critical > serious > moderate > minor)
  • baselineId · string · optionnel
    scan_history id of the BASELINE scan (local installs only)
  • baselineUrl · string · optionnel
    Scan this URL live as the baseline (e.g. production) — use when there is no stored baseline
  • rootSelector · string · optionnel
    CSS selector to limit live scans to (optional)
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "diff_scan", "arguments": {"url": "texte", "wcag": [], "level": "A", "rules": [], "format": "json", "context": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• flow_scan≈ 1056 tokens

  Scan a multi-page user journey. Walks startUrl plus the `autoNavigate` URLs sequentially (deterministic — one page fully rendered and scanned before the next), then returns ONE consolidated report with issues deduplicated across pages, each carrying the same fix payload as scan_page. Every requested URL gets an explicit outcome in `pages[]` (scanned / nav_failed / scan_failed / redirected_duplicate / duplicate_request / skipped_cap / blocked — bot-challenge, not a clean page) — a page is never silently dropped. Better than per-page scans for journeys (login → checkout etc). Without `autoNavigate` it scans only startUrl, exactly like scan_page. NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (`npx -y @webability/mcp`, simplest — nothing leaves the machine), or open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` together with the printed secret as `tunnel_secret`.

  Paramètres, retour & exemple (12)

  Paramètres

  • wcag · array · optionnel
    Only these WCAG criteria. A prefix selects the whole guideline ("1.4") or principle ("2").
  • level · string · optionnel · A | AA | AAA
    Highest WCAG conformance level to report. Default "AA" — Level AAA criteria are not reported. Pass "AAA" to include them (naming one AAA criterion in `wcag`, e.g. "3.2.5", also includes it).
  • rules · array · optionnel
    Only these rule ids (WebAbility type such as "missing_alt" or axe rule id such as "image-alt"). See get_rules.
  • format · string · optionnel · json | compact
    "compact" prints one line per element with rule metadata once. "json" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JSON summary of every count.
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • maxPages · number · optionnel
    Max pages to scan (default 10)
  • startUrl · string · requis
    Starting URL of the journey
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • minImpact · string · optionnel · critical | serious | moderate | minor
    Only findings at this severity or above (critical > serious > moderate > minor)
  • sourceRoot · string · optionnel
    Local project root (local installs only) for `sourceCandidates[]` on issues without a framework `source` pointer.
  • autoNavigate · array · optionnel
    The URLs to walk after startUrl, in order (the MCP server is headless and cannot discover a journey interactively). Omit or pass [] to scan only startUrl as a single page.
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "flow_scan", "arguments": {"startUrl": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• generate_ai_fix≈ 629 tokens

  Generate framework-aware fix alternatives for a specific accessibility issue. For color contrast issues, returns 3 alternatives (minimal, brand-aligned, high contrast); brand palette is auto-extracted from the live URL using our scanner if `brandColors` is omitted. For label/ARIA issues, returns 1-2 alternatives. Each alternative includes ready-to-paste code for the detected framework. NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (`npx -y @webability/mcp`, simplest — nothing leaves the machine), or open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` together with the printed secret as `tunnel_secret`.

  Paramètres, retour & exemple (8)

  Paramètres

  • url · string · optionnel
    Page URL — also used to auto-extract brand palette for contrast issues if `brandColors` is not provided.
  • html · string · requis
    The element's outerHTML — send at most ~600 chars
  • issue · object|string · requis
    Issue object from scan_page (with selector, wcag, impact, message, fix.currentValue), or a plain-text issue description
  • context · string · optionnel
    Parent element outerHTML for context (~400 chars)
  • framework · string · requis · tailwind | bootstrap | mui | wordpress | nextjs | plain-css
    CSS framework — use detect_framework first
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • brandColors · array · optionnel
    Brand palette for brand-aligned suggestions. If omitted on a contrast issue with a `url`, auto-extracted via the scanner.
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "generate_ai_fix", "arguments": {"html": "texte", "issue": {}, "framework": "tailwind"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_audit≈ 441 tokens

  Check an audit started with start_audit: returns overall status, per-step progress (scan → viewports → screenshots → agent → excel → publish), and — once complete — a severity summary plus short-lived download URLs for the report (JSON) and the Excel workbook. Poll every ~15s while status is pending/running. Only the account that started an audit can read it. Free with a WebAbility account.

  Paramètres, retour & exemple (3)

  Paramètres

  • id · number · requis
    The audit id returned by start_audit
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.

  Exemple d'appel

  {"name": "get_audit", "arguments": {"id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_install_snippet≈ 388 tokens

  Get the one-line script tag that installs the WebAbility accessibility widget. Put it in the <head> or before </body> of every page of a site added with add_site. The widget finds the site by its domain, so the same tag works on every site. No account needed.

  Paramètres, retour & exemple (2)

  Paramètres

  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.

  Exemple d'appel

  {"name": "get_install_snippet", "arguments": {"context": "texte", "llm_model": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_rules≈ 612 tokens

  List accessibility rules from both engines — axe-core (104) and the WebAbility detectors (90+) — with optional filters. Every rule carries `fixability` (mechanical | contextual | visual) and a `fix` op template, so you can pick the rules worth auto-fixing before scanning. Returns ruleId, engine, description, help, helpUrl, tags/wcag, fixability, fix.

  Paramètres, retour & exemple (6)

  Paramètres

  • rule · string · optionnel
    Only rules whose id contains these whole words (e.g. "link" → link-name, skip-link, not blink; "color-contrast"; case and -/_ insensitive). Also accepted: ruleId, id, query.
  • tags · array · optionnel
    axe tag filter (e.g. ["wcag2aa"], ["best-practice"], ["cat.aria"]; a category also works without "cat."). WebAbility rules match on their WCAG criterion tag (e.g. "wcag143"). An unknown tag or category is an error that lists the valid ones.
  • engine · string · optionnel · all | axe | webability
    Which engine's rules to list (default all)
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • fixability · string · optionnel · mechanical | contextual | visual
    Only rules of this fixability tier

  Exemple d'appel

  {"name": "get_rules", "arguments": {"rule": "texte", "tags": [], "engine": "all", "context": "texte", "llm_model": "texte", "fixability": "mechanical"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_sites≈ 378 tokens

  List the sites on the signed-in WebAbility account with each site id, plan tier and the date the current plan ends. Use it to check that a payment activated WebAbility Pro on a site. Needs a free WebAbility account.

  Paramètres, retour & exemple (2)

  Paramètres

  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.

  Exemple d'appel

  {"name": "list_sites", "arguments": {"context": "texte", "llm_model": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• scan_html≈ 918 tokens

  Scan a raw HTML snippet or component markup without serving it — IN-PROCESS by default (jsdom + WebAbility detectors + axe-core): milliseconds, no browser, no network, so it fits inside a tight edit loop. Fragments are auto-wrapped into a document. Returns scan_page's shape (issues / summary) with `fix.op` + `fixability` on every finding. jsdom has no layout, so visual-tier rules (contrast, target size, focus ring) are NOT evaluated — the dropped count is reported as `skippedVisual`; pass `engine: "browser"` to run the axe-core headless-browser path for those (slower, axe rules only, returns axe `violations`).

  Paramètres, retour & exemple (12)

  Paramètres

  • html · string · requis
    HTML content to test — a full document or a fragment
  • tags · array · optionnel
    WCAG tags to check (default ["wcag2a","wcag2aa","wcag21aa","wcag22aa"])
  • wcag · array · optionnel
    Only these WCAG criteria. A prefix selects the whole guideline ("1.4") or principle ("2").
  • level · string · optionnel · A | AA | AAA
    Highest WCAG conformance level to report. Default "AA" — Level AAA criteria are not reported. Pass "AAA" to include them (naming one AAA criterion in `wcag`, e.g. "3.2.5", also includes it).
  • rules · array · optionnel
    Only these rule ids (WebAbility type such as "missing_alt" or axe rule id such as "image-alt"). See get_rules.
  • width · number · optionnel
    Viewport width (browser engine only, default 1280)
  • engine · string · optionnel · in-process | browser
    "in-process" (default): jsdom, ms, structural rules. "browser": headless Chromium + axe-core, includes contrast.
  • format · string · optionnel · json | compact
    "compact" prints one line per element with rule metadata once. "json" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JSON summary of every count.
  • height · number · optionnel
    Viewport height (browser engine only, default 800)
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • minImpact · string · optionnel · critical | serious | moderate | minor
    Only findings at this severity or above (critical > serious > moderate > minor)

  Exemple d'appel

  {"name": "scan_html", "arguments": {"html": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• scan_page≈ 1105 tokens

  Scan a web page for WCAG accessibility issues. Works on any URL — deployed sites, localhost, staging. Returns `issues` (violations the scanner stands behind; findings the engines cannot decide are settled by the AI judge — a violation with a fix, or a pass recorded in `judged[]` with its reason — and anything unsettled is dropped, never listed for review) and a `summary`. On React ≤18 / Vue dev builds each issue carries `source` ({file, line, column, component}) read from the live component tree. Every issue carries a structured `fix.op` (add-attribute | set-attribute | remove-attribute | add-element | remove-element | add-text-content | suggest) with `fix.attribute` / `fix.value` when known, and a `fixability` tier (mechanical = apply as given; contextual = op known, value needs judgment; visual = needs rendered output, propose only). NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (`npx -y @webability/mcp`, simplest — nothing leaves the machine), or open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` together with the printed secret as `tunnel_secret`.

  Paramètres, retour & exemple (12)

  Paramètres

  • url · string · requis
    URL to scan (e.g. https://webability.io or http://localhost:3000)
  • wcag · array · optionnel
    Only these WCAG criteria. A prefix selects the whole guideline ("1.4") or principle ("2").
  • level · string · optionnel · A | AA | AAA
    Highest WCAG conformance level to report. Default "AA" — Level AAA criteria are not reported. Pass "AAA" to include them (naming one AAA criterion in `wcag`, e.g. "3.2.5", also includes it).
  • rules · array · optionnel
    Only these rule ids (WebAbility type such as "missing_alt" or axe rule id such as "image-alt"). See get_rules.
  • format · string · optionnel · json | compact
    "compact" prints one line per element with rule metadata once. "json" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JSON summary of every count.
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • viewport · string · optionnel · desktop | tablet | mobile
    Viewport size (default: desktop)
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • minImpact · string · optionnel · critical | serious | moderate | minor
    Only findings at this severity or above (critical > serious > moderate > minor)
  • sourceRoot · string · optionnel
    Local project root (local installs only). Issues without a framework `source` pointer get `sourceCandidates[]` — files whose contents match the selector's id/class/attribute tokens.
  • rootSelector · string · optionnel
    CSS selector to limit scan scope (optional)
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "scan_page", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• start_audit≈ 729 tokens

  Kick off a FULL accessibility audit deliverable for a URL — a persistent, timestamped artifact, not an inline scan. Runs the server-side pipeline (axe + advanced checks + mobile viewports + annotated screenshots + optional agent spot-check) and produces a downloadable report and a formatted Excel workbook (Cover / Status / Barriers / ADA context sheets) stored durably. Returns immediately with an audit `id`; poll `get_audit` for progress and, when complete, download URLs. Use this when someone needs a durable artifact to attach as evidence of testing effort for a compliance officer or legal response — for iterating on code, use scan_page + verify_fix instead. Needs a free WebAbility account (sign in by connecting https://mcp.webability.io/mcp/auth, or run `webability login`). Set includeAgent:true to add the slower agentic manual-audit pass. To audit a local dev server, open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` with the printed secret as `tunnel_secret`; keep the tunnel open until get_audit reports complete (about 5 minutes) — the pipeline loads the page several times.

  Paramètres, retour & exemple (5)

  Paramètres

  • url · string · requis
    URL to audit (a public/staging URL the server can reach, or a webability-tunnel URL — not localhost)
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • includeAgent · boolean · optionnel
    Also run the agentic manual-audit pass (keyboard/focus/modal exploration). Slower. Default false.
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "start_audit", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_fix≈ 984 tokens

  Re-scan a specific element after applying an accessibility fix and confirm the violation is gone. After you edit the code and serve it (deployed, staging, or http://localhost:3000), call this with the URL and the selector you fixed to get a machine-checked verified: true|false (DOM engines only — visual_audit findings are out of scope). Pass the WCAG criterion (e.g. "1.1.1") or axe rule id (e.g. "color-contrast") to check just that criterion; omit it to require the element be clean of ALL violations. A blocked page (bot-challenge / HTTP error) is reported as unverified, never a pass — verification fails closed. verified: true is only returned when the selector matched at least one element AND the criterion is one the DOM engines check; if the selector matches no element the result is verified: false with reason "not-found" ("selector matched no elements"), a criterion outside the coverage set returns reason "not-verifiable" ("not checked by any WebAbility tool"); a finding in scope that only the AI judge can settle, when the judge did not run or gave no verdict, also returns "not-verifiable", and shadow-DOM (>>>) / iframe selectors return "unsupported-selector" — pass the element's current selector, or re-run scan_page if your fix removed the element. Pair with scan_page → generate_ai_fix → verify_fix for a full find-fix-verify cycle. NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (`npx -y @webability/mcp`, simplest — nothing leaves the machine), or open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` together with the printed secret as `tunnel_secret`.

  Paramètres, retour & exemple (7)

  Paramètres

  • url · string · requis
    URL now serving the fix (deployed, staging, or http://localhost:3000). Also accepted as `page` or `pageUrl`.
  • wcag · string · optionnel
    Optional: WCAG criterion (e.g. "1.1.1", "1.4.3") or axe rule id (e.g. "color-contrast") to verify specifically. Omit to require the element be free of ALL violations.
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • selector · string · requis
    CSS selector of the element you fixed — use the `selector` from the original scan_page issue
  • viewport · string · optionnel · desktop | tablet | mobile
    Viewport size (default: desktop). Use the same viewport the issue was found at.
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "verify_fix", "arguments": {"url": "texte", "selector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• visual_audit≈ 719 tokens

  Pixel-level accessibility audit using Claude vision. Catches issues that DOM scanners miss: icon contrast (1.4.11), focus visibility (2.4.7), "looks like a button but isn't" (4.1.2), text rendered as images (1.4.5), visual hierarchy mismatches. Takes a URL, opens it in a headless browser, screenshots, and runs vision-based detection. Complements scan_page — run both for full coverage. Sign in with a free WebAbility account for vision and full audits (sign in by connecting https://mcp.webability.io/mcp/auth, or run `webability login`). Fair-use rate limits apply. NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (`npx -y @webability/mcp`, simplest — nothing leaves the machine), or open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` together with the printed secret as `tunnel_secret`.

  Paramètres, retour & exemple (7)

  Paramètres

  • url · string · requis
    URL to audit visually
  • context · string · optionnel
    Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
  • fullPage · boolean · optionnel
    Capture full scrolled page instead of just viewport (default: false)
  • viewport · string · optionnel · desktop | tablet | mobile
    Viewport size (default: desktop)
  • llm_model · string · optionnel
    The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
  • brandColors · array · optionnel
    Brand hex colors for context-aware filtering
  • tunnel_secret · string · optionnel
    Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

  Exemple d'appel

  {"name": "visual_audit", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.webability.io/mcp