{
  "markdown": "# wcagc-mcp\n\n[![WCAG-Compliance/wcagc-mcp MCP server](https://glama.ai/mcp/servers/WCAG-Compliance/wcagc-mcp/badges/score.svg)](https://glama.ai/mcp/servers/WCAG-Compliance/wcagc-mcp)\n[![smithery badge](https://smithery.ai/badge/wcag-compliance/wcagc-mcp)](https://smithery.ai/servers/wcag-compliance/wcagc-mcp)\n\nAn [MCP](https://modelcontextprotocol.io) server that lets an AI assistant (Claude, ChatGPT, or\nany MCP-compatible client) run real, deterministic accessibility scans through\n[wcagc](https://wcagc.com) — axe-core under the hood, not an LLM guess. Every scan result carries\nan explicit coverage disclaimer and never claims \"compliant\": automated testing finds only a\nportion of accessibility barriers, and this tool says so in every response.\n\nThis package is a **thin, stateless adapter**. It holds no database, no scan logic, and no\nsecrets beyond the wcagc API base URL — it translates MCP tool calls into HTTP calls against the\nwcagc API and forwards the caller's own bearer. All authentication, entitlements, quotas, and\nscan orchestration live in the API; this code is safe to read end to end.\n\n## Two ways to run it\n\n**Local (stdio)** — for Claude Desktop, Cursor, or any MCP client that spawns a local process:\n\n```bash\nnpx @wcagc/mcp\n```\n\nConfigure your MCP client with:\n\n```json\n{\n  \"mcpServers\": {\n    \"wcagc\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@wcagc/mcp\"],\n      \"env\": {\n        \"WCAGC_MCP_KEY\": \"<your mcp:scan API key>\"\n      }\n    }\n  }\n}\n```\n\nMint an `mcp:scan` key from your wcagc account under Settings → API keys — available on every\nplan, with a daily quota on Free/Starter and unlimited on Pro/Agency.\n\n**Hosted (Streamable HTTP + managed OAuth)** — what Claude web/desktop/mobile connectors and\nChatGPT use, since neither runs a local process for you. Add this remote MCP connector:\n\n```\nhttps://mcp.wcagc.com/mcp\n```\n\nThe client discovers `/.well-known/oauth-protected-resource/mcp`, opens the wcagc login/consent\nflow, and binds the connection to one Organization. No key copy/paste is required. API-key bearer\nauthentication remains supported for local stdio and CI.\n\nChatGPT availability depends on the ChatGPT plan and on whether the client permits action tools;\n`scan_url` creates a scan and is not a read-only operation. See\n[wcagc.com/integrations/mcp](https://wcagc.com/integrations/mcp).\n\n## Tools\n\n| Tool | Plan | What it does |\n|---|---|---|\n| `scan_url` | all | Scan any public URL, or a registered site for full tracking (Pro+). |\n| `check_pdf` | all | Run a PDF/UA-1 structure check on a public PDF. |\n| `get_scan` · `get_findings` | all | Read a `scan_url` scan's status, severity counts, and findings — either kind, recorded or one-off. |\n| `list_sites` | Pro+ | List the account's registered sites. |\n| `scan_site` | Pro+ | Crawl and scan every reachable page of a registered site. |\n| `get_run` · `get_run_findings` | Pro+ | Read a full-site run from `scan_site`. |\n| `get_root_causes` | Pro+ | Group a run's repeated DOM patterns and return factual element/page blast radius. |\n| `run_journey` | Pro+ | Replay a saved multi-step journey and check each step. |\n| `get_trends` | Pro+ | Read a site's violation-count history over time. |\n\nOne id, one poll tool: whatever `scan_url` did with a URL, `get_scan` and `get_findings` read it\nback. `get_run` and `get_run_findings` are only for full-site runs from `scan_site`.\n\nEvery scan-producing tool returns the coverage disclaimer in both the text content and the\nstructured content. There is no score, grade, or conformance verdict — automated testing finds\nroughly 30–57% of accessibility issues, and the remainder needs manual review.\n\n## Configuration\n\n| Env var | Used by | Meaning |\n|---|---|---|\n| `WCAGC_API_BASE_URL` | both | The wcagc API to call. Defaults to `https://api.wcagc.com`; set it only when self-hosting. |\n| `WCAGC_MCP_KEY` | stdio | Your `mcp:scan` API key. |\n| `PORT` | hosted | Port to listen on (default `8080`). |\n| `WCAGC_MCP_ALLOWED_HOSTS` | hosted | Comma-separated Host-header allowlist (DNS-rebinding protection when bound to `0.0.0.0`). |\n| `WCAGC_MCP_INTROSPECT_TTL_SECONDS` | hosted | How long a verified bearer is cached before re-checking with the API (default `60`). |\n| `WCAGC_MCP_OAUTH_ISSUER` | hosted | Expected OAuth issuer (defaults to `WCAGC_API_BASE_URL`). |\n| `WCAGC_MCP_OAUTH_JWKS_URL` | hosted | Authorization Server public JWKS URL. |\n| `WCAGC_MCP_URL` | hosted | Canonical RFC 9728 protected-resource URL (defaults to `https://mcp.wcagc.com/mcp`). |\n| `WCAGC_MCP_JWKS_TTL_SECONDS` | hosted | JWKS cache TTL; an unknown `kid` triggers an immediate refetch. |\n| `WCAGC_OPENAI_APPS_CHALLENGE` | hosted | OpenAI Plugins Directory domain-verification token; keep it in the deployment secret store, never in source. |\n\n## Development\n\n```bash\nnpm install\nnpm run dev        # hosted, watch mode\nnpm run start:stdio # stdio mode\nnpm run typecheck\nnpm run verify      # node:test against a local fixture API\n```\n\n## License\n\nMIT — see [LICENSE](./LICENSE).\n",
  "bytes": 5016,
  "sha": "a6cc2f8a18074a414c442fd36ba27f56245dcfe0596eb7804d96b185d7c29233",
  "repo_slug": "wcag-compliance/wcagc-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_wcag_compliance_mcp_a35c6fcb/readme"
}