Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

OverlayQA

NPM · @OVERLAYQA/MCP · 2 COMPONENTS

Run accessibility, contrast, and design token audits and file QA issues from your AI coding tool.

0 this week 75 Trust /100

Last scanned (17 hours ago)

Scores higher than 51% of npm servers

Category Testing and QA

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 32 of 103 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability66
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 6887 tokens (~163/item across 42 items; 42 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management95
  • Stability check failed: the tool surface changed between 0.2.0 and 0.7.0: 0 tool removals, 1 breaking changes, 32 additions. See how to fix → Fail
Tool Coverage95
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 84% of tool parameters carry a description.Partial
Tool Safety83
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 1 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_comment" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Partial
  • An AI judge read all 43 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 25 Oct 26 0
    • Security disclosure: unverified → fail ▼ functional
  • 24 Oct 26 +10
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
    • Malware scan: unverified → pass ▲ security
    • Security disclosure: fail → unverified ▼ functional
  • 23 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Schema quality: 5340 → 6887 ▼ functional
    • Tool coverage: 93% → 84% ▼ functional
    • Destructive annotations: 0% → 33% ▲ functional
    • Schema quality: excellent → good functional
    • Package version: 0.6.0 → 0.7.0 functional
  • 21 Oct 26 +5
    • Malware scan: pass → unverified ▼ security
    • Source repository: fail → pass ▲ security
    • Package version: 0.5.0 → 0.6.0 functional
  • 19 Oct 26 −1
    • Stability: pass → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Stability: pass → fail ▼ security
    • Schema quality: 4848 → 5340 ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Stability: pass → 0.97 functional
    • Package version: 0.4.1 → 0.5.0 functional
  • 18 Oct 26 0
    • Package version: 0.4.0 → 0.4.1 functional
  • 17 Oct 26 +2
    • Stability: 0.87 → pass security
  • 15 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/@overlayqa/mcp@0.7.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 103 packages
Packages resolved 103
Stale 32
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 42 exposed · ~6,765 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
audit_tokens ~163

Audit a live URL's design-system token usage. Returns a 0-100 token-health score plus findings (inconsistent font sizes, text colors, spacing, font families, border radii) with severity and evidence. Audits the live page only; the figmaFileKey argument is accepted but Figma comparison is not yet available via MCP.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
figmaFileKeystring–Optional Figma file key for token comparison
urlstringyesThe URL to audit for design token usage

No output schema declared.

No examples provided.

compare_visual ~259

Start AI visual comparison of a public page against a Figma frame, saved design or uploaded image. Supply reference, or both figmaFileKey and figmaNodeId. Captures at the design’s authored width. Optional measureSpacing adds supported element measurements and tolerances. Uses your scan allowance and returns a persistent job ID; results include individual differences and screenshot evidence. Does not create issues or provide a deterministic pixel-difference build gate.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
figmaFileKeystring–Figma file key; use with figmaNodeId instead of reference
figmaNodeIdstring–Figma frame node ID
measureSpacingboolean–Include supported element measurements and layout tolerances
projectIdstringyesReadable project UUID
reference––Figma, saved design, or uploaded image reference
requestIdstringyesNew UUID for this review; reuse after a lost response
urlstringyesPublic page URL

No output schema declared.

No examples provided.

create_client_review ~329

Create a public client review link for a website in a writable project, optionally with a title, client emails, welcome note and private guest comments. Snapshot mode starts asynchronous capture; read list_client_reviews for readiness. New client emails may receive an invitation and automatic day 3/7/10 reminders. Requires explicit intent to share and, when emails are supplied, invite those people. If invitationsEnabled is false, addresses are saved but not sent and may be invited when delivery is enabled. Inspect invites for per-address sent/skipped results. After a lost response, list links before creating again to avoid duplicates.

NameTypeReqDescription
allowResponsiveViewsboolean––
clientEmailsarray–Complete client email list. Existing addresses keep their invitation and reminder history; omitted addresses are removed.
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
expiresAtstring–Expiry as an ISO-8601 UTC instant
modestringyes–
pageUrlstringyes–
privateCommentsboolean–When true, each guest sees only their own comments; teammates can see all comments
projectIdstringyesProject UUID from list_projects
titlestring––
viewportHeightinteger––
viewportWidthinteger––
welcomeNotestring–Optional note shown to guests at the top of the review

No output schema declared.

No examples provided.

create_comment ~236

Post a comment with explicit audience (Team only or Team and clients), optional teammate mentions and PNG/JPG/PDF files. Reuse requestId when retrying the same submission after a lost response.

NameTypeReqDescription
attachmentsarray–Optional attachments; at most 10 MiB total. Server validates file bytes.
contentstringyesComment text; may be empty when attaching files
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID or display id such as OQ-12
mentionedUserIdsarray–Teammate userIds from list_project_members. In content, use @[userId] for each mention.
requestIdstringyesNew UUID for this comment. Reuse it only when retrying the same comment after an uncertain response, to avoid duplicates.
visibilitystringyesinternal = Team only; public = Team and clients

No output schema declared.

No examples provided.

create_issue ~183

Create an issue in an OverlayQA project. Title is required; severity, type, and description default to medium / general / empty. Assignee defaults to you; pass null for Unassigned.

NameTypeReqDescription
assigneeId––Teammate userId from list_project_members; null means Unassigned; omitted assigns to you
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
descriptionstring–Issue description
projectIdstringyesProject to create the issue in
severitystring–Issue severity (default: medium)
titlestringyesIssue title
typestring–Issue type (default: general)

No output schema declared.

No examples provided.

create_label ~121

Create a reusable workspace label. Editors can create labels; retries and case-insensitive duplicate names return the existing label. Apply it with set_issue_label.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
namestringyesLabel name, shared across the workspace
projectIdstringyesA project in the workspace whose labels to use

No output schema declared.

No examples provided.

create_project ~103

Create a new OverlayQA project. Returns the project id, name, slug, displayPrefix, and url.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
namestringyesProject name
urlstring–Primary URL for this project

No output schema declared.

No examples provided.

create_review_issues ~174

File selected findings from your completed MCP Auto Review or visual comparison in its original project. Preserves saved images, page, captured context and fix guidance without scanning again. Repeating the same job and indexes recovers existing issues; inspect every finding outcome for partial completion. Old jobs without retained page provenance cannot be filed.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
findingIndexesarrayyesZero-based indexes in result.findings (Auto Review) or result.diffs (comparison). Only explicitly selected findings are filed.
jobIdstringyesCompleted MCP Auto Review or visual comparison job ID

No output schema declared.

No examples provided.

create_scheduled_review ~162

Create a recurring public-page review with the same plan limits and cadence as the dashboard. Enables future scans and review emails. A lost response can be recovered by listing schedules; the same project, page and scan type cannot have duplicate schedules.

NameTypeReqDescription
cadencestringyes–
confirmLoginPageboolean–True only when the user explicitly wants to review the sign-in page itself
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
projectIdstringyes–
scanTypestringyes–
urlstringyes–

No output schema declared.

No examples provided.

delete_comment ~117

Delete your own native comment and its attached files. This also removes it from client-visible discussions when its audience was public.

NameTypeReqDescription
commentIdstringyesNative comment UUID from list_comments
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID or display id such as OQ-12

No output schema declared.

No examples provided.

delete_label ~117

Delete a label from the workspace and all its issues. Requires workspace owner or admin permission. Issues themselves are retained.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
labelIdstringyesLabel id returned by list_labels or create_label
projectIdstringyesA project in the workspace whose labels to use

No output schema declared.

No examples provided.

delete_scheduled_review ~89

Delete a scheduled review and stop its future scans and emails. Does not delete filed project issues.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
scheduleIdstringyes–

No output schema declared.

No examples provided.

export_issues ~170

Export existing issues with their captured evidence and discussion to an explicitly chosen connected tracker destination. Uses the same product export and retry handlers. Inspect every result: pending or partial attachment delivery is not success. Read the saved export status after uncertain outcomes before retrying.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
destinationobjectyesExplicit destination fields from the destination discovery results; no first/default destination is selected
issueIdsarrayyes–
metadataobject–Optional destination fields from the provider schema, such as status or assignee
providerstringyes–

No output schema declared.

No examples provided.

get_comment_attachment ~135

Read a native comment attachment as filename and base64 bytes. Uses the same issue permissions as reading comments. Attachment IDs come from list_comments.

NameTypeReqDescription
attachmentIdstringyesAttachment UUID from list_comments
commentIdstringyesNative comment UUID from list_comments
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID or display id such as OQ-12

No output schema declared.

No examples provided.

get_issue ~153

Read a complete issue by UUID or display id: description, labels, assignee, ignored state, screenshot URLs, captured element/CSS and viewport evidence, its comments (the same discussion list_comments returns), and latestVerification (the newest saved check, or null). Read get_issue_verifications for history; issue status and notDetectedAt alone do not prove a fix.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID or display id such as OQ-12

No output schema declared.

No examples provided.

get_issue_export_status ~121

Read persisted export destinations, attachment delivery and the latest recorded sync success/error for an issue. Does not contact trackers or force a sync. Missing or stale sync evidence is not proof of a current round trip; unsupported fields are reported.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID or display ID

No output schema declared.

No examples provided.

get_issue_verifications ~143

Read the latest 50 saved verification results for an issue, newest first. Includes verdicts, explanations, confidence, after-screenshot URLs, capture context, and timestamps. This does not run a new check. An issue status of verified or a no-longer-detected flag alone is not a verification pass.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID or display id such as OQ-12

No output schema declared.

No examples provided.

get_review_result ~127

Read a previously started review without starting or charging for another run. Returns running progress, failed details, or the complete Auto Review or visual-comparison findings and evidence. Results are retained for 24 hours by default and require access to the original project and workspace.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
jobIdstringyesReview job ID returned at start

No output schema declared.

No examples provided.

get_scheduled_review_result ~142

Read the latest retained scheduled-review findings and evidence without rescanning, or poll a specific run by requestId. An empty result before the first successful run is not a clean scan. No longer detected, ignored and already filed are not proof that an issue was fixed.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
requestId––Optional run request ID to read that run without starting another scan
scheduleIdstringyes–

No output schema declared.

No examples provided.

list_client_reviews ~157

List a project’s client review links, share URLs, titles, capture status, expiry, visits, comments, doneReviewers and clients. Each client includes invitedAt, inviteFailed, lastReminderAt, done, commented and unsubscribed. Done reviewing means that reviewer finished giving feedback, not that issues are fixed or that every client is done. invitationsEnabled reports the delivery switch; reminders follow the existing automatic schedule.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
projectIdstringyesProject UUID from list_projects

No output schema declared.

No examples provided.

list_comments ~109

Read an issue discussion, including comment authors, audience, mentions and attachment metadata. Returns native and linked comments; edit/delete accept native comment IDs only.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID or display id such as OQ-12

No output schema declared.

No examples provided.

list_export_connections ~94

List your connected issue trackers and reconnect requirements without exposing credentials. A connection does not prove export delivery or working two-way sync. Connect or reconnect in OverlayQA first.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…

No output schema declared.

No examples provided.

list_export_destinations ~162

Discover and read destination choices for a connected tracker. Omit collection to learn its available collections and required parameters. Read choices before exporting; use schema collections for required destination fields. Does not create tasks or connect accounts.

NameTypeReqDescription
accountId–––
cloudId–––
collectionstring–Omit to discover allowed collections and required parameters; use the returned collection name to list choices
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueTypeId–––
parentId–––
providerstringyes–

No output schema declared.

No examples provided.

list_issues ~535

List project issues with labels, description, ownership and ignored state. notDetectedAt records when a scan stopped detecting the issue; lastDetectedAt records a detection. Neither proves a fix. Use notDetected to filter the flag. Filter by status, severity, type, labels, assignee, creator, page (pageUrl), or active/finished/ignored state, and use createdAfter to ask only for issues newer than the last one seen. Each issue carries source (client means a reviewer filed it on a share link), commentCount, lastCommentAt and lastCommentBy (reviewer or team): an issue still needs a reply when source is client and commentCount is 0, or lastCommentBy is reviewer. Returns page, pageSize, total and hasMore; continue to the next page while hasMore is true. Use get_issue for full capture evidence and the discussion.

NameTypeReqDescription
assigneeId––Filter by teammate userId, me, or unassigned
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
createdAfterstring–Only issues created after this ISO-8601 instant with a zone, such as 2026-10-05T22:00:00Z. Pass the createdAt of the newest issue already seen to ask for what is new.
createdById––Filter by creator userId or me
labelIdsarray–Match any selected label, or unlabeled
notDetectedboolean–true: only issues flagged No longer detected; false: issues without that flag, including those never checked. This flag is not proof of a fix. Combines with state and status.
pageinteger–Page number, starting at 1; use hasMore to continue
pageSizeinteger–Issues per page, up to 100 (default 100)
pageUrlstring–Only issues captured on this page URL, as returned in pageUrl. The query string is ignored.
projectIdstringyesProject to list issues from
severity––One or more severities
statestring–Default all. Active means open/in-progress and not ignored. Finished means resolved/verified/closed and not ignored. Ignored is separate from status.
status––One or more statuses; combines with state
type––One or more issue types

No output schema declared.

No examples provided.

list_labels ~108

List the workspace label library and your write/manage permissions. Optionally include an issue UUID to see its assigned labels.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstring––
projectIdstringyesA project in the workspace whose labels to use

No output schema declared.

No examples provided.

list_project_members ~100

List workspace teammates for a readable project. Use their userId for assignment and comment mentions. Returns the signed-in userId too.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
projectIdstringyesProject UUID from list_projects

No output schema declared.

No examples provided.

list_projects ~71

List all OverlayQA projects in the authenticated user's team.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…

No output schema declared.

No examples provided.

list_scheduled_reviews ~91

List readable scheduled reviews in this workspace, including cadence, pause state, next run and latest saved result summary. Does not scan or send email.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…

No output schema declared.

No examples provided.

move_issue ~127

Move an issue into another project in the same workspace, preserving its identity, comments and evidence. Requires write access to both projects. Returns its new display id; use that id afterward.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesStable issue UUID from get_issue or list_issues
targetProjectIdstringyesDestination project UUID

No output schema declared.

No examples provided.

rename_label ~135

Rename a label throughout its workspace. Requires workspace owner or admin permission. Assignments are preserved; existing shared reports keep their original names.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
labelIdstringyesLabel id returned by list_labels or create_label
namestringyesLabel name, shared across the workspace
projectIdstringyesA project in the workspace whose labels to use

No output schema declared.

No examples provided.

run_auto_review ~192

Start Auto Review of a public page in a readable project. Uses your scan allowance and the project’s review settings, ignored findings and already-filed issues. Returns a persistent job ID; results include findings, scores, AI status and screenshot evidence. Does not create issues. Login-required pages need the browser extension.

NameTypeReqDescription
breakpointLabelstring–Optional label, such as Desktop or Mobile
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
projectIdstringyesReadable project UUID
requestIdstringyesNew UUID for this review; reuse after a lost response
urlstringyesPublic page URL
viewportobject–Browser viewport in CSS pixels

No output schema declared.

No examples provided.

run_scheduled_review ~167

Run an active scheduled review now using its existing settings and the dashboard run-now path. Uses scan resources; Run now does not send email. Request IDs and run results are retained for 24 hours. Reuse requestId after a lost response; poll the saved run with the same scheduleId and requestId. Does not resume paused schedules.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
requestIdstringyesNew UUID for a run; reuse after a lost response. Use this same ID when polling the saved run.
scheduleIdstringyes–

No output schema declared.

No examples provided.

scan_accessibility ~132

Run an accessibility audit on a URL. Returns WCAG violations with severity, descriptions, and an overall score. Scans one page per call. Free plans include 3 scans per day; Pro is unlimited.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
projectIdstring–Optional project ID to associate results with
urlstringyesThe URL to scan for accessibility issues

No output schema declared.

No examples provided.

scan_and_create_issues ~158

Run an accessibility scan on a URL and automatically create issues in the given project for each violation at or above the minimum severity. Returns scan summary + issue IDs created. Scans one page per call. Free plans include 3 scans per day; Pro is unlimited.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
minSeveritystring–Minimum severity to create issues for (default: medium)
projectIdstringyesProject to create issues in
urlstringyesThe URL to scan

No output schema declared.

No examples provided.

scan_contrast ~117

Run a color contrast audit on a URL. Returns elements failing WCAG contrast ratios with severity and details. Scans one page per call. Free plans include 3 scans per day; Pro is unlimited.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
urlstringyesThe URL to scan for color contrast issues

No output schema declared.

No examples provided.

set_client_review_recipients ~222

Replace a client review link’s COMPLETE client email list. Requires explicit intent to invite or remove these people. New addresses may receive an invitation and automatic day 3/7/10 reminders; retained addresses keep their history and are not invited again. Removed addresses stop reminders; an empty list removes all recipients but leaves the public link working. If invitationsEnabled is false, addresses are saved for later delivery. Read clients and invites for actual per-address state. Reminders stop after that address comments, marks done, unsubscribes, or the link expires/is revoked.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
emailsarrayyesComplete client email list. Existing addresses keep their invitation and reminder history; omitted addresses are removed.
reviewIdstringyesClient review UUID from list_client_reviews; not the public link token

No output schema declared.

No examples provided.

set_issue_label ~131

Apply (applied=true) or remove (applied=false) one workspace label on an issue. Other labels and issue text remain unchanged. Safe to retry.

NameTypeReqDescription
appliedbooleanyes–
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID from list_issues
labelIdstringyesLabel id returned by list_labels or create_label

No output schema declared.

No examples provided.

update_client_review ~160

Change a client review link’s expiry or responsive previews, or revoke/restore access. Supply only fields to change. Revoked or expired links stop scheduled reminders. This does not mark a reviewer done or change issue status.

NameTypeReqDescription
allowResponsiveViewsboolean––
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
expiresAtstring–Expiry as an ISO-8601 UTC instant
reviewIdstringyesClient review UUID from list_client_reviews; not the public link token
revokeboolean––

No output schema declared.

No examples provided.

update_comment ~160

Edit your own native comment text and mention list. Audience and attached files stay unchanged. Supply the complete mention list, including retained mentions.

NameTypeReqDescription
commentIdstringyesNative comment UUID from list_comments
contentstringyesReplacement comment text
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID or display id such as OQ-12
mentionedUserIdsarrayyesTeammate userIds from list_project_members. In content, use @[userId] for each mention.

No output schema declared.

No examples provided.

update_issue ~254

Update issue status, title, description, severity, type, assignee, or ignored state. Only supplied fields change. Use null to unassign and ignored=false to restore. Accepts UUID or display id. Status verified does not run a verification scan. Use verify_issue to check a deployed fix, then inspect its evidence before deciding whether to change status.

NameTypeReqDescription
assigneeId––Teammate userId from list_project_members, or null to unassign
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
descriptionstring–Replacement description, or empty to clear
ignoredboolean–Ignore (true) or restore (false), without changing status
issueIdstringyesIssue UUID or display id such as OQ-12
severitystring–New severity
statusstring–New status; marking verified records a status, it does not run verification
titlestring–Replacement title
typestring–New issue type

No output schema declared.

No examples provided.

update_scheduled_review ~125

Pause, resume, or change a scheduled review cadence. Supply exactly one of action or cadence. Resuming enables future scans and review emails; plan and project permissions still apply. Pausing keeps previous results.

NameTypeReqDescription
actionstring––
cadencestring––
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
scheduleIdstringyes–

No output schema declared.

No examples provided.

verify_issue ~214

Check whether a resolved, verified, or closed issue is fixed on its public page. Uses the existing capture and verification engine and your verification allowance. Requires an original screenshot and a verifiable issue type. Returns the saved verdict, explanation, confidence, and after-screenshot evidence; passed_with_caveat, failed, inconclusive, and error are not an unconditional pass. Does not change issue status. Login-required and localhost pages need the browser extension. Reuse requestId only when retrying the same check after a lost response. Availability follows the verification rollout.

NameTypeReqDescription
contextstring–One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe…
issueIdstringyesIssue UUID or display id such as OQ-12
requestIdstringyesNew UUID per verification; reuse to retry the same check without creating another result

No output schema declared.

No examples provided.

Install

How do I install the OverlayQA MCP server?

OverlayQA runs locally as an npm package, launched with npx -y @overlayqa/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @overlayqa/mcp

# add to Claude Code
claude mcp add com-overlayqa-mcp -- npx -y @overlayqa/mcp
Common questions

What is the OverlayQA MCP server?

OverlayQA is an MCP server listed in the public MCP registry as com.overlayqa/mcp. Run accessibility, contrast, and design token audits and file QA issues from your AI coding tool. This page covers its npm package (@overlayqa/mcp).

Is the OverlayQA MCP server safe to use?

OverlayQA scores 75 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the OverlayQA MCP server expose?

OverlayQA exposes 42 tools: create_review_issues, list_scheduled_reviews, create_scheduled_review, update_scheduled_review, delete_scheduled_review, and 37 more. Their descriptions and schemas cost roughly 6,765 tokens of context every time the server is loaded.

Is the OverlayQA MCP server still maintained?

OverlayQA is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the OverlayQA MCP server under?

OverlayQA declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.