OverlayQA
NPM · @OVERLAYQA/MCP · 2 COMPONENTS
Run accessibility, contrast, and design token audits and file QA issues from your AI coding tool.
Available components
Last scanned (17 hours ago)
Scores higher than 51% of npm servers
Category Testing and QA
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 32 of 103 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 12 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability66
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 6887 tokens (~163/item across 42 items; 42 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management95
- Stability check failed: the tool surface changed between 0.2.0 and 0.7.0: 0 tool removals, 1 breaking changes, 32 additions. See how to fix → Fail
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 84% of tool parameters carry a description.Partial
Tool Safety83
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 1 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_comment" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Partial
- An AI judge read all 43 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 24 Oct 26 +10
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Security disclosure: fail → unverified ▼ functional
- 23 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Schema quality: 5340 → 6887 ▼ functional
- Tool coverage: 93% → 84% ▼ functional
- Destructive annotations: 0% → 33% ▲ functional
- Schema quality: excellent → good functional
- Package version: 0.6.0 → 0.7.0 functional
- 21 Oct 26 +5
- Malware scan: pass → unverified ▼ security
- Source repository: fail → pass ▲ security
- Package version: 0.5.0 → 0.6.0 functional
- 19 Oct 26 −1
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: pass → fail ▼ security
- Schema quality: 4848 → 5340 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: pass → 0.97 functional
- Package version: 0.4.1 → 0.5.0 functional
- 18 Oct 26 0
- Package version: 0.4.0 → 0.4.1 functional
- 17 Oct 26 +2
- Stability: 0.87 → pass security
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/@overlayqa/mcp@0.7.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 103 packages
| Packages resolved | 103 |
|---|---|
| Stale | 32 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
audit_tokens ~163
Audit a live URL's design-system token usage. Returns a 0-100 token-health score plus findings (inconsistent font sizes, text colors, spacing, font families, border radii) with severity and evidence. Audits the live page only; the figmaFileKey argument is accepted but Figma comparison is not yet available via MCP.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| figmaFileKey | string | – | Optional Figma file key for token comparison |
| url | string | yes | The URL to audit for design token usage |
No output schema declared.
No examples provided.
compare_visual ~259
Start AI visual comparison of a public page against a Figma frame, saved design or uploaded image. Supply reference, or both figmaFileKey and figmaNodeId. Captures at the design’s authored width. Optional measureSpacing adds supported element measurements and tolerances. Uses your scan allowance and returns a persistent job ID; results include individual differences and screenshot evidence. Does not create issues or provide a deterministic pixel-difference build gate.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| figmaFileKey | string | – | Figma file key; use with figmaNodeId instead of reference |
| figmaNodeId | string | – | Figma frame node ID |
| measureSpacing | boolean | – | Include supported element measurements and layout tolerances |
| projectId | string | yes | Readable project UUID |
| reference | – | – | Figma, saved design, or uploaded image reference |
| requestId | string | yes | New UUID for this review; reuse after a lost response |
| url | string | yes | Public page URL |
No output schema declared.
No examples provided.
create_client_review ~329
Create a public client review link for a website in a writable project, optionally with a title, client emails, welcome note and private guest comments. Snapshot mode starts asynchronous capture; read list_client_reviews for readiness. New client emails may receive an invitation and automatic day 3/7/10 reminders. Requires explicit intent to share and, when emails are supplied, invite those people. If invitationsEnabled is false, addresses are saved but not sent and may be invited when delivery is enabled. Inspect invites for per-address sent/skipped results. After a lost response, list links before creating again to avoid duplicates.
| Name | Type | Req | Description |
|---|---|---|---|
| allowResponsiveViews | boolean | – | – |
| clientEmails | array | – | Complete client email list. Existing addresses keep their invitation and reminder history; omitted addresses are removed. |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| expiresAt | string | – | Expiry as an ISO-8601 UTC instant |
| mode | string | yes | – |
| pageUrl | string | yes | – |
| privateComments | boolean | – | When true, each guest sees only their own comments; teammates can see all comments |
| projectId | string | yes | Project UUID from list_projects |
| title | string | – | – |
| viewportHeight | integer | – | – |
| viewportWidth | integer | – | – |
| welcomeNote | string | – | Optional note shown to guests at the top of the review |
No output schema declared.
No examples provided.
create_comment ~236
Post a comment with explicit audience (Team only or Team and clients), optional teammate mentions and PNG/JPG/PDF files. Reuse requestId when retrying the same submission after a lost response.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | – | Optional attachments; at most 10 MiB total. Server validates file bytes. |
| content | string | yes | Comment text; may be empty when attaching files |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID or display id such as OQ-12 |
| mentionedUserIds | array | – | Teammate userIds from list_project_members. In content, use @[userId] for each mention. |
| requestId | string | yes | New UUID for this comment. Reuse it only when retrying the same comment after an uncertain response, to avoid duplicates. |
| visibility | string | yes | internal = Team only; public = Team and clients |
No output schema declared.
No examples provided.
create_issue ~183
Create an issue in an OverlayQA project. Title is required; severity, type, and description default to medium / general / empty. Assignee defaults to you; pass null for Unassigned.
| Name | Type | Req | Description |
|---|---|---|---|
| assigneeId | – | – | Teammate userId from list_project_members; null means Unassigned; omitted assigns to you |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| description | string | – | Issue description |
| projectId | string | yes | Project to create the issue in |
| severity | string | – | Issue severity (default: medium) |
| title | string | yes | Issue title |
| type | string | – | Issue type (default: general) |
No output schema declared.
No examples provided.
create_label ~121
Create a reusable workspace label. Editors can create labels; retries and case-insensitive duplicate names return the existing label. Apply it with set_issue_label.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| name | string | yes | Label name, shared across the workspace |
| projectId | string | yes | A project in the workspace whose labels to use |
No output schema declared.
No examples provided.
create_project ~103
Create a new OverlayQA project. Returns the project id, name, slug, displayPrefix, and url.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| name | string | yes | Project name |
| url | string | – | Primary URL for this project |
No output schema declared.
No examples provided.
create_review_issues ~174
File selected findings from your completed MCP Auto Review or visual comparison in its original project. Preserves saved images, page, captured context and fix guidance without scanning again. Repeating the same job and indexes recovers existing issues; inspect every finding outcome for partial completion. Old jobs without retained page provenance cannot be filed.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| findingIndexes | array | yes | Zero-based indexes in result.findings (Auto Review) or result.diffs (comparison). Only explicitly selected findings are filed. |
| jobId | string | yes | Completed MCP Auto Review or visual comparison job ID |
No output schema declared.
No examples provided.
create_scheduled_review ~162
Create a recurring public-page review with the same plan limits and cadence as the dashboard. Enables future scans and review emails. A lost response can be recovered by listing schedules; the same project, page and scan type cannot have duplicate schedules.
| Name | Type | Req | Description |
|---|---|---|---|
| cadence | string | yes | – |
| confirmLoginPage | boolean | – | True only when the user explicitly wants to review the sign-in page itself |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| projectId | string | yes | – |
| scanType | string | yes | – |
| url | string | yes | – |
No output schema declared.
No examples provided.
delete_comment ~117
Delete your own native comment and its attached files. This also removes it from client-visible discussions when its audience was public.
| Name | Type | Req | Description |
|---|---|---|---|
| commentId | string | yes | Native comment UUID from list_comments |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID or display id such as OQ-12 |
No output schema declared.
No examples provided.
delete_label ~117
Delete a label from the workspace and all its issues. Requires workspace owner or admin permission. Issues themselves are retained.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| labelId | string | yes | Label id returned by list_labels or create_label |
| projectId | string | yes | A project in the workspace whose labels to use |
No output schema declared.
No examples provided.
delete_scheduled_review ~89
Delete a scheduled review and stop its future scans and emails. Does not delete filed project issues.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| scheduleId | string | yes | – |
No output schema declared.
No examples provided.
export_issues ~170
Export existing issues with their captured evidence and discussion to an explicitly chosen connected tracker destination. Uses the same product export and retry handlers. Inspect every result: pending or partial attachment delivery is not success. Read the saved export status after uncertain outcomes before retrying.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| destination | object | yes | Explicit destination fields from the destination discovery results; no first/default destination is selected |
| issueIds | array | yes | – |
| metadata | object | – | Optional destination fields from the provider schema, such as status or assignee |
| provider | string | yes | – |
No output schema declared.
No examples provided.
get_comment_attachment ~135
Read a native comment attachment as filename and base64 bytes. Uses the same issue permissions as reading comments. Attachment IDs come from list_comments.
| Name | Type | Req | Description |
|---|---|---|---|
| attachmentId | string | yes | Attachment UUID from list_comments |
| commentId | string | yes | Native comment UUID from list_comments |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID or display id such as OQ-12 |
No output schema declared.
No examples provided.
get_issue ~153
Read a complete issue by UUID or display id: description, labels, assignee, ignored state, screenshot URLs, captured element/CSS and viewport evidence, its comments (the same discussion list_comments returns), and latestVerification (the newest saved check, or null). Read get_issue_verifications for history; issue status and notDetectedAt alone do not prove a fix.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID or display id such as OQ-12 |
No output schema declared.
No examples provided.
get_issue_export_status ~121
Read persisted export destinations, attachment delivery and the latest recorded sync success/error for an issue. Does not contact trackers or force a sync. Missing or stale sync evidence is not proof of a current round trip; unsupported fields are reported.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID or display ID |
No output schema declared.
No examples provided.
get_issue_verifications ~143
Read the latest 50 saved verification results for an issue, newest first. Includes verdicts, explanations, confidence, after-screenshot URLs, capture context, and timestamps. This does not run a new check. An issue status of verified or a no-longer-detected flag alone is not a verification pass.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID or display id such as OQ-12 |
No output schema declared.
No examples provided.
get_review_result ~127
Read a previously started review without starting or charging for another run. Returns running progress, failed details, or the complete Auto Review or visual-comparison findings and evidence. Results are retained for 24 hours by default and require access to the original project and workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| jobId | string | yes | Review job ID returned at start |
No output schema declared.
No examples provided.
get_scheduled_review_result ~142
Read the latest retained scheduled-review findings and evidence without rescanning, or poll a specific run by requestId. An empty result before the first successful run is not a clean scan. No longer detected, ignored and already filed are not proof that an issue was fixed.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| requestId | – | – | Optional run request ID to read that run without starting another scan |
| scheduleId | string | yes | – |
No output schema declared.
No examples provided.
list_client_reviews ~157
List a project’s client review links, share URLs, titles, capture status, expiry, visits, comments, doneReviewers and clients. Each client includes invitedAt, inviteFailed, lastReminderAt, done, commented and unsubscribed. Done reviewing means that reviewer finished giving feedback, not that issues are fixed or that every client is done. invitationsEnabled reports the delivery switch; reminders follow the existing automatic schedule.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| projectId | string | yes | Project UUID from list_projects |
No output schema declared.
No examples provided.
list_comments ~109
Read an issue discussion, including comment authors, audience, mentions and attachment metadata. Returns native and linked comments; edit/delete accept native comment IDs only.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID or display id such as OQ-12 |
No output schema declared.
No examples provided.
list_export_connections ~94
List your connected issue trackers and reconnect requirements without exposing credentials. A connection does not prove export delivery or working two-way sync. Connect or reconnect in OverlayQA first.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
No output schema declared.
No examples provided.
list_export_destinations ~162
Discover and read destination choices for a connected tracker. Omit collection to learn its available collections and required parameters. Read choices before exporting; use schema collections for required destination fields. Does not create tasks or connect accounts.
| Name | Type | Req | Description |
|---|---|---|---|
| accountId | – | – | – |
| cloudId | – | – | – |
| collection | string | – | Omit to discover allowed collections and required parameters; use the returned collection name to list choices |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueTypeId | – | – | – |
| parentId | – | – | – |
| provider | string | yes | – |
No output schema declared.
No examples provided.
list_issues ~535
List project issues with labels, description, ownership and ignored state. notDetectedAt records when a scan stopped detecting the issue; lastDetectedAt records a detection. Neither proves a fix. Use notDetected to filter the flag. Filter by status, severity, type, labels, assignee, creator, page (pageUrl), or active/finished/ignored state, and use createdAfter to ask only for issues newer than the last one seen. Each issue carries source (client means a reviewer filed it on a share link), commentCount, lastCommentAt and lastCommentBy (reviewer or team): an issue still needs a reply when source is client and commentCount is 0, or lastCommentBy is reviewer. Returns page, pageSize, total and hasMore; continue to the next page while hasMore is true. Use get_issue for full capture evidence and the discussion.
| Name | Type | Req | Description |
|---|---|---|---|
| assigneeId | – | – | Filter by teammate userId, me, or unassigned |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| createdAfter | string | – | Only issues created after this ISO-8601 instant with a zone, such as 2026-10-05T22:00:00Z. Pass the createdAt of the newest issue already seen to ask for what is new. |
| createdById | – | – | Filter by creator userId or me |
| labelIds | array | – | Match any selected label, or unlabeled |
| notDetected | boolean | – | true: only issues flagged No longer detected; false: issues without that flag, including those never checked. This flag is not proof of a fix. Combines with state and status. |
| page | integer | – | Page number, starting at 1; use hasMore to continue |
| pageSize | integer | – | Issues per page, up to 100 (default 100) |
| pageUrl | string | – | Only issues captured on this page URL, as returned in pageUrl. The query string is ignored. |
| projectId | string | yes | Project to list issues from |
| severity | – | – | One or more severities |
| state | string | – | Default all. Active means open/in-progress and not ignored. Finished means resolved/verified/closed and not ignored. Ignored is separate from status. |
| status | – | – | One or more statuses; combines with state |
| type | – | – | One or more issue types |
No output schema declared.
No examples provided.
list_labels ~108
List the workspace label library and your write/manage permissions. Optionally include an issue UUID to see its assigned labels.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | – | – |
| projectId | string | yes | A project in the workspace whose labels to use |
No output schema declared.
No examples provided.
list_project_members ~100
List workspace teammates for a readable project. Use their userId for assignment and comment mentions. Returns the signed-in userId too.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| projectId | string | yes | Project UUID from list_projects |
No output schema declared.
No examples provided.
list_projects ~71
List all OverlayQA projects in the authenticated user's team.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
No output schema declared.
No examples provided.
list_scheduled_reviews ~91
List readable scheduled reviews in this workspace, including cadence, pause state, next run and latest saved result summary. Does not scan or send email.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
No output schema declared.
No examples provided.
move_issue ~127
Move an issue into another project in the same workspace, preserving its identity, comments and evidence. Requires write access to both projects. Returns its new display id; use that id afterward.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Stable issue UUID from get_issue or list_issues |
| targetProjectId | string | yes | Destination project UUID |
No output schema declared.
No examples provided.
rename_label ~135
Rename a label throughout its workspace. Requires workspace owner or admin permission. Assignments are preserved; existing shared reports keep their original names.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| labelId | string | yes | Label id returned by list_labels or create_label |
| name | string | yes | Label name, shared across the workspace |
| projectId | string | yes | A project in the workspace whose labels to use |
No output schema declared.
No examples provided.
run_auto_review ~192
Start Auto Review of a public page in a readable project. Uses your scan allowance and the project’s review settings, ignored findings and already-filed issues. Returns a persistent job ID; results include findings, scores, AI status and screenshot evidence. Does not create issues. Login-required pages need the browser extension.
| Name | Type | Req | Description |
|---|---|---|---|
| breakpointLabel | string | – | Optional label, such as Desktop or Mobile |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| projectId | string | yes | Readable project UUID |
| requestId | string | yes | New UUID for this review; reuse after a lost response |
| url | string | yes | Public page URL |
| viewport | object | – | Browser viewport in CSS pixels |
No output schema declared.
No examples provided.
run_scheduled_review ~167
Run an active scheduled review now using its existing settings and the dashboard run-now path. Uses scan resources; Run now does not send email. Request IDs and run results are retained for 24 hours. Reuse requestId after a lost response; poll the saved run with the same scheduleId and requestId. Does not resume paused schedules.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| requestId | string | yes | New UUID for a run; reuse after a lost response. Use this same ID when polling the saved run. |
| scheduleId | string | yes | – |
No output schema declared.
No examples provided.
scan_accessibility ~132
Run an accessibility audit on a URL. Returns WCAG violations with severity, descriptions, and an overall score. Scans one page per call. Free plans include 3 scans per day; Pro is unlimited.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| projectId | string | – | Optional project ID to associate results with |
| url | string | yes | The URL to scan for accessibility issues |
No output schema declared.
No examples provided.
scan_and_create_issues ~158
Run an accessibility scan on a URL and automatically create issues in the given project for each violation at or above the minimum severity. Returns scan summary + issue IDs created. Scans one page per call. Free plans include 3 scans per day; Pro is unlimited.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| minSeverity | string | – | Minimum severity to create issues for (default: medium) |
| projectId | string | yes | Project to create issues in |
| url | string | yes | The URL to scan |
No output schema declared.
No examples provided.
scan_contrast ~117
Run a color contrast audit on a URL. Returns elements failing WCAG contrast ratios with severity and details. Scans one page per call. Free plans include 3 scans per day; Pro is unlimited.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| url | string | yes | The URL to scan for color contrast issues |
No output schema declared.
No examples provided.
set_client_review_recipients ~222
Replace a client review link’s COMPLETE client email list. Requires explicit intent to invite or remove these people. New addresses may receive an invitation and automatic day 3/7/10 reminders; retained addresses keep their history and are not invited again. Removed addresses stop reminders; an empty list removes all recipients but leaves the public link working. If invitationsEnabled is false, addresses are saved for later delivery. Read clients and invites for actual per-address state. Reminders stop after that address comments, marks done, unsubscribes, or the link expires/is revoked.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| emails | array | yes | Complete client email list. Existing addresses keep their invitation and reminder history; omitted addresses are removed. |
| reviewId | string | yes | Client review UUID from list_client_reviews; not the public link token |
No output schema declared.
No examples provided.
set_issue_label ~131
Apply (applied=true) or remove (applied=false) one workspace label on an issue. Other labels and issue text remain unchanged. Safe to retry.
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | yes | – |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID from list_issues |
| labelId | string | yes | Label id returned by list_labels or create_label |
No output schema declared.
No examples provided.
update_client_review ~160
Change a client review link’s expiry or responsive previews, or revoke/restore access. Supply only fields to change. Revoked or expired links stop scheduled reminders. This does not mark a reviewer done or change issue status.
| Name | Type | Req | Description |
|---|---|---|---|
| allowResponsiveViews | boolean | – | – |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| expiresAt | string | – | Expiry as an ISO-8601 UTC instant |
| reviewId | string | yes | Client review UUID from list_client_reviews; not the public link token |
| revoke | boolean | – | – |
No output schema declared.
No examples provided.
update_comment ~160
Edit your own native comment text and mention list. Audience and attached files stay unchanged. Supply the complete mention list, including retained mentions.
| Name | Type | Req | Description |
|---|---|---|---|
| commentId | string | yes | Native comment UUID from list_comments |
| content | string | yes | Replacement comment text |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID or display id such as OQ-12 |
| mentionedUserIds | array | yes | Teammate userIds from list_project_members. In content, use @[userId] for each mention. |
No output schema declared.
No examples provided.
update_issue ~254
Update issue status, title, description, severity, type, assignee, or ignored state. Only supplied fields change. Use null to unassign and ignored=false to restore. Accepts UUID or display id. Status verified does not run a verification scan. Use verify_issue to check a deployed fix, then inspect its evidence before deciding whether to change status.
| Name | Type | Req | Description |
|---|---|---|---|
| assigneeId | – | – | Teammate userId from list_project_members, or null to unassign |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| description | string | – | Replacement description, or empty to clear |
| ignored | boolean | – | Ignore (true) or restore (false), without changing status |
| issueId | string | yes | Issue UUID or display id such as OQ-12 |
| severity | string | – | New severity |
| status | string | – | New status; marking verified records a status, it does not run verification |
| title | string | – | Replacement title |
| type | string | – | New issue type |
No output schema declared.
No examples provided.
update_scheduled_review ~125
Pause, resume, or change a scheduled review cadence. Supply exactly one of action or cadence. Resuming enables future scans and review emails; plan and project permissions still apply. Pausing keeps previous results.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| cadence | string | – | – |
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| scheduleId | string | yes | – |
No output schema declared.
No examples provided.
verify_issue ~214
Check whether a resolved, verified, or closed issue is fixed on its public page. Uses the existing capture and verification engine and your verification allowance. Requires an original screenshot and a verifiable issue type. Returns the saved verdict, explanation, confidence, and after-screenshot evidence; passed_with_caveat, failed, inconclusive, and error are not an unconditional pass. Does not change issue status. Login-required and localhost pages need the browser extension. Reuse requestId only when retrying the same check after a lost response. Availability follows the verification rollout.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | One sentence on why you are calling this tool, for OverlayQA product analytics. Describe the purpose only (for example "checking the checkout page for contrast issues"). Never include credentials, pe… |
| issueId | string | yes | Issue UUID or display id such as OQ-12 |
| requestId | string | yes | New UUID per verification; reuse to retry the same check without creating another result |
No output schema declared.
No examples provided.
How do I install the OverlayQA MCP server?
OverlayQA runs locally as an npm package, launched with npx -y @overlayqa/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @overlayqa/mcp
claude mcp add com-overlayqa-mcp -- npx -y @overlayqa/mcp
What is the OverlayQA MCP server?
OverlayQA is an MCP server listed in the public MCP registry as com.overlayqa/mcp. Run accessibility, contrast, and design token audits and file QA issues from your AI coding tool. This page covers its npm package (@overlayqa/mcp).
Is the OverlayQA MCP server safe to use?
OverlayQA scores 75 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the OverlayQA MCP server expose?
OverlayQA exposes 42 tools: create_review_issues, list_scheduled_reviews, create_scheduled_review, update_scheduled_review, delete_scheduled_review, and 37 more. Their descriptions and schemas cost roughly 6,765 tokens of context every time the server is loaded.
Is the OverlayQA MCP server still maintained?
OverlayQA is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the OverlayQA MCP server under?
OverlayQA declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.