Ara — audits d'accessibilité RGAA
NPM · ARA-RGAA-MCP · SCANNED SEP 22
Piloter des audits RGAA 4.1 sur Ara, référentiel embarqué. Non officiel.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 0 of 3 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (EUPL-1.2).Pass
- Actively maintained (last published 54 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability71
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2818 tokens (~165/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 85% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the Ara — audits d'accessibilité RGAA MCP server?
Ara — audits d'accessibilité RGAA runs locally as an npm package, launched with npx -y ara-rgaa-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · ara-rgaa-mcp
claude mcp add davidpivert-ara-rgaa-mcp -- npx -y ara-rgaa-mcp
{
"mcpServers": {
"davidpivert-ara-rgaa-mcp": {
"command": "npx",
"args": [
"-y",
"ara-rgaa-mcp"
]
}
}
} {
"servers": {
"davidpivert-ara-rgaa-mcp": {
"command": "npx",
"args": [
"-y",
"ara-rgaa-mcp"
]
}
}
} codex mcp add davidpivert-ara-rgaa-mcp -- npx -y ara-rgaa-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"davidpivert-ara-rgaa-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"ara-rgaa-mcp"
],
"enabled": true
}
}
} openclaw mcp add davidpivert-ara-rgaa-mcp --command npx --arg -y --arg ara-rgaa-mcp
mcp_servers:
davidpivert-ara-rgaa-mcp:
command: "npx"
args: ["-y", "ara-rgaa-mcp"] {
"McpServers": {
"davidpivert-ara-rgaa-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"ara-rgaa-mcp"
]
}
}
} assistant mcp add davidpivert-ara-rgaa-mcp -t stdio -c npx -a -y ara-rgaa-mcp
{
"mcpServers": {
"davidpivert-ara-rgaa-mcp": {
"command": "npx",
"args": [
"-y",
"ara-rgaa-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 22 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −2
- Stability: pass → 0.83 functional
- 17 Sept 26 0
- Stability: 0.97 → pass security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 −2
- Stability: pass → 0.80 functional
- 10 Sept 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 22 Sept 2026 · Analysed npm/ara-rgaa-mcp@2.5.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 3 packages
| Packages resolved | 3 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
auth_refresh Refresh the Ara session ~123
Re-authenticate against Ara using the credentials configured in this server's environment, and report the current authentication state. Takes no arguments on purpose: credentials must never be passed as tool arguments, because tool arguments transit through the model's context and are persisted in conversation transcripts. Configure them in the `env` block of your MCP client configuration: - ARA_AUTH_TOKEN — a pre-issued Bearer token (recommended) - ARA_USERNAME + ARA_PASSWORD — used to sign in automatically at startup Use this tool only when a call has failed with an expired-token error.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
create_audit Create an RGAA audit ~213
Create a new RGAA accessibility audit in Ara. Returns the audit with its editUniqueId (for editing) and consultUniqueId (for viewing the report). Audit types: - FULL: all 106 RGAA criteria - FAST: 25 criteria (audit rapide) - COMPLEMENTARY: 25 criteria (audit complémentaire) — disjoint from the rapid ones, the two methodologies together covering 50 Call list_rgaa_criteria to see exactly which criteria a type covers.
| Name | Type | Req | Description |
|---|---|---|---|
| auditType | string | yes | Type of RGAA audit |
| auditorEmail | string | yes | Email of the auditor. Required: the Ara API answers 500 Internal Server Error when it is missing, even though it does not list the field as mandatory. |
| auditorName | string | yes | Name of the auditor |
| pageElements | object | yes | Types of elements present on the site |
| pages | array | yes | List of pages to audit |
| procedureName | string | yes | Name of the audited procedure/site |
No output schema declared.
No examples provided.
delete_audit Delete an audit ~131
Soft-delete an audit. The audit itself returns HTTP 410 Gone for future requests, and disappears from the account's audit list. This cannot be undone from this server. IMPORTANT — deleting does NOT unpublish. If the audit was published, its report REMAINS publicly readable at its consultation URL after deletion, and it is then reachable from nowhere in the Ara interface, so it can no longer be edited or withdrawn. Verified against the live API. Do not present deletion to the user as a way to undo a publication.
| Name | Type | Req | Description |
|---|---|---|---|
| uniqueId | string | yes | The editUniqueId of the audit to delete |
No output schema declared.
No examples provided.
duplicate_audit Duplicate an audit ~71
Fully duplicate an existing audit (metadata, pages, RGAA results, example images). Returns a new audit with fresh IDs. The source audit is left untouched.
| Name | Type | Req | Description |
|---|---|---|---|
| procedureName | string | yes | Name for the duplicated audit |
| uniqueId | string | yes | The editUniqueId of the audit to duplicate |
No output schema declared.
No examples provided.
export_csv Export results as CSV ~30
Export audit results in CSV format.
| Name | Type | Req | Description |
|---|---|---|---|
| uniqueId | string | yes | The editUniqueId of the audit |
No output schema declared.
No examples provided.
get_audit Get an audit ~45
Retrieve a full audit by its editUniqueId. Returns all metadata, pages, environments, and notes.
| Name | Type | Req | Description |
|---|---|---|---|
| uniqueId | string | yes | The editUniqueId of the audit |
No output schema declared.
No examples provided.
get_audit_method Plan de travail d'un audit ~154
Return the work plan for an audit type: which criteria can be settled by reading the HTML source, and which ones require the rendered page, keyboard navigation, the accessibility tree, or editorial judgement. Call this BEFORE starting an audit. It tells you which tools you will actually need — a browser, a keyboard pass, a screen reader — instead of discovering halfway through that half the criteria cannot be answered from markup. Criteria that need more than the source cannot be marked COMPLIANT or NOT_COMPLIANT by update_audit_results without declaring the matching evidence. This classification is guidance from this server, not a prescription of the RGAA.
| Name | Type | Req | Description |
|---|---|---|---|
| auditType | string | yes | The Ara audit type you are about to run |
No output schema declared.
No examples provided.
get_audit_progress Avancement d'un audit ~158
Where an audit stands: how many criteria are evaluated on each page, and WHICH ONES ARE LEFT — as a compact list of ids. Use this instead of get_audit_results whenever the question is "what remains to be done". A FULL audit carries 106 criteria per page, transverse elements included: 212 results for a single page, close to a thousand on an eight-page sample. Pulling all of them back just to spot the gaps wastes the context you need for the audit itself. Also reports whether the audit can be published — Ara refuses publish_audit while a single criterion is still NOT_TESTED, and this is how you find that one.
| Name | Type | Req | Description |
|---|---|---|---|
| uniqueId | string | yes | The editUniqueId of the audit |
No output schema declared.
No examples provided.
get_audit_results Get all criterion results ~213
Retrieve all criterion results for an audit. Returns an array of results, each with: - topic (1-13): RGAA topic number - criterium: criterion number within the topic - pageId: ID of the audited page - status: COMPLIANT | NOT_COMPLIANT | NOT_APPLICABLE | NOT_TESTED - compliantComment / notApplicableComment - notCompliantItems: the individual issues found, each with title, comment, userImpact (MINOR | MAJOR | BLOCKING) and quickWin On a FULL audit this returns 106 criteria per page — hundreds of entries. Filter by pageId or status rather than pulling everything, and call get_audit_progress when all you need is what is left to evaluate.
| Name | Type | Req | Description |
|---|---|---|---|
| pageId | number | – | Keep only this page. Page ids come from get_audit. |
| status | string | – | Keep only results in this state |
| uniqueId | string | yes | The editUniqueId of the audit |
No output schema declared.
No examples provided.
get_report Get the audit report ~66
Get the full audit report (read-only). Includes accessibility rate, criteria counts, and result distributions by page and topic. Uses the consultUniqueId (not the editUniqueId).
| Name | Type | Req | Description |
|---|---|---|---|
| consultUniqueId | string | yes | The consultUniqueId of the audit (found in the audit data) |
No output schema declared.
No examples provided.
get_rgaa_criterion Get one RGAA criterion and its tests ~210
Return the wording of a single RGAA 4.1 criterion AND its numbered tests — the checks an auditor actually performs to decide COMPLIANT / NOT_COMPLIANT / NOT_APPLICABLE. Call this before evaluating a criterion with update_audit_results: it is what turns "topic 6, criterium 1" into something you can actually assess. Also tells whether the criterion belongs to the rapid or complementary audit. The "verification" block says what is needed BEYOND the HTML source to settle the criterion — keyboard navigation, rendered page, accessibility tree, or editorial judgement — and how to go about it. When "sourceSuffit" is false, reading the markup is not enough: open the page. Source: the RGAA reference shipped with Ara, published by the DINUM under Licence Ouverte 2.0.
| Name | Type | Req | Description |
|---|---|---|---|
| criterium | number | yes | Criterion number within the topic |
| topic | number | yes | RGAA topic number (1-13) |
No output schema declared.
No examples provided.
list_rgaa_criteria List the RGAA criteria ~186
List RGAA 4.1 criteria as an index: topic number, topic name, criterion number and wording. Tests are NOT included — call get_rgaa_criterion for those. Use this to know what an audit actually covers before evaluating anything. Filter to keep the answer small: - auditType FAST — the 25 criteria of a rapid audit - auditType COMPLEMENTARY — the 25 complementary criteria (disjoint from the rapid ones) - auditType FULL, or no filter — all 106 - topic — restrict to one of the 13 topics Source: the RGAA reference shipped with Ara, published by the DINUM under Licence Ouverte 2.0.
| Name | Type | Req | Description |
|---|---|---|---|
| auditType | string | – | Keep only the criteria covered by this Ara audit type |
| topic | number | – | Keep only this RGAA topic (1-13) |
No output schema declared.
No examples provided.
patch_audit_notes Replace the audit notes ~101
Update only the notes field of an audit, without touching other metadata. The new content REPLACES the existing notes. Unlike criterion comments, this field is passed through as rich text: HTML is interpreted. Write <th> rather than <th> if you need to quote markup literally.
| Name | Type | Req | Description |
|---|---|---|---|
| notes | string | yes | New notes content (rich text / HTML) |
| uniqueId | string | yes | The editUniqueId of the audit |
No output schema declared.
No examples provided.
publish_audit Publish an audit (public) ~157
Mark an audit as published/completed. This makes the audit report and its accessibility statement PUBLICLY available at their consultation URL — confirm with the user before calling it. The audit must be fully filled in (all criteria evaluated) before publishing. Returns HTTP 409 if incomplete. IMPORTANT — publishing is effectively irreversible from here. There is no unpublish operation, and delete_audit does NOT withdraw a published report: it stays publicly readable while disappearing from the Ara interface. Make sure the user means to publish THIS audit, on THIS site, before calling it — publishing an audit about a third party puts a public accessibility statement about them under the auditor's name.
| Name | Type | Req | Description |
|---|---|---|---|
| uniqueId | string | yes | The editUniqueId of the audit to publish |
No output schema declared.
No examples provided.
update_audit Update an audit (full replace) ~321
Full update of an audit's metadata (procedure info, auditor info, environments, tools, technologies, notes, etc.). This REPLACES the existing metadata: fetch the audit with get_audit first and resend the fields you want to keep.
| Name | Type | Req | Description |
|---|---|---|---|
| auditType | string | yes | – |
| auditorEmail | string | yes | – |
| auditorName | string | yes | – |
| auditorOrganisation | string | – | – |
| contactEmail | string | – | Accessibility contact email |
| contactFormUrl | string | – | URL of accessibility contact form |
| contactName | string | – | Accessibility contact name |
| derogatedContent | string | – | Description of derogated content |
| environments | array | – | Test environments used |
| initiator | string | – | Organisation requesting the audit |
| notCompliantContent | string | – | Description of non-compliant content |
| notInScopeContent | string | – | Description of content not in scope |
| notes | string | – | General audit notes (rich text) |
| pages | array | yes | – |
| procedureName | string | yes | – |
| procedureUrl | string | – | URL of the audited site |
| technologies | array | – | Technologies used on the site (e.g. ['HTML', 'CSS', 'JavaScript']) |
| tools | array | – | Audit tools used (e.g. ['Axe', 'WAVE']) |
| transverseElements | array | – | Transverse elements (e.g. ['En-tête', 'Pied de page']) |
| uniqueId | string | yes | The editUniqueId of the audit |
No output schema declared.
No examples provided.
update_audit_results Update criterion results ~411
Update criterion results for an audit. Send an array of result items. Each item targets one criterion on one page using (pageId, topic, criterium), and REPLACES the previous evaluation of that criterion. The topic/criterium must be a valid RGAA combination. Topics 1-13: 1. Images, 2. Cadres, 3. Couleurs, 4. Multimédia, 5. Tableaux, 6. Liens, 7. Scripts, 8. Éléments obligatoires, 9. Structuration, 10. Présentation, 11. Formulaires, 12. Navigation, 13. Consultation Status values: COMPLIANT, NOT_COMPLIANT, NOT_APPLICABLE, NOT_TESTED Working through a FULL audit: 106 criteria on every page, transverse elements included. Send them page by page, or topic by topic — not in one call. Between batches, call get_audit_progress to see what is left rather than re-reading every result. Before evaluating a criterion, call get_rgaa_criterion to read its wording and its tests: it is what lets you judge rather than guess. Comments are stored as rich text by Ara, so this server escapes < and > before sending: quote markup freely (<th>, <label for>, <video>) and it will survive as written. Do not pre-escape. Describing a non-compliance: the details live in notCompliantItems, one entry per issue found, each with its own title, comment, userImpact (MINOR | MAJOR | BLOCKING) and quickWin. The API requires this array on EVERY item — send [] when there is nothing to report. Ara counts an audit as having blocking issues by looking at the userImpact of these entries, not of the criterion.
| Name | Type | Req | Description |
|---|---|---|---|
| results | array | yes | Array of criterion results to update |
| uniqueId | string | yes | The editUniqueId of the audit |
No output schema declared.
No examples provided.
update_statement Update the accessibility statement ~228
Update the accessibility statement (déclaration d'accessibilité) for an audit, REPLACING the current statement fields. This also PUBLISHES the statement: after the call the audit carries a statementPublicationDate and the déclaration is available at its public consultation URL — confirm with the user before calling it. Publishing the statement is separate from publish_audit, which publishes the audit report.
| Name | Type | Req | Description |
|---|---|---|---|
| auditorOrganisation | string | – | Auditing organisation |
| contactEmail | string | – | Accessibility contact email |
| contactFormUrl | string | – | Accessibility contact form URL |
| contactName | string | – | Accessibility contact name |
| derogatedContent | string | – | – |
| editUniqueId | string | yes | The editUniqueId of the audit |
| environments | array | – | Test environments |
| initiator | string | – | Organisation requesting the audit |
| notCompliantContent | string | – | – |
| notInScopeContent | string | – | – |
| procedureUrl | string | – | URL of the audited site |
| technologies | array | – | Technologies used |
| tools | array | – | Audit tools used |
No output schema declared.
No examples provided.
What is the Ara — audits d'accessibilité RGAA MCP server?
Ara — audits d'accessibilité RGAA is an MCP server listed in the public MCP registry as io.github.DavidPivert/ara-rgaa-mcp. Piloter des audits RGAA 4.1 sur Ara, référentiel embarqué. Non officiel. This page covers its npm package (ara-rgaa-mcp).
Is the Ara — audits d'accessibilité RGAA MCP server safe to use?
Ara — audits d'accessibilité RGAA scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 22 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Ara — audits d'accessibilité RGAA MCP server expose?
Ara — audits d'accessibilité RGAA exposes 17 tools: list_rgaa_criteria, get_audit_method, get_rgaa_criterion, auth_refresh, create_audit, and 12 more. Their descriptions and schemas cost roughly 2,818 tokens of context every time the server is loaded.
Is the Ara — audits d'accessibilité RGAA MCP server still maintained?
Ara — audits d'accessibilité RGAA is still listed as active in the MCP registry. We last reached this channel on 22 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Ara — audits d'accessibilité RGAA MCP server under?
Ara — audits d'accessibilité RGAA declares the EUPL-1.2 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.