Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Ara — audits d'accessibilité RGAA

NPM · ARA-RGAA-MCP · SCANNED SEP 22

Piloter des audits RGAA 4.1 sur Ara, référentiel embarqué. Non officiel.

Available components

+1 this week 83 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 0 of 3 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency45
Schema Quality & AI Usability71
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2818 tokens (~165/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
  • Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 85% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Install

How do I install the Ara — audits d'accessibilité RGAA MCP server?

Ara — audits d'accessibilité RGAA runs locally as an npm package, launched with npx -y ara-rgaa-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · ara-rgaa-mcp

# add to Claude Code
claude mcp add davidpivert-ara-rgaa-mcp -- npx -y ara-rgaa-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "davidpivert-ara-rgaa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ara-rgaa-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "davidpivert-ara-rgaa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ara-rgaa-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add davidpivert-ara-rgaa-mcp -- npx -y ara-rgaa-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidpivert-ara-rgaa-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "ara-rgaa-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add davidpivert-ara-rgaa-mcp --command npx --arg -y --arg ara-rgaa-mcp
# ~/.hermes/config.yaml
mcp_servers:
  davidpivert-ara-rgaa-mcp:
    command: "npx"
    args: ["-y", "ara-rgaa-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "davidpivert-ara-rgaa-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "ara-rgaa-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add davidpivert-ara-rgaa-mcp -t stdio -c npx -a -y ara-rgaa-mcp
// mcp.json
{
  "mcpServers": {
    "davidpivert-ara-rgaa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ara-rgaa-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 22 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 −2
    • Stability: pass → 0.83 functional
  • 17 Sept 26 0
    • Stability: 0.97 → pass security
  • 16 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 −2
    • Stability: pass → 0.80 functional
  • 10 Sept 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 22 Sept 2026 · Analysed npm/ara-rgaa-mcp@2.5.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 3 packages
Packages resolved 3
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 17 exposed · ~2,818 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
auth_refresh ~123

Re-authenticate against Ara using the credentials configured in this server's environment, and report the current authentication state. Takes no arguments on purpose: credentials must never be passed as tool arguments, because tool arguments transit through the model's context and are persisted in conversation transcripts. Configure them in the `env` block of your MCP client configuration: - ARA_AUTH_TOKEN — a pre-issued Bearer token (recommended) - ARA_USERNAME + ARA_PASSWORD — used to sign in automatically at startup Use this tool only when a call has failed with an expired-token error.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

create_audit ~213

Create a new RGAA accessibility audit in Ara. Returns the audit with its editUniqueId (for editing) and consultUniqueId (for viewing the report). Audit types: - FULL: all 106 RGAA criteria - FAST: 25 criteria (audit rapide) - COMPLEMENTARY: 25 criteria (audit complémentaire) — disjoint from the rapid ones, the two methodologies together covering 50 Call list_rgaa_criteria to see exactly which criteria a type covers.

NameTypeReqDescription
auditTypestringyesType of RGAA audit
auditorEmailstringyesEmail of the auditor. Required: the Ara API answers 500 Internal Server Error when it is missing, even though it does not list the field as mandatory.
auditorNamestringyesName of the auditor
pageElementsobjectyesTypes of elements present on the site
pagesarrayyesList of pages to audit
procedureNamestringyesName of the audited procedure/site

No output schema declared.

No examples provided.

delete_audit ~131

Soft-delete an audit. The audit itself returns HTTP 410 Gone for future requests, and disappears from the account's audit list. This cannot be undone from this server. IMPORTANT — deleting does NOT unpublish. If the audit was published, its report REMAINS publicly readable at its consultation URL after deletion, and it is then reachable from nowhere in the Ara interface, so it can no longer be edited or withdrawn. Verified against the live API. Do not present deletion to the user as a way to undo a publication.

NameTypeReqDescription
uniqueIdstringyesThe editUniqueId of the audit to delete

No output schema declared.

No examples provided.

duplicate_audit ~71

Fully duplicate an existing audit (metadata, pages, RGAA results, example images). Returns a new audit with fresh IDs. The source audit is left untouched.

NameTypeReqDescription
procedureNamestringyesName for the duplicated audit
uniqueIdstringyesThe editUniqueId of the audit to duplicate

No output schema declared.

No examples provided.

export_csv ~30

Export audit results in CSV format.

NameTypeReqDescription
uniqueIdstringyesThe editUniqueId of the audit

No output schema declared.

No examples provided.

get_audit ~45

Retrieve a full audit by its editUniqueId. Returns all metadata, pages, environments, and notes.

NameTypeReqDescription
uniqueIdstringyesThe editUniqueId of the audit

No output schema declared.

No examples provided.

get_audit_method ~154

Return the work plan for an audit type: which criteria can be settled by reading the HTML source, and which ones require the rendered page, keyboard navigation, the accessibility tree, or editorial judgement. Call this BEFORE starting an audit. It tells you which tools you will actually need — a browser, a keyboard pass, a screen reader — instead of discovering halfway through that half the criteria cannot be answered from markup. Criteria that need more than the source cannot be marked COMPLIANT or NOT_COMPLIANT by update_audit_results without declaring the matching evidence. This classification is guidance from this server, not a prescription of the RGAA.

NameTypeReqDescription
auditTypestringyesThe Ara audit type you are about to run

No output schema declared.

No examples provided.

get_audit_progress ~158

Where an audit stands: how many criteria are evaluated on each page, and WHICH ONES ARE LEFT — as a compact list of ids. Use this instead of get_audit_results whenever the question is "what remains to be done". A FULL audit carries 106 criteria per page, transverse elements included: 212 results for a single page, close to a thousand on an eight-page sample. Pulling all of them back just to spot the gaps wastes the context you need for the audit itself. Also reports whether the audit can be published — Ara refuses publish_audit while a single criterion is still NOT_TESTED, and this is how you find that one.

NameTypeReqDescription
uniqueIdstringyesThe editUniqueId of the audit

No output schema declared.

No examples provided.

get_audit_results ~213

Retrieve all criterion results for an audit. Returns an array of results, each with: - topic (1-13): RGAA topic number - criterium: criterion number within the topic - pageId: ID of the audited page - status: COMPLIANT | NOT_COMPLIANT | NOT_APPLICABLE | NOT_TESTED - compliantComment / notApplicableComment - notCompliantItems: the individual issues found, each with title, comment, userImpact (MINOR | MAJOR | BLOCKING) and quickWin On a FULL audit this returns 106 criteria per page — hundreds of entries. Filter by pageId or status rather than pulling everything, and call get_audit_progress when all you need is what is left to evaluate.

NameTypeReqDescription
pageIdnumberKeep only this page. Page ids come from get_audit.
statusstringKeep only results in this state
uniqueIdstringyesThe editUniqueId of the audit

No output schema declared.

No examples provided.

get_report ~66

Get the full audit report (read-only). Includes accessibility rate, criteria counts, and result distributions by page and topic. Uses the consultUniqueId (not the editUniqueId).

NameTypeReqDescription
consultUniqueIdstringyesThe consultUniqueId of the audit (found in the audit data)

No output schema declared.

No examples provided.

get_rgaa_criterion ~210

Return the wording of a single RGAA 4.1 criterion AND its numbered tests — the checks an auditor actually performs to decide COMPLIANT / NOT_COMPLIANT / NOT_APPLICABLE. Call this before evaluating a criterion with update_audit_results: it is what turns "topic 6, criterium 1" into something you can actually assess. Also tells whether the criterion belongs to the rapid or complementary audit. The "verification" block says what is needed BEYOND the HTML source to settle the criterion — keyboard navigation, rendered page, accessibility tree, or editorial judgement — and how to go about it. When "sourceSuffit" is false, reading the markup is not enough: open the page. Source: the RGAA reference shipped with Ara, published by the DINUM under Licence Ouverte 2.0.

NameTypeReqDescription
criteriumnumberyesCriterion number within the topic
topicnumberyesRGAA topic number (1-13)

No output schema declared.

No examples provided.

list_rgaa_criteria ~186

List RGAA 4.1 criteria as an index: topic number, topic name, criterion number and wording. Tests are NOT included — call get_rgaa_criterion for those. Use this to know what an audit actually covers before evaluating anything. Filter to keep the answer small: - auditType FAST — the 25 criteria of a rapid audit - auditType COMPLEMENTARY — the 25 complementary criteria (disjoint from the rapid ones) - auditType FULL, or no filter — all 106 - topic — restrict to one of the 13 topics Source: the RGAA reference shipped with Ara, published by the DINUM under Licence Ouverte 2.0.

NameTypeReqDescription
auditTypestringKeep only the criteria covered by this Ara audit type
topicnumberKeep only this RGAA topic (1-13)

No output schema declared.

No examples provided.

patch_audit_notes ~101

Update only the notes field of an audit, without touching other metadata. The new content REPLACES the existing notes. Unlike criterion comments, this field is passed through as rich text: HTML is interpreted. Write &lt;th&gt; rather than <th> if you need to quote markup literally.

NameTypeReqDescription
notesstringyesNew notes content (rich text / HTML)
uniqueIdstringyesThe editUniqueId of the audit

No output schema declared.

No examples provided.

publish_audit ~157

Mark an audit as published/completed. This makes the audit report and its accessibility statement PUBLICLY available at their consultation URL — confirm with the user before calling it. The audit must be fully filled in (all criteria evaluated) before publishing. Returns HTTP 409 if incomplete. IMPORTANT — publishing is effectively irreversible from here. There is no unpublish operation, and delete_audit does NOT withdraw a published report: it stays publicly readable while disappearing from the Ara interface. Make sure the user means to publish THIS audit, on THIS site, before calling it — publishing an audit about a third party puts a public accessibility statement about them under the auditor's name.

NameTypeReqDescription
uniqueIdstringyesThe editUniqueId of the audit to publish

No output schema declared.

No examples provided.

update_audit ~321

Full update of an audit's metadata (procedure info, auditor info, environments, tools, technologies, notes, etc.). This REPLACES the existing metadata: fetch the audit with get_audit first and resend the fields you want to keep.

NameTypeReqDescription
auditTypestringyes
auditorEmailstringyes
auditorNamestringyes
auditorOrganisationstring
contactEmailstringAccessibility contact email
contactFormUrlstringURL of accessibility contact form
contactNamestringAccessibility contact name
derogatedContentstringDescription of derogated content
environmentsarrayTest environments used
initiatorstringOrganisation requesting the audit
notCompliantContentstringDescription of non-compliant content
notInScopeContentstringDescription of content not in scope
notesstringGeneral audit notes (rich text)
pagesarrayyes
procedureNamestringyes
procedureUrlstringURL of the audited site
technologiesarrayTechnologies used on the site (e.g. ['HTML', 'CSS', 'JavaScript'])
toolsarrayAudit tools used (e.g. ['Axe', 'WAVE'])
transverseElementsarrayTransverse elements (e.g. ['En-tête', 'Pied de page'])
uniqueIdstringyesThe editUniqueId of the audit

No output schema declared.

No examples provided.

update_audit_results ~411

Update criterion results for an audit. Send an array of result items. Each item targets one criterion on one page using (pageId, topic, criterium), and REPLACES the previous evaluation of that criterion. The topic/criterium must be a valid RGAA combination. Topics 1-13: 1. Images, 2. Cadres, 3. Couleurs, 4. Multimédia, 5. Tableaux, 6. Liens, 7. Scripts, 8. Éléments obligatoires, 9. Structuration, 10. Présentation, 11. Formulaires, 12. Navigation, 13. Consultation Status values: COMPLIANT, NOT_COMPLIANT, NOT_APPLICABLE, NOT_TESTED Working through a FULL audit: 106 criteria on every page, transverse elements included. Send them page by page, or topic by topic — not in one call. Between batches, call get_audit_progress to see what is left rather than re-reading every result. Before evaluating a criterion, call get_rgaa_criterion to read its wording and its tests: it is what lets you judge rather than guess. Comments are stored as rich text by Ara, so this server escapes < and > before sending: quote markup freely (<th>, <label for>, <video>) and it will survive as written. Do not pre-escape. Describing a non-compliance: the details live in notCompliantItems, one entry per issue found, each with its own title, comment, userImpact (MINOR | MAJOR | BLOCKING) and quickWin. The API requires this array on EVERY item — send [] when there is nothing to report. Ara counts an audit as having blocking issues by looking at the userImpact of these entries, not of the criterion.

NameTypeReqDescription
resultsarrayyesArray of criterion results to update
uniqueIdstringyesThe editUniqueId of the audit

No output schema declared.

No examples provided.

update_statement ~228

Update the accessibility statement (déclaration d'accessibilité) for an audit, REPLACING the current statement fields. This also PUBLISHES the statement: after the call the audit carries a statementPublicationDate and the déclaration is available at its public consultation URL — confirm with the user before calling it. Publishing the statement is separate from publish_audit, which publishes the audit report.

NameTypeReqDescription
auditorOrganisationstringAuditing organisation
contactEmailstringAccessibility contact email
contactFormUrlstringAccessibility contact form URL
contactNamestringAccessibility contact name
derogatedContentstring
editUniqueIdstringyesThe editUniqueId of the audit
environmentsarrayTest environments
initiatorstringOrganisation requesting the audit
notCompliantContentstring
notInScopeContentstring
procedureUrlstringURL of the audited site
technologiesarrayTechnologies used
toolsarrayAudit tools used

No output schema declared.

No examples provided.

Common questions

What is the Ara — audits d'accessibilité RGAA MCP server?

Ara — audits d'accessibilité RGAA is an MCP server listed in the public MCP registry as io.github.DavidPivert/ara-rgaa-mcp. Piloter des audits RGAA 4.1 sur Ara, référentiel embarqué. Non officiel. This page covers its npm package (ara-rgaa-mcp).

Is the Ara — audits d'accessibilité RGAA MCP server safe to use?

Ara — audits d'accessibilité RGAA scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 22 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Ara — audits d'accessibilité RGAA MCP server expose?

Ara — audits d'accessibilité RGAA exposes 17 tools: list_rgaa_criteria, get_audit_method, get_rgaa_criterion, auth_refresh, create_audit, and 12 more. Their descriptions and schemas cost roughly 2,818 tokens of context every time the server is loaded.

Is the Ara — audits d'accessibilité RGAA MCP server still maintained?

Ara — audits d'accessibilité RGAA is still listed as active in the MCP registry. We last reached this channel on 22 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Ara — audits d'accessibilité RGAA MCP server under?

Ara — audits d'accessibilité RGAA declares the EUPL-1.2 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.