Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.snayyar00/webability

NPM · @WEBABILITY/MCP · 2 COMPONENTS

Free WCAG 2.2/ADA/508 accessibility MCP: scan, AI fixes, verify, vision audit, localhost tunnel

+12 this week 91 Trust /100

Last scanned (20 hours ago)

Scores higher than 93% of npm servers

Category Testing and QA

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security99
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 38 of 142 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to snayyar00/webability-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 1 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 6330 tokens (~316/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability check failed: the tool surface changed between 1.3.1 and 1.9.0: 0 tool removals, 1 breaking changes, 6 additions. See how to fix → Fail
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 15 Oct 26 +42
    • Stability: unverified → fail ▼ security
    • Injection markers: unverified → pass ▲ security
    • Schema quality: 359 → 316 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • Tool coverage: unverified → 100 ▲ functional
  • 14 Oct 26 0
    • Stability: unverified → fail ▼ security
    • Injection markers: unverified → pass ▲ security
    • Schema quality: 359 → 312 ▲ functional
    • Tool coverage: unverified → 100 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • Package version: 1.7.0 → 1.9.0 functional
  • 13 Oct 26 0
    • Package version: 1.7.0 → 1.8.2 functional
  • 12 Oct 26 0
    • Security disclosure: unverified → fail ▼ functional
    • Package version: 1.8.0 → 1.8.1 functional
  • 11 Oct 26 −30
    • Stability: fail → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Provenance: fail → pass ▲ security
    • The attested source repository moved: snayyar00/webability-mcp security
    • Tool coverage: 100 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Security disclosure: fail → unverified ▼ functional
    • Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
    • Package version: 1.7.0 → 1.8.0 functional
  • 4 Oct 26 −1
    • Known CVEs: pass → unverified ▼ security
    • Stability: 0.77 → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Stability: 0.77 → fail ▼ security
    • Schema quality: 212 → 359 ▼ functional
    • Schema quality: 212 → 324 ▼ functional
    • Schema quality: 212 → 330 ▼ functional
    • Security disclosure: unverified → fail ▼ functional
    • Dependency health: 0.86 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
    • Package version: 1.3.1 → 1.7.0 functional
    • Package version: 1.3.1 → 1.6.4 functional
    • Package version: 1.3.1 → 1.6.3 functional
  • 3 Oct 26 −3
    • Security disclosure: fail → unverified ▼ functional
    • Stability: pass → 0.77 functional
  • 2 Oct 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 16 Oct 2026 · Analysed npm/@webability/mcp@1.9.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo snayyar00/webability-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/snayyar00/webability-mcp/.github/workflows/publish.yml@refs/heads/master
Rekor log index 3251749009
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:503c30340ab3c8b36bcd2ffe041c82d4790006c8bc7f19b556b5910789b1de7f2d8c47d70853606de3c1eced245170c7265fdee3453795881a276d526

Background: How many MCP packages publish verified provenance →

Dependencies 142 packages
Packages resolved 142
Stale 38
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 20 exposed · ~5,241 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_site ~120

Add a website to the signed-in WebAbility account. The site gets the full widget for its first 30 days and a first scan. Returns the site id and plan tier. Next: put the get_install_snippet tag on the site, and use create_upgrade_link to get a payment link for the WebAbility Pro plan. Needs a free WebAbility account (an AI agent can sign itself up with "Sign in with AgentID").

NameTypeReqDescription
urlstringyesThe site to add, for example https://shop.example.com. One domain per site.

No output schema declared.

No examples provided.

check_aria ~246

Validate ARIA attribute + accessible name/role/value usage — in an HTML snippet (`html`) or on a live page (`url`), optionally limited to one element and its descendants (`selector`). Runs axe-core `cat.aria` and `cat.name-role-value` rules (aria-* attribute correctness, role validity, required parents/children, aria-hidden-focus, accessible names). Returns `violations`. A selector that matches nothing, or a page that answers an HTTP error, is an error — never "no violations". Nodes cap at 5 per rule by default — every rule reports nodesTotal + truncated; raise nodeLimit (max 50) or use scan_history(id) for the full set.

NameTypeReqDescription
htmlstring–HTML to test for ARIA correctness (pass this or `url`)
nodeLimitnumber–Max nodes returned per rule (default 5, max 50)
selectorstring–Only report findings on this element and its descendants (e.g. the `selector` from a scan_page issue). ARIA references outside it still resolve.
urlstring–Live page to check (pass this or `html`)

No output schema declared.

No examples provided.

check_color_contrast ~407

Check text contrast against the WCAG AA threshold (4.5:1, or 3:1 for large text); the AAA verdict is shown only when you pass level: "AAA". Either pass a `foreground` / `background` color pair, or pass `url` + `selector` to read the element's own text color, background (composited from the nearest painted ancestors), font size and weight from the live page; explicit colors win over the page. A gradient or image background is reported as an error, never a guessed ratio. When it fails, suggests BRAND-aligned replacements — extracts the actual brand palette from the `url` page using our scanner (CSS vars + most-used colors), or use a provided `brandColors` array. No `url` and no `brandColors` = ratio + pass/fail only.

NameTypeReqDescription
backgroundstring–Background color (hex or rgb). Optional with url + selector.
brandColorsarray–Pre-supplied brand palette. Skips URL extraction if provided.
fontSizenumber–Font size in px (default 16, or the element's computed size with url + selector)
foregroundstring–Foreground color (hex or rgb). Optional with url + selector.
isBoldboolean–Whether text is bold (default false, or the element's computed weight with url + selector)
levelstring–Conformance level to judge. Default "AA". "AAA" adds the enhanced-contrast (1.4.6) verdict and AAA palette suggestions.
selectorstring–CSS selector of the text element on `url` (e.g. the `selector` from a scan_page issue)
urlstring–Live page: with `selector`, the colors are read from that element; on a failing pair, the brand palette is extracted from it (uses our scanner — CSS vars + dominant colors).

No output schema declared.

No examples provided.

create_upgrade_link ~119

Get a Stripe Checkout link that puts one site on the WebAbility Pro plan (the widget subscription). Give the link to the human who pays (your owner). When they pay, the plan activates on that site automatically; check with list_sites. You never handle card details. The site must be on the account (add_site first). Needs a free WebAbility account.

NameTypeReqDescription
billing_intervalstring–Billing period. Default monthly.
domainstringyesThe site to upgrade, as added with add_site (for example shop.example.com)

No output schema declared.

No examples provided.

detect_framework ~127

Detect a page's stack as two separate fields: `framework` — the application framework, CMS or site builder (e.g. nextjs, nuxt, sveltekit, vitepress, astro, gatsby, wordpress, shopify, mediawiki, vue, react; "unknown" when no signal) — and `cssToolkit` (tailwind, bootstrap, mui, plain-css). Lists the evidence it used and the value to pass as generate_ai_fix `framework`. scan_page reports the same two fields from the same detection.

NameTypeReqDescription
urlstringyesURL to inspect

No output schema declared.

No examples provided.

diff_scan ~526

Compare two scans of the same page and report what changed: `fixed[]` (in the baseline, gone now), `new[]` (regressions — not in the baseline, present now), `remaining[]` (still there). Page-level complement to verify_fix (one element). Baseline is a scan_history id (`baselineId`, local installs) or a live scan of `baselineUrl`; current is `url` (scanned live now) or another history id (`currentId`). Findings are matched by issue id (rule + element), so a changed class/id on a fixed element reads as fixed AND new — check `new[]` before calling it a regression. Typical loop: scan_page → edit → diff_scan(baselineId=<that scan id>, url=<same url>) → confirm new[] is empty.

NameTypeReqDescription
baselineIdstring–scan_history id of the BASELINE scan (local installs only)
baselineUrlstring–Scan this URL live as the baseline (e.g. production) — use when there is no stored baseline
currentIdstring–scan_history id to use as the CURRENT side instead of scanning `url`
formatstring–"compact" prints one line per element with rule metadata once. "json" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JS…
levelstring–Highest WCAG conformance level to report. Default "AA" — Level AAA criteria are not reported. Pass "AAA" to include them (naming one AAA criterion in `wcag`, e.g. "3.2.5", also includes it).
minImpactstring–Only findings at this severity or above (critical > serious > moderate > minor)
rootSelectorstring–CSS selector to limit live scans to (optional)
rulesarray–Only these rule ids (WebAbility type such as "missing_alt" or axe rule id such as "image-alt"). See get_rules.
urlstring–URL to scan now as the CURRENT side (deployed, staging, or http://localhost:3000). Omit when passing currentId.
viewportstring–Viewport for live scans (default: desktop). Use the same viewport the baseline used.
wcagarray–Only these WCAG criteria. A prefix selects the whole guideline ("1.4") or principle ("2").

No output schema declared.

No examples provided.

find_source ~80

Find source files in the local project that contain a given CSS selector. Maps DOM selectors back to source code so you can edit the right file. Searches React/Vue/Svelte/HTML/PHP/Astro files.

NameTypeReqDescription
rootDirstring–Project root to search (defaults to cwd)
selectorstringyesCSS selector from a scan issue

No output schema declared.

No examples provided.

flow_scan ~454

Scan a multi-page user journey. Walks startUrl plus the `autoNavigate` URLs sequentially (deterministic — one page fully rendered and scanned before the next), then returns ONE consolidated report with issues deduplicated across pages, each carrying the same fix payload as scan_page. Every requested URL gets an explicit outcome in `pages[]` (scanned / nav_failed / scan_failed / redirected_duplicate / duplicate_request / skipped_cap / blocked — bot-challenge, not a clean page) — a page is never silently dropped. Better than per-page scans for journeys (login → checkout etc). Without `autoNavigate` it scans only startUrl, exactly like scan_page.

NameTypeReqDescription
autoNavigatearray–The URLs to walk after startUrl, in order (the MCP server is headless and cannot discover a journey interactively). Omit or pass [] to scan only startUrl as a single page.
formatstring–"compact" prints one line per element with rule metadata once. "json" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JS…
levelstring–Highest WCAG conformance level to report. Default "AA" — Level AAA criteria are not reported. Pass "AAA" to include them (naming one AAA criterion in `wcag`, e.g. "3.2.5", also includes it).
maxPagesnumber–Max pages to scan (default 10)
minImpactstring–Only findings at this severity or above (critical > serious > moderate > minor)
rulesarray–Only these rule ids (WebAbility type such as "missing_alt" or axe rule id such as "image-alt"). See get_rules.
sourceRootstring–Local project root (local installs only) for `sourceCandidates[]` on issues without a framework `source` pointer.
startUrlstringyesStarting URL of the journey
wcagarray–Only these WCAG criteria. A prefix selects the whole guideline ("1.4") or principle ("2").

No output schema declared.

No examples provided.

generate_ai_fix ~231

Generate framework-aware fix alternatives for a specific accessibility issue. For color contrast issues, returns 3 alternatives (minimal, brand-aligned, high contrast); brand palette is auto-extracted from the live URL using our scanner if `brandColors` is omitted. For label/ARIA issues, returns 1-2 alternatives. Each alternative includes ready-to-paste code for the detected framework.

NameTypeReqDescription
brandColorsarray–Brand palette for brand-aligned suggestions. If omitted on a contrast issue with a `url`, auto-extracted via the scanner.
contextstring–Parent element outerHTML for context (~400 chars)
frameworkstringyesCSS framework — use detect_framework first
htmlstringyesThe element's outerHTML — send at most ~600 chars
issueobject|stringyesIssue object from scan_page (with selector, wcag, impact, message, fix.currentValue), or a plain-text issue description
urlstring–Page URL — also used to auto-extract brand palette for contrast issues if `brandColors` is not provided.

No output schema declared.

No examples provided.

generate_report_pdf ~220

Turn scan findings into a branded WebAbility accessibility-report PDF, saved next to the project (local installs only). Pass the `issues[]` array a scan_page call returned plus the page `url`; the tool groups findings by functionality (Low Vision / Mobility / Navigation / Content / Cognitive), computes the WCAG score with the same penalty ladder as the platform, and renders a shareable PDF — free, no account. Use it when the user wants a deliverable to attach to an email, ticket, or compliance thread. Capped at 500 findings. For the full audit deliverable (Excel workbook + evidence screenshots), use start_audit instead.

NameTypeReqDescription
issuesarrayyesFindings to include — pass the `issues[]` array from scan_page (message/type/wcag/selector/html/impact/fix).
urlstringyesThe scanned page URL (used for the report header and file name)
widgetDetectedboolean–Whether the WebAbility widget was detected on the page (shown in the report's widget status).

No output schema declared.

No examples provided.

get_audit ~157

[Full — FREE with a WebAbility account. Not runnable in Lite. Connect hosted MCP at https://mcp.webability.io/mcp (dashboard or Smithery: webability/accessibility), authenticate, then call `get_audit`.] Check an audit started with start_audit: returns overall status, per-step progress (scan → viewports → screenshots → agent → excel → publish), and — once complete — a severity summary plus short-lived download URLs for the report (JSON) and the Excel workbook. Poll every ~15s while status is pending/running. Only the account that started an audit can read it. Free with a WebAbility account.

NameTypeReqDescription
idnumberyesThe audit id returned by start_audit

No output schema declared.

No examples provided.

get_install_snippet ~69

Get the one-line script tag that installs the WebAbility accessibility widget. Put it in the <head> or before </body> of every page of a site added with add_site. The widget finds the site by its domain, so the same tag works on every site. No account needed.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_rules ~246

List accessibility rules from both engines — axe-core (104) and the WebAbility detectors (90+) — with optional filters. Every rule carries `fixability` (mechanical | contextual | visual) and a `fix` op template, so you can pick the rules worth auto-fixing before scanning. Returns ruleId, engine, description, help, helpUrl, tags/wcag, fixability, fix.

NameTypeReqDescription
enginestring–Which engine's rules to list (default all)
fixabilitystring–Only rules of this fixability tier
rulestring–Only rules whose id contains these whole words (e.g. "link" → link-name, skip-link, not blink; "color-contrast"; case and -/_ insensitive). Also accepted: ruleId, id, query.
tagsarray–axe tag filter (e.g. ["wcag2aa"], ["best-practice"], ["cat.aria"]; a category also works without "cat."). WebAbility rules match on their WCAG criterion tag (e.g. "wcag143"). An unknown tag or catego…

No output schema declared.

No examples provided.

list_sites ~55

List the sites on the signed-in WebAbility account with each site id, plan tier and the date the current plan ends. Use it to check that a payment activated WebAbility Pro on a site. Needs a free WebAbility account.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

scan_history ~167

Browse past scans run through this MCP server. Every scan_page / flow_scan / scan_html / visual_audit / check_aria / verify_fix call is logged locally (~/.webability/scans; local installs only — the hosted server keeps no history). Without arguments, lists recent scans (when, what target, result summary). Pass `id` to retrieve the FULL stored result of one past scan, or `filter` to match a URL/tool substring.

NameTypeReqDescription
filterstring–Substring match on target URL or tool name (e.g. "webability.io" or "scan_page")
idstring–A scan id from the history list — returns that scan's full stored response
limitnumber–Max history entries to return (default 20)

No output schema declared.

No examples provided.

scan_html ~480

Scan a raw HTML snippet or component markup without serving it — IN-PROCESS by default (jsdom + WebAbility detectors + axe-core): milliseconds, no browser, no network, so it fits inside a tight edit loop. Fragments are auto-wrapped into a document. Returns scan_page's shape (issues / summary) with `fix.op` + `fixability` on every finding. jsdom has no layout, so visual-tier rules (contrast, target size, focus ring) are NOT evaluated — the dropped count is reported as `skippedVisual`; pass `engine: "browser"` to run the axe-core headless-browser path for those (slower, axe rules only, returns axe `violations`).

NameTypeReqDescription
enginestring–"in-process" (default): jsdom, ms, structural rules. "browser": headless Chromium + axe-core, includes contrast.
formatstring–"compact" prints one line per element with rule metadata once. "json" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JS…
heightnumber–Viewport height (browser engine only, default 800)
htmlstringyesHTML content to test — a full document or a fragment
levelstring–Highest WCAG conformance level to report. Default "AA" — Level AAA criteria are not reported. Pass "AAA" to include them (naming one AAA criterion in `wcag`, e.g. "3.2.5", also includes it).
minImpactstring–Only findings at this severity or above (critical > serious > moderate > minor)
rulesarray–Only these rule ids (WebAbility type such as "missing_alt" or axe rule id such as "image-alt"). See get_rules.
tagsarray–WCAG tags to check (default ["wcag2a","wcag2aa","wcag21aa","wcag22aa"])
wcagarray–Only these WCAG criteria. A prefix selects the whole guideline ("1.4") or principle ("2").
widthnumber–Viewport width (browser engine only, default 1280)

No output schema declared.

No examples provided.

scan_page ~502

Scan a web page for WCAG accessibility issues. Works on any URL — deployed sites, localhost, staging. Returns `issues` (violations the scanner stands behind; findings the engines cannot decide are settled by the AI judge — a violation with a fix, or a pass recorded in `judged[]` with its reason — and anything unsettled is dropped, never listed for review) and a `summary`. On React ≤18 / Vue dev builds each issue carries `source` ({file, line, column, component}) read from the live component tree. Every issue carries a structured `fix.op` (add-attribute | set-attribute | remove-attribute | add-element | remove-element | add-text-content | suggest) with `fix.attribute` / `fix.value` when known, and a `fixability` tier (mechanical = apply as given; contextual = op known, value needs judgment; visual = needs rendered output, propose only).

NameTypeReqDescription
formatstring–"compact" prints one line per element with rule metadata once. "json" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JS…
levelstring–Highest WCAG conformance level to report. Default "AA" — Level AAA criteria are not reported. Pass "AAA" to include them (naming one AAA criterion in `wcag`, e.g. "3.2.5", also includes it).
minImpactstring–Only findings at this severity or above (critical > serious > moderate > minor)
rootSelectorstring–CSS selector to limit scan scope (optional)
rulesarray–Only these rule ids (WebAbility type such as "missing_alt" or axe rule id such as "image-alt"). See get_rules.
sourceRootstring–Local project root (local installs only). Issues without a framework `source` pointer get `sourceCandidates[]` — files whose contents match the selector's id/class/attribute tokens.
urlstringyesURL to scan (e.g. https://webability.io or http://localhost:3000)
viewportstring–Viewport size (default: desktop)
wcagarray–Only these WCAG criteria. A prefix selects the whole guideline ("1.4") or principle ("2").

No output schema declared.

No examples provided.

start_audit ~404

[Full — FREE with a WebAbility account. Not runnable in Lite. Connect hosted MCP at https://mcp.webability.io/mcp (dashboard or Smithery: webability/accessibility), authenticate, then call `start_audit`.] Kick off a FULL accessibility audit deliverable for a URL — a persistent, timestamped artifact, not an inline scan. Runs the server-side pipeline (axe + advanced checks + mobile viewports + annotated screenshots + optional agent spot-check) and produces a downloadable report and a formatted Excel workbook (Cover / Status / Barriers / ADA context sheets) stored durably. Returns immediately with an audit `id`; poll `get_audit` for progress and, when complete, download URLs. Use this when someone needs a durable artifact to attach as evidence of testing effort for a compliance officer or legal response — for iterating on code, use scan_page + verify_fix instead. Free for everyone; needs a free WebAbility account (sign in by connecting https://mcp.webability.io/mcp/auth, or run `webability login`). Set includeAgent:true to add the slower agentic manual-audit pass. To audit a local dev server, open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` with the printed secret as `tunnel_secret`; keep the tunnel open until get_audit reports complete (about 5 minutes) — the pipeline loads the page several times.

NameTypeReqDescription
includeAgentboolean–Also run the agentic manual-audit pass (keyboard/focus/modal exploration). Slower. Default false.
tunnel_secretstring–Secret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.
urlstringyesURL to audit (a public/staging URL the server can reach, or a webability-tunnel URL — not localhost)

No output schema declared.

No examples provided.

verify_fix ~370

Re-scan a specific element after applying an accessibility fix and confirm the violation is gone — closes the loop that find-only tools leave open. After you edit the code and serve it (deployed, staging, or http://localhost:3000), call this with the URL and the selector you fixed to get a machine-checked verified: true|false (DOM engines only — visual_audit findings are out of scope). Pass the WCAG criterion (e.g. "1.1.1") or axe rule id (e.g. "color-contrast") to check just that criterion; omit it to require the element be clean of ALL violations. A blocked page (bot-challenge / HTTP error) is reported as unverified, never a pass — verification fails closed. If the selector matches no element, the result is verified: false with reason "not-found" — pass the element's current selector, or re-run scan_page if your fix removed the element. Pair with scan_page → generate_ai_fix → verify_fix for a full find-fix-verify cycle.

NameTypeReqDescription
selectorstringyesCSS selector of the element you fixed — use the `selector` from the original scan_page issue
urlstringyesURL now serving the fix (deployed, staging, or http://localhost:3000). Also accepted as `page` or `pageUrl`.
viewportstring–Viewport size (default: desktop). Use the same viewport the issue was found at.
wcagstring–Optional: WCAG criterion (e.g. "1.1.1", "1.4.3") or axe rule id (e.g. "color-contrast") to verify specifically. Omit to require the element be free of ALL violations.

No output schema declared.

No examples provided.

visual_audit ~261

[Full — FREE with a WebAbility account. Not runnable in Lite. Connect hosted MCP at https://mcp.webability.io/mcp (dashboard or Smithery: webability/accessibility), authenticate, then call `visual_audit`.] Pixel-level accessibility audit using Claude vision. Catches issues that DOM scanners miss: icon contrast (1.4.11), focus visibility (2.4.7), "looks like a button but isn't" (4.1.2), text rendered as images (1.4.5), visual hierarchy mismatches. Takes a URL, opens it in a headless browser, screenshots, and runs vision-based detection. Complements scan_page — run both for full coverage. Free for everyone; sign in with a free WebAbility account for vision and full audits (sign in by connecting https://mcp.webability.io/mcp/auth, or run `webability login`). Fair-use rate limits apply.

NameTypeReqDescription
brandColorsarray–Brand hex colors for context-aware filtering
fullPageboolean–Capture full scrolled page instead of just viewport (default: false)
urlstringyesURL to audit visually
viewportstring–Viewport size (default: desktop)

No output schema declared.

No examples provided.

Install

How do I install the io.github.snayyar00/webability MCP server?

io.github.snayyar00/webability runs locally as an npm package, launched with npx -y @webability/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @webability/mcp

# add to Claude Code
claude mcp add snayyar00-webability -- npx -y @webability/mcp
Common questions

What is the io.github.snayyar00/webability MCP server?

io.github.snayyar00/webability is an MCP server listed in the public MCP registry as io.github.snayyar00/webability. Free WCAG 2.2/ADA/508 accessibility MCP: scan, AI fixes, verify, vision audit, localhost tunnel. This page covers its npm package (@webability/mcp).

Is the io.github.snayyar00/webability MCP server safe to use?

io.github.snayyar00/webability scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 16 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.snayyar00/webability MCP server expose?

io.github.snayyar00/webability exposes 20 tools: scan_page, verify_fix, diff_scan, start_audit, add_site, and 15 more. Their descriptions and schemas cost roughly 5,241 tokens of context every time the server is loaded.

Is the io.github.snayyar00/webability MCP server still maintained?

io.github.snayyar00/webability is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.snayyar00/webability MCP server under?

io.github.snayyar00/webability declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.