← Registry

Security & Testing

webability.io

Scans web pages for WCAG accessibility issues, verifies fixes, compares scans, and generates full audit reports.

1 endpoint13 known toolsFirst detected May 29, 2026Last detected October 6, 2026

ENDPOINT 1

https://mcp.webability.io/mcp

No auth detected

MCP server metadata

Name
webability
Version
1.6.4
Capabilities
tools
Server instructions

WebAbility is a web accessibility platform — AI-powered widget, scanner, and agents for WCAG 2.2 / ADA / Section 508 / EAA compliance. https://webability.io This is **WebAbility MCP** (hosted Full). Free for everyone. Scan and check tools work with no account or key, under fair-use limits per IP. A free WebAbility account (sign-in prompted by your client) unlocks `visual_audit`, `start_audit` and `get_audit`. ## Engines used by scan_page - WebAbility detectors (60+ rules — gradient-aware contrast, weak names, decorative-icon detection, etc.) - axe-core (104 rules) - HTML_CodeSniffer (200+ rules) Results from all three are deduplicated into one issue list. ## Three-tier output (since v1.2.1, mirrors axe-core) `scan_page` and `flow_scan` return (`scan_html` is axe-only and returns raw violations): - **issues**: high-confidence violations — safe to act on - **incomplete**: needs human review — DO NOT auto-fix these. Common causes: contrast against gradient/image backgrounds, marketing-image alt text, framer-motion pre-animation states. - **summary**: counts by severity + an `incomplete` count When proposing fixes to the user, treat `incomplete` items as questions, not bugs. ## Structured fixes (since v1.6.0) Every issue carries `fix.op` from a closed set — `add-attribute`, `set-attribute`, `remove-attribute`, `add-element`, `remove-element`, `add-text-content`, `suggest` — plus `fix.attribute` / `fix.value` when known, and a top-level `fixability`: - **mechanical**: the value is known — apply it as given - **contextual**: the op is known, the VALUE needs judgment (alt text, a label) — read `html` and `message`, then write it - **visual**: needs rendered output (contrast, focus ring, target size) — propose, never auto-apply On React ≤18 / Vue dev builds each issue also carries `source` (`{file, line, column, component}`) read from the live component tree — open that file directly instead of calling find_source. Pass `sourceRoot` (local only) to get `sourceCandidates[]` for production builds. ## Output controls (every scan tool) `minImpact`, `rules[]`, `wcag[]` narrow the result; `format: "compact"` prints one line per element with rule metadata once — use it by default in a coding loop, it is a fraction of the tokens. ## Tool routing - "Scan this page / URL / localhost" → `scan_page` - "Walk through login → checkout" → `flow_scan` with `autoNavigate` - "What does this WCAG rule check" → `get_rules` - "Suggest a fix for this issue" → `detect_framework` then `generate_ai_fix` - "Did my fix work?" → `verify_fix` (after you edit the code AND serve the change — closes scan → fix → verify) - "What changed since the last scan / did I introduce regressions?" → `diff_scan` (baseline vs current → fixed / new / remaining) - "Check this contrast pair" → `check_color_contrast` (pass `url` to get brand-aligned suggestions) - "Find where this selector lives in code" → `find_source` (Lite / local only) - "Validate this HTML snippet / a component's markup" → `scan_html` (in-process, milliseconds, no browser — structural rules only; `engine: "browser"` for contrast) or `check_aria` - "Give me a shareable report of these findings" → `generate_report_pdf` (Lite / local only) - "Catch issues axe misses (icon contrast, focus visibility, look-but-not-button)" → `visual_audit` (free with account) - "I need a report to hand to a compliance officer / legal" → `start_audit`, then poll `get_audit` (free with account) - `find_source` / `scan_history` / `generate_report_pdf` are not available on the hosted server ## Important - The core loop: `scan_page` → `detect_framework` → `generate_ai_fix` → edit source → `verify_fix`. - Generated fix code edits the user's source — confirm before applying. - The widget runtime applies its own client-side patches at runtime; do not duplicate those edits in source code.

Known tools 13

scan_page

Scan a web page for WCAG accessibility issues.

Inferred read-only
verify_fix

Re-scan a specific element after applying an accessibility fix and confirm the violation is gone — closes the loop that find-only tools leave open.

Inferred read-only
diff_scan

Compare two scans of the same page and report what changed: `fixed[]` (in the baseline, gone now), `new[]` (regressions — not in the baseline, present now), `remaining[]` (still there).

Inferred read-only
start_audit

Kick off a FULL accessibility audit deliverable for a URL — a persistent, timestamped artifact, not an inline scan.

Inferred read-only
get_audit

Check an audit started with start_audit: returns overall status, per-step progress (scan → viewports → screenshots → agent → excel → publish), and — once complete — a severity summary plus short-lived download URLs for the report (JSON) and the Excel workbook.

Potential side effects
flow_scan

Scan a multi-page user journey.

Inferred read-only
detect_framework

Detect which framework/stack a page uses (Tailwind, MUI, Bootstrap, WordPress, Next.

Inferred read-only
generate_ai_fix

Generate framework-aware fix alternatives for a specific accessibility issue.

Inferred read-only
visual_audit

Pixel-level accessibility audit using Claude vision.

Inferred read-only
scan_html

Scan a raw HTML snippet or component markup without serving it — IN-PROCESS by default (jsdom + WebAbility detectors + axe-core): milliseconds, no browser, no network, so it fits inside a tight edit loop.

Potential side effects
get_rules

List accessibility rules from both engines — axe-core (104) and the WebAbility detectors (90+) — with optional filters.

Inferred read-only
check_color_contrast

Check a foreground/background color pair against WCAG contrast thresholds.

Inferred read-only
check_aria

Validate ARIA attribute + accessible name/role/value usage in an HTML snippet.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.webability]
url = "https://mcp.webability.io/mcp"
enabled = true
Claude Code

.mcp.json

{
  "mcpServers": {
    "webability": {
      "type": "http",
      "url": "https://mcp.webability.io/mcp"
    }
  }
}
Claude Desktop

Settings → Connectors → Add custom connector

Name: webability
Remote MCP URL: https://mcp.webability.io/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "webability": {
      "url": "https://mcp.webability.io/mcp"
    }
  }
}
Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code
{
  "servers": {
    "webability": {
      "type": "http",
      "url": "https://mcp.webability.io/mcp"
    }
  }
}
Generic MCP

Client-specific MCP configuration

{
  "name": "webability",
  "transport": "streamable-http",
  "url": "https://mcp.webability.io/mcp"
}
MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.