Security & Testing
webability.io
Scans web pages for WCAG accessibility issues, verifies fixes, compares scans, and generates full audit reports.
ENDPOINT 1
https://mcp.webability.io/mcp
MCP server metadata
- Name
- webability
- Version
- 1.6.4
WebAbility is a web accessibility platform — AI-powered widget, scanner, and agents for WCAG 2.2 / ADA / Section 508 / EAA compliance. https://webability.io This is **WebAbility MCP** (hosted Full). Free for everyone. Scan and check tools work with no account or key, under fair-use limits per IP. A free WebAbility account (sign-in prompted by your client) unlocks `visual_audit`, `start_audit` and `get_audit`. ## Engines used by scan_page - WebAbility detectors (60+ rules — gradient-aware contrast, weak names, decorative-icon detection, etc.) - axe-core (104 rules) - HTML_CodeSniffer (200+ rules) Results from all three are deduplicated into one issue list. ## Three-tier output (since v1.2.1, mirrors axe-core) `scan_page` and `flow_scan` return (`scan_html` is axe-only and returns raw violations): - **issues**: high-confidence violations — safe to act on - **incomplete**: needs human review — DO NOT auto-fix these. Common causes: contrast against gradient/image backgrounds, marketing-image alt text, framer-motion pre-animation states. - **summary**: counts by severity + an `incomplete` count When proposing fixes to the user, treat `incomplete` items as questions, not bugs. ## Structured fixes (since v1.6.0) Every issue carries `fix.op` from a closed set — `add-attribute`, `set-attribute`, `remove-attribute`, `add-element`, `remove-element`, `add-text-content`, `suggest` — plus `fix.attribute` / `fix.value` when known, and a top-level `fixability`: - **mechanical**: the value is known — apply it as given - **contextual**: the op is known, the VALUE needs judgment (alt text, a label) — read `html` and `message`, then write it - **visual**: needs rendered output (contrast, focus ring, target size) — propose, never auto-apply On React ≤18 / Vue dev builds each issue also carries `source` (`{file, line, column, component}`) read from the live component tree — open that file directly instead of calling find_source. Pass `sourceRoot` (local only) to get `sourceCandidates[]` for production builds. ## Output controls (every scan tool) `minImpact`, `rules[]`, `wcag[]` narrow the result; `format: "compact"` prints one line per element with rule metadata once — use it by default in a coding loop, it is a fraction of the tokens. ## Tool routing - "Scan this page / URL / localhost" → `scan_page` - "Walk through login → checkout" → `flow_scan` with `autoNavigate` - "What does this WCAG rule check" → `get_rules` - "Suggest a fix for this issue" → `detect_framework` then `generate_ai_fix` - "Did my fix work?" → `verify_fix` (after you edit the code AND serve the change — closes scan → fix → verify) - "What changed since the last scan / did I introduce regressions?" → `diff_scan` (baseline vs current → fixed / new / remaining) - "Check this contrast pair" → `check_color_contrast` (pass `url` to get brand-aligned suggestions) - "Find where this selector lives in code" → `find_source` (Lite / local only) - "Validate this HTML snippet / a component's markup" → `scan_html` (in-process, milliseconds, no browser — structural rules only; `engine: "browser"` for contrast) or `check_aria` - "Give me a shareable report of these findings" → `generate_report_pdf` (Lite / local only) - "Catch issues axe misses (icon contrast, focus visibility, look-but-not-button)" → `visual_audit` (free with account) - "I need a report to hand to a compliance officer / legal" → `start_audit`, then poll `get_audit` (free with account) - `find_source` / `scan_history` / `generate_report_pdf` are not available on the hosted server ## Important - The core loop: `scan_page` → `detect_framework` → `generate_ai_fix` → edit source → `verify_fix`. - Generated fix code edits the user's source — confirm before applying. - The widget runtime applies its own client-side patches at runtime; do not duplicate those edits in source code.
Known tools 13
verify_fixRe-scan a specific element after applying an accessibility fix and confirm the violation is gone — closes the loop that find-only tools leave open.
Inferred read-onlydiff_scanCompare two scans of the same page and report what changed: `fixed[]` (in the baseline, gone now), `new[]` (regressions — not in the baseline, present now), `remaining[]` (still there).
Inferred read-onlystart_auditKick off a FULL accessibility audit deliverable for a URL — a persistent, timestamped artifact, not an inline scan.
Inferred read-onlyget_auditCheck an audit started with start_audit: returns overall status, per-step progress (scan → viewports → screenshots → agent → excel → publish), and — once complete — a severity summary plus short-lived download URLs for the report (JSON) and the Excel workbook.
Potential side effectsdetect_frameworkDetect which framework/stack a page uses (Tailwind, MUI, Bootstrap, WordPress, Next.
Inferred read-onlygenerate_ai_fixGenerate framework-aware fix alternatives for a specific accessibility issue.
Inferred read-onlyscan_htmlScan a raw HTML snippet or component markup without serving it — IN-PROCESS by default (jsdom + WebAbility detectors + axe-core): milliseconds, no browser, no network, so it fits inside a tight edit loop.
Potential side effectsget_rulesList accessibility rules from both engines — axe-core (104) and the WebAbility detectors (90+) — with optional filters.
Inferred read-onlycheck_color_contrastCheck a foreground/background color pair against WCAG contrast thresholds.
Inferred read-onlycheck_ariaValidate ARIA attribute + accessible name/role/value usage in an HTML snippet.
Inferred read-onlyCONNECT WITH APPROVAL
Client installation
Review this server and its permissions before adding it. Secret placeholders must be set locally.
Codex
~/.codex/config.toml
[mcp_servers.webability]
url = "https://mcp.webability.io/mcp"
enabled = true
Claude Code
.mcp.json
{
"mcpServers": {
"webability": {
"type": "http",
"url": "https://mcp.webability.io/mcp"
}
}
}
Claude Desktop
Settings → Connectors → Add custom connector
Name: webability
Remote MCP URL: https://mcp.webability.io/mcp
Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.
Cursor
.cursor/mcp.json
{
"mcpServers": {
"webability": {
"url": "https://mcp.webability.io/mcp"
}
}
}
Visual Studio Code
.vscode/mcp.json
Add to Visual Studio Code{
"servers": {
"webability": {
"type": "http",
"url": "https://mcp.webability.io/mcp"
}
}
}
Generic MCP
Client-specific MCP configuration
{
"name": "webability",
"transport": "streamable-http",
"url": "https://mcp.webability.io/mcp"
}
MCP Inspector
Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.
TRUST AND VERIFICATION EVIDENCE
Loading Trust v2 evidence…
Checking the associated registrable domain. The BuiltWith key remains server-side.
Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.