WCAG 无障碍审计 MCP 服务器

WCAG Report MCP Server

An MCP server that audits web pages for WCAG 2.1 AA accessibility issues using pa11y (HTML_CodeSniffer), and reports them either as Markdown or as a filled-in UU-tilsynet Excel checklist.

It works on live URLs (crawl a site, or check a single page) and on HTML you already have, without any network access.

Features

• Live scans — crawl a site or check one page; issues grouped by WCAG success criterion and severity
• UU-tilsynet Excel reports — official WEB and APP checklist templates, filled in with status colours and cell comments
• SSRF-guarded — private, loopback, link-local and cloud-metadata targets are rejected
• No documents left behind — every report is built in memory and returned inline
• SPA-aware — configurable hydration wait and network-idle navigation for React/Vue/Svelte/Angular
• Norwegian and English reports

Quick start

npm install
docker compose up -d --build     # http://localhost:8009/mcp

Add it to your MCP client:

{
  "servers": {
    "uu-wcag": {
      "type": "http",
      "url": "http://localhost:8009/mcp"
    }
  }
}

Tools

{ "name": "analyze_wcag", "arguments": { "url": "https://example.com", "max_pages": 10, "format": "excel" } }
{ "name": "quick_check", "arguments": { "url": "https://example.com", "language": "en" } }

Scans are serialised — one Chromium per replica, so a second concurrent scan is refused. Each scan also runs against a wall-clock budget (WCAG_SCAN_BUDGET_MS); when it expires you get partial results plus an explicit note.

Privacy: reports are never persisted

Nothing is written to the container filesystem:

• Excel workbooks are produced with ExcelJS writeBuffer() and returned as inline base64
• The Docker build fails if a disk-write call (writeFile, createWriteStream, appendFile, …) is ever added to src/
• Startup warns if a stray artifact directory exists

Configuration

All settings are optional — environment variables or a .env file.

For static sites, drop PA11Y_WAIT to about 1500 ms and use PA11Y_WAIT_UNTIL=domcontentloaded to speed scans up considerably.

Report formats

Markdown — WCAG criteria summary, severity counts, a detailed per-criterion breakdown and page-by-page results.

Excel — the UU-tilsynet checklist for nettsider (997 rules) or for apper (993 rules), with colour-coded status cells, cell comments carrying the violation detail, and a disclaimer sheet. Choose with checklist_type.

Checklist templates

src/contents/WCAG-sjekkliste-web.xlsx and -app.xlsx are loaded at runtime by src/reporter.js. They are generated from UU-tilsynet's published test-rule tables:

# scrape uutilsynet.no and rebuild both workbooks (needs internet)
.\scraping\refresh.ps1

The rule tables themselves are public information from uutilsynet.no.

Limitations

Automated tools detect only about 30–40 % of accessibility issues. Treat this as a screening step, then verify manually:

• Test with real screen readers (NVDA, JAWS, VoiceOver)
• Test keyboard navigation
• Test with people who have disabilities

Common false positives: empty titles in SPAs before JavaScript runs, dynamically rendered content, and slow-network timing.

Development

npm start      # node src/index.js
npm run dev    # nodemon

Licence

MIT — see LICENSE.