← MCP Security Catalog

@accesslint/mcp 0.11.1

npm · @accesslint/mcp · latest release

Scan failed
Security result
4
Observed tools
Version rating
95
Change risk

Independent inventory

Observed 2026-08-25T04:47:47.017Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
audit_htmlAudit an HTML string for accessibility violations. Ensures a debuggable Chrome (auto-launches one headless if none is reachable), loads the HTML into a blank tab, and runs the @accesslint/core engine against the real DOM. Auto-detects fragments vs full documents.
Input schema
{
  "type": "object",
  "properties": {
    "html": {
      "type": "string",
      "description": "HTML to audit for accessibility violations"
    },
    "port": {
      "type": "integer",
      "exclusiveMinimum": 0,
      "description": "CDP port to attach to / launch on. Defaults to 9222 or ACCESSLINT_CDP_PORT. Omit for auto-detection."
    },
    "host": {
      "type": "string",
      "description": "CDP host. Defaults to 127.0.0.1."
    },
    "min_impact": {
      "type": "string",
      "enum": [
        "critical",
        "serious",
        "moderate",
        "minor"
      ],
      "description": "Only show violations at this severity or above"
    },
    "format": {
      "type": "string",
      "enum": [
        "verbose",
        "compact"
      ],
      "description": "Output verbosity. 'compact' fits one violation per line; default 'verbose'."
    },
    "rules": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Allow-list of rule IDs to run (e.g. [\"text-alternatives/img-alt\"])"
    },
    "wcag": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Allow-list of WCAG criteria to run (e.g. [\"1.4.3\", \"2.4.4\"])"
    },
    "include_aaa": {
      "type": "boolean",
      "description": "Include WCAG AAA-level rules in the audit"
    },
    "component_mode": {
      "type": "boolean",
      "description": "Treat the page as a component fragment (skip page-level rules like html-has-lang). Auto-detected from the markup when omitted."
    }
  },
  "required": [
    "html"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
audit_liveAudit a live URL via CDP. Ensures a debuggable Chrome (auto-launches one headless via @accesslint/chrome if none is reachable — no manual setup needed), then runs the @accesslint/core engine against the live DOM. CSP-bypassing. Use this for any URL audit.
Input schema
{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "format": "uri",
      "description": "URL to audit. Reuses an existing tab matching this URL; opens a new one otherwise."
    },
    "port": {
      "type": "integer",
      "exclusiveMinimum": 0,
      "description": "CDP port to attach to / launch on. Defaults to 9222 or ACCESSLINT_CDP_PORT. Omit for auto-detection."
    },
    "host": {
      "type": "string",
      "description": "CDP host. Defaults to 127.0.0.1."
    },
    "wait_for": {
      "type": "string",
      "description": "Selector or visible text to wait for after navigation (e.g. '#main', 'Welcome'). Polls until present or wait_timeout_ms elapses."
    },
    "wait_timeout_ms": {
      "type": "integer",
      "exclusiveMinimum": 0,
      "description": "Max ms to wait for wait_for / selector. Default 10000."
    },
    "selector": {
      "type": "string",
      "description": "CSS selector to scope the audit to; auto-waits for the element, then reports only violations inside it."
    },
    "min_impact": {
      "type": "string",
      "enum": [
        "critical",
        "serious",
        "moderate",
        "minor"
      ],
      "description": "Only show violations at this severity or above"
    },
    "format": {
      "type": "string",
      "enum": [
        "verbose",
        "compact"
      ],
      "description": "Output verbosity. 'compact' fits one violation per line; default 'verbose'."
    },
    "rules": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Allow-list of rule IDs to run"
    },
    "wcag": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Allow-list of WCAG criteria to run (e.g. [\"1.4.3\", \"2.4.4\"])"
    },
    "include_aaa": {
      "type": "boolean",
      "description": "Include WCAG AAA-level rules in the audit"
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
explain_ruleReturn detailed metadata for a single rule: description, WCAG criteria, level, fixability, browser hint, and remediation guidance.
Input schema
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Rule ID, e.g. 'text-alternatives/img-alt'. Discover IDs via list_rules."
    }
  },
  "required": [
    "id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
list_rulesList available accessibility rules with optional filters by category, WCAG level, fixability, or criterion.
Input schema
{
  "type": "object",
  "properties": {
    "category": {
      "type": "string",
      "description": "Filter by category slug (e.g. \"aria\", \"text-alternatives\")"
    },
    "level": {
      "type": "string",
      "enum": [
        "A",
        "AA",
        "AAA"
      ],
      "description": "Filter by WCAG level"
    },
    "fixability": {
      "type": "string",
      "enum": [
        "mechanical",
        "contextual",
        "visual"
      ],
      "description": "Filter by fixability"
    },
    "wcag": {
      "type": "string",
      "description": "Filter by WCAG criterion (e.g. \"1.1.1\")"
    },
    "format": {
      "type": "string",
      "enum": [
        "verbose",
        "compact"
      ],
      "description": "Output verbosity. 'compact' is one rule per line; default 'verbose' is a table."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Resources 0

Resource templates 0

Prompts 1

Changes from previous version

Compared with 0.10.0 using full_plus_regression. View version comparison →

RiskChangeSubject
criticalfile_modifiedpackage.json
criticalinstall_script_changedinstall_scripts
highentrypoint_changedexecutable_entrypoints
highfile_modifieddist/index.js
lowfile_modifiedREADME.md

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: fa90836619382650d189bb0764f4bc36244ea8c1fcbe678b7b65c5e0e1f6c0db

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.