Back to Home
Berucha icon

a11y-mcp

Verified Safe

by Berucha

Overview

Automated WCAG 2.2 AA accessibility code review for GitHub Pull Requests, providing immediate feedback and fix suggestions.

Installation

Run Command
sh /workspace/a11y-mcp/run.sh

Environment Variables

  • GITHUB_TOKEN
  • LDS_STORYBOOK_URL
  • LDS_CACHE_TTL

Security Notes

The server interacts with GitHub API (`@octokit/rest`) to fetch PR content and post comments, requiring `GITHUB_TOKEN` with `pull-requests: write` scope. File system operations (`fs.readFileSync`) are used for local file analysis. The `child_process.spawn` is used internally by `mcp-client.js` to invoke the `mcp-server.js` or `cli-scanner.js` locally, and by `run.sh` to potentially start a Python HTTP server (for artifacts viewer). No direct `eval` or arbitrary external command execution from user input is observed. `LDS_STORYBOOK_URL` could point to an external resource, but its usage is currently for a planned feature (Phase 2) and not actively making network requests from the core analysis. Overall, the approach seems designed with security in mind for its intended purpose, but relies on GitHub's security for fetching PR content.

Similar Servers

Stats

Interest Score0
Security Score8
Cost ClassMedium
Avg Tokens1500
Stars0
Forks0
Last Update2025-12-12

Tags

accessibilitywcaggithub-actionscode-reviewmcp