AllyProof Accessibility

npx add-mcp 'https://allyproof.com/api/mcp'

AllyProof runs a hosted Model Context Protocol (MCP) server, so AI agents like Cursor, Claude Code, and Claude Desktop can scan pages and work with your accessibility data without leaving the editor. The endpoint is https://allyproof.com/api/mcp (Streamable HTTP transport).

Business includes API keys, CLI, authenticated MCP tools and CI/CD integration. Organization owners and admins can create keys. Free does not include API keys; public MCP scan_url remains available without a key.

What MCP means

MCP is the connection between your AI assistant and AllyProof. You ask the assistant to inspect a page or retrieve findings; it calls an AllyProof tool and receives structured results. AllyProof runs the scans on its servers. You do not need to install the AllyProof CLI or run a local MCP server.

Use scan_url for a quick check of one public page. Use the authenticated tools for work tied to your organization, such as starting a crawl and reviewing its saved findings. MCP does not give AllyProof access to your editor or automatically change your source code; your assistant handles any code edits in its own environment.

What your agent can do

The tool surface expands once you add an API key. Without a key, the public scan_url tool is available to anyone; with a key, your agent also gets tools scoped to your own organization.

Tool	Needs key?	What it does
scan_url	No	Scan any single URL for WCAG 2.2 AA violations. Returns a score, severity breakdown, and up to 20 violations with WCAG criteria and fix guidance.
list_sites	Yes	List the sites registered in your organization.
scan_site	Yes	Start a full multi-page scan (a crawl) of one of your registered sites, by site_id or url.
list_violations	Yes	List your open violations with their WCAG criteria, affected pages, and AI-generated fix suggestions. Filter by site_id and impact.

Get an API key

In the organization switcher, select the organization you want the agent to use. An owner or admin can create a key at Settings → API Keys when the organization's effective plan is Business or Enterprise, including an admin-granted upgrade. Members and guests cannot create keys. It's shown once at creation - copy it before closing the dialog.

A key is a credential for that organization. Newly created keys include the supported scopes; scan_site requires scan:trigger, and list_violations requires violations:read. Revoked or expired keys stop working. Keep keys out of prompts, screenshots and committed configuration files. Revoke an unused key before creating another if you reach the ten-key limit.

Connect your agent

Claude Code (CLI)

claude mcp add --transport http allyproof https://allyproof.com/api/mcp \
  --header "x-api-key: ap_live_..."

Omit the --header flag for scan-only (public) access.

Cursor (config file)

Add AllyProof to .cursor/mcp.json for a project, or your global Cursor MCP configuration. Replace the placeholder locally and keep the file out of version control if it contains a key:

{
  "mcpServers": {
    "allyproof": {
      "url": "https://allyproof.com/api/mcp",
      "headers": { "x-api-key": "ap_live_..." }
    }
  }
}

You can also generate these snippets pre-filled with your key from Settings → Integrations.

Other MCP clients

Configure a remote server with URL https://allyproof.com/api/mcp, transport Streamable HTTP, and header x-api-key containing your key. Omit the header for public access. Configuration formats vary by client; the Cursor JSON above is not a universal Claude Desktop configuration. Authenticated access requires a client that can send custom HTTP headers. See the current Claude Code and Cursor instructions for client-specific options.

Try it

Once connected, ask your agent things like:

• "Scan https://example.com/pricing for accessibility issues."
• "List my sites, then start a scan of the marketing site."
• "What are my open critical violations and how do I fix them?"

Limits & scope

For a saved site scan, ask the agent to call list_sites, then scan_site with the selected site_id. The returned scan_id confirms the background job was started, not that it has finished. Check progress in the dashboard or with the REST API; after completion, use list_violations filtered by that site. The MCP server currently has no dedicated scan-status tool.

• scan_url is a single-page scan, rate-limited per IP and cached for 24h. For a full-site crawl, use scan_site (with a key) or the REST API.
• After changing a page, an authenticated caller can pass fresh: true to scan_url to bypass its cache. Check scanned_at and cached in the result. Fresh public scans still do not update a registered site's history.
• Only scan_site appears in a site's scan history. scan_url will happily scan a URL that is not yours, so it is not attached to any site, does not affect a site's score, and is not stored as a scan. If you are running scan_url against your own site and wondering why the dashboard has not moved, that is why - add an API key and use scan_site, and the run shows up in the history with MCP as its source.
• Account-scoped tools read and write only your organization's data, scoped by the API key - exactly like the v1 REST API and CLI.
• Automated scanning detects common WCAG failure patterns; it cannot establish conformance, and no findings is not evidence of conformance. Determining conformance also needs manual review. No tool can guarantee legal compliance.

Troubleshooting

What you see	What to check
Only scan_url is available	The connection is public. Check the key header, expiration, revocation and the organization's effective plan, then reconnect or refresh the client's tool list.
A key-scope error	Use a key with the required scope. Changing a plan does not expand an existing key's permissions.
405 Method Not Allowed when opening the endpoint in a browser	This is expected: MCP uses JSON-RPC requests over HTTP POST. Connect through an MCP client.
Findings look unchanged after a fix	Request fresh: true with a valid key, or run a new scan_site and wait for completion.
Site not found	Check which organization issued the key and use an ID from list_sites.
Scan rejected or temporarily unavailable	Follow the returned verification, rate-limit or concurrency message. MCP uses the same server-side scan eligibility checks as the REST API.

Next steps

• Prefer scripting? See the CLI and REST API.
• Gate your builds with the CI/CD guide.