AccessWiser MCP Server

The AccessWiser MCP Server lets the AI coding tool you already use start an automated accessibility scan of one deployed page on a site added to your account, and read the findings back in your editor. It is a small server that runs on your machine, speaks the Model Context Protocol, and talks only to the Scan API, so there is no request code to write. Its README covers Claude Code, Claude Desktop, Cursor and VS Code.

It is published on npm as @accesswiser/mcp (opens in a new tab), free to install and MIT-licensed. The scans it starts draw on your account's allowance, the same as any other scan.

Set it up

You need Node.js 20 or later and a secret scan key (awsk_…), created in your dashboard under Scanning, then Scan API, as step 1 of the Quickstart describes. The public aw_… widget key does not work here. Your AI tool starts the server itself, so there is nothing to install by hand, and the key reaches the server through its environment as ACCESSWISER_SCAN_KEY. It is never one of the server's own arguments. In Claude Code, one command adds it:

claude mcp add --transport stdio --scope user accesswiser --env ACCESSWISER_SCAN_KEY=awsk_YOUR_SECRET_KEY -- npx -y @accesswiser/mcp

The key in that command is an argument to claude, not to the server: claude mcp addstores it in your user-level Claude Code configuration, and Claude Code puts it in the server's environment when it starts the server. Your shell may also keep the command, key included, in its history; the README shows how to pass the key from a variable you have already set.

On native Windows, npx runs through cmd /c, and the Claude Code command is written differently in each shell. In PowerShell or Command Prompt:

claude mcp add --transport stdio --scope user accesswiser --env ACCESSWISER_SCAN_KEY=awsk_YOUR_SECRET_KEY "--" cmd /c npx -y @accesswiser/mcp

The "--" is quoted on purpose. Windows PowerShell 5.1 runs the claude.ps1 script that npm installs, and that script drops the first bare --, so Claude Code would read -y as one of its own options and the command would fail. Command Prompt strips the quotes, so the same line works there. Git Bash turns an argument that starts with / into a Windows path, so in Git Bash write //c:

claude mcp add --transport stdio --scope user accesswiser --env ACCESSWISER_SCAN_KEY=awsk_YOUR_SECRET_KEY -- cmd //c npx -y @accesswiser/mcp

Any other MCP client starts the server with this command, with ACCESSWISER_SCAN_KEYset in the server's environment:

npx -y @accesswiser/mcp

On native Windows, a JSON configuration gives "command": "cmd" and "args": ["/c", "npx", "-y", "@accesswiser/mcp"] instead, whatever shell you use. The configuration for each client, and for native Windows, is in the AccessWiser MCP Server README (opens in a new tab). Keep the key out of any file you commit.

What a scan costs

The server has two tools. scan_page starts a scan and waits up to 40 seconds for the result, or for the number of seconds set in ACCESSWISER_MCP_WAIT_SECONDS. If the scan is still running then, it says so and gives the scan id to read later with get_scan. Each scan it starts uses one specific page scan from your account's monthly allowance, or one purchased specific page scan credit once the allowance is used up — the same as a POST /scans with "scanClass": "quick". It never starts a full site scan. get_scan reads a scan again or pages through its findings, and uses nothing. Like the Scan API, it is included on the Basic, Pro and Business plans. On Free and Starter, the Scan API refuses its requests with plan_required. The allowance on each plan is in scan classes, allowances and credits.

What a result contains

A completed result is one block of text, in this order:

• A summary line: the progress marker as a number on a 0–100 scale, labelled “our own rough marker”, then the issues found, counted by severity, and the checks left for you to do by hand. The marker is the healthScore the API returns, an internal progress indicator and not a grade.
• A link to the visual report in your dashboard. It opens for the account owner after they sign in, and for nobody else.
• The findings, grouped by rule with the most severe first. Each rule shows up to 3 of its elements, each with its selector and its HTML, as the browser rendered the page or as the server sent it, and for some rules with a suggested change for you to review. For a rule with more, the result gives the get_scan call, with rule_id, that lists every element of that rule.
• The coverage disclosure, which comes with every completed result, then the API's disclaimer, which ends every result the server returns, a refusal or an error included.

If the scan could not open the page in a browser and read only the HTML the server sent, the result says so and names the checks that did not run.

What it cannot do

• It scans only sites added to your account. A page on a public host that is not on your account is refused by the API with site_not_added, the same answer POST /scans gives.
• It scans the deployed page as it is served when the scan runs. It cannot reach localhost, private networks, files on your machine or changes you have not deployed, so deploy first, then scan. The server refuses a local or private address itself, before anything is sent to AccessWiser.
• It never changes your site or any repository. AccessWiser suggests changes, and you make them.
• Automated checks find only some accessibility barriers. Treat every result as a starting point for a person, as what automated scanning can and cannot tell you explains.