MCP.Market

Ara — audits d'accessibilité RGAA MCP server

by DavidPivert·io.github.DavidPivert/ara-rgaa-mcp·v2.5.0·3 stars
No reviews yet

Piloter des audits RGAA 4.1 sur Ara, référentiel embarqué. Non officiel.

B78/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B78/100

full report

Adoption
Growing

3 stars42 downloads/wk

Reviews

Write one

Nobody has reviewed Ara — audits d'accessibilité RGAA yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Ara — audits d'accessibilité RGAA tools (17, 7 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • auth_refresh

    Re-authenticate against Ara using the credentials configured in this server's environment, and report the current authentication state. Takes no arguments on purpose: credentials must never be passed as tool arguments, because tool arguments transit through the model's context and are persisted in conversation transcripts. Configure them in the `env` block of your MCP client configuration: - ARA_A

  • create_auditwrite action

    Create a new RGAA accessibility audit in Ara. Returns the audit with its editUniqueId (for editing) and consultUniqueId (for viewing the report). Audit types: - FULL: all 106 RGAA criteria - FAST: 25 criteria (audit rapide) - COMPLEMENTARY: 25 criteria (audit complémentaire) — disjoint from the rapid ones, the two methodologies together covering 50 Call list_rgaa_criteria to see exactly which crit

  • delete_auditwrite action

    Soft-delete an audit. The audit itself returns HTTP 410 Gone for future requests, and disappears from the account's audit list. This cannot be undone from this server. IMPORTANT — deleting does NOT unpublish. If the audit was published, its report REMAINS publicly readable at its consultation URL after deletion, and it is then reachable from nowhere in the Ara interface, so it can no longer be edi

  • duplicate_audit

    Fully duplicate an existing audit (metadata, pages, RGAA results, example images). Returns a new audit with fresh IDs. The source audit is left untouched.

  • export_csv

    Export audit results in CSV format.

  • get_audit

    Retrieve a full audit by its editUniqueId. Returns all metadata, pages, environments, and notes.

  • get_audit_method

    Return the work plan for an audit type: which criteria can be settled by reading the HTML source, and which ones require the rendered page, keyboard navigation, the accessibility tree, or editorial judgement. Call this BEFORE starting an audit. It tells you which tools you will actually need — a browser, a keyboard pass, a screen reader — instead of discovering halfway through that half the criter

  • get_audit_progress

    Where an audit stands: how many criteria are evaluated on each page, and WHICH ONES ARE LEFT — as a compact list of ids. Use this instead of get_audit_results whenever the question is "what remains to be done". A FULL audit carries 106 criteria per page, transverse elements included: 212 results for a single page, close to a thousand on an eight-page sample. Pulling all of them back just to spot t

  • get_audit_results

    Retrieve all criterion results for an audit. Returns an array of results, each with: - topic (1-13): RGAA topic number - criterium: criterion number within the topic - pageId: ID of the audited page - status: COMPLIANT | NOT_COMPLIANT | NOT_APPLICABLE | NOT_TESTED - compliantComment / notApplicableComment - notCompliantItems: the individual issues found, each with title, comment, userImpact (MINOR

  • get_report

    Get the full audit report (read-only). Includes accessibility rate, criteria counts, and result distributions by page and topic. Uses the consultUniqueId (not the editUniqueId).

  • get_rgaa_criterion
  • list_rgaa_criteria

    List RGAA … criteria as an index: topic number, topic name, criterion number and wording. Tests are NOT included — call get_rgaa_criterion for those. Use this to know what an audit actually covers before evaluating anything. Filter to keep the answer small: - auditType FAST — the 25 criteria of a rapid audit - auditType COMPLEMENTARY — the 25 complementary criteria (disjoint from the rapid ones) -

  • patch_audit_noteswrite action

    Update only the notes field of an audit, without touching other metadata. The new content REPLACES the existing notes. Unlike criterion comments, this field is passed through as rich text: HTML is interpreted. Write &lt;th&gt; rather than <th> if you need to quote markup literally.

  • publish_auditwrite action

    Mark an audit as published/completed. This makes the audit report and its accessibility statement PUBLICLY available at their consultation URL — confirm with the user before calling it. The audit must be fully filled in (all criteria evaluated) before publishing. Returns HTTP 409 if incomplete. IMPORTANT — publishing is effectively irreversible from here. There is no unpublish operation, and delet

  • update_auditwrite action

    Full update of an audit's metadata (procedure info, auditor info, environments, tools, technologies, notes, etc.). This REPLACES the existing metadata: fetch the audit with get_audit first and resend the fields you want to keep.

  • update_audit_resultswrite action
  • update_statementwrite action

    Update the accessibility statement (déclaration d'accessibilité) for an audit, REPLACING the current statement fields. This also PUBLISHES the statement: after the call the audit carries a statementPublicationDate and the déclaration is available at its public consultation URL — confirm with the user before calling it. Publishing the statement is separate from publish_audit, which publishes the au

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

no findings
  • Code scan11 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 57 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Ara — audits d'accessibilité RGAA compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
78/100
higher than 57% of 48,255 servers
Tools
17
the typical server has 7
Tools that change things
41%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
3
more than 80% of 28,688 servers
Downloads a week
42
more than 34% of 12,191 servers with a package

What its tools let an agent do: 10 read · 1 create · 4 change · 1 delete · 1 send or post

Install Ara — audits d'accessibilité RGAA in Claude Code, Cursor or VS Code

Runs npx -y ara-rgaa-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add ara-rgaa-mcp -- npx -y ara-rgaa-mcp
Add to Cursor

What the publisher says

From the Ara — audits d'accessibilité RGAA repository's README, as published. We do not edit it. Read it on GitHub

Ara MCP Server — Audits RGAA via IA

Serveur MCP (Model Context Protocol) qui expose les opérations CRUD sur les audits d'accessibilité RGAA de la plateforme Ara. Permet de piloter un audit Ara entièrement depuis Claude Code, Codex ou tout client MCP compatible — sans login manuel dans le navigateur.

Projet communautaire, non officiel. Ce serveur est un client tiers de l'API d'Ara, le service d'audit d'accessibilité de la DINUM. Il n'est ni édité ni maintenu par la DINUM.

English — An MCP server for Ara, the French government platform for RGAA 4.1 accessibility audits. It exposes 17 tools to create, fill in, publish and export accessibility audits from any MCP client. Requires an account on ara.numerique.gouv.fr. Documentation is in French, matching the audience of the RGAA. Unofficial community project.

Installation

1. Se connecter, une fois :

npx ara-rgaa-mcp login

Une page s'ouvre dans votre navigateur, sur votre propre ordinateur. Vous y saisissez vos identifiants Ara ; le jeton est enregistré dans ~/.config/ara-rgaa-mcp/credentials.json, en permissions 600. Votre mot de passe n'est jamais enregistré.

2. Déclarer le serveur — sans aucun secret dans la configuration :

{
  "mcpServers": {
    "ara-rgaa": {
      "command": "npx",
      "args": ["-y", "ara-rgaa-mcp"]
    }
  }
}

Prérequis : Node.js ≥ 18 et un compte sur ara.numerique.gouv.fr.

Pour Claude Code, le fichier est ~/.claude/claudedesktopconfig.json. Pour Codex ou Cursor, même format dans leurs réglages MCP respectifs.

Le renouvellement est automatique. Les jetons d'Ara durent 24 h, mais le serveur en demande un neuf à chaque démarrage : un usage régulier ne redemande jamais de se connecter. Après plus de 24 h sans usage, le serveur vous dit de relancer login.

Sécurité de la page de connexion

Une page locale qui réclame des identifiants ressemble à du hameçonnage : le serveur prend donc quatre précautions.

  • Il écoute uniquement sur 127.0.0.1, jamais sur une interface réseau.
  • L'URL comporte un jeton aléatoire qu'une autre page locale ne peut pas deviner ; toute autre adresse renvoie 404.
  • Elle est à usage unique : le serveur s'arrête dès la connexion réussie.
  • L'URL exacte est affichée dans le terminal — comparez-la à celle du navigateur avant de saisir quoi que ce soit.

Votre mot de passe ne transite que du navigateur vers ce processus local, puis vers ara.numerique.gouv.fr. Il n'est écrit nulle part.

Si vous n'avez pas lancé la commande vous-même, fermez la page.

Authentification par variables d'environnement

Alternative à login, pour l'automatisation ou les environnements sans navigateur.

Les identifiants ne sont jamais acceptés en paramètres d'outil. Un paramètre d'outil transite par le contexte du modèle et se retrouve conservé dans les transcripts de conversation. Ils sont donc lus uniquement depuis l'environnement du processus ou depuis le fichier écrit par login.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Ara — audits d'accessibilité RGAA: common questions

Is Ara — audits d'accessibilité RGAA MCP server safe?
Mostly: it is graded B (78/100). Read the Ara — audits d'accessibilité RGAA safety report
How do I install Ara — audits d'accessibilité RGAA?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Ara — audits d'accessibilité RGAA need an API key?
Yes. The registry entry asks for ARA_AUTH_TOKEN, ARA_PASSWORD.
Is Ara — audits d'accessibilité RGAA maintained?
The last commit was 98 days ago (2026-07-29). The latest release is v2.5.0.
How does Ara — audits d'accessibilité RGAA compare with other MCP servers?
safety score 78/100 (higher than 57% of 48,255 servers); tools 17 (the typical server has 7); tools that change things 41% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.