Val MCP server

Read from the package source without running it. The installed server may list more.

• val_a11y_audit

  Inject axe-core into the page and run a WCAG 2.0 / 2.1 A + AA audit plus best-practice checks. Returns each violation with id, impact (minor/moderate/serious/critical), a description, help URL, and up to 5 offending elements with their HTML snippets and failure summary. Use this when you want a real a11y review, not just the cheap heuristics in val_scan.

• val_actwrite action

  Run a host-LLM-planned sequence on the current session (click, type, scroll, wait, open, screenshot). Each step gets a screenshot afterward (signed 30d URL) plus the resulting URL/title/changes/errors. This is the agentic loop: the LLM plans, Val drives the browser, the LLM re-reads the transcript and decides the next step.

• val_capture_network

  Open a URL and record every HTTP request the page fires for up to 30 seconds (default 5s). Returns method, URL, status, content-type, duration, request body (capped 4KB), and a preview of the response body for JSON/text payloads. Catches the class of bug where a vibecoded app returns HTTP 200 with `{ ok: false, error: '…' }` in the JSON body, which the browser does not flag as an error.

• val_checkwrite action

  Run the passive checks on a SINGLE page. Use after fixing a bug to confirm it is gone.

• val_click

  Click an element by its [ref] (from val_snapshot) or by visible text. Returns whether anything changed, where it navigated, and any errors triggered. If nothing changes and no error fires, the control is flagged as a possible dead button.

• val_close

  Close the browser session when finished walking a flow.

• val_compare

  Take a screenshot of each URL (signed 30d URLs, or base64 fallback), grab their visible text, and return a structured diff: which phrases appeared, which disappeared, character delta, same-URL flag. This is the building block for 'did the agent's fix actually land?': pass the preview URL before and after a deploy, let the host LLM judge.

• val_console

  Open a URL and capture every console.log / warn / error / info message (plus uncaught page errors) for up to 30 seconds (default 5s). Returns type, text, and source location. Use this to read what the app says about itself at runtime: deprecation warnings, missing keys, hydration mismatches, third-party SDK complaints.

• val_dedupe

  Search a repo's open + closed issues for the given query string and return up to 10 matches with number, title, URL, state. Call this BEFORE val_file_finding to skip duplicates.

• val_describe

  Open a URL and return a structured snapshot: signed 30d screenshot URL (or base64 fallback), a compressed visible-only DOM outline, visible body text (capped), and any console / page / network errors observed at load. Cheaper than a crawl, richer than a screenshot. Pass `device` to render mobile.

• val_detect_paywall

  Inspects the page for Stripe, Paddle, LemonSqueezy, or Gumroad. Returns the processor name, whether it is in test or live mode (for Stripe), and a clear go or no-go decision: can Val safely bypass this with a test card, or does it need a real subscription? Always call before val_pay_stripe_test.

• val_exercise

  Deterministically click every visible button on the current page (returning to the page after any navigation) and report which ones are DEAD (no effect, no error, no network) or which throw a JS error. The fast way to answer 'is any button broken on this screen?'.

• val_exercise_forms

  Find every visible <form>, fill its inputs with plausible test data (email, password, text, etc.), submit it, and report which forms are DEAD (submit produced no effect, no API call, no DOM change), which threw a JS error, and which submitted successfully. Complements val_exercise — buttons-only sweeps miss broken signup/checkout/contact forms.

• val_file_findingwrite action

  Post a structured Val report. If `target` is a PR URL, posts as a PR comment (updating in-place if a prior Val finding exists). Otherwise treats target as 'owner/repo' and opens a new issue. Optionally embeds a screenshot URL at the top.

• val_invariants

  Observe a URL for up to 15s and report runtime invariant violations: NaN / undefined / null / [object Object] leaking into the UI, 5xx responses, uncaught JS errors. Combine with val_act to validate a whole funnel.

• val_lighthouse

  Launches a headless Chrome via chrome-launcher and runs Lighthouse against the URL with all four core categories (performance, accessibility, best-practices, seo). Returns category scores (0 to 1), the key Web Vitals (LCP, FCP, TBT, CLS, Speed Index, TTI in milliseconds), and the top 8 failing audits sorted by severity. Pass formFactor='mobile' (default) or 'desktop'.

• val_login

  Drives a login form with the email and password you pass. Finds the email/username and password fields heuristically, fills them, submits, waits for navigation, and reports success or failure. Cookies and storage are persisted in the session, so every subsequent val_* call (val_describe, val_review, val_act, val_a11y_audit, etc.) runs as the authenticated user. ALWAYS use a dedicated test account;

• val_open

  Start (or reuse) the browser session and navigate to a URL. Returns the page state and any load errors. This begins an interactive session you drive with val_snapshot / val_click / val_type to walk a funnel (e.g. sign up, checkout).

• val_pay_stripe_testwrite action

  If the current page is showing Stripe Elements AND Stripe is loaded in test mode (pk_test_*), Val fills card number 4242 4242 4242 4242, exp 12/35, cvc 123, postal 12345. Refuses (returns ok=false) if Stripe is in live mode so we never trigger a real charge. After this fills the form, you still need val_click to press the Pay/Subscribe button.

• val_pr_context

  Pulls everything Val (and the host LLM) needs to reason about a PR: title, body, author, base/head branches, changed files with line counts, the unified diff, commit summaries, linked issue references, and a best-effort preview deployment URL parsed from PR check details (Vercel, Netlify, Fly, etc.). Pass a PR URL or number.

• val_review

  The one-shot Val workflow: pass either a URL or a GitHub PR URL. If URL: runs describe + a11y audit + invariants on it, returns a structured report with status (green/yellow/red), findings, and a markdown summary. If PR: pulls PR context, finds the preview deployment, infers up to 3 touched routes from the diff, tests each, and posts the report as a PR comment (set postToPr=false to skip posting).

• val_scan

  Crawl an app (localhost or live), following same-origin links, and report passive bugs: broken links/404s, uncaught JS errors, console errors, failed network requests, broken images, missing titles, horizontal layout overflow, clipped text, and janky load (layout shift / CLS). Pass `device` to test the MOBILE rendering (e.g. 'iPhone 14'). Good first pass. Does NOT click buttons — use val_open/val_

• val_scan_devices

  Crawl the app under MULTIPLE device profiles in parallel (e.g. ['desktop', 'iPhone 14', 'Pixel 7']) and report findings. Bugs that appear on every device are tagged 'all'; mobile-only or desktop-only bugs keep their device tag so the agent knows where to fix. Use this instead of val_scan when responsive behavior matters.

• val_screenshot

  Capture a PNG of a URL so you can reason about layout/visual issues.

• val_snapshot

  Return every clickable/fillable element on the current page with a [ref] you can pass to val_click / val_type, plus its kind and label. Call this to see what you can act on before clicking or typing.

• val_state

  Return the current URL/title and any console/JS/network errors captured since the last action. Use to verify a step did not break anything.

• val_type

  Fill an input/textarea (by [ref] or label) with text. Use to fill a signup or checkout form, then val_click the submit button.

• val_verify_fix

  Pulls PR context, infers which user-facing routes the changed files probably touch (Next.js app/pages router, SvelteKit), then runs val_describe + val_invariants on each route against the PR's preview URL. Returns a bundle the host LLM can use to judge: 'is the claim true?'. Pass `previewUrl` if you already have it; otherwise Val tries to read it from the PR's check details.

• Code scan11 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 122 days ago8/15
• Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace7/10

Safety score

71/100

higher than 36% of 866 Scraping and browsing servers

Tools

28

the typical Scraping and browsing server has 6

Tools that change things

14%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

36

more than 18% of 309 Scraping and browsing servers with a package

Val: common questions

Is Val MCP server safe?

Mostly: it is graded B (71/100). Read the Val safety report

How do I install Val?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Val need an API key?

Yes. The registry entry asks for VAL_LICENSE_KEY.

Is Val maintained?

The last commit was 160 days ago (2026-05-28). The latest release is v0.10.1.

What can I use instead of Val?

Servers from other publishers that do the same job: GrowBlocks Dev Kit MCP server, KnownFix MCP server and SeleniumBase MCP server.

How does Val compare with other Scraping and browsing MCP servers?

safety score 71/100 (higher than 36% of 866 Scraping and browsing servers); tools 28 (the typical Scraping and browsing server has 6); tools that change things 14% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.