Section 508 Evidence MCP
WCAG + Section 508 audits that produce the deliverable federal buyers actually require: ACR/VPAT-ready evidence.
status: in-developmentclass: mcpAccessibility ComplianceAudits
Vendor: Cyan Eclipse Technologies
What it does
- Statically audit caller-supplied HTML against WCAG 2.1 A/AA as incorporated by Revised Section 508: 22 statically decidable checks (alt text, form labels, heading order, page lang and title, duplicate ids, ARIA validity, link/button names, positive tabindex, data-table headers, iframe titles, contrast for inline-declared colors, and more)
- Evidence-bound findings: every finding carries its WCAG criterion id, a verbatim snippet of the supplied markup, and an element locator (DOM path + line), verifiable against the exact bytes that produced it
- ACR/VPAT-ready evidence report in VPAT table shape (criterion → conformance level → evidence/remarks)
- NOT_STATICALLY_DECIDABLE honesty: 15 criteria that static markup cannot decide are reported with reasons on every audit, never silently passed — a zero-failure audit still claims conformance NONE, and 1.4.3 renders Partially Supports when stylesheet contrast is unknowable, never a clean Supports
- Fail-closed named refusals on malformed input; v0.1 audits one supplied document per call — no rendered DOM, no browser, no multi-page crawl
Tools
audit_html · acr_report · checks_list
Platforms
- MCP over stdio (HTTP transport on roadmap)
Certification
Bench verdict: CERTIFIED(local)
Certified scope: CERTIFIED(local) — Eclipse Bazaar Test Bench 2026-10-26, 19 pass, 1 na of 20 checks (U1 auth: stdio process boundary). Run by W-003 (Verity), suites/section508.py. Runs 1–2 FAILED on bench-suite defects (a locator regex, then a corpus threshold) — no product code was touched between runs; run 3 is the standing card. N-CHECK: NOVELTY_PROVEN — the evidence binding (criterion id + verbatim snippet + element locator, programmatically verified on every bound finding) plus NOT_STATICALLY_DECIDABLE honesty: partially-decidable 1.4.3 renders Partially Supports, never a clean Supports, and a zero-failure audit still claims conformance NONE.
Not tested:
- Rendered-DOM / browser auditing — NOT built in v0.1 and not attempted: this environment has no headless browser. Only static analysis of caller-supplied HTML text is in scope.
- External-CSS / cascade contrast beyond inline-declared colors — classified NOT_STATICALLY_DECIDABLE in-product, never approximated or passed.
- Multi-page / site-level audits — v0.1 audits one supplied document per call.
- Formal VPAT 2.x edition exports (INT / Section 508 edition) and completed/signed ACR generation — v0.1 emits ACR/VPAT-ready evidence in VPAT table shape only.
- WCAG 2.2-only criteria — the Section 508-incorporated standard audited is WCAG 2.1 A/AA.
- Backlog D1 (minor, non-gating, house-pattern, from the standing card): an unparseable raw line on stdio returns -32603 with raw exception text where JSON-RPC reserves -32700 for parse errors; recorded for a house-wide fix wave.
Bench scorecard (evidence): https://eclipsebazaar.com/cards/eclipse-section508-mcp-2026-10-26-3.json
Pricing
Planned — PAID: per-audit report $29-$99 + subscription for continuous checks (slate sketch, not launched); free local v0.1
Install / verify
docker run -i ghcr.io/cyan-eclipse-technologies-llc/eclipse-section508-mcp:latest
Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).