# audit_url

Run accessibility checks against a live URL. Catches dynamic behaviour (focus management, transitions, live regions) that audit_html cannot. NOTE: it drives a fresh headless browser with no app state — for routes that depend on localStorage / auth / prior interaction, seed localStorage (or initScript) so the real view renders, and check the returned audited block to confirm which view was tested.

Agent View of the PolicyLayer registry record for `audit_url`. HTML page: https://policylayer.com/tools/a11y-assist-mcp/audit-url

## Facts

- Tool: `audit_url`
- Server: A11y Assist (`a11y-assist-mcp`) — https://policylayer.com/tools/a11y-assist-mcp.md
- Install: `npx -y a11y-assist-mcp`
- Homepage: https://www.npmjs.com/package/a11y-assist-mcp
- Risk category: Execute (High risk)
- Registry record: grade D, identity unverified
- Server rate-limited: no
- Parameters: 4 (1 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `url` | string | yes | URL to audit. Storybook story, dev server route, staging page, anywhere reachable from this machine. |
| `initScript` | string | no | JavaScript to run before the page's own scripts (Playwright addInitScript) — e.g. to seed cookies or app state. Trusted/dev use only. |
| `localStorage` | object | no | Seed localStorage entries (key→value) BEFORE the page loads, so state-dependent routes render real content. audit_url otherwise starts from a fresh browser with |
| `waitForSelector` | string | no | CSS selector to wait for before running axe — useful for SPAs or async content. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "audit_url",
    "arguments": {
      "url": "<url>"
    }
  }
}
```

## Why audit_url is rated High

audit_url triggers real processes with real consequences. An agent gone sideways doesn't fire it once. It starts dozens of builds, sends mass notifications, or burns through compute before anyone looks up.

Risk signals: Accepts URL/endpoint input (url)

## Use case

AI agents invoke audit_url to trigger actions in A11y Assist. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches A11y Assist:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "audit_url": {
      "limits": [
        {
          "counter": "audit_url_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on A11y Assist (11)

- `audit_html` — Execute — https://policylayer.com/tools/a11y-assist-mcp/audit-html.md
- `evaluate_verification` — Read — https://policylayer.com/tools/a11y-assist-mcp/evaluate-verification.md
- `get_act_rule` — Read — https://policylayer.com/tools/a11y-assist-mcp/get-act-rule.md
- `get_apg_pattern` — Read — https://policylayer.com/tools/a11y-assist-mcp/get-apg-pattern.md
- `get_aria_role` — Read — https://policylayer.com/tools/a11y-assist-mcp/get-aria-role.md
- `get_element_roles` — Read — https://policylayer.com/tools/a11y-assist-mcp/get-element-roles.md
- `get_wcag_sc` — Read — https://policylayer.com/tools/a11y-assist-mcp/get-wcag-sc.md
- `list_apg_patterns` — Read — https://policylayer.com/tools/a11y-assist-mcp/list-apg-patterns.md
- `search_act` — Read — https://policylayer.com/tools/a11y-assist-mcp/search-act.md
- `search_wcag` — Read — https://policylayer.com/tools/a11y-assist-mcp/search-wcag.md
- `evaluate_applicability` — Write — https://policylayer.com/tools/a11y-assist-mcp/evaluate-applicability.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=a11y-assist-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/a11y-assist-mcp