The CheckFox MCP server, which lets an AI agent read an audit, follow the official methodology, and record verdicts.

What the MCP server is

CheckFox hosts a Model Context Protocol (MCP) server, so an AI agent can work inside an audit directly. It is the read-and-write layer, not the auditor: the judgement stays with the agent and with you.

The public endpoint is https://api.checkfox.eu/mcp, and the guide to it lives at checkfox.eu/mcp.

What an agent can do with it

For each criterion, the agent reads the official tests and methodology, decides how to verify them (reading the page source, driving a real browser to exercise keyboard, focus and reflow, or running the CheckFox scanner for an extra signal), then records a status with its findings and a suggested fix.

Eight tools are exposed:

Tool	Purpose	Scope
`list_audits`	The audits the caller can access	read
`get_audit`	One audit, its samples and its progress	read
`list_criteria`	A sample's criteria with their current status	read
`get_next_criterion`	The next untested criterion, with its methodology	read
`get_criterion_methodology`	Any criterion's methodology, by referential and number	read
`run_scanner`	Run the automated scanner on a sample, in light mode, dark mode or both	write
`measure_contrast`	Measure the real text contrast of chosen elements of a sample	write
`update_criterion`	Record a status, findings and a fix	write

run_scanner and measure_contrast both need the scanner on the audit's workspace, and each call counts as one scan against the workspace's monthly scan allowance.

Light mode and dark mode

Many sites change their colours with the visitor's system theme (prefers-color-scheme). run_scanner and measure_contrast take a color_scheme of light (the default), dark, or both. With both, the page is rendered twice in a single call and every finding says which theme it came from. A contrast that passes in light mode can fail in dark mode, so scanning both is worth it on any site that has a dark theme.

Measuring contrast precisely

Automated scanners give up on text that sits over a gradient, a decorative halo or an image, and leave it as "needs review". measure_contrast settles those cases. The agent names the text elements with CSS selectors, and for each one it gets:

a measurement from the computed styles of the text and of every layer behind it, gradients included. It also covers every scroll position of a fixed background;
a measurement from the real screen pixels behind the text, with the text hidden. It also covers background images and filters, at one scroll position;
a verdict against the required ratio (4.5:1, or 3:1 for large text): pass, fail, review (the two measurements disagree, or the contrast varies across the text) or unknown.

Nothing is written to the audit: the agent uses the result as evidence for criterion 3.2.

The CheckFox scanner itself (in the app, the browser extension and run_scanner) now measures text over gradients automatically: see the checkfox-contrast-gradient rule.

The referential itself is also exposed as browsable resources: an index of every criterion of a standard, and any single criterion's methodology on demand. Both are read-only and accept a language parameter.

Why it does not damage an audit

It never overwrites a person. A write only lands on a criterion still marked "Not tested". A human verdict is never touched, so an agent adds to manual work rather than replacing it.
Read and write are separate permissions. A key can be given mcp:read only.
Roles still apply. A key belonging to someone who can only view an audit can read that audit and never write to it.
Work can be claimed. get_next_criterion can atomically claim the criterion it returns, with a lifetime, so several agents can run in parallel without colliding. A claim can be released early.
Writes are marked as machine-written, with the model that produced them, exactly like an AI fix suggestion made in the app. See findings.
Traffic is rate limited per key.

What it doesn't do

It doesn't create the audit for you, you still need to go through the audit creation process and sampling. See procedures / create an audit.
It doesn't replace the auditor's judgement.

Plan availability

MCP access is included from the Pro plan and available as the MCP add-on on Free and Starter. It is checked per audit, against the plan of the workspace that audit belongs to, not against the person holding the key. See plans and roles.

Where it lives in the UI

User settings > API keys, to generate a key with the MCP scopes.
Workspace settings > Integrations shows whether the workspace has MCP access.

procedures / connect an ai agent - how to connect a client and run an audit.
integrations - the other ways CheckFox talks to outside tools.