Skip to main content
Glama

Form audit

audit_form
Read-only

Audit a form's markup and its error messages, with extra care for sign-up and payment forms. Pass html or a public url, and optionally errors (error message strings, one per line). Checks programmatic labels and placeholder-only labels (WCAG 1.3.1, 3.3.2, 4.1.2), autocomplete tokens on personal data fields (1.3.5), wrong input types and inputmode for phone, email, card and one-time codes, password fields that block paste or lack a show-password option, required fields not marked in text or in aria, fieldset and legend on radio and checkbox groups, error wiring (aria-describedby, aria-invalid, live regions, error summary), disabled submit buttons, CAPTCHA without an alternative (3.3.8), and redundant entry (3.3.7). Each error string is checked for saying what happened, saying how to fix it, blame, jargon, the word invalid, and generic wording. Findings carry criterion, severity and fix. Reads static markup only; color-only errors and script-built fields need a browser check.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "audit_form"
  }
}

Input Schema

NameRequiredDescriptionDefault
urlNoPublic page to fetch and audit.
htmlNoForm or page HTML. Use this or url.
errorsNoOptional error messages to review, one per line.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint and destructiveHint=false, so safety is covered; the description adds the meaningful behavioural limit that it reads static markup only, plus a partial output shape ('Findings carry criterion, severity and fix'). It does not discuss what happens when a URL fetch fails or is private, which is a gap given openWorldHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and inputs, then the check list, then the static-only caveat — a sensible order with no filler sentences. The long comma-separated check enumeration is dense but each clause carries a distinct WCAG criterion or failure mode, so it earns its space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully characterises findings (criterion, severity, fix) and documents all three optional inputs plus the static-analysis limitation. What remains unstated is what the response looks like when nothing is found or when a URL cannot be fetched.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already documented; the description restates html/url as an either/or and repeats the one-per-line format for errors. It adds only the qualifier 'public' for url, which is marginal value beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Audit a form's markup and its error messages') and immediately narrows the scope to sign-up and payment forms. The long enumeration of checks (labels, autocomplete tokens, input types, error wiring, CAPTCHA alternatives) makes it clearly distinguishable from nearby siblings like check_form and error_message_check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear entry conditions ('Pass html or a public url, and optionally errors') and concentration guidance ('extra care for sign-up and payment forms'). It also sets a boundary on when results are trustworthy ('Reads static markup only; color-only errors and script-built fields need a browser check'), but never names a sibling tool to use instead for those cases or for non-form audits.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources