Skip to main content
Glama

webability

by io.github.snayyar00
OverviewDiscussionsAdmin

Scan a multi-page user flow

flow_scan
Read-onlyIdempotent

Scan a multi-page user journey. Walks startUrl plus the autoNavigate URLs sequentially (deterministic — one page fully rendered and scanned before the next), then returns ONE consolidated report with issues deduplicated across pages, each carrying the same fix payload as scan_page. Every requested URL gets an explicit outcome in pages[] (scanned / nav_failed / scan_failed / redirected_duplicate / duplicate_request / skipped_cap / blocked — bot-challenge, not a clean page) — a page is never silently dropped. Better than per-page scans for journeys (login → checkout etc). Without autoNavigate it scans only startUrl, exactly like scan_page. NOTE: on this HOSTED server, localhost and private addresses are refused — it runs in our cloud and cannot reach your machine. Two ways to scan a local dev server: run the MCP locally (npx -y @webability/mcp, simplest — nothing leaves the machine), or open a tunnel (webability-tunnel --port 3000) and pass its URL as url together with the printed secret as tunnel_secret.

Input Schema

NameRequiredDescriptionDefault
wcagNoOnly these WCAG criteria. A prefix selects the whole guideline ("1.4") or principle ("2").
levelNoHighest WCAG conformance level to report. Default "AA" — Level AAA criteria are not reported. Pass "AAA" to include them (naming one AAA criterion in `wcag`, e.g. "3.2.5", also includes it).
rulesNoOnly these rule ids (WebAbility type such as "missing_alt" or axe rule id such as "image-alt"). See get_rules.
formatNo"compact" prints one line per element with rule metadata once. "json" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JSON summary of every count.
contextNoExplain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."
maxPagesNoMax pages to scan (default 10)
startUrlYesStarting URL of the journey
llm_modelNoThe exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.
minImpactNoOnly findings at this severity or above (critical > serious > moderate > minor)
sourceRootNoLocal project root (local installs only) for `sourceCandidates[]` on issues without a framework `source` pointer.
autoNavigateNoThe URLs to walk after startUrl, in order (the MCP server is headless and cannot discover a journey interactively). Omit or pass [] to scan only startUrl as a single page.
tunnel_secretNoSecret printed by `webability-tunnel`. Required when `url` is a tunnel URL; the URL alone will be refused by the relay. Ignored otherwise.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • changedInput schema / properties / autoNavigate / description
      Previous value: -"REQUIRED — the URLs to walk after startUrl (the MCP server is headless and cannot discover a journey interactively). For a single page, use scan_page instead."New value: +"The URLs to walk after startUrl, in order (the MCP server is headless and cannot discover a journey interactively). Omit or pass [] to scan only startUrl as a single page."
    • changedInput schema / required
      Previous value: -[
-  "startUrl",
-  "autoNavigate"
-]New value: +[
+  "startUrl"
+]
  2. Changed1 schema field changed
    • addedInput schema / properties / level
      Added value: +{
+  "description": "Highest WCAG conformance level to report. Default \"AA\" — Level AAA criteria are not reported. Pass \"AAA\" to include them (naming one AAA criterion in `wcag`, e.g. \"3.2.5\", also includes it).",
+  "enum": [
+    "A",
+    "AA",
+    "AAA"
+  ],
+  "type": "string"
+}
  3. Changed1 schema field changed
    • removedInput schema / properties / conversation_id
      Removed value: -{
-  "description": "Echo the conversation_id from the server's previous response. The server provides it on the first call — never invent one, and do not issue parallel tool calls until you have it.",
-  "type": "string"
-}
  4. Changed2 schema fields changed
    • changedInput schema / properties / format / description
      Previous value: -"\"compact\" prints one line per element with rule metadata once — far fewer tokens than the default JSON. Default json."New value: +"\"compact\" prints one line per element with rule metadata once. \"json\" returns every field (html, fix values, source). Default: JSON when it fits inline (under ~24k chars), otherwise compact plus a JSON summary of every count."
    • changedInput schema / required
      Previous value: -[
-  "startUrl",
-  "autoNavigate",
-  "context",
-  "llm_model"
-]New value: +[
+  "startUrl",
+  "autoNavigate"
+]
  5. First observed

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover safety (readOnly, idempotent, non-destructive); the description adds substantial behavior: deterministic sequential rendering, one consolidated deduplicated report, the full set of per-page outcomes (scanned/nav_failed/scan_failed/... and blocked bot-challenge), and the guarantee a page is never silently dropped. It also discloses the hosted-server constraint that localhost/private IPs are refused, which is exactly the kind of behavioral context annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core behavior and outcome contract; each sentence carries information. The final local-host/tunnel sentence is long and slightly digressive, but it prevents failed calls, so it earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-param tool with no output schema, the description covers the return contract (one report, pages[] outcomes, deduped issues with fix payloads), the hosted-vs-local constraint, and the autoNavigate fallback. An agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3; the description adds meaning beyond the schema for autoNavigate ("walks ... sequentially", "omit ... to scan only startUrl") and tunnel_secret (required when url is a tunnel URL, ignored otherwise). This clarifies interaction between parameters that the schema documents only individually.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ("Scan a multi-page user journey") and immediately differentiates itself from the sibling scan_page ("Without autoNavigate it scans only startUrl, exactly like scan_page"). An agent can distinguish its scope without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to prefer it ("Better than per-page scans for journeys (login → checkout etc)"), the degenerate case that equals scan_page, and names two concrete alternatives for local-dev scanning (run MCP locally vs. tunnel). When/when-not/alternatives are all covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All webability toolsInspect
Try in Browser
Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources