Skip to main content
Glama
mertcanvural

overlayrisk-witness-mcp

by mertcanvural
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

OverlayRiskWitness MCP server

A Model Context Protocol server that runs the free, independent before/after accessibility-overlay witness from OverlayRiskWitness on any public URL.

Accessibility overlay widgets (accessiBe, UserWay, and similar) are sold as one-line ADA/WCAG compliance fixes, but independent testing routinely shows the underlying page is unchanged for real assistive-technology users. This server lets an AI agent run the witness: it loads a page with the overlay on, then off, captures both states, and returns one documented finding where the page's public accessibility/compliance claims don't hold up — with a UTC timestamp.

Findings are evidence, not a legal compliance ruling. This server is independent of accessiBe and UserWay; it tests their effect, it does not sell or defend an overlay.

What this server is (and isn't)

This is a thin client. It contains no scanning logic and no secrets. Its single tool POSTs to the hosted API at https://overlayrisk.com/api/witness, which does the real work (overlay detection, headless before/after capture, claim extraction). The full timestamped Risk Packet is a paid checkout on the website — see overlayrisk.com/pricing. The MCP server is a free funnel; it never handles payment.

Related MCP server: polaris-audit

Tool

witness_page

Input

{ "url": "https://example.com/checkout" } — a public HTTP/HTTPS page URL

Success

The free-witness JSON: runId, siteUrl, overlayVendor (accessibe/userway), pagesTested, claimsTested, didNotHoldUp, freeFinding, lockedFindingCount — plus a note linking to the paid Risk Packet

Error

{ status, code, error } (e.g. overlay_no_effect, page_fetch_failed, witness_timeout)

A single witness run can take up to ~3 minutes on cold/heavy sites. That exceeds many MCP clients' default 60s request timeout. The server emits periodic progress notifications, so clients that honor resetTimeoutOnProgress stay connected automatically; clients that don't should raise their per-request timeout.

Install

Run directly with npx (no global install):

npx overlayrisk-witness-mcp

The process speaks MCP over stdio.

Claude Desktop / Cursor / other MCP clients

Add to your client's MCP config:

{
  "mcpServers": {
    "overlayrisk-witness": {
      "command": "npx",
      "args": ["-y", "overlayrisk-witness-mcp"]
    }
  }
}

Configuration

Env var

Default

Purpose

OVERLAYRISK_API_URL

https://overlayrisk.com/api/witness

Override the witness endpoint (e.g. for local dev)

OVERLAYRISK_TIMEOUT_MS

200000

Request timeout in ms

No API key is required — the free one-page witness is public.

Develop

npm install
npm run smoke   # offline handshake test (lists tools, no network)
npm start       # run the server on stdio

License

MIT © Mert Can Vural

Available Tools

1 tool
witness_pageWitness a public overlay pageA

Runs the OverlayRiskWitness free one-page witness for a public URL. Loads the page with its accessibility overlay (accessiBe or UserWay) on, then off, captures both states, and returns one documented finding where the page’s public accessibility/compliance claims do not hold up, with a UTC timestamp. Findings are evidence, not a legal compliance ruling. The full timestamped Risk Packet is a paid checkout at https://overlayrisk.com/pricing.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesHTTP or HTTPS public page URL to run through the free OverlayRiskWitness witness.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral details beyond annotations by explaining the witness process (loading, toggling overlays, capturing states, returning timestamped findings). It does not contradict annotations such as destructiveHint=false, and the openWorldHint=true aligns with the free tool nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured with four sentences, each adding value: core action, process, output nature, and pricing note. Slightly verbose but front-loaded with key details, earning a 4.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple tool with one parameter, no output schema, and annotations present, the description adequately covers the input, process, output (finding with timestamp), and a caveat. Minor gaps like exact output format are acceptable for this complexity level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage for the single parameter, the baseline is 3. The description reiterates the need for a public URL, matching the schema, but adds no new semantic information beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs a free one-page witness for a public URL, detailing the specific process of loading with overlay on/off, capturing states, and returning a finding. It distinguishes the tool's action using specific verbs and resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context by specifying the input as a public URL and noting that findings are evidence not legal rulings. While it gives good usage context, it does not explicitly state when not to use the tool or mention alternatives, but no siblings exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev0.1.0
    • First observedwitness_page
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.7/5.0

Scored across 1 tool

Disambiguation5/5

Only one tool exists, so there is no possibility of confusion between tools. The tool's purpose is clearly defined and distinct.

Naming Consistency4/5

With only one tool, naming consistency is not fully testable, but the tool name 'witness_page' follows a logical verb_noun pattern and is descriptive of its function.

Tool Count1/5

A single tool for a service that could reasonably include multiple related operations (e.g., different types of audits, history, or batch processing) feels extremely thin and insufficient for a cohesive server.

Completeness1/5

The tool performs one specific check and then directs to an external paid service for further results, leaving the agent with no ability to complete a full workflow or access additional features, making the surface severely incomplete.

Maintenance

ActivityStale
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • polaris-audit

    cnohall
    A
    license
    A
    quality
    D
    maintenance
    Audit any website for privacy, security, accessibility, and performance issues — with scores, grades, and actionable fix instructions. No account required.
    3
    10 npm
    MIT

  • a11y-mcp

    antonio-rmrz
    A
    license
    A
    quality
    C
    maintenance
    Enables web accessibility audits using axe-core, allowing users to scan URLs, check WCAG compliance levels, and export reports. It uses an anti-detect browser to bypass Cloudflare and other bot protection.
    7
    MIT