OverlayRiskWitness MCP server

A Model Context Protocol server that runs the free, independent before/after accessibility-overlay witness from OverlayRiskWitness on any public URL.

Accessibility overlay widgets (accessiBe, UserWay, and similar) are sold as one-line ADA/WCAG compliance fixes, but independent testing routinely shows the underlying page is unchanged for real assistive-technology users. This server lets an AI agent run the witness: it loads a page with the overlay on, then off, captures both states, and returns one documented finding where the page's public accessibility/compliance claims don't hold up — with a UTC timestamp.

Findings are evidence, not a legal compliance ruling. This server is independent of accessiBe and UserWay; it tests their effect, it does not sell or defend an overlay.

What this server is (and isn't)

This is a thin client. It contains no scanning logic and no secrets. Its single tool POSTs to the hosted API at https://overlayrisk.com/api/witness, which does the real work (overlay detection, headless before/after capture, claim extraction). The full timestamped Risk Packet is a paid checkout on the website — see overlayrisk.com/pricing. The MCP server is a free funnel; it never handles payment.

Related MCP server: polaris-audit

Tool

witness_page

A single witness run can take up to ~3 minutes on cold/heavy sites. That exceeds many MCP clients' default 60s request timeout. The server emits periodic progress notifications, so clients that honor resetTimeoutOnProgress stay connected automatically; clients that don't should raise their per-request timeout.

Install

Run directly with npx (no global install):

npx overlayrisk-witness-mcp

The process speaks MCP over stdio.

Claude Desktop / Cursor / other MCP clients

Add to your client's MCP config:

{
  "mcpServers": {
    "overlayrisk-witness": {
      "command": "npx",
      "args": ["-y", "overlayrisk-witness-mcp"]
    }
  }
}

Configuration

No API key is required — the free one-page witness is public.

Develop

npm install
npm run smoke   # offline handshake test (lists tools, no network)
npm start       # run the server on stdio

License

MIT © Mert Can Vural