dissid-audit-mcp

DISSID's deterministic audit engine, packaged as an MCP server (G3). Three tools wrap the existing audit scripts — the server shells out to them and returns their markdown reports verbatim. It never reimplements a scan and never fabricates a result.

Honesty floors (inherited from the scripts, not weakened here)

• Reports state only what the scan proved; UNKNOWN != ABSENT (JS-rendered pages get UNKNOWN).

• Missing script → "tool not installed" error, never a fake report.

• Scan timeout (default 120s) → explicit timeout error; a timeout is not a finding.

• Corrupt usage counter → fail closed (treated as limit reached, user told why).

• The server never phones home except the optional Lemon Squeezy license validation below.

Related MCP server: mcp-a11y-tools

Install

Runtime: bun (≥1.1). No npm/npx anywhere.

git clone <this-repo> ~/dev/dissid-audit-mcp
cd ~/dev/dissid-audit-mcp
bun install
bun test          # 11 tests, network-free

Wire into Claude Code

claude mcp add dissid-audit -- bun run ~/dev/dissid-audit-mcp/src/index.ts

Or in .mcp.json / ~/.claude.json:

{
  "mcpServers": {
    "dissid-audit": {
      "command": "bun",
      "args": ["run", "/Users/<you>/dev/dissid-audit-mcp/src/index.ts"]
    }
  }
}

Configuration (env)

Metering model

• Free tier: 3 scans per UTC day, persisted in usage.json ({day, count}, atomic write, UTC rollover). Corrupt file = fail closed.

• Licensed: set DISSID_AUDIT_LICENSE_KEY. With LEMONSQUEEZY_VALIDATE=1 the key is validated per scan against Lemon Squeezy (invalid/unreachable → fail closed, no scan). Without it, the stub accepts any key and says so in the output.

Pricing plan (sketch)

• Free: 3 scans/day — enough to try every tool on your own domain.

• Pro: $19/mo, unlimited scans — license key sold via Lemon Squeezy (merchant-of-record handles global sales tax/VAT).

⚠️ Blocker before any sale: the DISSID Lemon Squeezy store currently has 0 products. Sid must create the store product (subscription with license keys enabled) before a key can ever validate. Until then, paying customers cannot exist; the LEMONSQUEEZY_VALIDATE=1 path is wired and tested against a mock.

Development

bun test                 # full suite (registration, metering, license seam, honest errors)
bunx tsc --noEmit        # typecheck
bun run src/index.ts     # serve on stdio