# WCAG Accessibility & Release Gate Auditor (`craigtechservicesllc/wcag-accessibility-release-gate-auditor`) Actor

Audit public pages in a real Chromium browser with axe-core WCAG 2.0–2.2 A/AA checks, scores, grades, sanitized evidence, and conservative PASS/REVIEW/BLOCK release gates.

- **URL**: https://apify.com/craigtechservicesllc/wcag-accessibility-release-gate-auditor.md
- **Developed by:** [Daniel Craig](https://apify.com/craigtechservicesllc) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $35.00 / 1,000 page auditeds

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## WCAG Accessibility & Release Gate Auditor

Audit public web pages in a real Chromium browser and export structured axe-core evidence for automated WCAG 2.0, 2.1, and 2.2 Level A/AA checks. Each completed page receives a deterministic score, grade, and conservative `PASS`, `REVIEW`, or `BLOCK` release-gate signal. No external API key is required.

### What it returns

Every successfully audited page includes:

- an automated score from 0 to 100 and grade from A to F;
- a `BLOCK` signal when axe reports critical or serious affected nodes;
- a `REVIEW` signal for other violations or incomplete/manual checks;
- a `PASS` signal only when axe reports no violations and no incomplete checks;
- violation rule and affected-node totals;
- critical, serious, moderate, minor, and unknown impact counts;
- sanitized CSS targets and short failure summaries;
- page title, final public URL, HTTP status, viewport, and rule-set label;
- an explicit manual-review boundary on every row.

Node HTML is intentionally not stored. A result can identify a public selector and remediation summary without copying form values or full page markup into the dataset.

### Input

Choose exactly one source:

```json
{
  "urls": [
    "https://example.com",
    "https://www.w3.org/WAI/demos/bad/before/home.html"
  ],
  "maxItems": 50,
  "concurrency": 2,
  "timeoutMs": 45000,
  "settleMs": 1000,
  "viewport": "desktop",
  "includeBestPractices": false,
  "deduplicate": true
}
```

Or use `items` / `datasetId` with `urlField`, including a nested dot path such as `page.canonicalUrl`. Run the same URLs once with `desktop` and once with `mobile` when both viewport experiences matter.

Bare domains are interpreted as HTTPS. Identical normalized URLs can be emitted as uncharged duplicate records instead of being opened twice.

### Release-gate meaning

| Signal | Automated meaning | Required next action |
| --- | --- | --- |
| `BLOCK` | One or more critical or serious affected nodes were detected. | Fix and rerun before release. |
| `REVIEW` | Other violations or incomplete rules need review. | Review evidence and perform manual checks. |
| `PASS` | No axe violations or incomplete checks were returned for this run. | Still perform manual assistive-technology and human testing. |

The score is a transparent triage aid: `100 - (critical nodes × 10 + serious × 6 + moderate × 3 + minor × 1 + unknown × 2)`, with a zero floor. It is not a standard-defined conformance score.

### Example result

```json
{
  "inputUrl": "https://example.com",
  "status": "audited",
  "viewport": "desktop",
  "score": 94,
  "grade": "A",
  "releaseGate": "BLOCK",
  "violationRules": 1,
  "violationNodes": 1,
  "impactCounts": {
    "minor": 0,
    "moderate": 0,
    "serious": 1,
    "critical": 0,
    "unknown": 0
  },
  "charged": true,
  "manualReviewRequired": true
}
```

### Browser and network boundary

- Only public HTTP and HTTPS targets are allowed.
- Local/private hostnames, credentials in URLs, and private, loopback, link-local, reserved, multicast, test-network, or otherwise non-unicast IP addresses are blocked.
- DNS answers are checked before the connection and the approved public IP is pinned.
- Every redirect is independently checked before it is followed.
- Hosts referenced by static HTML are separately resolved and pinned before Chromium opens.
- Browser requests to dynamically introduced, unapproved hosts are blocked. Pages that depend on such hosts may produce conservative or incomplete results.
- Initial HTML size, redirects, browser time, post-load settling, concurrency, and source rows are bounded.
- Full HTML, node HTML, screenshots, form values, cookies, and request bodies are not stored in the dataset or logs.
- Logs contain aggregate settings and counts only.

### Accessibility evidence boundary

Automated axe-core checks find many detectable accessibility issues, but cannot prove WCAG conformance, legal compliance, or usability. A `PASS` applies only to the selected page, viewport, content state, axe version, and automated rule set at the time of the run. Keyboard navigation, screen-reader behavior, cognitive usability, content quality, alternate states, authentication flows, and jurisdiction-specific legal duties require appropriate manual and professional review.

### Pricing behavior

The Actor uses pay-per-event pricing:

- one small run-start event;
- one `page-audited` event for each public page that completes browser rendering and axe analysis;
- invalid, blocked, failed, spending-limited, and duplicate rows are not charged the per-page event.

Apify enforces the caller's maximum total charge. If the remaining spending limit cannot cover another page event, unopened rows are returned with `SPENDING_LIMIT_REACHED` rather than silently overspending.

### Common uses

- block critical and serious automated findings in release workflows;
- audit public landing pages or sitemaps exported to a dataset;
- compare desktop and mobile accessibility evidence;
- triage affected selectors for remediation teams;
- feed structured results into Apify schedules, webhooks, APIs, or MCP workflows;
- monitor public-page regressions while preserving an explicit manual-review requirement.

Only audit pages you are authorized to test, and keep request volume appropriate for the target site.

# Actor input Schema

## `urls` (type: `array`):

One public HTTP or HTTPS page per row. Bare domains are interpreted as HTTPS.

## `items` (type: `array`):

Objects containing a page URL field. Use urlField to select a nested value.

## `datasetId` (type: `string`):

Dataset in the current Apify account. Never place an API token in this field.

## `urlField` (type: `string`):

Dot path used for JSON items or dataset rows.

## `maxItems` (type: `integer`):

Hard browser-audit limit. Truncation is explicitly reported in the run summary.

## `concurrency` (type: `integer`):

Number of isolated public pages audited concurrently. Lower values use less memory.

## `timeoutMs` (type: `integer`):

A slow page is stopped and returned as an explicit uncharged timeout instead of holding the run indefinitely.

## `settleMs` (type: `integer`):

Extra bounded time for client-rendered content to appear before axe-core runs.

## `maxResponseBytes` (type: `integer`):

Oversized initial HTML is rejected before a browser opens and returned as an uncharged failure.

## `maxRedirects` (type: `integer`):

Every redirect target is independently checked against the public-network policy.

## `viewport` (type: `string`):

Desktop uses 1440 by 900. Mobile uses a touch-enabled 390 by 844 browser context.

## `includeBestPractices` (type: `boolean`):

Adds non-WCAG axe best-practice checks while preserving the explicit automated-evidence boundary.

## `deduplicate` (type: `boolean`):

Duplicate rows are emitted as uncharged duplicate records rather than opened again.

## Actor input object example

```json
{
  "urls": [
    "https://www.example.com",
    "https://www.w3.org/WAI/demos/bad/before/home.html"
  ],
  "urlField": "url",
  "maxItems": 50,
  "concurrency": 2,
  "timeoutMs": 45000,
  "settleMs": 1000,
  "maxResponseBytes": 2000000,
  "maxRedirects": 5,
  "viewport": "desktop",
  "includeBestPractices": false,
  "deduplicate": true
}
```

# Actor output Schema

## `results` (type: `string`):

Dataset rows with scores, grades, release gates, rule and node evidence, sanitized selectors, and explicit manual-review boundaries.

## `summary` (type: `string`):

Counts, impact totals, truncation flags, effective settings, charged-event count, and the evidence boundary.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://www.example.com",
        "https://www.w3.org/WAI/demos/bad/before/home.html"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("craigtechservicesllc/wcag-accessibility-release-gate-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "https://www.example.com",
        "https://www.w3.org/WAI/demos/bad/before/home.html",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("craigtechservicesllc/wcag-accessibility-release-gate-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://www.example.com",
    "https://www.w3.org/WAI/demos/bad/before/home.html"
  ]
}' |
apify call craigtechservicesllc/wcag-accessibility-release-gate-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,craigtechservicesllc/wcag-accessibility-release-gate-auditor"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/eRcn0I5dBsHkwlmhE/builds/AzEa8FQe7HGP1ap8a/openapi.json