Accessibility Scan (accessibility-scan)

Summary

Injects axe-core in a browser session and maps WCAG violations to findings (Playwright).

Classification

• Category: ACCESSIBILITY
• Plugin id: accessibility-scan
• Version: 1.0.0
• Target types: WEBSITE, WEBSHOP
• Weight class: MEDIUM
• Risk level: not set on plugin object
• Browser required: Yes (Playwright)
• Tier / group: Tier 2 — Browser (Playwright)

Schedule

• scheduleHints: { defaultInterval: '0 */3 * * *', priority: 5 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().
standard	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for accessibility-scan.

Each axe-core violation becomes its own finding. Severity mapping: critical/serious/moderate → WARNING; minor → INFO.

Check	Typical severity	Why
One finding per axe-core rule violation (title from rule description)	WARNING if axe impact is critical, serious, or moderate; INFO for minor / other	WCAG violations exclude users with disabilities and create compliance risk; each rule is reported separately with affected selectors.

How each check works

1. Load page — Playwright opens the target URL with networkidle (default 30s timeout).
2. Inject axe-core — Loads axe-core 4.9.1 from cdnjs.cloudflare.com.
3. Run axe.run() — Executes in-page; returns violations and passes. The config field standard (default wcag2aa) is not currently forwarded to axe.run() — axe’s default rule bundle applies.
4. Emit findings — Each violation → one finding. Severity via mapImpactToSeverity: critical / serious / moderate → WARNING; everything else → INFO. Evidence stores rule id, impact, help URL, up to 5 nodes (HTML max 200 chars), and total affected count.
5. Score and status — Score = (totalElements − violationElements) / totalElements × 100. Status warning if any WARNING finding (plugin never emits CRITICAL today).

Caveats and concerns

• Single page — No crawl; inner templates with different markup are untested.
• External CDN — Blocked cdnjs prevents axe injection.
• Dynamic SPAs — Late-rendered content may be under-tested after networkidle.
• Severity ceiling — Even axe “critical” maps to WARNING, not CRITICAL, per platform severity policy.
• Complement, not substitute — Pair with accessibility-deep and manual testing for keyboard/contrast coverage axe misses.

Source

packages/test-plugins/src/plugins/accessibility-scan.ts