
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
MCP server providing ATAG 2.0 (Authoring Tool Accessibility Guidelines) guidance for authoring tool developers
An MCP (Model Context Protocol) server that provides guidance on ATAG 2.0 — the W3C Authoring Tool Accessibility Guidelines — to help authoring tool developers build more accessible software.
ATAG 2.0 defines how authoring tools (rich-text editors, CMSes, IDEs, website builders, etc.) should:
ATAG 2.0 has been a W3C Recommendation since 2015, but adoption among authoring tools remains limited — partly because the guidance is easy to overlook at the moment design and implementation decisions are actually made. With more authoring tool features now being built with the help of AI coding assistants, this server puts the full spec within the assistant's reach: describe the feature you're working on (an image upload dialog, a rich-text toolbar, a template picker) and get back the actual success criteria that apply, rather than a half-remembered summary. The aim is to lower the cost of considering ATAG at all — the first step towards tools that support it.
The data is a static, hand-checked copy of the ATAG 2.0 spec — not fetched or generated at runtime — so answers stay faithful to the W3C source. A weekly workflow checks for upstream spec changes.
| Tool | Description |
|---|---|
get-server-info | Dataset statistics and attribution |
explain-atag | Overview of ATAG, how it differs from WCAG, and its two-part structure |
list-parts | Part A and Part B summaries |
list-principles | All 8 principles, filterable by part |
list-guidelines | All 24 guidelines, filterable by part or principle |
list-success-criteria | All 63 success criteria, filterable by part, principle, guideline, or level |
get-criterion | Full details for a specific SC (e.g. B.2.3.1) |
get-guideline | Full guideline details with all child success criteria |
get-criteria-by-level | All criteria at Level A, AA, or AAA |
search-atag | Keyword search across all ATAG content |
list-glossary-terms | All ATAG glossary terms |
get-glossary-term | Definition of a specific ATAG term |
get-guidance | Key tool — describe a feature you're building and get the most relevant ATAG criteria |
No local install required — add the config below and your MCP client will fetch the package automatically via npx.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"atag-mcp": {
"command": "npx",
"args": ["-y", "atag-mcp"]
}
}
}
{
"mcp": {
"servers": {
"atag-mcp": {
"type": "stdio",
"command": "npx",
"args": ["-y", "atag-mcp"]
}
}
}
}
npm install
npm run build
# then point your config to dist/index.js directly
Ask Claude:
get-guidanceget-criteria-by-levelget-guidelineget-glossary-termsearch-atagnpm run dev # Run server directly with tsx (no compile step)
npm test # Run all tests
npm run test:watch # Watch mode
npm run validate-data # Validate data/atag.json structure
npm run check-updates # Check if W3C spec has changed
This project follows git flow with Conventional Commits:
main — released code only; every merge to main is tagged and publisheddevelop — integration branch; day-to-day work lands herefeature/<name> — branched from and merged back to developrelease/<version> — branched from develop, merged to main (tagged) and back to develophotfix/<name> — branched from main for urgent fixes, merged to both main and developCommit messages use conventional prefixes: feat:, fix:, docs:, test:, ci:, chore:, refactor: (with ! or a BREAKING CHANGE: footer for breaking changes).
Versioning uses standard npm version bumps. Pushing a v* tag triggers the GitHub Actions publish workflow, which runs tests and publishes to npm automatically.
npm version patch # bug fixes: 1.0.0 → 1.0.1
npm version minor # new features: 1.0.0 → 1.1.0
npm version major # breaking: 1.0.0 → 2.0.0
git push && git push --tags
When bumping the version, also update the version fields in server.json to match — the MCP Registry validates them against the published npm package. After the npm publish succeeds, refresh the registry listing with:
mcp-publisher login github
mcp-publisher publish
Publishing requires the NPM_TOKEN repository secret (a granular npm access token with write access to atag-mcp). If the token expires or is rotated, add the new one under the same secret name, then run the manual Check npm token workflow (Actions tab) to verify it authenticates before tagging a release.
The ATAG 2.0 spec is captured in data/atag.json. The GitHub Actions workflow (.github/workflows/update-atag.yml) runs weekly and opens an issue if the W3C spec content changes.
To update manually:
data/atag.json with the changesnpm run validate-data to check structurenpm run check-updates -- --save to update the stored hashMIT
FAQs
MCP server providing ATAG 2.0 (Authoring Tool Accessibility Guidelines) guidance for authoring tool developers
The npm package atag-mcp receives a total of 33 weekly downloads. As such, atag-mcp popularity was classified as not popular.
We found that atag-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.