Your VPAT journey starts in the editor. Connect our MCP

Here is something we see over and over in the platform data. A customer runs an audit, reads the findings, agrees with them, and a meaningful share of those issues are still open months later. Nobody disputed anything. The work just did not happen.

I assumed for a long time that this was a prioritisation problem, and that the fix was better severity scoring. It is mostly a logistics problem. The issue is in the DevAlly dashboard and the person who can fix it is in their editor, and getting from one to the other means stopping, finding the tab, finding the product, finding the issue, and reading enough of it to reconstruct what the checker actually meant. Call it three minutes. Three minutes is nothing, except that it lands at exactly the point where a developer has momentum and does not want to spend it, so the issue goes into the backlog and the backlog goes into next quarter.

Why the ACR drifts from the product

The version of this that eventually costs you money is what happens to your ACR.

You produce one, a customer's procurement team signs off, it gets filed. Then you keep shipping. Somebody adds a modal that traps focus, or a design refresh drops the contrast on secondary buttons below 4.5:1, and the document you signed in March describes a product that no longer exists. You find out at the next audit, or you find out because a customer asks for an updated ACR and sales forwards the request to you.

None of the underlying failures are difficult. It is contrast ratios, form fields without labels, buttons with no accessible name, focus order that follows the DOM rather than the visual layout. A competent developer fixes any of them in ten minutes with the element and context presented to them, and takes an hour six weeks later when the ticket surfaces cold.

What the DevAlly MCP does

MCP is a standard for connecting AI assistants to external tools. You connect DevAlly once and your assistant can query your accessibility data directly, which means the audit results turn up in the editor instead of waiting in a dashboard for somebody to go and get them.

A developer asks something like:

"Show me all critical issues on the checkout product."

"What is the fix for DEV-2487, and which pages does it affect?"

"What is still outstanding before we can update the ACR for the login product?"

"Which elements are covered by the contrast issue on the pricing page, and what ratios are they hitting?"

Back comes the WCAG success criterion, the failing element, the recommended fix, and the affected pages. Same data as the dashboard, delivered to the place where somebody can act on it in the next thirty seconds rather than the next sprint.

How it handles authentication and access

Authentication leads with OAuth 2.1. You sign in with your DevAlly account, pick your organisation, and that is the setup finished. We made it the default rather than one of two equal options because of offboarding. An API key is a long-lived secret that ends up in a plaintext config file on somebody's laptop, and rotating it becomes a job that belongs to nobody, so you end up maintaining two systems and two offboarding checklists and eventually forgetting one of them. With OAuth, removing somebody's DevAlly access removes their assistant's access at the same moment.

Key auth is available too, using the same keys as our public API, because some setups cannot do an interactive sign-in. CI pipelines and headless agents, mostly. If that is you, the keys behave exactly as they do everywhere else in the platform, so there is nothing new to reason about. Most teams will not need them.

It runs as a remote server, so your team hosts nothing and nobody installs anything that then needs updating. Everyone is on the same version, which matters more than it sounds like it should if you have ever supported a locally installed tool across a team of thirty.

There is also no second permission model, and that was deliberate. Over OAuth the MCP sees exactly what the signed-in account sees, so if a product is not visible to somebody in the dashboard, their assistant cannot query it either. Keys are org-scoped, the same as in the public API, which means a key can reach everything in the organisation. That is a broader credential than a user session, and it is the second reason we lead with OAuth rather than treating the two as equivalent. Neither case introduces a permission model your team is not already administering.

We could have built separate MCP scopes, and it would have looked more thorough on a security questionnaire, but it would have meant maintaining two things that are supposed to agree with each other forever.

The MCP will not write to your repository and it will not tell you whether you conform. It reports what is failing and what we suggest doing about it. A conformance claim is something your organisation puts its name to, and that should stay with a person who can be asked to justify it.

Why in-workflow compliance matters for the EAA, ADA, and Section 508

The European Accessibility Act has applied since 28 June 2025. In the US, the Department of Justice rule under Title II of the ADA sets compliance dates of April 2026 for larger public entities and April 2027 for smaller ones, and Section 508 still governs federal procurement.

What all of them share is that the document is only worth as much as the product behind it. An ACR sitting in a procurement folder means very little if the build has moved on since it was signed, and the teams that stay ahead of this are the ones checking accessibility as part of ordinary work rather than in the fortnight before an audit.

How to get started with the DevAlly MCP

The MCP is on our Growth and Compliance plans and takes about a minute to connect. Sign up, add the connector, sign in, ask it something.

We use this every day. The tool set came out of what we actually wanted in front of us when fixing real accessibility issues in our own products, not from a spec, so we are confident these tools work. But workflows are personal, and there will be paths we did not think to accommodate. If you ask it something you think it should be able to answer and it cannot, then reach out. We want to hear about it.

Set up your first product to get started → https://app.devally.com/auth/sign-up