Your VPAT journey starts in the editor. Connect our MCP

A VPAT is never finished, not the way procurement thinks it is. You produce one, a customer signs off, it gets filed, and everyone moves on. Then the product keeps shipping. Three months later something breaks WCAG, and nobody knows until the next audit, or until a customer's ACR request lands on sales asking why the numbers no longer match.

That gap, between the compliance you documented and the product you shipped, is where most accessibility work falls apart. And it falls apart for a boring reason: the compliance lives in a dashboard, and the engineers who could fix it live in their editor. The two never meet in the moment it matters.

I have spent my career building accessibility tooling, and that failure mode is always the same. We run an audit, we surface what is failing WCAG, we produce the VPAT, we hand over a clear report, and then a portion of those fixes go and sit in a backlog. Nobody disagreed with them. The report lived in one place and the developer lived in another, and the distance between them is where compliance goes to die.

The DevAlly MCP collapses that distance, and I believe it changes how compliance and engineering fit together. Compliance stops being a report that engineering receives and becomes a question engineering can ask, in the tools they already work in, at the moment they are writing the code. That is the shift I want to make normal across our industry, and it starts today.

What the DevAlly MCP is

If you've not come across MCP, it is a standard that lets AI assistants talk to tools like ours. Connect the DevAlly MCP once, and your assistant can query your compliance data on your behalf, the same issues, audits, and VPAT evidence you would otherwise dig out of the dashboard. You ask a question in plain English and get an answer where you are already working.

What you can ask the DevAlly MCP about your VPAT and WCAG compliance?

Here is what that looks like in practice. A developer opens their editor and asks:

"Show me all critical issues on our checkout product." "What is the fix for issue DEV-2487, and which pages does it affect?" ""What is still blocking the VPAT for our login product?" "Build me an ACR-ready report of serious issues from the last 30 days I can paste into Slack."

The assistant talks to DevAlly and comes back with the WCAG criterion, the offending code, the recommended fix, and the pages affected. No new interface to learn. No tab to remember to open. The compliance data goes to where the work happens instead of waiting for someone to come to it, which means the VPAT stays close to the truth of what shipped rather than drifting away from it between audits.

How to connect the MCP, and how it handles authentication and security

On the engineering side, I wanted this to be something a team could adopt in a minute and trust. It is a remote MCP server, so there is nothing to host. Authentication is OAuth 2.1, so there are no API keys to generate, store, or rotate. You sign in with your DevAlly account and pick your organisation. Claude Code and Claude.ai connect natively, and Claude Desktop and Cursor bridge through a small shim. It only ever sees what your DevAlly account already has access to, so scoping is not something new to manage. It won’t make legal judgments for you and it won’t change code in your repo. It surfaces what is failing and the recommended fix. Your team decides and ships.

Why in-workflow compliance matters for the EAA, ADA, and Section 508

I care about this launch because of what it does to the shape of the work. Accessibility is a hard requirement now. The EAA is in force across Europe, and ADA and Section 508 obligations keep tightening in the US. Under all of them, the paperwork is only as good as the product behind it. A VPAT that says you conform, or an ACR sitting in a customer's procurement folder, means very little if the build has moved on since you signed it.

The teams that keep up are the ones for whom compliance is part of the daily build, not a scramble before an audit or a legal letter. A dashboard you open once a year cannot get you there. Something that answers your questions inside the editor can.

That is the whole idea. Compliance you can ask about on a Tuesday afternoon and act on before you close the file, so the VPAT you hand a customer next quarter reflects the product you are shipping today.

How to get started with the DevAlly MCP

It connects in under a minute and is available on our Growth and Compliance plans. Sign up, add the connector, sign in, and ask your first question. I would love to hear what you ask it.

Set up your first product to get started → https://app.devally.com/auth/sign-up