cora-mcp-scan

scan_page’s and scan_url’s result: what one scan of one page found. scan_page scans the page the browser shows, as the agent left it, and scan_url loads a URL and scans the page as it loads. The result lists the scan’s issues, most severe first, each with an ID that explain_finding and verify_fix take. It also gives the page the scan covered and how completely, the page scan_url could not scan as itself, and the run the scan recorded, whose file keeps every finding.

Each version lists its fields, then a section for each object they hold, headed by its path, in which [] stands for each entry of a list. Where objects of several kinds share a path, each kind has a section, named by the field that tells them apart. A field marked required is in every object of its kind, and the description of any other says when it is absent.

Version 1

The version this release writes. Its JSON Schema is schemas/cora-mcp-scan/v1.json in the @vispero/cora package and at https://cora.vispero.com/docs/0.10/schemas/cora-mcp-scan/v1.json.

format (“cora-mcp-scan”, required): The result’s format, always cora-mcp-scan.
version (1, required): The version of cora-mcp’s tool surface, which every result and error of its tools declares.
run (string, required): The ID of the run the scan recorded, which explain_finding takes: its start time and eight random characters, such as 20261005T221403123Z-k3j9x2ab.
file (string, required): The run file the scan wrote, a cora-results file in the state directory’s runs/ (.cora/runs/ by default): its path relative to the project root when it is inside the project, and absolute otherwise.
scanned (object): The page the scan covered, and how completely; absent when scan_url scanned no page, as when the page failed to load or redirected to another host.
notScanned (object): The page scan_url was asked to scan, when it did not scan that page as itself, such as when the load failed, the page kept navigating or stopped answering, the scan ran out of time, or the page redirected to another one, which scanned holds when it is on the same host. Absent when the requested page was scanned, and in scan_page’s result.
counts (object, required): How many issues the scan found, counting every issue of the run, whether the result lists it or not, as cora scan’s summary counts them.
issues (array of objects, required): The issues the scan found, most severe first, then by their representative’s rule key, its rule’s equivalence class where it has one and otherwise its rule ID, then by ID, listed in that order while the result has room.
omitted (integer, required): How many issues the result leaves out for its size, which the run file keeps.

scanned

url (string, required): The URL of the page the scan covered, the one it settled on, with its credentials redacted as a results file stores a URL, cut short, ending with …, when it is long. After a redirect on the same host, it is the landing page’s, which scan_url scanned in place of the requested page.
reachedBy (“navigation” or “interaction”, required): How the page state was reached: navigation for a page scan_url loaded, and interaction for the page scan_page scanned as the agent left it.
browser (string, required): The name of the browser the page ran in, such as chrome. An open set: a cora that does not know a name, such as one a newer cora writes, keeps and compares it as it is.
viewport (object, required): The size of the browser’s viewport the page was shown at.
coverage (object, required): How completely the scan’s engines covered the page, taken together.
unsettled (object): The settle timeout that passed, when the page did not settle before the scan, so another scan of it can find other issues; absent when the page settled.

scanned.viewport

Also at: issues[].combinations[].viewport

width (integer, required): Its width, in CSS pixels.
height (integer, required): Its height, in CSS pixels.

scanned.coverage

status (“complete”, “partial” or “skipped”, required): complete when every engine scanned the whole page, skipped when every engine skipped it, and partial otherwise, such as for a scan limited by include or exclude, or a page with an iframe the scan could not reach.
reasons (array of objects, required): Why the coverage is not complete, each engine’s reasons in the engines’ order, listed after the issues while the result has room; empty when it is complete. Each reason’s detail is cut short, ending with …, when it is long.
omitted (integer, required): How many reasons the result leaves out for its size, which the run file keeps.

scanned.coverage.reasons[]

Also at: notScanned.reason

code (string, required): Why, as a code, such as navigation-failed. An open set: a cora shows a code it does not know, such as one a newer cora writes, as it is. The coverage reasons reference lists each code with what it means: https://cora.vispero.com/docs/reference/coverage-reasons/
detail (string, required): What the reason holds, which depends on its code, as the code’s entry in the coverage reasons reference says, such as HTTP 404 for a page that answered with that status.

scanned.unsettled

timeout (integer, required): The settle timeout that passed before the page settled, in milliseconds: the config’s page.settle.timeout for the page.

notScanned

url (string, required): The requested URL, with its credentials redacted as a results file stores a URL, cut short, ending with …, when it is long.
reason (object, required): Why the page was not scanned, such as navigation-failed or redirected, the reason’s detail cut short, ending with …, when it is long.

counts

issues (integer, required): Every issue of the run, those that need review included.
needsReview (integer, required): Of those, the issues whose findings all need a person’s review.

issues[]

id (string, required): The issue’s ID, which explain_finding and verify_fix take, as 32 lowercase hexadecimal characters: the source fingerprint its findings share where they have a source location, so one opening tag has one ID on every page it renders on, and their element fingerprint otherwise.
rules (array of strings, required): Every rule the issue’s findings fail, each once, sorted, such as axe/image-alt: several where rules of one equivalence class find one element, so their findings share the issue’s ID.
outcome (“violation” or “needs-review”, required): violation when any of the issue’s findings is one, and needs-review when its rules could not decide any of them and ask a person to check.
severity (“critical”, “serious”, “moderate” or “minor”, required): How much the issue hinders people: its most severe violation’s severity, or its most severe finding’s when it has no violation.
wcag (array of strings, required): The WCAG success criteria the issue’s findings fail, such as 1.1.1, each once, in WCAG’s order, by principle, guideline and criterion number; empty for best practices, whose failures are not WCAG failures.
fixClass (“mechanical”, “content”, “design” or “manual”, required): What fixing the issue takes: its representative’s rule’s fix class, which the rules reference describes: https://cora.vispero.com/docs/reference/rules/#fix-classes
message (string, required): What its representative’s rule checks, in one line, such as Images must have alternative text.
element (string, required): The element of the issue’s representative, the first of its findings by page and then by element, as its path: each iframe or shadow host it is inside, outermost first, as frame: or shadow: and its CSS selector, then the element’s own selector, joined by >> with a space on each side, such as frame:#checkout >> button.pay.
source (object): Where the representative’s element is in the project’s source, on an app built with CORA’s source stamps or Angular’s source locations; absent when it has no source location.
instances (integer, required): How many findings the issue has in the run, at least one.
callSites (integer, required): How many distinct call-site source locations the issue’s findings are at, each place counted once: the host elements in the project’s source around the uses of a component that renders the element, which a fix at the call site must reach. Zero when none of its findings has one.
combinations (array of objects, required): The browser and viewport the issue’s findings were seen in: one, since a scan scans one page.
report (true): true when cora scan’s report lists the issue as report-only: its violations are of rules the project’s rule selection sets to report on their page, beside any in a page state an agent reached, so it is shown but never fails CI’s gate and is never baselined. Absent otherwise, as on an issue that needs review or one with a violation the gate counts.
accepted (true): true when the project’s baseline accepts the issue, as cora scan counts it, so CI’s gate does not fail on it. Absent otherwise, as on every issue in scan_page’s result, whose page state no gate compares with a baseline.

issues[].source

file (string, required): The file, from the repository’s root, with forward slashes, such as src/App.tsx.
line (integer, required): The line the opening tag’s < is on, from 1.
column (integer, required): The column of the opening tag’s <, from 1, counting UTF-16 code units, as ESLint and SARIF do: a tab is one column, and an emoji two.
endLine (integer): The line the opening tag’s closing > is on, which may be line; absent when the location does not give its end.
endColumn (integer): The column just after the opening tag’s closing >, counted as column is; absent when the location does not give its end.
openingTag (string, required): The opening tag as the source fingerprint hashes it: its source text from < to >, each run of whitespace written as one space.
resolution (“element” or “call-site”, required): Whose opening tag the location is: element for the element’s own, when it has a source stamp of its own; call-site for its nearest stamped ancestor’s when it has none, such as an element a component from node_modules renders: the closest host element in the project’s source that encloses it.

issues[].combinations[]

browser (string, required): The name of the browser the page ran in, such as chrome. An open set: a cora that does not know a name, such as one a newer cora writes, keeps and compares it as it is.
viewport (object, required): The size of the browser’s viewport the page was shown at.