cora-mcp-issue

explain_finding’s result: one issue of a run, by its ID, with its rule, its call sites and the combinations of browser and viewport its findings were seen in. Each of its findings gives its element, source location, markup and why it failed, how to reach its page again, and what a rescan must cover to check a fix. The issue comes from the run the call named, or else from the newest run that holds it in the state directory, the project’s or, outside a project, the one in the folder cora-mcp was started in, so an issue a cora scan run found can be explained too.

Each version lists its fields, then a section for each object they hold, headed by its path, in which [] stands for each entry of a list. Where objects of several kinds share a path, each kind has a section, named by the field that tells them apart. A field marked required is in every object of its kind, and the description of any other says when it is absent.

Version 1

The version this release writes. Its JSON Schema is schemas/cora-mcp-issue/v1.json in the @vispero/cora package and at https://cora.vispero.com/docs/0.10/schemas/cora-mcp-issue/v1.json.

format (“cora-mcp-issue”, required): The result’s format, always cora-mcp-issue.
version (1, required): The version of cora-mcp’s tool surface, which every result and error of its tools declares.
id (string, required): The issue’s ID, as the call named it: 32 lowercase hexadecimal characters.
run (string, required): The ID of the run the issue was read from: the call’s run, or else the newest run that holds the issue in the state directory, the project’s or, outside a project, the one in the folder cora-mcp was started in.
file (string, required): The run file the issue was read from, a cora-results file: its path relative to the project root when it is inside the project, and absolute otherwise.
rule (object, required): The rule the issue’s findings fail, from this cora’s rule metadata, or, for a rule this cora does not know, from what the run recorded of it.
report (true): true when cora scan’s report of the run lists the issue as report-only: its violations are of rules the project’s rule selection set to report on their page, beside any in a page state an agent reached, so its findings are shown but never fail CI’s gate and are never baselined. Absent otherwise, as on an issue that needs review or one with a violation the gate counts.
accepted (true): true when the project’s baseline, as it is now, accepts the issue in the run, as cora scan counts it, so CI’s gate does not fail on it. Absent otherwise, as on an issue whose findings are all in page states an agent reached, which no gate compares with a baseline.
callSites (integer, required): How many distinct call-site source locations the issue’s findings are at, the findings the result leaves out included, each place counted once: the host elements in the project’s source around the uses of a component that renders the element, which a fix at the call site must reach. Zero when none of its findings has one.
combinations (array of objects, required): Each combination of browser and viewport the issue’s findings were seen in, once, those of the findings the result leaves out included, by browser name and then by viewport width and height. They are listed before the findings, while the result has room.
omittedCombinations (integer, required): How many combinations the result leaves out for its size, which the run file keeps.
findings (array of objects, required): The issue’s findings, by page and then by element, the first being the issue’s representative, listed in that order after the combinations while the result has room.
omitted (integer, required): How many findings the result leaves out for its size, which the run file keeps.

rule

id (string, required): The rule’s ID: its engine’s prefix, then the rule’s own ID, such as axe/image-alt.
description (string, required): What the rule checks, in one line, such as Images must have alternative text. For a rule this cora does not know, as in a run another cora wrote that explain_finding reads, it is what that run recorded, cut short, ending with …, when it is long.
wcag (array of strings, required): The WCAG success criteria the rule checks, such as 1.1.1; empty for a best practice, whose failures are not WCAG failures. For a rule this cora does not know, they are those the run recorded, kept in order while the list has room.
severity (“critical”, “serious”, “moderate” or “minor”, required): How much the rule’s failures hinder people by default; a finding takes axe-core’s impact for its element where axe-core gives one. For a rule this cora does not know, it is the severity the run recorded for the issue’s first finding.
fixClass (“mechanical”, “content”, “design” or “manual”, required): What fixing the rule’s failures takes: its fix class, which the rules reference describes: https://cora.vispero.com/docs/reference/rules/#fix-classes
helpUrl (string): The address of the rule’s documentation from its engine, such as Deque University’s page for an axe-core rule; absent for a rule this cora does not know.

combinations[]

browser (string, required): The name of the browser the page ran in, such as chrome. An open set: a cora that does not know a name, such as one a newer cora writes, keeps and compares it as it is.
viewport (object, required): The size of the browser’s viewport the page was shown at.

combinations[].viewport

Also at: findings[].reproduce.viewport

width (integer, required): Its width, in CSS pixels.
height (integer, required): Its height, in CSS pixels.

findings[]

outcome (“violation” or “needs-review”, required): violation when the element fails the rule, and needs-review when the rule could not decide and asks a person to check.
severity (“critical”, “serious”, “moderate” or “minor”, required): How much the finding hinders people: axe-core’s impact for its element, or else its rule’s severity.
element (string, required): The element’s path: each iframe or shadow host it is inside, outermost first, as frame: or shadow: and its CSS selector, then the element’s own selector, joined by >> with a space on each side, such as frame:#checkout >> button.pay.
source (object): Where the element is in the project’s source, on an app built with CORA’s source stamps or Angular’s source locations; absent when the finding has none, such as when the element’s file changed after the build, as the source locations page describes: https://cora.vispero.com/docs/source-locations/
html (string, required): The element’s markup, as the engine reported it.
summary (string, required): What is wrong with this element, as the engine reported it.
reproduce (object, required): The finding’s page and how to reach it again to check a fix: its URL, in its browser and viewport, and by its kind, whether to load it, reach its named state again, or repeat the interaction that reached it.
verify (object, required): What a rescan of the finding’s page must cover to check a fix, and the issue to look for in its result.

findings[].source

file (string, required): The file, from the repository’s root, with forward slashes, such as src/App.tsx.
line (integer, required): The line the opening tag’s < is on, from 1.
column (integer, required): The column of the opening tag’s <, from 1, counting UTF-16 code units, as ESLint and SARIF do: a tab is one column, and an emoji two.
endLine (integer): The line the opening tag’s closing > is on, which may be line; absent when the location does not give its end.
endColumn (integer): The column just after the opening tag’s closing >, counted as column is; absent when the location does not give its end.
openingTag (string, required): The opening tag as the source fingerprint hashes it: its source text from < to >, each run of whitespace written as one space.
resolution (“element” or “call-site”, required): Whose opening tag the location is: element for the element’s own, when it has a source stamp of its own; call-site for its nearest stamped ancestor’s when it has none, such as an element a component from node_modules renders: the closest host element in the project’s source that encloses it.

findings[].reproduce where kind is “load”

kind (“load”, required): How the page is reached again: load for a page reached by navigation, which loading its url reaches; state for a named state reached by interaction, which its producer, such as the test that named it, reaches again; and none for a state reached by interaction that no one can reach on demand, such as one an agent reached, which only repeating that interaction on the page at url reaches.
url (string, required): The page’s URL, as the run recorded it, with its credentials redacted as a results file stores a URL.
browser (string, required): The name of the browser the page ran in, such as chrome. An open set: a cora that does not know a name, such as one a newer cora writes, keeps and compares it as it is.
viewport (object, required): The size of the browser’s viewport the page was shown at.

findings[].reproduce where kind is “state”

kind (“state”, required): How the page is reached again: load for a page reached by navigation, which loading its url reaches; state for a named state reached by interaction, which its producer, such as the test that named it, reaches again; and none for a state reached by interaction that no one can reach on demand, such as one an agent reached, which only repeating that interaction on the page at url reaches.
url (string, required): The page’s URL, as the run recorded it, with its credentials redacted as a results file stores a URL.
browser (string, required): The name of the browser the page ran in, such as chrome. An open set: a cora that does not know a name, such as one a newer cora writes, keeps and compares it as it is.
viewport (object, required): The size of the browser’s viewport the page was shown at.
state (string, required): The name the state’s producer, such as a test, gave it, by which it reaches the state again.

findings[].reproduce where kind is “none”

kind (“none”, required): How the page is reached again: load for a page reached by navigation, which loading its url reaches; state for a named state reached by interaction, which its producer, such as the test that named it, reaches again; and none for a state reached by interaction that no one can reach on demand, such as one an agent reached, which only repeating that interaction on the page at url reaches.
url (string, required): The page’s URL, as the run recorded it, with its credentials redacted as a results file stores a URL.
browser (string, required): The name of the browser the page ran in, such as chrome. An open set: a cora that does not know a name, such as one a newer cora writes, keeps and compares it as it is.
viewport (object, required): The size of the browser’s viewport the page was shown at.

findings[].verify

rule (string, required): The rule the rescan must run, such as axe/image-alt.
issue (string, required): The issue’s ID to look for in the rescan’s result, as 32 lowercase hexadecimal characters. A fix that edits the element’s opening tag can change it, so verify_fix also finds the issue by its element.