Freedom251 › Website Accessibility Tools
accessio-scan
What accessio-scan is
accessio-scan is a free, open-source command-line accessibility scanner that runs axe-core against a URL and reports WCAG violations. Each run audits one page using the default axe-core rules for WCAG 2.1 and 2.2. The CLI supports console, JSON, and SARIF output, while a programmatic scan API and JSON formatter support code integration. SARIF results can be used with GitHub Code Scanning to annotate pull requests, making the tool suitable as a CI gate. Install it with npx or globally through npm; Node.js 20 or later is required. Playwright downloads Chromium on first use, about 300 MB, unless an existing Chromium installation is used. Telemetry is opt-in and off by default, sending a hashed hostname and scan-rule metadata rather than URLs, page HTML, headers, cookies, or authentication data. SARIF includes offending elements’ outer HTML, which may expose sensitive content. Version 0.1 scans a single page, and the README says roughly half of WCAG criteria are automatically detectable, leaving the remainder for manual audits. The project is MIT-licensed and bundles axe-core under MPL 2.0.
Who it suits
It suits developers and CI pipelines that need page-level WCAG checks, console or machine-readable reports, and pull-request annotations. Manual auditing is still needed for criteria the automated rules cannot detect.
What it does well
- WCAG 2.1 and 2.2 audits
- Console, JSON, and SARIF output
- GitHub Code Scanning integration
- Opt-in telemetry off by default
- Programmatic scan API
What to know first
- Scans one page per run
- Requires Node.js 20 or later
- Chromium download is about 300 MB
- Manual audits remain necessary
Verdict
accessio-scan adds axe-core accessibility checks to command lines and CI workflows, with SARIF support for GitHub annotations. Its single-page scope and partial automated coverage define where manual review is still required.
Facts from accessio-scan's own pages
- Audit coverage
- The README describes each run as a WCAG 2.1 and 2.2 audit using the default axe-core ruleset. · github.com, 12 Oct 2026
- Automated testing limit
- The README says axe-core can automatically detect roughly 50% of WCAG success criteria and that the remaining criteria need manual audits. · github.com, 12 Oct 2026
- Browser dependency
- Playwright downloads Chromium on first use, about 300 MB; browser download can be skipped when Chromium is already installed. · github.com, 12 Oct 2026
- CI/CD integration
- Yes · github.com, 22 Sept 2026
- CI integration
- The README shows using SARIF output with GitHub Code Scanning to annotate pull requests. · github.com, 12 Oct 2026
- Free plan
- Yes · github.com, 22 Sept 2026
- How to run
- The README shows running it with npx or installing it globally with npm. · github.com, 12 Oct 2026
- Install
- Run it with npx or install it globally through npm; it requires Node.js 20 or later. · github.com, 12 Oct 2026
- Intended use
- The README presents the scanner as a CI gate and says issues and pull requests are welcome. · github.com, 12 Oct 2026
- License
- The project is MIT-licensed and bundles axe-core under MPL 2.0. · github.com, 12 Oct 2026
- Notable limits
- Version 0.1 scans one page at a time, and the README says roughly half of WCAG success criteria can be automatically detected; the rest need manual audits. · github.com, 12 Oct 2026
- Output formats
- The CLI supports console, JSON, and SARIF output, and the package exposes a programmatic scan API. · github.com, 12 Oct 2026
- Privacy caveat
- SARIF reports include the offending element’s outer HTML, which may expose sensitive DOM content to people with access to the repository’s Security tab. · github.com, 12 Oct 2026
- Programmatic use
- The package exports a programmatic scan API and a JSON formatter. · github.com, 12 Oct 2026
- Purpose
- accessio-scan runs axe-core against a URL and reports WCAG violations. · github.com, 12 Oct 2026
- Requirement
- It requires Node.js 20 or later and downloads Chromium on first use, about 300 MB via Playwright. · github.com, 12 Oct 2026
- SARIF data caution
- SARIF reports contain offending elements’ outer HTML, which may expose sensitive content from the scanned page to people who can read the repository’s Security tab. · github.com, 12 Oct 2026
- Scan scope
- page · github.com, 22 Sept 2026
- Scope limit
- Version 0.1 scans a single page; crawling and sitemap support are described as planned for v0.2. · github.com, 12 Oct 2026
- Security
- The Chromium sandbox is enabled by default, and the README warns against scanning untrusted URLs from a privileged network. · github.com, 12 Oct 2026
- Security guidance
- The README warns against scanning untrusted URLs from privileged networks because the browser can reach internal services. · github.com, 12 Oct 2026
- Telemetry
- Telemetry is opt-in and off by default; the README says reports include a one-way hostname hash and scan-rule metadata, but not URLs, page HTML, cookies, or authentication data. · github.com, 12 Oct 2026
- Telemetry and privacy
- Telemetry is opt-in and off by default; the README says it sends a hashed hostname and scan-rule metadata, but not URLs, page HTML, headers, cookies, or authentication. · github.com, 12 Oct 2026
- Telemetry hosting
- The telemetry endpoint can be overridden, allowing users to send opt-in telemetry to their own collector. · github.com, 12 Oct 2026
Where accessio-scan stands on Freedom251
- Website Accessibility Tools#100 of 133