mcp-accessibility-scannerBLOCK

**Behind a login:** the crawl shares the browser context, so signing in with `browser_navigate` / `browser_fill_form` first is enough. Alternatively record a session with `npx [email protected] codege

'location': `http://127.0.0.1:${state.deadPort}/gone`,

state.fixtureOrigin = `http://127.0.0.1:${address.port}`;

resolve({ url: `http://127.0.0.1:${address.port}/audit-site`, close: () => closeFixtureServer(server) });

const secret = 'startup-secret-do-not-print';

browser_drag, browser_drop

.oxlintrc.json

.graphify_labels.json

.graphify_python

.graphify_root

expect(() => new Function('page', `return async () => {\n${response.code()}\n};`)).not.toThrow();

expect(() => new Function(`return ${wrapped}`)).not.toThrow();

expect(() => new Function(`return ${toFunctionSource(source, onElement)}`)).not.toThrow();

await new Function('page', `return (async () => { ${response.code()} })();`)(page);

await new Function('page', `return (async () => { ${response.code()} })();`)(page);

import type { Config } from '../../config.js';

import type { ToolCapability } from '../../config.js';

it.each(['my-profile', 'Default/../../etc', 'Profile 1 ', ''])('rejects an invalid profile directory name from the CLI: %s', async profileDirName => {

const result = await outputFile(config, 'test/../../../etc/passwd');

'https://169.254.169.254/latest/sitemap.xml': '<urlset><url><loc>https://example.com/one</loc></url></urlset>',

sitemapUrl: 'https://169.254.169.254/latest/sitemap.xml',

const redirectTarget = 'https://169.254.169.254/latest/sitemap.xml';

network: { blockedOrigins: ['169.254.169.254'] },

'ws://169.254.169.254/',

- Advertised vs enforced: with `--host 0.0.0.0` the server printed `http://0.0.0.0:<port>/mcp`, but its own Host-header allowlist rejected that Host with 403; earlier, wildcard binds never added inter