Skip to content
Pandus
Pandus SDK documentation

MCP server

Connect Pandus to Claude Desktop, Claude Code or Cursor over MCP: what to fix, rule cards, live barriers and re-checks, with token rights and team isolation.

Updated:

Teams increasingly fix sites together with AI assistants such as Claude Code, Cursor and Windsurf. The Pandus MCP server gives the assistant direct access to your Pandus data: it sees what to fix, where the problem is on the site and how to fix it from the rule card, and after the change it starts a re-check by itself.

What the assistant can read

  • the sites of your team;
  • what to fix first for a site;
  • a problem card: the rule, the WCAG criterion, pages, selectors, an HTML example and how to fix it on the platform;
  • live barriers of the SDK for a page or a template;
  • a short analytics summary: visits, conversion, barriers on the funnel steps;
  • the history of checks and the comparison “before and after”.

What it can do, only with the right in the token

  • start a check of a site or a page;
  • mark a problem as fixed and start the confirmation;
  • create an event without code.

Resources and prompts

  • Resources: the rule cards in seven languages and the scoring method.
  • Prompts: “fix the top 3 problems on this page” and “prepare a report for the client”.

Tokens and rights

The server works on top of the public API /api/v1 with the same tokens. Create a token in API and webhooks → MCP and give it only the rights it needs:

Right Allows
mcp:read Reading sites, problems, cards, live barriers and analytics summaries
mcp:check Starting checks and re-checks
mcp:write Changing problem statuses and creating events without code

A token also lists the sites of the team it may see.

Connecting

The server runs remotely over streamable HTTP at mcp.pandus.online, and as a local package over stdio. API and webhooks → MCP in the dashboard gives ready configurations for Claude Desktop, Claude Code and Cursor to copy.

Limits and safety

  • Only the data of your own team; team isolation is covered by tests.
  • No personal data of visitors: only SDK aggregates, never session recordings.
  • The same request limits as the API.
  • Every call is written to the team's activity log.
  • No action without the right in the token.

The Pandus SDK and the scanner are automated checks, not a full audit, and not legal advice. The SDK changes nothing on your site and does not determine which visitors use assistive technology.