Pandus SDK documentation
MCP server
Connect Pandus to Claude Desktop, Claude Code or Cursor over MCP: what to fix, rule cards, live barriers and re-checks, with token rights and team isolation.
Updated:
Teams increasingly fix sites together with AI assistants such as Claude Code, Cursor and Windsurf. The Pandus MCP server gives the assistant direct access to your Pandus data: it sees what to fix, where the problem is on the site and how to fix it from the rule card, and after the change it starts a re-check by itself.
What the assistant can read
- the sites of your team;
- what to fix first for a site;
- a problem card: the rule, the WCAG criterion, pages, selectors, an HTML example and how to fix it on the platform;
- live barriers of the SDK for a page or a template;
- a short analytics summary: visits, conversion, barriers on the funnel steps;
- the history of checks and the comparison “before and after”.
What it can do, only with the right in the token
- start a check of a site or a page;
- mark a problem as fixed and start the confirmation;
- create an event without code.
Resources and prompts
- Resources: the rule cards in seven languages and the scoring method.
- Prompts: “fix the top 3 problems on this page” and “prepare a report for the client”.
Tokens and rights
The server works on top of the public API /api/v1 with the same tokens. Create a token in API and webhooks → MCP and give it only the rights it needs:
| Right | Allows |
|---|---|
mcp:read |
Reading sites, problems, cards, live barriers and analytics summaries |
mcp:check |
Starting checks and re-checks |
mcp:write |
Changing problem statuses and creating events without code |
A token also lists the sites of the team it may see.
Connecting
The server runs remotely over streamable HTTP at mcp.pandus.online, and as a local package over stdio. API and webhooks → MCP in the dashboard gives ready configurations for Claude Desktop, Claude Code and Cursor to copy.
Limits and safety
- Only the data of your own team; team isolation is covered by tests.
- No personal data of visitors: only SDK aggregates, never session recordings.
- The same request limits as the API.
- Every call is written to the team's activity log.
- No action without the right in the token.
The Pandus SDK and the scanner are automated checks, not a full audit, and not legal advice. The SDK changes nothing on your site and does not determine which visitors use assistive technology.