Accessibility Conformance Report · WCAG Edition · VPAT® 2.5Rev

Malimbe by Beyond A11y Accessibility Conformance Report

WCAG 2.0, 2.1 and 2.2, Levels A and AA. Tested build: commit f04f234, 2026-10-12 to 2026-10-13. Report date October 14, 2026.

WCAG Edition — based on VPAT® Version 2.5Rev (ITI)

Field Entry
Name of Product/Version Malimbe by Beyond A11y (beta) — repository beyond-a11y/malimbeba, branch main, commit f04f234; untagged build (package.json reads 0.4.3, but the tested fixes postdate the 0.4.3 tag of 2026-10-06)
Report Date October 14, 2026
Product Description Malimbe is an accessibility toolkit for developers who build software with AI coding assistants. It runs as a Model Context Protocol (MCP) server inside tools such as Claude Code, Codex, Cursor and VS Code, and provides accessibility auditing (axe-core, WCAG 2.2 A and AA), pre-release review of unhosted code, release gating, and component guidance. It includes three browser-based interfaces: a guided prompt builder, an expert prompt builder, and a component tester.
Contact Information Beyond-A11y, LLC — info@beyond-a11y.com — 833-239-6632 — beyond-a11y.com
Notes This report covers Malimbe's own user interfaces and outputs, not the accessibility of sites that Malimbe audits. Malimbe runs inside third-party host applications; the accessibility of those hosts is outside this report.
Evaluation Methods Used See "Scope and evaluation methods" below.

Applicable Standards/Guidelines

Standard/Guideline Included in Report
Web Content Accessibility Guidelines 2.0 Level A (Yes), Level AA (Yes), Level AAA (No)
Web Content Accessibility Guidelines 2.1 Level A (Yes), Level AA (Yes), Level AAA (No)
Web Content Accessibility Guidelines 2.2 Level A (Yes), Level AA (Yes), Level AAA (No)

WCAG 2.2 A and AA include every 2.0 and 2.1 A and AA success criterion except 4.1.1 Parsing, which 2.2 removed. One set of tables below therefore covers all three versions, with the version noted per criterion.

Terms

Scope and evaluation methods

Components in scope

Component Type In scope Notes
Guided prompt builder (guided.html) Web interface Yes Default entry point; plain-language prompt building and audit-check mode
Expert prompt builder (index.html) Web interface Yes Tested in both Generate mode and Audit mode (the conditionally shown audit form)
Component tester (component-tester.html) Web interface Yes Renders pasted component code in an isolated frame and lists findings
Audit reports Text shown in the expert view Yes, via the expert view The rendered audit report is plain text written into the same output element (<pre id="prompt">) already covered by the expert-view tests; no separate interface
Command-line readiness check (malimbeba-doctor) Terminal output No — excluded It produces terminal text, not web content, so WCAG's web-content criteria don't apply to it
Host applications (Claude Code, Codex, Cursor, VS Code) Third-party software No Outside Beyond-A11y's control
Marketing website and landing page Web No Not part of the licensed product

Mobile screen readers are out of scope. VoiceOver on iOS and TalkBack on Android are outside this report's scope for Malimbe entirely. Desktop VoiceOver on macOS remains in scope and is reported as Not Evaluated (see the disclosure below), not as out of scope.

Evaluation methods

Testing was performed on 2026-10-12 and 2026-10-13 against the three browser-based interfaces, served locally (node ui/server.mjs, http://127.0.0.1:4173/).

  1. Automated testing. Real-browser axe-core scan (Playwright, WCAG 2.2 A and AA) via Malimbe's a11y_audit_axe tool, on all three interfaces. axe-core 4.12.1; Google Chrome 155.0.8059.40 (real, installed browser).
  2. Scripted keyboard testing. Tab-key walkthrough via Malimbe's a11y_audit_keyboard tool. Ambiguous automated flags were adjudicated by manual source inspection.
  3. Manual screen reader testing. NVDA and JAWS, all three interfaces, performed 2026-10-12 by the owner.
  4. Manual resize and reflow testing. Real-browser text resize to 210% and zoom to 400%, performed by the owner. No scripted zoom or reflow check exists in Malimbe's current tooling.

Assistive technology coverage disclosure. Screen reader testing used NVDA and JAWS. VoiceOver (desktop, macOS) is Not Evaluated: Beyond-A11y does not currently have Apple hardware in its testing toolkit. This is a standing limitation, disclosed in each remark where a Supports claim rests partly on screen reader testing.

Fix applied during testing. component-tester.html was missing a <main> landmark and had two sections of content outside any landmark (axe landmark-one-main and region, moderate). The content was wrapped in <main> and the live axe-core audit re-run, confirming 0 violations. After the fix, all three interfaces returned 0 axe-core violations (WCAG 2.2 A/AA).

Independent tool cross-check. Pa11y with the HTML_CodeSniffer engine (a different ruleset from axe-core) was run against all three interfaces on 2026-10-13. guided.html and component-tester.html: no issues. index.html: one finding — the options form had no native submit control, so pressing Enter in a text field did nothing. Fixed: the existing "Run the audit" button became a form-associated submit control, routed to the same audit action. Verified by re-running Pa11y (no issues), a functional Enter-key test in both modes, a full axe-core re-scan (0 violations) and a repeat keyboard walk (no new findings).

Audit mode tested directly. The expert view's conditionally shown Audit-mode form was opened and scanned with axe-core (WCAG 2.2 A/AA) on 2026-10-13: 0 violations.

Additional checks (2026-10-13). Reading order compared with visual position (a11y_audit_reading_order); status-message announcements (a11y_audit_status_messages); rendered-pixel contrast sampling for text over gradient backgrounds; measured border contrast of form controls; WCAG 1.4.12 text-spacing override injected into each live page; rendered size of every interactive control; scripted Tab-through reading live computed focus styles, confirmed by screenshot; and source review for focus, input, pointer, shortcut and language behavior.

Defects found and fixed before this report. Each fix was re-verified with a full axe-core re-scan:

Every result records the test date and method so any finding can be re-run.

Table 1: Success Criteria, Level A

Criteria Conformance Level Remarks and Explanations
1.1.1 Non-text Content (2.0, 2.1, 2.2) Supports Automated axe-core scan (image-alt and related rules) clean across all three interfaces, including the Audit-mode form state on the expert view. Alt-text quality, not just presence, manually reviewed (2026-10-13): every real <img> across the three interfaces is either the brand favicon with alt="" (correct — adjacent text already names the brand, so it's properly marked decorative) or the dynamic design-system screenshot preview (#ds-image-preview, on both guided.html and index.html), which starts alt="" while empty/hidden and is set to a real, specific, descriptive value ("Preview of uploaded screenshot: " + filename) by JS the moment it actually shows content. No generic or missing alt text found anywhere.
1.2.1 Audio-only and Video-only (Prerecorded) (2.0, 2.1, 2.2) Not Applicable None of the three interfaces contain any audio or video content.
1.2.2 Captions (Prerecorded) (2.0, 2.1, 2.2) Not Applicable No prerecorded audio/video content exists anywhere in scope.
1.2.3 Audio Description or Media Alternative (Prerecorded) (2.0, 2.1, 2.2) Not Applicable No prerecorded video content exists anywhere in scope.
1.3.1 Info and Relationships (2.0, 2.1, 2.2) Supports Automated axe-core scan (Playwright, real browser) clean on all 3 interfaces. component-tester.html had a missing <main> landmark and unlandmarked content; fixed same day and re-verified clean. Manual NVDA/JAWS pass (2026-10-12), no issues found; re-run 2026-10-13 against the current build (after the skip link, back-link, theme toggle and status-message fixes), clean. Not Evaluated — VoiceOver (no Apple hardware currently in this organization's testing toolkit).
1.3.2 Meaningful Sequence (2.0, 2.1, 2.2) Supports Ran a11y_audit_reading_order (real browser, compares DOM order to visual position) against all three interfaces. guided.html and component-tester.html clean, no mismatches. index.html flagged one jump (last form field to the output panel's heading) — reviewed: this is the same benign multi-column-layout case already established for 2.4.3 (options panel ends, output section heading begins; DOM/reading order is still logically correct, only visual position differs). No defect found.
1.3.3 Sensory Characteristics (2.0, 2.1, 2.2) Supports Searched all copy for shape/color/position-only references ("the button on the," "click the blue," etc.) — none found.
1.4.1 Use of Color (2.0, 2.1, 2.2) Supports Every color-coded state found (severity tags, selected/pressed mode buttons) pairs color with an explicit text label or aria-pressed, never color alone.
1.4.2 Audio Control (2.0, 2.1, 2.2) Not Applicable No audio content anywhere in scope.
2.1.1 Keyboard (2.0, 2.1, 2.2) Supports Scripted Tab-walk (real browser), current build: guided.html 14/14, index.html 18/19, component-tester.html 7/7. The one unreached item on index.html is a radio input in a native role="radiogroup" that Tab correctly skips per HTML/ARIA spec (arrow keys move within the group) — confirmed false positive, not a defect. Manual NVDA/JAWS pass (2026-10-12), re-run 2026-10-13 against the current build including the new skip link, back-link and theme toggle — clean. Not Evaluated — VoiceOver (no Apple hardware currently in this organization's testing toolkit).
2.1.2 No Keyboard Trap (2.0, 2.1, 2.2) Supports The scripted Tab-walk had flagged a possible trap on the expert view (at the radiogroup above) and on the component tester (at the "Load fixed sample" button beside the live-render <iframe>, which by default loads a demo sample containing a positive tabindex — intentional demo content, not host-page navigation). Manual NVDA/JAWS pass (2026-10-12) tabbed through both spots directly: no trap, both fully navigable; re-run 2026-10-13 against the current build, still clean. Both automated flags confirmed as tool false positives. Not Evaluated — VoiceOver (no Apple hardware currently in this organization's testing toolkit).
2.1.4 Character Key Shortcuts (2.1, 2.2) Not Applicable No single-character keyboard shortcuts are implemented anywhere (searched for keydown/keypress handlers; none exist).
2.2.1 Timing Adjustable (2.0, 2.1, 2.2) Not Applicable None of the three interfaces impose a time limit on any task — no session timeouts, no countdowns, no auto-expiring input.
2.2.2 Pause, Stop, Hide (2.0, 2.1, 2.2) Not Applicable None of the three interfaces contain moving, blinking, scrolling, or auto-updating content. (Status-message live regions announce brief, user-triggered updates, not continuous auto-updating content — out of this SC's scope.)
2.3.1 Three Flashes or Below Threshold (2.0, 2.1, 2.2) Not Applicable No flashing or strobing content exists anywhere in scope; prefers-reduced-motion is respected where any transition exists at all.
2.4.1 Bypass Blocks (2.0, 2.1, 2.2) Supports All three interfaces have a working "Skip to main content" link. The component tester's theme toggle and back-link sit in its header before <main>, so a skip link was added there on 2026-10-13 using the same pattern as the other two pages. Verified with a full tab-order trace (skip link → back-link → theme toggle → first textarea, each with a visible focus outline, confirmed by screenshot) and the owner's NVDA/JAWS re-check (2026-10-13) on all three pages — clean. Not Evaluated — VoiceOver (no Apple hardware currently in this organization's testing toolkit).
2.4.2 Page Titled (2.0, 2.1, 2.2) Supports Automated axe-core document-title check clean; each of the three interfaces has a descriptive, distinct <title>.
2.4.3 Focus Order (2.0, 2.1, 2.2) Supports Several heuristic "focus order vs. visual layout" flags across all three interfaces. Each one checked by hand against the markup lines up with either an intentional skip link ("Skip to main content") or a multi-column layout where an output/preview panel sits visually beside the input form — both are the tool's own documented benign case (DOM/reading order still correct; only visual position differs). No defect found.
2.4.4 Link Purpose (In Context) (2.0, 2.1, 2.2) Supports Automated axe-core confirms every link has an accessible name (none empty/unnamed). Link text manually reviewed against the current build (2026-10-13): 8 static links — index.html: "Skip to main content," "Not sure where to start? Use guided mode →," "Review this component." guided.html: "Skip to main content," "Open the expert view," "Review this component" (with a descriptive subtitle), "the expert view" (footer). component-tester.html: "Skip to main content," plus a conditional link, "← Back to the guided door" / "← Back to the expert view," shown only when launched from one of the other two. All descriptive out of context, none generic ("click here"/"read more").
2.5.1 Pointer Gestures (2.1, 2.2) Not Applicable No multipoint or path-based gesture input anywhere (searched for drag/touch/pointer handlers; none exist).
2.5.2 Pointer Cancellation (2.1, 2.2) Supports No mousedown-triggered actions found anywhere — every action fires on click (the up-event), which is cancelable by default.
2.5.3 Label in Name (2.1, 2.2) Supports Searched every aria-label usage on all three pages (5 total): none override a differing visible text label on an operable control — they're on a <form>, a role="radiogroup" container, and two <pre> output regions, none of which have a separate visible "label text" a voice-control user would speak to activate them.
2.5.4 Motion Actuation (2.1, 2.2) Not Applicable None of the three interfaces use device motion (shake, tilt) as an input mechanism.
3.1.1 Language of Page (2.0, 2.1, 2.2) Supports Automated axe-core html-has-lang/html-lang-valid checks clean; all three interfaces declare <html lang="en">.
3.2.1 On Focus (2.0, 2.1, 2.2) Supports No onfocus handler anywhere triggers navigation or an unexpected context change (confirmed by reading the source — focus-related logic only updates visual/ARIA state).
3.2.2 On Input (2.0, 2.1, 2.2) Supports The global input/change listeners only call render(), which updates on-page content; nothing auto-submits or auto-navigates on a field change.
3.2.6 Consistent Help (2.2) Not Applicable No help, contact, or support mechanism (link, chat, phone, email) exists anywhere within these three interfaces' scope.
3.3.1 Error Identification (2.0, 2.1, 2.2) Supports The one error condition in scope (submitting Audit mode with an empty URL) is identified in text via the live-region status message ("Enter a URL first") and focus is moved to the field in error.
3.3.2 Labels or Instructions (2.0, 2.1, 2.2) Supports Every input-requiring field has a visible label or instructional text — covered across the 1.1.1, 2.4.4 and 2.4.6 checks.
3.3.7 Redundant Entry (2.2) Not Applicable No multi-step process anywhere asks the user to re-enter information they already provided in the same process.
4.1.1 Parsing (2.0, 2.1) Supports (WCAG 2.0 and 2.1) For WCAG 2.0 and 2.1, per W3C errata, this criterion is always satisfied for HTML and XML. Removed in WCAG 2.2.
4.1.2 Name, Role, Value (2.0, 2.1, 2.2) Supports Automated axe-core pass clean, plus manual NVDA and JAWS pass (2026-10-12) across all three interfaces found no issues with name/role/value exposure to either screen reader; re-run 2026-10-13 against the current build, still clean. Not Evaluated — VoiceOver (no Apple hardware currently in this organization's testing toolkit).

Table 2: Success Criteria, Level AA

Criteria Conformance Level Remarks and Explanations
1.2.4 Captions (Live) (2.0, 2.1, 2.2) Not Applicable No live audio/video content exists anywhere in scope.
1.2.5 Audio Description (Prerecorded) (2.0, 2.1, 2.2) Not Applicable No prerecorded video content exists anywhere in scope.
1.3.4 Orientation (2.1, 2.2) Supports No orientation-locking CSS anywhere (@media (orientation:...) absent).
1.3.5 Identify Input Purpose (2.1, 2.2) Not Applicable No field on any of the three interfaces collects personal/user-identity information matching the SC's defined autocomplete taxonomy (name, email, address, etc.) — every text field collects project/tool configuration (a URL to audit, a design-system reference), not user data.
1.4.3 Contrast (Minimum) (2.0, 2.1, 2.2) Supports Automated axe-core contrast checks clean on all three interfaces. Text over the gradient page background, which axe-core cannot evaluate, was checked by rendered-pixel sampling (2026-10-13): two masthead links on guided.html and index.html measured 4.44:1 and 4.06:1, below the 4.5:1 minimum. Fixed with a darker light-mode color for those two links (commit eab8103); both now measure 5.36–5.85:1. Dark mode already measured 7.0–7.7:1 and was unchanged. Re-verified with axe-core and Pa11y/HTML_CodeSniffer, both clean.
1.4.4 Resize Text (2.0, 2.1, 2.2) Supports Manual testing (2026-10-13, owner), real browser text resize to 210% (above the 200% SC threshold), across all three interfaces: presented without horizontal scroll and without loss of content or functionality.
1.4.5 Images of Text (2.0, 2.1, 2.2) Supports No image contains text used in place of real text — the only images are the brand favicon (decorative) and a user-uploaded screenshot preview (real image content, not a text substitute).
1.4.10 Reflow (2.1, 2.2) Supports Tested with real browser zoom to both 210% (above the 1.4.4 threshold) and 400% across all three browser-based interfaces. Content reflows to a single column with no loss of functionality and no two-dimensional scrolling.
1.4.11 Non-text Contrast (2.1, 2.2) Supports Real defect found and fixed (2026-10-13). Every plain-bordered text input, <select> and <textarea> on all three interfaces used a light-mode border color (#D6DCE4) measuring 1.38:1 against white, under the 3:1 minimum for UI component boundaries. Fixed by darkening the light-mode border to #7C8798 (3.64:1 against white). Dark mode's border already measured 3.12:1 and was unchanged. Verified by re-measured contrast, a full axe-core re-scan (clean on all three interfaces) and a visual check for regressions.
1.4.12 Text Spacing (2.1, 2.2) Supports Injected the standard WCAG 1.4.12 override CSS (line-height 1.5, letter-spacing 0.12em, word-spacing 0.16em, paragraph spacing 2em) into all three live pages and visually inspected full-page screenshots: no clipped, truncated, or overlapping content anywhere; no horizontal overflow (measured).
1.4.13 Content on Hover or Focus (2.1, 2.2) Not Applicable No custom hover/focus-triggered content (tooltips, popovers) exists on any of the three interfaces — searched for :hover display/visibility rules and title= attributes beyond one native iframe title; found none that create dismissible/hoverable content.
2.4.5 Multiple Ways (2.0, 2.1, 2.2) Supports All three interfaces are now mutually reachable by real, verified links, not just reasoned around for a small toolset: guided.html and index.html already cross-linked to each other; both now also link to component-tester.html ("Review this component"), which links back to whichever of the two launched it. No page is a dead end or orphaned endpoint.
2.4.6 Headings and Labels (2.0, 2.1, 2.2) Supports Clean heading-order/empty-heading results on every axe-core scan this round; every form field's label text reviewed and found descriptive (part of the 2.4.4, 1.1.1 and 3.3.2 checks).
2.4.7 Focus Visible (2.0, 2.1, 2.2) Supports Not reliably automatable by axe-core's standard ruleset (known gap — see AUDIT-COVERAGE.md). Verified by an actual visual Tab-through (2026-10-13): scripted real Tab presses across all three interfaces and read the live computed style (outline/box-shadow) at each focus stop. Every control type reached (links, buttons, radio, select, textarea) renders a visible 3px solid amber outline (#F59E0B) when focused. index.html's explicit CSS rule doesn't list textarea specifically, but nothing removes its native browser focus outline either, so it still gets a visible (if unstyled) indicator — a minor visual-consistency gap, not an accessibility defect. Defect found and fixed (2026-10-13): the "Skip to main content" link on guided.html and index.html stayed clipped to 1×1 px even while focused, so the first Tab stop showed no visible focus. Fixed with a .sr-only:focus rule that shows the link, with its focus ring, only while focused. Verified by screenshot, a full axe-core re-scan (clean) and a keyboard walk (13/13 reachable, no new findings).
2.4.11 Focus Not Obscured (Minimum) (2.2) Supports No position: sticky or position: fixed elements anywhere on any of the three pages — nothing can float over a focused control.
2.5.7 Dragging Movements (2.2) Not Applicable No drag-and-drop interaction anywhere in scope.
2.5.8 Target Size (Minimum) (2.2) Supports Measured every interactive control's real rendered size on all three pages. A few are genuinely under 24×24 (two inline text links, a few native checkboxes) — each qualifies for one of the SC's own explicit exceptions: inline text links are exempt outright; every undersized checkbox is wrapped in a <label> with substantial visible text, which is a same-function target ≥24×24 px (the "equivalent" exception), confirmed by reading the actual markup, not assumed.
3.1.2 Language of Parts (2.0, 2.1, 2.2) Not Applicable No passage anywhere is in a language other than the page's own declared lang="en" — searched for any lang= attribute beyond the root <html>; found none, meaning there's no language shift to mark in the first place.
3.2.3 Consistent Navigation (2.0, 2.1, 2.2) Supports All three pages share the masthead structure and relative order (logo/brand, context-dependent link, heading, intro, theme toggle). The component tester's back-link is a deliberate, contextual difference, not an inconsistency: guided.html and index.html are the two hub tools that always cross-link to each other and out to the component tester; the component tester needs a way back to whichever hub launched it. Same navigational role (a way to the other relevant tool), with content suited to each page's position in the flow.
3.2.4 Consistent Identification (2.0, 2.1, 2.2) Supports All three pages offer dark mode through the identical theme-toggle button: same icon, same "Dark mode"/"Light mode" label, same aria-pressed pattern, and a shared malimbeba-ui-theme storage key so the choice stays in sync across all three. Verified with an axe-core scan of the dark-mode rendered state as well as the light-mode default.
3.3.3 Error Suggestion (2.0, 2.1, 2.2) Supports The same "Enter a URL first" message doubles as the correction suggestion — it states exactly what to do.
3.3.4 Error Prevention (Legal, Financial, Data) (2.0, 2.1, 2.2) Not Applicable None of the three interfaces perform legal commitments, financial transactions, or deletion of user-controlled data.
3.3.8 Accessible Authentication (Minimum) (2.2) Not Applicable No authentication mechanism exists anywhere in these three interfaces.
4.1.3 Status Messages (2.1, 2.2) Supports Status-message check (a11y_audit_status_messages, 2026-10-13) found that results and mode changes were not announced. Fixed (commit a376e8c): the component tester's status region now announces the audit outcome ("No violations found." or "Blocked — N issues: X critical, Y serious, Z moderate.") and any errors; guided.html and index.html announce mode switches (Build/Check, Generate/Audit). The prompt and report panels, which regenerate on every keystroke, are deliberately not live regions, so screen readers are not flooded with the full text on each change. Announcement text verified on all three interfaces; axe-core re-scan clean. Confirmed with assistive technology: the owner's NVDA/JAWS re-check (2026-10-13, through commit f04f234) covered these announcements and came back clean. Not Evaluated — VoiceOver (no Apple hardware currently in this organization's testing toolkit).

Table 3: Success Criteria, Level AAA

Not evaluated.