AI for Accessibility Audits: Automated WCAG Compliance Testing with AZMX AI

AI for accessibility audits promises speed, but most solutions send your entire page DOM to a cloud API. That’s a non-starter for HIPAA, financial data, or internal dashboards. This guide shows you how to run WCAG 2.2 AA audits locally using AZMX AI’s approval-gated agent, preserving privacy and audit trail. We’ll cover setup, prompt templates, sub-agent delegation, and when human review still beats automation.

Why AI for Accessibility Audits Matters Right Now

Accessibility compliance is no longer optional. The European Accessibility Act, ADA Title III updates, and WCAG 2.2 have turned audits from a nice-to-have into a legal requirement. But manual audits cost $5,000–$15,000 per page when done by a certified specialist. Automated tools help, but most ship your content to a commercial cloud — Axe, Wave, or Lighthouse all call home. For any site behind a login, that’s a data leak.

This is where AI for accessibility audits running locally changes the game. Instead of sending DOM to OpenAI, you run an agent that reads your page, runs checks, and produces a report on your machine. The agent never phones home. It can also delegate sub-checks — color contrast, ARIA validation, keyboard navigation — to smaller models or deterministic scripts, then ask you before making any code change.

What AZMX AI Brings to the Table

AZMX AI is a native desktop app (~7 MB) that combines a real PTY terminal, a CodeMirror 6 editor, and an approval-gated AI agent. You bring your own key (BYOK) for any provider: OpenAI, Anthropic, Ollama, LM Studio, Groq, DeepSeek, Cerebras, xAI, Sarvam, NVIDIA NIM, Azure OpenAI, even local models running via ollama run. No account, no telemetry, no cloud dependencies — the only network call it makes is the signed updater check.

For accessibility audits, the key features are:

• Per-hunk approval — The agent proposes a fix; you review the diff before it’s applied.
• Sub-agents — You can spin off a contrast-checker agent, an ARIA validator, and a keyboard-navigation tester in parallel.
• Project memory — Write rules in AZMX.md at the project root; the agent reads them before every task.
• Deny-list — The agent refuses to read or write files matching .env, .ssh, credentials, id_rsa, etc. by default.
• MCP — Model Context Protocol over stdio or HTTP lets you plug in custom tools (e.g., an Axe CLI wrapper, a Puppeteer script, or a Lighthouse evaluator).

Setting Up an Accessibility Audit Agent

Let’s walk through a real workflow. You have a React app for internal reporting — it contains financial projections. You want a WCAG 2.2 AA audit without exposing the data.

1. Create an AZMX.md File

Project memory is the secret weapon. At the root of your repo, add:

# AZMX.md — Accessibility Audit Rules
- Agent must NEVER read .env, .ssh, or any file containing "credentials".
- All accessibility checks must run locally. Do not call any external API.
- Use axe-core via MCP tool "axe-check" (installed via npm).
- Always produce a JSON report before suggesting code changes.
- Any code change requires explicit human approval per hunk.
- Flag all failures with WCAG Success Criterion number, severity, and code snippet.

Now the agent knows the rules before it sees a file.

2. Set Up the MCP Tool for Axe

You need a local tool that runs axe-core against a Puppeteer page. In your AZMX AI settings, define an MCP tool:

{
  "mcpServers": {
    "axe-check": {
      "command": "node",
      "args": ["path/to/axe-server.mjs"],
      "env": {}
    }
  }
}

The axe-server.mjs script opens a headless browser, injects axe-core, runs analysis on the provided URL or file path, and returns JSON. No data ever leaves your machine.

3. Run the Audit

Open your project in AZMX AI’s editor. Type in the terminal:

/agent Run accessibility audit on /path/to/source/components/

The agent reads AZMX.md, invokes the axe-check tool on each page, collects results, and produces a report. It might say:

Found 12 issues:
  - 3 color contrast violations (WCAG 1.4.3)
  - 2 missing ARIA labels (WCAG 4.1.2)
  - 1 heading skip (WCAG 2.4.10)
  - 6 missing focus indicators (WCAG 2.4.7)
Generating JSON report... Ready. Open report.json.
Human approval requested for next step: suggest fixes for level A issues?

You approve per-hunk. The agent proposes a fix — say, changing #C0C0C0 to #595959 — with a diff you can accept or reject.

Sub-Agent Delegation for Complex Audits

A full audit goes beyond automated scans. Keyboard navigation, screen reader behavior, and zoom testing require human judgment or dedicated tools. AZMX AI’s sub-agent feature helps you parallelize:

• Sub-agent 1: Runs axe-core for static analysis.
• Sub-agent 2: Checks color contrast with a deterministic formula (relative luminance + WCAG threshold).
• Sub-agent 3: Parses ARIA roles and ensures proper parent-child relationships.
• Sub-agent 4: Runs tab-order simulation using Puppeteer (no model needed).

Each sub-agent reports back to the main agent. The main agent merges findings and presents a unified report. This parallel approach cuts audit time from hours to minutes per page.

Comparison: How Not to Do It

Most AI coding tools (Claude Code, Cursor, Windsurf, GitHub Copilot, Tabnine, Codeium, Sourcegraph Cody, Tabby, Cline, Continue) treat every snippet as a generic editing task. They don’t understand WCAG. They can’t run an axe-core subprocess. And they all send your data to a cloud service unless you self-host (which few do).

Even tools that “support BYOK” still use telemetry-enriched prompts. AZMX AI sends nothing outside your machine unless you explicitly enable a remote model. For accessibility audits, that privacy guarantee matters.

Aider can run locally if you use Ollama, but it has no sub-agent model, no project memory file, and no approval-gated workflow that blocks premature code changes. Cline supports MCP but doesn’t have a deny-list or project memory. Only AZMX AI combines all three: local execution, sub-agents, and approval gates.

When Human Review Still Wins

AI cannot test everything. WCAG success criteria like 2.4.11 (Focus Appearance), 2.5.8 (Target Size Minimum), and 3.3.7 (Accessible Authentication) require contextual judgment. A bot cannot tell if a focus ring is “sufficiently visible” in all states. It cannot evaluate whether a CAPTCHA alternative is genuinely accessible.

So the right workflow is:

1. Automate the mechanical checks — contrast, heading hierarchy, ARIA errors, alt text presence.
2. Flag probable issues — missing labels, duplicate IDs, empty buttons.
3. Send the report to a human — a certified accessibility specialist reviews a subset of pages and writes the compliance statement.

AI for accessibility audits saves 70–80% of the time on the mechanical part. The human part remains billable, but it’s a fraction of the original cost.

Putting It All Together

Here’s a concrete command sequence for AZMX AI that runs a complete audit on a single page:

# In the AZMX AI terminal
/agent Load page from ./src/pages/Dashboard.tsx

/agent Run axe-core via MCP axe-check on the current rendered HTML

/agent Run contrast check: compute relative luminance for all foreground/background pairs

/agent Check ARIA: list all roles, states, properties; flag orphans

/agent Merge results into report.json with WCAG SC references

/agent Show diff for each Level A fix, await approval

The agent executes each step, stops at each approval gate, and never sends a byte to the internet. The final report.json can feed directly into your project’s accessibility tracker or a CI pipeline.

Conclusion

AI for accessibility audits is not a pipe dream — it’s a practical, local, privacy-preserving workflow you can run today. AZMX AI gives you sub-agent delegation, approval gates, project memory, and a deny-list, all inside a 7 MB desktop app with zero telemetry. For any site containing PII, financial data, or internal logic, this is the only responsible way to automate WCAG compliance testing.

Download AZMX AI at azmx.ai/download, bring your own key, and start auditing your first page in five minutes. The report will be yours, the data stays yours, and the fixes only land when you say yes.