Mcp A11Y Detection

Detection coverage — has the client's CODE been analyzed? (mcp:*, read-only)

MCP twin of the core GET /v1/projects/{id}/a11y/detection, for the same reason as the scan twin: mcp:* does not satisfy even ProjectViewer on the core surface (the scope map knows project:read/project:write/*, not mcp:*), so the core route 403s. This is the scanner's post-scan verification loop — it re-reads the SERVER's coverage instead of trusting what it believes it wrote.

The four TREATMENT reports (aria-names, alt-text, screen-reader, plain-language) deliberately have NO twin: they feed the client-admin dashboard over a user JWT. Adding twins nothing calls would grow the MCP tool surface every agent has to carry, for no caller.